Consumer Health Data Privacy Policy

This policy is for residents of Washington (My Health My Data Act), Nevada (SB 370) and Connecticut, whose laws give specific rights over “consumer health data”. It sits alongside our Privacy Policy and adds to it — it does not replace it.

We apply everything in this policy to everyone who uses YourMentorDoc, not only to residents of those three states. Splitting our privacy practices by geography would be worse for our members and harder for us to get right.

This policy is published by Your Mentor Doc LLC. Contact: admin@yourmentordoc.com.

1. What counts as consumer health data

Broadly, any information that identifies your past, present or future physical or mental health. On YourMentorDoc that means:

• Diagnosis and disease status — whether you have been diagnosed, the type, estimated stage, and receptor subtype.
• Treatment information — surgery, chemotherapy, radiation, endocrine and targeted therapy you have had or plan to have; medications, doses, and whether you took them.
• Symptoms and bodily functions — symptoms you log, mood, sleep, steps, water intake, protein intake, and free-text or spoken journal entries.
• Post-operative measurements — surgical drain output in millilitres, recorded for each drain you have in place and each time you empty one.
• Vital signs — blood pressure and heart rate, with the time you recorded them.
• Habits you choose to track — the movement and eating trackers you create, including the names you give them, and whether you completed each one on a given day.
• Measurements — age, height, menopausal status, and your weight, which you may record once a day over time.
• Genetic and family-history information — genetic testing results and family history you tell us about.
• Reproductive and fertility information you choose to enter.
• Medical documents you upload — pathology, imaging and laboratory reports, and the plain-language interpretations generated from them.
• Health questions you ask or speak to MentorDoc-AI.
• Appointments and visit notes you record.
• Inferences we draw from the above, such as the educational risk estimates and the personalised summary in your Risk Snapshot.
• Your ZIP code, if you give it — optional, used only to show cancer centres near you. A ZIP code is not precise location information, and it is the only location data we hold.

2. Where it comes from

From you, and only from you. Every piece of health data we hold was typed, spoken, selected or uploaded by you into the Service, or generated by the Service from what you provided.

Voice input. If you use the microphone on chat or your daily check-in journal, the recording is sent to our Google Vertex AI environment (the same one covered by the Business Associate Agreement described in section 4) to be transcribed into text. The audio itself is never saved. Only the resulting text is kept — exactly as if you had typed it, and treated the same way as any other health question or journal entry in this policy.

We do not obtain health data from anyone else. Not from data brokers, not from advertising networks, not from your insurer or employer, not from public records, and not from tracking you on other websites. We do not use third-party analytics, advertising pixels or trackers anywhere in the Service.

If you are not signed in, your Risk Assessment answers stay in your own browser. They are not transmitted to us at all unless you choose to save them to an account.

3. Why we collect it, and what we do with it

• To give you what you asked for — answer your questions, build your Risk Snapshot, keep your check-in history, and store and interpret your reports.
• To personalise educational guidance — a short summary of your answers is given to MentorDoc-AI so its answers fit your situation. You can view, edit or clear that summary at any time on your Risk Snapshot page.
• To keep the Service secure and to investigate misuse.
• To understand in aggregate which features are used, in a form that does not identify you.

We have never sold consumer health data and we will not. Selling it would require your signed authorisation on a form the statute dictates. We do not intend to ask for one. We also do not use health data for advertising, and we do not use it to train artificial intelligence models.

4. Who we share it with

The specific companies below. Washington law entitles you to this list by name, so we publish it rather than making you ask.

Each of these acts as our processor: it may use the data only to perform the service for us, under a written contract, and not for its own purposes.

We may also disclose health data where the law compels it, or to protect someone from serious harm. If we receive a legal demand for your health data we will notify you unless we are legally prohibited from doing so.

If we are ever involved in a merger or sale, health data may transfer to the buyer. We would notify you first, and this policy would continue to apply until replaced by one that is at least as protective.

