Consumer Health Data Privacy Policy

1. Scope

This Consumer Health Data Privacy Policy supplements the Iris Privacy Policy. It applies to consumer health data covered by Washington’s My Health My Data Act, Nevada’s consumer-health-data law, and similar laws when those laws apply to a user or processing activity.

Iris is a consumer AI reflection service, not a healthcare provider. This notice does not state that Iris is covered by HIPAA or that it provides diagnosis or treatment.

2. Consumer health data we may collect

Depending on what you choose to discuss and which features you use, Iris may process:

• Information about physical or mental health, symptoms, diagnoses or possible conditions, medications, disability, substance use, grief, trauma, or emotional state.
• Information about reproductive or sexual health, sex life, sexual orientation, or gender-affirming care.
• Information about behavioral, social, spiritual, or other interventions sought or received.
• Journal entries, conversation content, voice transcripts, support messages, or feedback that contain health-related information.
• Memory, summaries, profiles, or other inferences derived from the information you provide.
• Account, device, and usage identifiers when linked or reasonably linkable to the health-related information above.

3. Sources

We collect consumer health data directly from you; from your use of requested Iris features; and from outputs, summaries, memory, or inferences generated from content you provide. We do not purchase consumer health data from data brokers. Iris does not intentionally collect precise location to identify that a person sought health services.

4. Why we collect and use it

• Provide AI conversations, journals, memory, voice when enabled, saved history, safety resources, support, export, and settings you request.
• Personalize later responses when memory is enabled.
• Authenticate users, maintain accounts, prevent fraud and abuse, and protect service security.
• Respond to privacy, deletion, support, and legal requests.
• Comply with law and enforce the Terms of Use.

Iris does not use consumer health data to diagnose or treat a condition or to make a consequential medical, credit, employment, housing, insurance, or similar decision about a person.

5. How consumer health data is shared

We share consumer health data only as reasonably necessary for the service you request or as otherwise permitted with required consent. Recipient categories may include:

• AI service providers using OpenAI and DeepSeek models for AI response generation and related processing, and moderation, transcription, and speech providers when those features are used.
• Hosting, database, storage, authentication, backup, and security providers.
• Support, email, SMS, and communications providers when needed for a request or service message.
• Professional advisers, authorities, or transaction participants when lawfully required or necessary to protect rights, safety, or service security.

Stripe processes payment information, but private conversation content is not required for checkout. Consent-controlled analytics are designed not to receive private chat, journal, or memory content.

6. Sale and targeted advertising

Iris does not sell consumer health data. Iris does not share consumer health data for targeted or cross-context behavioral advertising. A sale, if ever proposed, would require a separate authorization that satisfies applicable law.

7. Consent and necessary processing

Where permitted, Iris collects and shares consumer health data only as necessary to provide a feature you request. When law requires consent for another purpose, Iris will request a specific opt-in before that collection or sharing. Consent to collect and consent to share will be separate where required and will not be inferred merely because you accepted general Terms.

You may withdraw consent for future processing where applicable. Withdrawal does not undo processing already completed and may prevent Iris from providing a requested feature.

8. Your rights

Where applicable, you may:

• Confirm whether Iris collects or shares your consumer health data and access that data.
• Obtain a list of third parties or affiliates that received it, where required.
• Withdraw consent to future collection or sharing.
• Request deletion, including notification to processors and other recipients when required.
• Appeal a denied request.
• Exercise these rights without unlawful discrimination.

9. How to make a request

Use Privacy Choices or email app@irislightwithin.com. Describe the right you want to exercise and the account contact information needed to locate the data. Do not send a password or unnecessary health details.

We may verify identity and an authorized agent’s authority. We will respond within the period required by applicable law. To appeal, reply to the decision with “Privacy Appeal” in the subject line and explain why you believe the decision should change.

10. Retention and deletion

Iris retains registered-user conversation data for up to 12 months from last activity, guest data for 30 days from last activity, and data associated with a canceled paid account for up to 12 months after cancellation. Other limited records may be retained for security, consent evidence, transactions, disputes, legal holds, and compliance as described in the Privacy Policy.

When a verified deletion right applies, Iris will delete covered data from active systems and instruct processors or other covered recipients to delete it as required. Backup or archive deletion may occur later, but Iris will follow the applicable legal deadline, including the shorter Washington deadline when that law applies. Information may be retained only when a statutory exception permits it.

11. Security

Iris uses administrative, technical, and organizational safeguards designed to protect consumer health data, including encrypted transmission, authentication, access controls, logging, and data minimization. No online system can guarantee absolute security.

12. Changes

We will post a revised version and effective date when this Policy changes. We will provide additional notice and obtain consent before materially different collection or sharing when required.

13. Contact