izmio Consumer Health Data Policy

Draft — requires review by a qualified attorney before publication

Effective date: [DATE] · Last updated: [DATE]

This policy explains how izmio handles consumer health data: personal information that is linked or reasonably linkable to you and that identifies your past, present or future physical or mental health status. It is written to meet the Washington My Health My Data Act (RCW 19.373) and similar laws in Nevada (SB 370) and Connecticut. [VERIFY Nevada and Connecticut requirements] It supplements our Privacy Policy.

izmio is a space for ritual and rest, not medical care. Still, some of what you share with us, such as how you're feeling, could reveal something about your health. So we handle it as health data.

Who we are: [COMPANY LEGAL NAME] Ltd. Şti. (izmio), [STREET ADDRESS, POSTAL CODE, CITY, Türkiye] · [email protected] [VERIFY]

1. Consumer health data we collect

We do not collect medical records, prescriptions, information from health professionals, biometric data, data from Apple Health or Google Health Connect, precise location or microphone audio.

2. Sources

• You, when you choose intentions, check in your mood or write in your journal.
• Your use of the app, such as which sessions you play and when, recorded on your device and in your izmio account.

We do not buy health data or receive it from other companies.

3. How we use it

We use consumer health data only to:

1. Run the features you ask for: your journal, mood history and "mood before/after" cards.
2. Personalize your daily session and recommendations. This happens on your device.
3. Show safety resources: for example, if you check in as "Heavy" during onboarding, we show the 988 Suicide & Crisis Lifeline. We do not record or report this.
4. Back up your journal, with the moods attached to entries, only if you turn on journal sync. Otherwise your journal stays on your device, encrypted.
5. Understand how izmio is used and fix problems, using listening events that carry only IDs and counts (for example, which session was played and for how long).
6. Keep the service secure and meet legal obligations.

We do not use consumer health data for advertising, marketing to others, profiling or training AI models. Your mood check-ins, intentions and journal content are never sent to analytics, crash-reporting or advertising tools.

4. Consent

• We ask for your consent before asking about your intentions and mood, in a separate screen that comes before those onboarding questions and explains what we collect and why. It is not bundled with our Terms of Use. If you skip it, izmio does not ask those questions and suggests a gentle starting session instead. The daily mood check-in on the Today screen is offered only while your consent is in place. Your intention and mood answers are stored only on your device.
• Journal entries are written only when you choose to write one, and they stay on your device unless you turn on sync. Journal sync is a separate choice with its own switch at You › Settings › Privacy › Journal, which asks before it turns on. Health-related listening history is recorded because you play sessions. [VERIFY with counsel: whether the journal and its moods, and health-related listening history, need their own consent under the Washington My Health My Data Act or are necessary to provide the features you ask for]
• If we ever want to share consumer health data beyond the service providers listed in Section 5, we will ask for a separate consent first.
• You can use izmio's sessions, live circles and animal modes without giving this consent.
• Withdrawing consent: you can withdraw consent at any time in You › Settings › Privacy › Health data. izmio then deletes the intention, mood and mood check-in answers stored on your device, records that you declined, stops asking for them and no longer uses intentions or mood to personalize your sessions. These answers are never stored on our servers. Withdrawing does not stop the journal or delete its server copy: journal sync is a separate choice with its own switch, and turning it off deletes the copy on our servers. You can delete entries in the journal at any time.

5. Sharing

Sale: we do not sell consumer health data, and we will never do so without your signed, valid authorization as required by law.

Categories shared and with whom:

Affiliates: none. We have no affiliates that receive consumer health data.

Processors act only on our written instructions under a contract that limits their use to providing services to us. Your mood check-ins, intentions and journal content never go to analytics (PostHog), crash reporting (Sentry), payment providers (Apple, Google, RevenueCat) or advertising platforms. Crash reports, payment providers and advertising platforms receive no consumer health data at all.

We may disclose consumer health data if the law requires it (for example, a valid court order), and we will tell you unless the law forbids it.

6. Geofencing

We do not set up virtual boundaries (geofences) around facilities that provide health care services, and we do not use location to identify, track or send messages to people at or near them.

7. Your rights

Wherever you live in the United States, you can:

• Confirm and access: ask whether we collect, share or sell your consumer health data, get a copy, and get a list of every third party and affiliate we shared it with, with their contact details.
• Withdraw consent to collection and sharing.
• Delete: ask us to delete your consumer health data. We delete it from our systems right away; it disappears from automatic backups within 30 days. We instruct our processors to do the same.
• Appeal if we refuse your request.
• Not be discriminated against for exercising these rights.

How to make a request

• In the app: withdraw consent at You › Settings › Privacy › Health data (deletes your intention and mood answers on the device), delete journal entries in the journal, turn off journal sync at You › Settings › Privacy › Journal (deletes the server copy), or delete your account at You › Settings › Account › Delete account. The app has no export feature: to get a copy of your data, email us and we send it by email.
• Online: follow the steps on our account deletion page.
• Email: [email protected] with the subject "Consumer Health Data Request".

We verify that the request comes from the account holder (for example, by asking you to confirm from inside the app). We respond within 45 days. If we need more time, we may extend once by another 45 days and will tell you why. Requests are free, up to twice a year.

How to appeal

Reply to our decision with the subject "Consumer Health Data Appeal" within a reasonable time. We will respond within 45 days, explaining what we did and why. If we deny your appeal, you can contact the Washington State Attorney General (atg.wa.gov/file-complaint) or the attorney general where you live.

8. Security and retention

Journal entries are stored on your device and encrypted there by default. Synced data is encrypted in transit and at rest, and protected by access rules that let each account read only its own records. We keep consumer health data only while you use the feature or keep your account. Your intention and mood answers are deleted from your device when you withdraw consent; a journal entry when you delete it; the server copy of your journal when you turn off sync; and all of it when you delete your account in the app. Deleted data disappears from automatic backups within 30 days. Listening events in product analytics are kept for [VERIFY: analytics retention, e.g., 12 months], the same period as in our Privacy Policy.

9. Changes

If we change this policy, we will update the date above. We will ask for your consent again before using consumer health data in a materially new way.

10. Contact

[COMPANY LEGAL NAME] Ltd. Şti. (izmio) · [STREET ADDRESS, POSTAL CODE, CITY, Türkiye] · [email protected]

This policy is linked from the izmio.com homepage and from our App Store and Google Play pages, as the law requires.