Consumer Health Data Privacy Policy

Soled.ai preserves life stories, and life stories sometimes include health: an illness survived, a caregiving season, grief, recovery, mental health. Washington's My Health My Data Act and similar laws treat that information, and biometric data such as your voice, as consumer health data with its own protections. This policy covers that data specifically; our Privacy Policy covers everything else.

• Health-related details you choose to share in interview answers, conversations, or corrections: physical or mental health conditions, treatments, surgeries, recoveries, and similar life events, in your own words.
• Health-related details about other people that appear inside a life story: a parent's illness, a spouse's recovery, a child's diagnosis. Life stories involve the people in them. We process such details solely within that member's private vault to operate their clone; we never use them to build anything about the person mentioned, and that person can contact us without having an account (see Your rights below).
• Biometric data: your voice recordings and, if you train one, the synthetic voice model described in our Voice Data Notice.
• Derived content that may reflect those details: transcripts, extracted memories, embeddings, persona documents, and your clone's generated replies.

The sources are the people using the service: the member telling their story, and invited participants in what they say to the clone. We do not infer health conditions, buy health data, or collect it from data brokers or anyone outside those conversations.

• One purpose: building and running your clone, the service you asked us to provide. Health details you share are preserved, retrieved, and spoken back the same way as any other memory.
• Members give affirmative consent before their first interview, and training a voice requires its own explicit authorization. Invited participants agree when accepting their invitation, and the chat screen reminds everyone that what they share is stored with the clone.
• We never use consumer health data for advertising and never sell it (and will not; sale would require your separate, signed authorization under Washington law).

• The people the member invites: a clone shares the member's family-level memories, which can include health-related stories, with invited participants in conversation. That sharing happens at the member's direction, as part of the service the member asked for, and the member controls it: marking a memory private stops its use in new participant conversations and removes it from the material used to generate them (this cannot retract what someone already received), and access can be revoked.
• The clone's owner: owners can read the conversations invited participants have with their clone, including health details a participant chooses to share. Participants are told this before they chat.
• Service providers: the processors listed in our Privacy Policy can receive consumer health data inside the content they process for us: Supabase (storage), Anthropic (conversation and extraction), Voyage AI (embeddings), Deepgram (transcription), and ElevenLabs (voice, only if trained). Each is bound by processing terms restricting it to providing the service, and where a provider offers a model-training opt-out we have exercised it.

• Access: ask what consumer health data we have about you, and who it was shared with.
• Withdraw consent: stop future collection or sharing at any time, separately. Withdrawing collection consent means interviews and conversations stop capturing new material from you; features that depend on what you withdraw stop working (a clone cannot speak from memories you remove, and revoked sharing ends a participant's access). We will tell you exactly what a withdrawal turns off before you confirm it.
• Delete: ask us to delete your consumer health data. Deletion covers the source (recordings, transcripts) and what we derived from it: memories, embeddings, and persona content, which is scrubbed as part of the deletion rather than waiting for a future rebuild. We direct our processors to delete their copies and track those requests to completion, and backup copies are purged no later than six months after we authenticate your request. Marking a memory private is a sharing control, not deletion: it hides the memory from participants but keeps it in your archive.
• Not a user? If someone's story contains identifiable health information about you, email us; you do not need an account. We will verify your identity and evaluate and fulfill your request under applicable law. If a specific legal exception limits what we can do, we will explain the basis and your appeal options.
• No retaliation: we never charge you more or deny you the service for exercising these rights. The only changes that follow are the ones a withdrawal or deletion itself requires, which we explain before you confirm.

To exercise any right, email support@soled.ai (from the address on your account, if you have one). We will verify it is you and respond within 30 days. If we decline a request, we will explain why, and you may appeal by replying to our decision; appeals are reviewed by a person not involved in the original decision and answered within 30 days. Washington residents who are not satisfied after an appeal may contact the Washington State Attorney General at atg.wa.gov.

We do not use geofencing of any kind, and we do not track your location. Our only cookies are the ones that keep you signed in.