Plain-language summary: This policy covers the health-related information you choose to share with AskSonya.ai — lab values, lab report uploads, health questions you ask the AI, and entries in wellness tools. It exists in addition to our general Privacy Policy, because several states (including Washington and Nevada) give consumer health data extra protection. The short version: we collect health data only when you provide it to get an explanation or use a tool, we use it only to provide that service, we never sell it, and you can see it, delete it, or withdraw consent at any time.
This Consumer Health Data Privacy Policy applies to "consumer health data" as defined by the Washington My Health My Data Act (RCW 19.373), Nevada SB 370, and similar state laws: personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status. It applies to all visitors and users of AskSonya.ai, wherever located, and describes the additional rights available to residents of states with consumer health data laws.
AskSonya.ai is an educational health-literacy platform operated by Sonya M., CLS. It is not a healthcare provider and is not a covered entity under HIPAA; that is exactly why this policy exists — to give your health data strong, transparent protection anyway.
We do not collect biometric data, precise geolocation, or health data from other sources — the only consumer health data we process is what you actively choose to submit.
We collect consumer health data only to the extent necessary to provide the service you specifically requested. We do not use your health data for advertising, profiling, or any secondary purpose, and we do not collect it from third parties.
We do not sell consumer health data, and we do not share it with third parties for their own purposes. No advertising or analytics service receives your health data. The only entities that touch consumer health data are service providers (processors) acting on our documented instructions:
| Processor | Role | What it processes |
|---|---|---|
| Anthropic (Claude API) | Generates AI responses | Chat messages and lab text/PDF content, in transit, to produce your explanation. Not used to train Anthropic's models under our commercial API terms. |
| Cloudflare | Hosting & API gateway | Requests pass through our Cloudflare Worker gateway in transit. |
| Stripe | Payments | Billing only — Stripe never receives your health data. |
| Zoom | Educational consultations | Live session content, if you book a consultation. |
| Email service provider | Newsletter & replies | Only health information you include in a message to us. |
Each processor is bound by contractual terms restricting use of your data to providing the service. If we were ever to share consumer health data beyond this, we would first ask for your separate, explicit consent — and we would never sell it without the signed authorization state law requires.
Wherever you live — and specifically if you are a resident of Washington, Nevada, or another state with a consumer health data law — you have the right to:
How to exercise these rights: Email [email protected] with the subject line "Health Data Request" from the email address associated with your account (we verify identity this way to protect you). We will respond within 45 days. Premium subscribers can also delete saved chat and lab history directly from account settings at any time.
Health data in transit is protected with HTTPS/TLS encryption, processed through server-side credentials, and restricted by access controls. Before uploading a lab report, we recommend removing direct identifiers (name, date of birth, patient ID) — the analysis works the same without them.
We do not use geofencing of any kind, including around healthcare facilities.
If we change this policy, we will update the "Last Updated" date above, post the revised version on this page, and notify users by email and a homepage notice before material changes take effect. Prior versions are available on request at [email protected].