Consumer Health Data Privacy Policy

(Washington My Health My Data Act)

Effective date: [EFFECTIVE_DATE]

Wren (entity name pending) ("Wren," "we," "us") operates from Washington State and complies with the Washington My Health My Data Act ("MHMD Act"), chapter 19.373 RCW. This policy explains what consumer health data we collect, why, who processes it, and the rights you have over it. It applies to all Wren users — we extend these rights to every customer regardless of where you live.

Our three commitments, up front:

1. We never sell consumer health data. Not for money, not for anything else of value. Ever.
2. We never share consumer health data with any third party except the processors listed below, who work for us under contracts that prohibit them from using your data for anything except providing services to us.
3. You can see it, and you can delete it — including from our processors — at any time.

1. What "Consumer Health Data" Means Here

Under the MHMD Act, consumer health data is personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status. Wren is a relaxation and personal-development product, not a medical service — but the information you share in our quiz can reveal things about your mental and physical well-being, so we treat it as consumer health data and give it the Act's full protections.

2. Categories of Consumer Health Data We Collect

We do not collect: diagnoses or medical records; biometric or genetic data; precise geolocation; reproductive or sexual health data as a category of our quiz; or data from health-care providers. We do not use geofencing (see Section 10).

3. Sources of Consumer Health Data

We collect consumer health data from one source only: you, when you:

• complete the quiz (at sign-up for a free sample or when generating a new session);
• rate or give feedback on a generated session;
• email support about your sessions or goals.

We do not buy, license, scrape, or otherwise obtain consumer health data from any other source, and we do not infer health data from your browsing on other sites.

4. Why We Collect It (Purposes)

We collect and use consumer health data only for these purposes:

1. To generate your personalized sessions — your goal, situation, first name, and preferences are what make the session yours;
2. To deliver and title sessions in your private library and let you stream, download, and re-play them;
3. To operate quality and safety guardrails — automated review of generated scripts to keep them on-protocol and free of medical claims, and human review of flagged sessions;
4. To respond when you contact support about your sessions;
5. To fulfill your rights requests (access, deletion, export) and meet legal obligations.

That's it. We do not use consumer health data for advertising of any kind, we do not use your identifiable quiz answers to train generalized AI models, and we will not use consumer health data for any new purpose without first asking for and receiving your separate consent.

5. Consent: When and How We Ask

The MHMD Act requires consent before collection. We collect consumer health data only after you affirmatively agree at the point of collection — the quiz itself. The consent is specific, separate from the Terms of Service, and not a pre-ticked box.

Exact consent language displayed at the quiz start (unchecked checkbox):

☐ I consent to Wren collecting and using my quiz answers — including my goal and what I write about my situation — to create my personalized audio sessions and run my private library. This information may reveal things about my well-being, so Wren treats it as consumer health data: it is never sold, never shared except with the service providers that operate the product under contract, and I can view or delete it anytime. Consumer Health Data Privacy Policy

Notes for implementation:

• The checkbox must be unchecked by default and required before quiz answers are stored.
• The consent event (account/email, timestamp, policy version, checkbox text shown) must be logged.
• If we ever want to use consumer health data for a new purpose, a new, separate consent must be obtained first — the original checkbox does not cover new purposes.
• Withdrawing consent (Section 7) must be as easy as giving it.

6. Who Processes Consumer Health Data (and What They Receive)

We never sell consumer health data, and we never share it with third parties for their own purposes. It is disclosed only to the following processors, each bound by a written contract (per RCW 19.373.070) limiting processing to our documented instructions:

Stripe (payments) does not receive consumer health data. Checkout is separated from the quiz: Stripe sees your email, plan, and payment details — never your quiz answers or session topics.

We may also disclose consumer health data if compelled by law (e.g., a valid subpoena or court order); where lawful, we will notify you before complying and will resist overbroad requests.

