ALANNA APP LLC · Last updated:

Consumer Health Data Privacy Notice

This Consumer Health Data Privacy Notice supplements the Alanna Privacy Policy and applies to our users in Washington, Nevada, and Connecticut. Connecticut residents are also covered by the broader rights described in our Privacy Policy.

This Notice must be read together with our Privacy Policy. Where this Notice and the Privacy Policy conflict on a topic covered by this Notice, this Notice controls.

What This Notice Covers

This Notice applies to “consumer health data,” meaning personal information that identifies your past, present, or future physical or mental health status, as defined by applicable law.

Consumer health data does not include protected health information subject to HIPAA, publicly available information, or deidentified information.

Categories of Consumer Health Data We Collect

Information about your mental or emotional health status or experiences, including mood, stress, grief, guilt, anger, overwhelm, and other emotional states you share with Alanna
Information about the health conditions of the person you care for, to the extent you share it
Information identifying your caregiving situation, including the nature of the illness, disability, or condition involved
Information about your well-being, coping strategies, sleep, energy, and daily functioning
Inferences about your emotional patterns and caregiving situation generated by our AI systems, which we call memory notes
Information that identifies your intention to seek health care services, mental health support, or crisis intervention
Crisis detection records — the category of detection, whether crisis resources were shown to you, and the time, not the content of your message
Safety disclosure flags, in the narrow circumstances described in our Privacy Policy under “Automated Safety Systems,” which may include a short excerpt of the relevant message

Categories of Sources

Provided directly by you when you use Alanna, including during conversations with the chatbot, in journal entries, and in Alanna Allies posts
Generated by our AI systems as inferences from your conversations
Generated by our automated safety systems

Purposes for Collecting, Using, and Sharing Consumer Health Data

To provide the Services, including generating personalized AI responses and maintaining context across conversations through memory notes
To operate our crisis detection and safety systems
To identify a narrow set of explicit disclosures of serious harm to a child or vulnerable adult, and to meet reporting obligations that apply under state and federal law
To provide customer support when you contact us
To operate our business, including improving the Services, maintaining security, and detecting fraud
To meet our legal obligations
For other purposes only with your separate, specific consent

We do not collect, use, or share consumer health data for advertising, retargeting, or marketing purposes.

How Consumer Health Data Is Processed

Your messages are transmitted over an encrypted connection to our servers, then to our AI provider, which generates a response. Data is stored in an encrypted database with row-level access controls so that one account’s data cannot be reached from another.

Automated systems analyze the content of your messages for crisis indicators and for a narrow set of serious safety disclosures. These systems produce a routing decision, not a diagnosis, score, or assessment of you.

In ordinary operation no person reads your conversations. Access by authorized personnel is limited to the narrow circumstances described in our Privacy Policy, requires a recorded written reason, and is permanently logged.

Categories of Consumer Health Data We Share

We share consumer health data only with service providers acting on our behalf, as necessary to provide the Services, maintain security, and comply with law. We share:

Conversation content, with our AI provider, as needed to generate a response
Conversation data, journal data, memory notes, and safety records, with our infrastructure provider, for storage
The minimum data required, with law enforcement or a government agency, only where required by law or to prevent imminent serious harm, or where a mandatory reporting obligation applies

We do not sell consumer health data. We do not share consumer health data with advertising platforms, marketing partners, or data brokers.

Third Parties With Whom We Share Consumer Health Data

You can ask us for the specific list of third parties your consumer health data has gone to, with contact information for each. See “Your Rights” below.

Recipient	Purpose	Data shared
Anthropic	Generate AI responses to your messages	Conversation content necessary to produce a response. Not used to train models.
Supabase	Secure database storage	Conversation data, journal data, memory notes, crisis and safety records
Law enforcement, protective services, or other government agencies	Only where required by law, legal process, a mandatory reporting obligation, or to prevent imminent serious harm	Only the minimum data required

Whether Third Parties Collect Data Over Time and Across Sites

No third party collects consumer health data over time or across different websites or online services when you use Alanna. We do not install advertising SDKs in our mobile applications, and we do not permit third-party tracking of consumer health data on our website.

Your Rights

If you are a resident of Washington, Nevada, or Connecticut, you have the following rights regarding your consumer health data:

Right to know. Confirm whether we collect, share, or sell consumer health data about you, and request information about how we process it.

Right to access. Request a copy of the consumer health data we hold about you.

Right to know who received it. Request a list of all specific third parties and affiliates with whom we have shared your consumer health data, and an active email address or other online mechanism you can use to contact each of them.

Right to review and correct. Review your consumer health data and ask us to correct anything inaccurate. This includes the memory notes our AI systems generate about you.

Right to delete. Request that we delete your consumer health data.

Right to withdraw consent. Withdraw consent to our collection or sharing of your consumer health data at any time. Withdrawal does not affect the lawfulness of processing before withdrawal. Because Alanna cannot function without processing this information, withdrawing consent means we will close your account.

Right to be free from discrimination. We will not discriminate against you for exercising any of these rights.

What Happens When You Delete

When you delete your account or ask us to delete your consumer health data:

We delete it from our active systems within 30 days
We notify every service provider and third party that received it and require them to delete it within 30 days
We delete it from backup and archive systems within six months

Limited records survive: a minimal record that you made the request, payment records we must keep for tax purposes, and any records subject to a legal preservation requirement — including the preservation period that follows a report to a child protection authority.

If you have participated in Alanna Allies, we delete or de-identify the content of any moderation records about you, keeping only the date, category, action taken, and outcome, unless the law requires us to preserve the content.

One thing we cannot do. Our AI provider deletes most data within 30 days, but may retain content its automated safety systems have flagged for up to two years on its own systems. We cannot delete that. We do not receive or review it, and it is never used for advertising.

How to Exercise Your Rights

You can export your data and delete your account directly in Settings. For all other requests, contact us at heyalannaai@gmail.com.

We will respond within 45 calendar days. Where permitted and reasonably necessary, we may extend once by up to an additional 45 days, and we will tell you within the first 45 days if we do, along with the reason.

Requests are free. We will not require you to create an account to exercise a right.

Appeals

If we deny your request, you may appeal by contacting us at heyalannaai@gmail.com with the subject line “Privacy Appeal.” Include your name, the state where you reside, and the request you are appealing.

We will respond in writing within 45 calendar days with our decision and the reasons for it.

If your appeal is unsuccessful, you may file a complaint with your state Attorney General:

How We Notify You of Changes to This Notice

We may update this Notice as our practices or the law evolve. When we do, we will post the updated version here with a new effective date.

If a change materially affects your rights, we will notify you by email and by in-app notice.

If we ever want to collect a new category of consumer health data, or use or share it for a new purpose, we will disclose that and obtain your consent before we begin — not afterward.

If we make a change that affects consumer health data we already collected, we will give you a reasonable opportunity to withdraw your consent to any further processing of that data.

Contact Us

ALANNA APP LLC
13725 Beach Blvd Ste 3
Jacksonville, FL 32224
heyalannaai@gmail.com

Alanna is a general wellness tool. She is not a substitute for clinical care. If you are in crisis, call or text 988.