Consumer Health Data Privacy Policy
Last updated 11 September 2026.
Operator: Indemni, Inc., 325 S Legend Tree Dr, Liberty Lake, WA 99019, USA. Contact: contact@indemni.io.
This policy is provided under the Washington My Health My Data Act (RCW 19.373) and the Nevada consumer health data law (SB 370). It is separate from our general Privacy Policy on purpose: Washington requires this document to be its own policy, reachable by its own link, and to contain only what that Act requires. Everything else about how Whole Story handles your information is in the general policy.
1. The consumer health data we collect, and why
| Category | What it is | Why we collect it |
|---|---|---|
| Measurements | Steps, active energy, resting heart rate, heart rate variability, body mass, sleep, and workouts | To show you your own history, and to work out what is normal for you so the coach can notice when something changes |
| Period days | Menstrual flow days from Apple Health, if you share them. Reproductive data — a special category. | So a weight change in that week is read as what it is, not as a stalled cut. We do not guess a next period or infer anything else from them |
| Body figures you enter | Weight you type in or say to the coach | Same as above, for people who do not use a wearable |
| Food and drink | What you ate or drank, in your own words, and any amount you stated | So the coach can talk about your week accurately. We do not estimate calories or macros from it |
| How you feel | Energy, mood, sleep quality and similar ratings, and anything you say about how you are | Because how you feel is the point, and no device measures it |
| Health circumstances you tell us | Conditions, injuries, medications, supplements, symptoms, side effects, appointments, and goals — whatever you choose to say in conversation | So the coach remembers, and does not ask you the same thing twice |
| What we work out from the above | Daily and weekly summaries, your personal baselines, and observations such as "you have not run in two weeks" | This is the product. It is derived from the categories above and nothing else |
How it is used. To operate Whole Story for you: to display your data back to you, to let the coach hold a conversation that takes your history into account, and to decide whether there is anything worth telling you. We do not use consumer health data for advertising, and we do not profile you for anyone else's purposes.
Intended purpose. Whole Story is a health and wellbeing app. It is not a medical device, it does not practise medicine, and using it does not create a doctor–patient or any other clinical relationship.
2. Where it comes from
- From you, by typing or speaking in the app.
- From Apple Health, only after you grant permission on your device, and only the categories listed in section 1. You can withdraw that permission at any time in the iOS Settings app, or stop syncing in Whole Story.
- From our own processing of the two sources above.
We do not buy consumer health data, and we do not obtain it from data brokers, advertising networks, or any other third party.
3. What we share, and with whom
We do not sell consumer health data. We have never sold it and the app has no mechanism to. We share it only with the service providers below, only so that Whole Story can function, and only under contracts that forbid them from using it for their own purposes.
| Category of third party | Specific provider | What they receive | Retention |
|---|---|---|---|
| AI model provider | Anthropic, PBC | The content of your conversation with the coach, and the specific figures the coach retrieves to answer you. Not used to train their models | 30 days |
| Web search | Anthropic, PBC (run on their systems) | Only the wording of a search the coach composes, plus your time zone so results are regionally relevant. No consumer health data — the coach is instructed never to search for anything about you, and the pages it read are listed under its reply | 30 days, with the conversation |
| Database hosting | Neon, Inc. | All stored consumer health data, encrypted at rest | For as long as you have an account |
| Application hosting | Railway Corp. | Consumer health data in transit and in memory while a request is being served | The request |
| Authentication | Clerk, Inc. | Your identity only — email and sign-in credentials. No consumer health data | For as long as the account exists |
| Background job scheduling | Inngest, Inc. | An account identifier and a time zone only. No consumer health data | The job record |
| Subscriptions | RevenueCat, Inc. | Subscription status only. No consumer health data | While the subscription record exists |
| Diagnostics | Sentry | Crash and error diagnostics. No consumer health data | Diagnostics only |
| Product analytics | PostHog | Event names only — never a health value | Event names only |
| Operator mail | Resend | Mail we send you when you write to us. No consumer health data in the product | Operator mail only |
We have no affiliates. Indemni, Inc. has no parent, subsidiary, or commonly controlled entity with which anything is shared.
No advertisers, no analytics companies, no data brokers. Whole Story contains no third-party advertising or analytics SDK. Our own usage records store event names only — for example that a screen was opened — and are structurally incapable of carrying a health value.
We may also disclose consumer health data if legally compelled, or to protect someone from serious harm. If that ever happens we will tell you unless we are legally forbidden from doing so.
4. Your rights, and how to exercise them
Under RCW 19.373.040 you have the right to:
- Confirm whether we are collecting, sharing, or selling consumer health data about you, and to access that data, including the list of third parties above.
- Withdraw your consent to our collection and sharing of it.
- Have it deleted, including from backups.
Two ways to exercise any of these. You do not need to create an account you do not already have.
- In the app. Open the You tab → Your data. Export downloads everything we hold about you as a file. Delete account erases it. Deletion is immediate in our live systems; encrypted backups roll off within 30 days, and the Act permits up to six months.
- By email, to contact@indemni.io, from the address on your account so we can tell it is you. If we cannot verify who you are, we will ask you for the minimum extra information needed, and we will not act on the request until we can.
We will respond within 45 days, free of charge, up to twice a year. If a request is genuinely complex we may take one further 45 days, and we will tell you why inside the first 45.
Withdrawing consent stops collection and sharing going forward. Turn off Let the coach read what you tell it under You → App and account. The coach and the nightly notes stop; Health and Plan still read, and nothing is deleted. Because the coach cannot function without the data it is built on, withdrawing consent while keeping the account leaves those parts of Whole Story unable to work — we would rather say that plainly than surprise you.
When you ask us to delete, we delete it from our records and instruct every provider in section 3 to do the same.
5. If we refuse
If we decline a request, we will tell you why in writing. You may appeal by replying to that message or by writing to contact@indemni.io with "Appeal" in the subject. We will decide within 45 days and explain the decision in writing.
If we deny your appeal, you may complain to the Washington State Attorney General at https://www.atg.wa.gov/file-complaint.
6. Changes
We will not collect, use, or share categories of consumer health data, or use it for purposes, that this policy does not disclose. If that ever needs to change, we will update this policy and ask for your consent before the new collection or use begins.