Consumer Health Data Privacy Policy

Who This Policy Is For

This Consumer Health Data Privacy Policy applies to you if you live in Washington or Nevada. It explains how Hayaa handles your consumer health data under Washington's My Health My Data Act and Nevada's Senate Bill 370.

Hayaa is operated by Hayaa LLC, a Michigan limited liability company. Our full Privacy Policy, at hayaa.io/privacy, also applies to you and describes everything else about how we handle your personal information.

Consumer Health Data We Collect

Hayaa is a recovery app, so much of what you share in it relates to your health. By the nature of the App, your use of it is itself indicative of a sensitive personal context. The consumer health data we collect is the following.

• The recovery goals, struggle duration, usage frequency, triggers, and motivations you give during onboarding.
• Your streak start date, current streak, longest streak, streak history, relapse events, and milestone records.
• Your check-ins and the mood you choose, the urges you log, and your SOS button use (date, time, and completion).
• Journal entries you write.
• Your messages with the AI companion (Rafiq/Rafiqa) and the mood you choose for a conversation.
• Anything about your health that you choose to write in messages to your accountability partner or in community posts and replies.
• On Android, if you have an accountability partner and turn on partner alerts, records of Blocker events (the kind of event and the time) and whether your Blocker is on or off and since when.

We do not collect details of sexual behaviour beyond what you voluntarily disclose in journal entries, partner messages, or AI conversations. Your Blocker block lists and Blocker settings stay on your device. We never receive them.

Where It Comes From

• From you, when you enter it in the App, such as your onboarding answers, check-ins, urges, journal entries, and messages.
• From your use of the App, such as your streak, milestones, and SOS use.
• From the App on your Android phone, only if you turn on partner alerts. It sends us a short still-running signal (a device code and whether the Blocker is running), a sign-out signal, and a record when the Blocker is turned off, loosened, or its Accessibility Service is switched off. We never receive what you block or what changed.

Your Consent

We ask for your explicit consent to process your health-related information on a separate screen when you create your account, by ticking two boxes. We process it only to deliver the App's features, and we never sell it or use it for advertising.

If a change adds a new use of your sensitive information, we will ask for your consent in the App first.

Why We Use It

• To run the App's recovery tools, such as streaks, milestones, check-ins, urge logging, the SOS button, and the journal.
• To operate the AI companion (Rafiq/Rafiqa) and to match the religious content you see to your stage of recovery.
• To match you with accountability partners, preferring a similar recovery stage and streak, and to show your partner the limited information listed below.
• To deliver notifications you have opted into, such as check-in reminders, partner activity, and milestone celebrations.
• To moderate community content and partner messages using automated in-app filters, and to investigate user reports.
• To detect, prevent, and investigate fraud, abuse, and Terms of Service violations, and to comply with legal obligations.
• To improve the App and fix bugs, using aggregated, de-identified data where possible.

Who We Share It With

We do not sell your personal information, including your consumer health data. We share it only as described here.

1. Service providers (processors) acting on our instructions
   • Supabase, Inc. hosts your profile, recovery data, journal entries, partner messages, AI conversations, and community data.
   • Anthropic, PBC provides the AI model behind Rafiq/Rafiqa. Each time you send a message, it receives that message, your 10 most recent messages in the conversation, the mood you chose, and a few profile details (sect, current streak, recovery stage, triggers, and motivation). Anthropic does not use this data to train its models.
   • Voyage AI receives the text of each message you send to Rafiq/Rafiqa, and nothing else, to find matching religious content in our database.
   • Expo, Apple, and Google deliver our notifications. A notification can include your partner's display name, the kind of event (for example an SOS or an urge) and, if you allow message previews, the start of a message.
   • Sentry (Functional Software, Inc.) receives crash reports and, for a sample of app launches and screen changes, how long the App took to start and to show the screen. These carry technical data and the screen's name only, never your content.

Each of these providers may use your information only to provide its service to us, and must protect it at least as well as our Privacy Policy does.

1. Your accountability partner, only if you choose to link one
   • Your partner can see your display name, avatar, current streak, last check-in date, whether you triggered an SOS alert in the last 24 hours, your recent urge activity (count and recency within 24 hours), and whether you recently had a hard day (streak reset). On Android, if you turned on partner alerts, your partner also sees Blocker alerts (the kind of event, the time and, for a loosened Blocker, how many times in the last day) and whether your Blocker is on or off right now and since when. Your partner also reads the messages you send them.
   • Your partner cannot see your real name, email, journal entries, AI conversations, or any other private data.
2. Other community members, only for what you choose to post
   • Posts and replies you submit are visible to other users of the same gender, with your display name and your streak day at the time you posted.
3. Legal and safety disclosures
   • We may disclose information when we believe in good faith that disclosure is necessary to comply with applicable law or legal process, enforce our Terms of Service, address fraud or security issues, or protect against harm to the rights, property, or safety of Hayaa, our users, or the public.

How Long We Keep It

We keep your consumer health data while your account exists, unless a shorter period applies. Messages with your accountability partner are deleted 30 days after they are sent. Blocker partner alert records are deleted after 90 days. You can delete journal entries yourself at any time.

When you delete your account, we delete it straight away, together with everything linked to it. Copies in our encrypted database backups are overwritten within 7 days. Our Privacy Policy lists the few records that stay after deletion, without your name or account.

Your Rights

• Access. You can request a copy of the consumer health data we hold about you. The App provides a data export under Settings → Privacy and data → Request data export.
• Correction. You can update most information directly in the App, or ask us to correct it.
• Deletion. You can delete your account in the App under Settings → Privacy and data → Delete account. This deletes your account straight away, together with everything linked to it. You can also ask us to delete your account by emailing support@hayaa.io from the address you signed up with.
• Withdraw consent. You can withdraw your consent under Settings → Privacy and data → Withdraw consent. The App cannot work without it, so withdrawing deletes your account.

To exercise any of these rights, email support@hayaa.io or use the in-app controls described above. We will respond within 30 days (or sooner where required by law). We may verify your identity before fulfilling certain requests.

Appeals

If we decline your request, you can appeal by replying to our answer with the subject line "Appeal". We answer appeals within 45 days. If we still decline, we will tell you how to contact your state Attorney General.

Contact Us

If you have questions about this policy or your consumer health data, email us at support@hayaa.io

Please use the subject line "Privacy Inquiry".