Consumer Health Data Privacy Notice
Effective date and version: September 01, 2026 (2026-09-01)
This Notice supplements the Quillith Privacy Policy. It explains how Toadstool Labs LLC ("Toadstool Labs," "we," "us," or "our") handles consumer health data. It is intended to satisfy the Washington My Health My Data Act and similar state health-data laws. If this Notice conflicts with the general Privacy Policy, this Notice controls for consumer health data to the extent required by law.
1. Consumer health data we collect
Consumer health data means personal information that identifies or is reasonably linkable to a person and that identifies past, present, or future physical or mental health. Quillith can collect the following categories:
- Information you write: journal statements about physical or mental health, symptoms, diagnoses, treatment, medication, disability, substance use, sleep, exercise, diet, reproductive or sexual health, health care, or other health-related subjects.
- Health-related context: relationships, location, finances, beliefs, employment, or other information when it reveals or is used to understand health status or a request for health care.
- Derived information: entry summaries, remembered facts and tags, reflections, and other inferences derived from journal content.
- Safety information: limited classifications for a possible severe mental health crisis, self-harm risk, or threat of violence, including category, severity, an AI-generated reason, and supporting entry identifiers.
- Linked account and technical data: email address, username, time zone, account identifiers, message identifiers, IP address, and device or service data when linked to health-related journal use.
Quillith does not ask for medical records, insurance records, biometric identifiers, genetic test results, or precise geolocation. We can receive any of these if you choose to write them in a journal entry. Do not submit information you do not want Quillith to process.
2. Sources
We collect consumer health data from:
- You, when you write on the web, send a journal email, edit account information, or contact us.
- Your email provider and our email delivery provider, when they transmit a journal message or delivery information.
- OpenAI, when its models return a summary, remembered-fact operation, safety classification, or reflection based on the context Quillith sent.
- Your browser, device, and our hosting or security providers, for technical data linked to use of health-related features.
3. Why we collect and use it
We collect and use consumer health data only to:
- Receive, store, display, export, and delete the private journal you request.
- Create entry summaries and user-correctable remembered facts.
- Generate and deliver the reflections you request.
- Identify limited severe safety concerns, suppress an ordinary reflection when a concern is detected, support manual review, and permit appropriate outreach.
- Authenticate and secure your account, prevent abuse, troubleshoot errors, deliver email, and support the Service.
- Comply with law and protect rights and safety.
We do not use consumer health data for advertising, data brokerage, decisions about employment, credit, insurance, housing, education, or health care eligibility, or to train public AI models.
4. Consumer health data we disclose
We disclose the categories below only as needed for the stated purpose:
- OpenAI: journal text, summaries, remembered facts, recent reflections, generated content, and a hashed account identifier for AI processing.
- Email delivery provider: journal email content, email address, reflection content, safety notice content, and delivery metadata for inbound and outbound email.
- Railway: all consumer health data stored in or transmitted through the hosted application and PostgreSQL database, plus related infrastructure data and protected backups.
- Authorized Toadstool Labs personnel: account information, safety records, and relevant journal content when needed for a safety review, support, security, or legal compliance.
- Professional advisers, authorities, and transaction recipients: relevant data when reasonably necessary for legal advice, a valid legal requirement, protection from a credible threat, or a business transaction subject to privacy obligations.
Cloudflare and RewindRewind receive technical and diagnostic information as described in the general Privacy Policy. We filter journal bodies and sensitive request fields from diagnostic request parameters and do not intentionally disclose journal content to them.
We do not sell consumer health data. We do not use a geofence around a health care facility to identify, track, collect data from, or send messages or advertisements to a person. We do not disclose consumer health data to a corporate affiliate or intentionally make it available to other Toadstool Labs products. Some processor accounts are shared, but Quillith uses separate project or server scopes as described in the Privacy Policy.
5. Your consent
During account setup, you check one box confirming that you have read and agree to the Terms of Service and the Privacy Policy, which incorporate this Notice. That acceptance identifies the health-data categories, purposes, processor categories, and withdrawal method described here, and it is your affirmative consent to the collection and use described in this Notice. OpenAI, our email delivery provider, and Railway act as processors to provide the Service you request; under the Washington My Health My Data Act, a purpose-consistent disclosure to a processor is not a "share." We will obtain any additional consent required before collecting, using, or sharing a new category of consumer health data or using it for a materially different purpose.
6. Your rights
Subject to applicable law and exceptions, you may:
- Confirm whether we collect, disclose, or sell your consumer health data.
- Access the consumer health data we hold about you.
- Receive a list of third parties and affiliates to which your consumer health data was disclosed or sold, with a way to contact them when required.
- Withdraw consent from future collection and disclosure.
- Delete consumer health data, including by requesting that processors and other recipients delete it.
- Appeal our refusal to act on a request.
- Exercise these rights without unlawful discrimination.
You can delete entries, delete remembered facts, export journal data, stop journal email, or delete the account through Quillith. Deleting one entry also deletes any safety flag that cites it, but does not automatically rewrite earlier summaries, reflections, or remembered facts derived from it. Safety flags are deleted after 24 months even while an account remains active. A full account deletion removes all account-linked journal and health data from the active Quillith database.
To exercise a right, email hello@quillith.com with the subject "Health Data Request." Send it from your account email when possible and describe your request. To appeal a refusal, reply or use the subject "Health Data Appeal." We may verify your identity and an authorized agent's authority. We will respond within the time required by applicable law.
Withdrawing consent stops future consumer health data processing. Because that processing is required for the journal and reflection Service, withdrawal may require account closure. We will stop consent-based processing as soon as practicable and within any deadline required by law.
For a verified deletion request, we will delete consumer health data from active systems and notify processors or other recipients as required. Protected backup copies may be deleted when the backup system is next restored or overwritten, no later than six months after authentication when Washington law applies. We may retain information that law exempts from deletion.
7. Changes to this Notice
We will not collect, use, or disclose a new category of consumer health data, or use existing consumer health data for a materially different purpose, without first updating this Notice and obtaining consent when required by law.
8. Contact
Toadstool Labs LLC
5441 S Macadam Ave, Ste N
Portland, OR 97239, USA
hello@quillith.com