5. Your rights

You have the right to:

• Confirm whether we collect, share or sell your consumer health data.
• Access it, including a list of all third parties we have shared it with and an active contact for each.
• Withdraw your consent to our collection or sharing of it.
• Delete it — see below for exactly what that means.
• Not be discriminated against for exercising any of these rights.

What deletion actually does

The moment you confirm, your account is closed immediately: your membership is cancelled, you are signed out on every device, and neither you nor anyone else can sign in again. This cannot be undone and there is no way to reactivate the account.

Your health data is then permanently erased from our live systems within 30 days, and from our backups within six months, which are the deadlines Washington law sets. The short gap before erasure is not a cooling-off period you can cancel — it exists only so that we can recover an account that was deleted by someone who had improperly gained access to it. We also notify every processor and third party that received your health data and instruct them to delete their copies.

Exactly three things outlive your account, and none of them contains health data:

• A minimal record that an account existed and was deleted — an identifier and dates. It is what lets us answer “what happened to my data” if you ever contact us again, and what proves the deletion took place.
• Your record of accepting our Terms, kept as evidence of consent.
• Billing and tax records, which are held by our payment processor under its own retention rules, as tax law requires.

Deleting your health data may end your ability to use parts of the Service — not as a penalty, but because your Risk Snapshot and check-in history are the health data. We will tell you what will be lost before you confirm.

How to exercise a right

Much of it is self-service and immediate, from your Account page: export your data, delete all your Risk Assessment data, delete all your wellness data, delete individual check-in days, and delete any uploaded report.

To close your account and delete everything at once, go to Account → Delete my account. You will be asked to type “DELETE” and to re-enter your password — not to make it difficult, but because this is permanent and we will not act on a device someone left unlocked. Your account closes immediately and your health data is erased on the schedule above.

Export anything you want to keep before you confirm. Your uploaded reports are the clearest case: for some people this is the only copy they hold. Once deleted we cannot recover it for you, and we will not be able to make an exception.

If you would rather not use the button, email admin@yourmentordoc.com and we will do it for you, on the same schedule.

For anything else — including the list of third parties, or withdrawing consent — email admin@yourmentordoc.com. We verify your identity using the email address on your account, and we respond within 45 days, which we may extend once by 45 days where the law allows, telling you why.

An authorised agent may act for you if you give them written permission we can verify.

If we say no

You can appeal, free of charge, by emailing admin@yourmentordoc.com with “Appeal” in the subject line. We will respond in writing within 45 days explaining our decision.

If you are still not satisfied you may complain to your state Attorney General: Washington — the Attorney General’s Consumer Protection Division; Nevada and Connecticut — their equivalent offices. Washington residents may also bring a claim directly under the Washington Consumer Protection Act.

6. Consent

We collect health data because you chose to give it to us to get something you asked for — an answer, a report, a place to keep your records. That is the legal basis for collecting it, and we collect nothing beyond what those features need.

We ask for your separate, explicit consent before doing anything with health data beyond providing the Service to you. We are not doing anything of that kind today, and we will not start without asking.

You can withdraw consent at any time by deleting your data or your account from the Account page, or by emailing admin@yourmentordoc.com. Withdrawal is not retroactive: it stops future collection and use, and triggers deletion as described above.

7. Security and where your data lives

Health data is encrypted in transit and at rest, and uploaded documents are encrypted with keys we control and stored in per-user isolation. Our database denies all direct access by default. Access to production systems is limited and audited. Data is stored in the United States. Fuller detail is in section 10 of our Privacy Policy.

We do not maintain any geofence around a healthcare facility, or anywhere else. We never collect location from your device — no GPS, no network-derived location, no tracking of where you go. The only location information we hold is a ZIP code you type in yourself, if you choose to, which we use solely to list nearby cancer centres. You can leave it blank or remove it at any time.

8. Changes to this policy

If we change how we handle consumer health data we will update this page and notify you before the change takes effect. We will not use previously collected health data for a materially new purpose without asking your consent first.

9. Contact

Your Mentor Doc LLC
4907 Sweetwater Drive, Noblesville, IN 46062, USA
Privacy: admin@yourmentordoc.com