Consumer Health Data Privacy Policy

This policy supplements the Pocket EA Privacy Policy. It describes consumer health data that may be covered by U.S. state consumer health privacy laws. Pocket EA is not a health-care provider, medical device, crisis service, or substitute for professional care.

Consumer health data we may collect

Pocket EA collects consumer health data only when you choose to provide it or ask for a feature that requires it. This can include information about mental or emotional health, symptoms, diagnoses, medications, disability, wellness routines, reproductive or sexual health, relationships, or other information that can reveal health status.

Sources include your messages, onboarding answers, voice transcripts, attachments, remembered details you approve, support requests, and information from a service you deliberately connect. Pocket EA does not collect precise location to infer health status and does not purchase consumer health data from data brokers.

Why we collect and use it

• Respond to the request or conversation in which you provided the information.
• Remember a sensitive detail only when the product asks for and receives the required confirmation.
• Organize tasks, commitments, routines, and follow-ups you request.
• Provide safety-oriented crisis language when a message may indicate self-harm.
• Secure, troubleshoot, and maintain the service using the minimum information necessary.

Consent and control

Before account creation, Pocket EA asks for affirmative consent to process sensitive personal or health-related information you choose to share. Sharing health information is optional. You may withhold it, correct or delete it later, or withdraw consent by deleting the content and contacting hello@pocket-ea.app. Withdrawal does not affect processing already completed with valid consent.

Who receives it

We do not sell consumer health data and do not use it for advertising. Depending on the feature you request, it may be disclosed to the following contracted processors:

• Supabase for authentication, database records, and private file storage.
• OpenAI for assistant responses, interpretation, memory extraction, attachment processing, and moderation.
• ElevenLabs for real-time speech-to-text and text-to-speech during live voice conversations, processed through Pocket EA’s servers.
• Render to host the authenticated API, with operational logging designed to exclude conversation content.
• Expo to deliver notifications; notification text is limited and should not be treated as a private medical channel.
• Google or Microsoft only when you connect a service and approve an action involving that service.

We may disclose information when required by law or when necessary to prevent serious harm, but Pocket EA does not automatically call emergency services or disclose a conversation to a family member.

Retention and security

Health-related assistant content follows the retention periods in the Privacy Policy. You can delete individual remembered details, assistant data, uploaded files, or the full account. We protect this data with authenticated server access, private storage, encryption in transit, encrypted connected-service credentials, and access restrictions. No security system eliminates all risk.

Your consumer health data rights

Subject to applicable law, you may request confirmation of collection, access, a list of categories of sources or recipients, correction, deletion (including deletion requests sent to processors where required), withdrawal of consent, or an appeal. Email hello@pocket-ea.app from your account address. Use "Health Data Privacy Appeal" to appeal a denial. We will verify and respond within the legally required period, without unlawful discrimination.

Contact

Alpha Code LLC operates Pocket EA. Questions and requests may be sent to hello@pocket-ea.app.