Consumer Health Data Privacy Policy

1. What "consumer health data" means here

Washington and Nevada law define consumer health data as personal information that identifies a person's past, present, or future physical or mental health status, including information derived or inferred from other data. Connecticut law treats consumer health data as sensitive data. Those are the laws' words. Novii is a life design and self-understanding product, not a health product. Some of its questions, such as those in Life Crafting, invite you to reflect on areas of your life that include your health. You answer every question in your own words, so what you write may include information the law counts as consumer health data.

2. Consumer health data we collect, and where it comes from

We do not collect consumer health data from any other source. We do not buy it, infer it from other data, or collect it from your location.

3. Why we collect it

We collect and use consumer health data for these purposes only:

1. To generate your results, which requires sending your written answers to an AI provider each time a result is generated.
2. To store your answers and results in your account so you can view, export, and share them.
3. To respond to your requests under this policy.
4. To comply with law.

We do not use consumer health data for advertising, for profiling, or for any purpose you did not ask for.

4. Who receives it

Third parties and affiliates. We do not share consumer health data with any third party or affiliate. We have no affiliates that receive it. We do not sell it.

Processors. The following categories of processors handle consumer health data for us, under their written terms with us, and only to provide their services to Novii. Each is named on our Subprocessor List at novii.ai/subprocessors.

Our product analytics provider, bot-protection provider, and subscription management provider do not receive consumer health data.

Processing by the AI providers' safety systems. Our AI providers run their own automated safety systems on the text we send. Those systems create a classification result about the text. This is a processing activity performed by the provider, and we disclose it here because a classification of what you wrote can itself be consumer health data. On the date of this policy, the providers' published retention is: inputs and outputs kept up to 30 days by default and then deleted; at Anthropic, if a request is flagged, inputs and outputs for up to two years and safety classification scores for up to seven years; at OpenAI, inputs and outputs for up to 30 days for abuse monitoring. Novii cannot shorten these periods. We re-verify them on a schedule and update this section when they change.

Where it is processed. In the United States.

5. Your consent

Before your first question, Novii shows a screen with three separate controls. One of them is a consent to AI processing. It is separate from the Terms of Service and from the Privacy Policy. It tells you that your answers will be sent to an AI provider to generate your results and that your answers may include information about your health. You choose it yourself; it is not pre-selected. Novii cannot create your results without it, so you need to turn it on to use the app.

When you create an account, the answers and results held on your device are saved to your account. Creating the account is your consent to that storage.

You can withdraw the AI-processing consent at any time in Settings. After you withdraw it, we send nothing further to AI providers. You cannot use features that need AI until you turn it back on. Your existing answers and results stay in your account until you delete them.

We do not obtain consent through the Terms of Service, and we do not ask you to consent to sharing with third parties, because we do not share.

6. Your rights

How to make a request. In the app: export or delete from Settings, or withdraw consent in Settings. By email: support@novii.ai, from the address on your account. By web: the deletion page at novii.ai/delete-account.

Verification. Being signed in verifies an in-app request. For email requests, we reply to the address on your account and may send a confirmation code to it.

Timing. We respond within 45 days. If we need more time, we tell you within that period and take no more than 45 additional days.

Authorized agents. Someone may make a request for you with your written permission. We may confirm the request with you directly.

7. Deletion

When you delete your account, or ask us to delete your consumer health data:

1. We stop using the data immediately.
2. Within 30 days, we delete it from our active systems. You can restore your account during those 30 days by emailing support@novii.ai from the address on your account; if you do, deletion does not proceed.
3. Backups are overwritten within 6 months at most.
4. We instruct each processor that received the data to delete it. The AI providers keep inputs and outputs for the periods in Section 4, measured from the date of each request; we cannot shorten those periods.

8. Appeals

If we deny a request, you can appeal by replying to our decision or by emailing support@novii.ai with "Appeal" in the subject line. We respond within 45 days with the reasons for our decision. If we deny your appeal, we will tell you how to contact your state's attorney general. Washington residents can file a complaint with the Washington Attorney General at atg.wa.gov. Nevada residents can contact the Nevada Attorney General at ag.nv.gov. Connecticut residents can contact the Connecticut Attorney General at portal.ct.gov/ag.

9. Geofencing

Novii does not use geofencing or any location technology. We do not collect precise location. We do not identify, track, or send messages to anyone based on their presence near any health facility.

10. Nevada disclosures

• We do not permit any third party to collect consumer health data about you through Novii over time and across other websites or services.
• To review or ask us to change consumer health data we hold, use the request methods in Section 6.
• When we make a material change to this policy, we notify you by email and in the app before the change takes effect and update the effective date at the top.

11. Connecticut disclosures

Consumer health data is sensitive data under Connecticut law. We process it only with the consent described in Section 5, we do not sell it, and we do not use geofencing as described in Section 9.

12. Contact