Consumer Health Data Privacy Policy

Washington's My Health My Data Act and Nevada's consumer health data law give you specific rights over information about your health, including mental health, and require us to publish this separate policy. It applies to you if you live in Washington or Nevada, or if we collect your consumer health data while you are in either state. It supplements our Privacy Policy, which continues to apply to everything else. If anything here conflicts with the Privacy Policy, this policy controls for consumer health data.

4couple is operated by WUMI sp. z o.o., ul. Prosta 20, 00-850 Warszawa, Poland (KRS 0001259684). We are the regulated entity responsible for your consumer health data. Contact us at contact@4couple.ai.

4couple is not a healthcare provider and the AI Companion is not therapy or medical care. We are not covered by HIPAA. This policy exists precisely because we are not a healthcare provider and the law therefore treats the health-related information we hold as “consumer health data”.

“Consumer health data” means personal information that is linked or reasonably linkable to you and that identifies your past, present or future physical or mental health status. In 4couple, this includes:

• Your conversations with the AI Companion (your own chat and the partners' chat), including the topics you choose, the AI's summaries and follow-up plans, and the AI's memory of what matters to you across sessions.
• Your onboarding answers about how you connect and handle conflict, and the connection type derived from them.
• Your mood entries, sub-moods and free-text mood notes, and the mood and weekly insights generated from them.
• Intimacy and need signals you send to your partner, including “wants to make love”, “needs a hug” and “needs some space”, which reveal information about your sex life and emotional state.
• Safety signals: the output of the automated classifier that checks each AI Companion message for signs of risk, the crisis resources shown to you, and automated signals about each turn of conversation (topic and emotional state).
• What you type into Translate My Emotions, to the extent it reveals your emotional or mental state.
• Voice recordings you make for voice input, and photos you add in shared sessions, to the extent they contain health-related information.
• Inferences we or our AI draw from any of the above.

We do not collect biometric data, precise geolocation used to identify visits to health services, or reproductive or sexual health information beyond the intimacy signals described above.

We collect consumer health data directly from you when you use the features above, from your linked partner when they share content with you in a shared session or send you a signal, and from our own automated processing (the safety classifier, conversation signals, insights and the AI's memory). We do not buy or receive consumer health data from third parties.

We collect and use consumer health data only for the following purposes:

• To provide the features you have asked for: generating AI Companion responses, remembering context across sessions, showing you and your partner your moods and insights, delivering the signals you send, and rewording messages in Translate My Emotions.
• To show you crisis resources: detecting messages that may indicate a risk to you or others, and showing you where to find help.
• To personalise the Services for you.
• To honour your data rights and comply with the law.

Detection is automated and imperfect. It may miss a message that indicates risk, or show resources when there is no risk, and we do not contact emergency services, a helpline or anyone else on your behalf. Section 4 of our Terms & Conditions explains this in full.

We do not use consumer health data for advertising, and we do not use it to make decisions about your eligibility for anything.

We collect consumer health data only with your separate, affirmative consent, which we ask for in a dedicated step before you first use the Mood Checker or the AI Companion. This consent is not bundled with accepting our Terms and is not pre-selected. We also ask for your separate consent before your consumer health data is shared with our service providers to generate AI responses, because the law treats this as sharing.

You can withdraw either consent at any time in Settings > Privacy & data or by contacting us. Withdrawal stops the related features and, subject to section 8, leads to deletion of the related data. It does not affect processing that took place while your consent was in place.

We do not sell consumer health data, and we would never do so without your separate, written authorisation, which we do not currently request. We share consumer health data only with:

• Your linked partner, for the content you choose to share in shared sessions and the moods and signals the Services share with them, as described in section 9 of the Privacy Policy.
• Our service providers (processors), under written contracts that limit them to processing the data on our behalf and on our instructions: hosting and infrastructure, artificial intelligence, speech-to-text, product analytics (which does not receive the content of your conversations, moods or notes), push-notification delivery, and email delivery. The current providers are listed on our Sub-processors page.
• Public authorities or courts where the law requires it, and our professional advisers where needed to establish, exercise or defend legal rights.
• A successor organisation if we sell or transfer our business, bound by this policy.

We do not share consumer health data with affiliates (we have none) or with any third party for their own purposes.

You have the right to:

• Confirm and access: confirm whether we are collecting, sharing or selling your consumer health data, access that data, and receive a list of all third parties and affiliates with whom we have shared it, with an email address or other online contact for each.
• Withdraw consent to the collection and sharing of your consumer health data.
• Delete your consumer health data. When you ask, we will delete it from our systems and, within 7 days, from our backups, and we will instruct our service providers to do the same.
• Not be discriminated against for exercising any of these rights.

To exercise a right, email contact@4couple.ai from the email address on your account, or use the controls in the App (Settings > Privacy & data to view and clear the AI's memory or delete individual entries; Settings to delete your account). We will verify your request using your account email and respond within 45 days, extendable once by 45 days where reasonably necessary, with notice. Requests are free unless they are manifestly excessive, in which case we may charge a reasonable fee or decline.

Appeals. If we decline your request, you may appeal within 45 days by replying to our decision. We will respond within 45 days with a written explanation of the reasons and any action taken. If your appeal is denied, you may contact the Washington State Attorney General (atg.wa.gov) or the Nevada Attorney General (ag.nv.gov).

The text of ended AI Companion sessions is deleted automatically after 90 days. You can turn that automatic deletion off in Settings > Privacy & data, in which case the text is kept until you delete the session or your account; for a shared session, the shorter of the two partners' settings applies. Session summaries and the AI's memory are kept until you clear them or delete your account. Mood entries, notes, signals, insights and safety-classifier output are kept until you delete them or your account; the 90-day rule covers session text only, not these. The partners' chat, its summaries and follow-up plans, and the insights about you both are deleted for both of you when your link ends, whether because one of you unlinks or because one of you deletes their account. Voice recordings are used only to produce a transcription and are not retained. When you delete your account, all of the above is deleted immediately, and residual copies in our encrypted backups are removed within 7 days; see section 13 of the Privacy Policy.

Consumer health data is protected by encryption in transit and at rest, access controls, and row-level security that limits your partner to the content described in section 6. We limit internal access to the small number of people who need it to run and support the Services, and no one monitors your conversations in real time. Our safety classification is fully automated; no person reviews safety events. If a breach puts your data at risk, we will notify you and the relevant authorities as the law requires, including under the FTC Health Breach Notification Rule.

We will notify you before any material change to this policy takes effect and will not collect or share consumer health data in ways that go beyond this policy without first obtaining your consent. Questions and requests: contact@4couple.ai, or by post to WUMI sp. z o.o., ul. Prosta 20, 00-850 Warszawa, Poland.