7. Your Rights Under the MHMD Act

You have the right to:

1. Know and access. Confirm whether we collect, share, or (we don't) sell your consumer health data; receive a copy of it; and receive a list of the third parties and affiliates (see Section 6 — processors only) to whom it has been disclosed, with contact information for each.
2. Withdraw consent. Stop our collection and use of your consumer health data going forward. Practically: you can stop taking the quiz at any time, and you can withdraw consent entirely from account settings or by email — after which we will not generate new personalized sessions (the product requires quiz data to personalize) but your existing library remains available, or can be deleted too, your choice.
3. Delete. Have your consumer health data deleted — individual quiz answers, individual sessions, or everything. Deletion covers our systems, our archives and backups (on backup-cycle schedules), and our processors: we will instruct every processor listed in Section 6 to delete your data. Under the Act we act on deletion requests without unreasonable delay and in all cases within the statutory timelines (response within 45 days; processor deletion instructions within 30 days of our deletion).
4. Non-discrimination. We will never deny you the Service, charge you a different price, or degrade your experience because you exercised any of these rights. (Note: withdrawing consent to quiz collection means new sessions cannot be personalized — that is a functional consequence of the product, not a penalty; the starter library and existing sessions remain fully available.)
5. Appeal. If we decline any request, you may appeal (Section 8).

How to exercise your rights

• In the app: account settings → Privacy → view, export, or delete your data (self-service, immediate).
• By email: support@wren.rest with the subject "Health Data Request." Tell us which right you're exercising; no special form is required.
• Verification: we verify requests by confirming control of the account email (a confirmation link). We only ask for information we already hold.
• Timing: we respond within 45 days, extendable once by 45 days for complex requests (we'll tell you if so). Requests are free; if requests from you become manifestly excessive (more than two per year for the same data), the Act permits a reasonable fee, but our intent is never to charge.

Authorized agents

You may designate an authorized agent to exercise your rights for you. The agent should email support@wren.rest with: (a) your name and account email, (b) proof of authorization (a signed statement or power of attorney), and (c) the request. We will confirm directly with you at your account email before acting. Parents/guardians may act for any minor whose data was collected in error (the Service is 18+; any such data is deleted on discovery regardless).

8. Right to Appeal

If we refuse a request in whole or in part:

1. Reply to our decision email or write to support@wren.rest with the subject "Privacy Appeal" within a reasonable time.
2. Your appeal will be reviewed fresh — not by rubber-stamping the original decision — and we will respond in writing within 45 days with the outcome and the reasons.
3. If your appeal is denied, we will provide you a method to contact the Washington State Attorney General to submit a complaint: online at www.atg.wa.gov/file-complaint or by phone at 1-800-551-4636.

9. Affected Populations Note

The MHMD Act protects both Washington residents and people whose consumer health data is collected in Washington. Because Wren (entity name pending) operates from Washington State, we apply this policy to all Wren users, everywhere — every user gets MHMD-level rights, the same consent flow, and the same deletion guarantees, regardless of state or country of residence. Residents of other states with consumer-health-data statutes (e.g., Nevada SB 370, Connecticut) may exercise their equivalent rights through the identical channels in Section 7.

10. Geofencing — Not Applicable

The MHMD Act (RCW 19.373.030) prohibits implementing a geofence around any facility that provides in-person health-care services in order to identify, track, or message consumers, or to infer health status. Wren is a web-only service and does not use geofencing technology of any kind, anywhere, for any purpose. We do not collect precise geolocation at all. We state this both as a factual disclosure and as a standing commitment.

11. Data Security and Retention for Consumer Health Data

Consumer health data receives our highest protection tier: encryption in transit and at rest, row-level access controls (your quiz data is readable only by your authenticated account and the generation pipeline), restricted internal access, and processor contracts with security and confidentiality obligations. Retention: quiz responses and session metadata are kept while your account is active and deleted within 30 days of account deletion or on any earlier deletion request, with processor deletion instructed on the statutory schedule (Section 7).

12. Changes to This Policy

If we change this policy, we will post the new version here with a new effective date and notify you by email. Any change that would use previously collected consumer health data for a new purpose will not take effect for your existing data unless you give new, affirmative consent.

13. Contact

Wren (entity name pending)
[MAILING_ADDRESS]
Email: support@wren.rest (subject "Health Data Request" or "Privacy Appeal")

Washington State Attorney General (complaints): www.atg.wa.gov/file-complaint · 1-800-551-4636