Consumer Health Data Privacy Policy
Pre-release legal draft. This is a separate consumer health data privacy policy prepared for review under laws such as Washington’s My Health My Data Act. It must be reviewed by qualified counsel before Merosa is offered in production.
Consumer health data collected
Merosa may collect consumer health data that a user chooses to submit, including mood, energy, sensory load, support needs, stressors, helpful actions, communication preferences, early warning signs, wellbeing, connection and confidence scores, private beta comments, community content that reveals mental or behavioral health information, and assistive-technology selections that may reveal disability-related information.
Purpose of collection and use
Merosa collects and uses this data to provide the specific check-in, support-plan, support-passport, community, beta-outcome, export, deletion, personalization, moderation, safety-routing, and service-security functions requested by the user. Voluntary beta outcomes may also be used to evaluate and improve Merosa. Consumer health data is not used for targeted advertising, sale, insurance eligibility, employment decisions, or unrelated profiling.
Sources
Consumer health data comes directly from the user’s entries and selections. Merosa does not currently import health records, HealthKit data, fitness-tracker data, clinical records, or data-broker profiles.
Categories shared and recipients
Merosa may disclose consumer health data to hosting, database, storage, edge-security, and operational processors only as needed to provide and secure the requested feature. Current planned processors include Render and Cloudflare. Authorized human moderators may access submitted community or beta content for review, safety, and governance. Merosa does not share consumer health data with advertising networks or data brokers.
How consumer health data is processed
Data is linked to the account where necessary to provide private features. Approved community posts are displayed without the account email or account identifier. Retention is bounded by feature: check-ins use a selected 7-, 30-, or 90-day period; community posts and beta feedback are retained no longer than 90 days unless a lawful hold applies; exports expire after 24 hours and are destroyed after download; eligible account data is erased after the 14-day deletion grace period.
Consumer rights
You may confirm whether Merosa collects or shares your consumer health data, access it, withdraw consent, request deletion, and request an export through in-app controls or by emailing privacy@joinmindbridgeapp.com. Withdrawal does not affect processing already completed before the withdrawal. Merosa may verify a request and will handle appeals or additional rights as required by applicable law.
Sale
Merosa does not sell consumer health data. If that practice ever changed, Merosa would first provide the notices and obtain the separate valid authorization required by applicable law.
Contact
Merosa is operated by Jonathan Sumpter in North Carolina, United States. Consumer health data questions and requests may be sent to privacy@joinmindbridgeapp.com.