Consumer Health Data Privacy Policy

This policy explains how Theia handles "consumer health data" as defined by Washington’s My Health My Data Act (RCW 19.373) and Nevada’s consumer health data law (NRS Chapter 603A), and similar health information protected by other state laws. It adds to our Privacy Policy, which uses the same terms ("Theia", "we", "you", "Service", "Connected Accounts", "Family Members", "Family" and "Family Adults") and describes our other practices.

Theia is a general family assistant. It is not a health care provider, a medical records service or a health app. But because Theia works with the emails, messages, calendars and files you connect or send, it can collect health information about you and your Family Members.

The short versionLink to this section: The short version

Theia uses health information only to provide the features you ask for, such as cards, reminders, summaries and answers, and to fix problems, keep Theia secure and comply with the law.
We never sell health information, share it with advertisers or use it to train AI. When we say we "process" it, we mean we use it only to run Theia for you.
We share it only with the service providers that run Theia for us, with your Family Adults in a family you create or join, with people you direct Theia to contact, when the law requires, or as part of a business transfer, as described below.
You can ask to see it, get a list of everyone we shared it with, withdraw your consent, and have it deleted. Email support@asktheia.com.

Who we areLink to this section: Who we are

Theia is provided by Secure Data Solutions LLC, a Wyoming limited liability company.

Secure Data Solutions LLC

San Francisco, California

Mailing address: 30 N Gould St #66905, Sheridan, WY 82801, USA

Health data and other privacy requests: support@asktheia.com
Legal notices: legal@asktheia.com
General questions: contact@asktheia.com

We have no affiliates that receive consumer health data.

Consumer health data we collectLink to this section: Consumer health data we collect

Depending on what you connect or send, Theia may collect:

Health details in your content: appointments with doctors, dentists, therapists and other providers; names and addresses of clinics and providers; conditions, symptoms, allergies and injuries; medicines and prescriptions; vaccinations; test results; school health, sports and medical forms; and bills or insurance details for care. This can be about you, your children and other people who appear in your emails and messages.
Health details you tell Theia directly, for example "remind me to give Leo his inhaler at 8", or the allergies, medicines, doctor or insurance details you give Theia to fill a form.
Forms Theia fills for you, such as a camp health form or a medication authorization, and the filled copies it saves in your files.
What Theia creates from them, such as cards, reminders, summaries and answers that mention health, and which child an appointment is for.
Voice recordings that mention health, if you use voice features.

Theia doesn’t collect your device’s precise location, and it doesn’t use location to identify visits to health care facilities.

We don’t let advertising networks, analytics companies or other third parties collect consumer health data about you over time or across different websites or online services through Theia.

Where it comes fromLink to this section: Where it comes from

You, when you type, text, say or upload something to Theia.
Your Connected Accounts: Gmail, Google Calendar and the WhatsApp chats you choose.
People who send you emails or messages, and people who text Theia.

How we use itLink to this section: How we use it

We use consumer health data only to:

provide the features you ask for, such as cards, reminders, daily and weekly summaries, answers and search;
if you create or join a family, show your family items, including health items about your children, to your Family Adults, and let them ask Theia about those items;
deliver reminders to you, including reminders your Family Adults set for you, and to people you ask Theia to remind;
investigate and fix problems, and keep Theia secure;
comply with the law.

We don’t use it for advertising, we don’t sell it, and we don’t use it to train AI models.

You give your consent to Theia collecting and processing consumer health data when you create your account and agree to this policy and our Privacy Policy, and each time you connect an account, upload a file or send Theia a message. Processing means using the information to run Theia for you: to store, read, organize and act on it for the features you ask for. It never includes selling it, sharing it with advertisers or using it to train AI models.

When you invite someone to a family or tap Join, you consent to Theia sharing the consumer health data in your family items with that family’s adults, as described in Who we share it with. When you share or assign one of your items, or turn on "Share my personal items too", you consent to Theia sharing the consumer health data in those items with the people who can then see them. Before you join, Theia shows you what the family will see and what stays yours.

We share consumer health data only with our service providers, with your Family Adults, with people you direct Theia to contact, through the networks that carry your messages, when the law requires it, and in a business transfer, as described below. We don’t share it with anyone else without your separate consent.

You can withdraw your consent at any time by emailing support@asktheia.com. Because Theia can’t separate health information from the rest of an email or message, withdrawing consent means we disconnect your Connected Accounts and stop collecting new content from them. If you ask, we will also delete the consumer health data we hold, as described below. To withdraw your consent to sharing in a family, leave the family (or, as its owner, end it), set the items to Only you, or turn off "Share my personal items too". This deletes nothing, and your Family Adults keep what they already received, such as delivered reminders and summary emails, events they added to their own calendars, files they downloaded and earlier answers in their chats with Theia.

Service providers that process it for us to provide Theia:

AI providers: Vercel (AI gateway), Google (Gemini models), Anthropic (Claude models), Voyage AI (search) and ElevenLabs (speech);
hosting, database and storage providers: Google Cloud, Supabase (on Amazon Web Services) and Cloudflare;
texting, calling and email providers: Linq, Twilio and Resend;
our web search provider, Serper, which receives only search words and no account details;
Google, which hosts the mailbox that receives emails you send to our @asktheia.com addresses.

The Privacy Policy lists what each of them receives and how long they keep it. Our AI model providers may not use your information to train AI models, and model training is turned off in our accounts with our AI gateway and speech providers.

The standard terms of a few of these providers also give them some rights of their own, which the Privacy Policy describes in "Some providers keep rights of their own":

Vercel may use request content to support and improve its AI products, and ElevenLabs may use content to improve its services.
Reminder calls go through Twilio, and the audio of a reminder call contains the reminder’s words, which can include health details. Twilio’s terms let it use call content and call data for its own purposes, to prevent fraud and abuse (including training related models) and to develop and improve its products and services, and to use data it has de-identified or aggregated for any purpose.
Serper has not agreed with us to limit how it uses the search words it receives. Google handles emails you send to our @asktheia.com addresses under its consumer Gmail terms, not a business agreement that limits Google to acting for us.

Your Family Adults. If you create or join a family through Theia’s Family feature, health items about a child on the family’s children list, such as appointments, medicines and school health forms, and health information in other family emails and messages that aren’t about you or a child on your own children list, such as a class health notice, are family items. Every adult in the family sees them, with the whole emails and attachments behind them, and can download those attachments, get the items in their summary emails, add them to their own calendars and ask Theia about them. When they ask, Theia sends the item and the emails and attachments behind it to our AI providers to answer. Health items about you are personal: your Family Adults see them only if you share them or turn on "Share my personal items too". The Privacy Policy describes Family in full.

People you direct Theia to contact. For example, if you ask Theia to remind someone to give a child medicine, that person receives your display name and the words of the reminder. This includes a Family Adult you set a reminder for, and a child whose phone number a parent in your family linked. Events you ask Theia to add go to your Google Calendar. The health answers on a form Theia fills go only where you send that form: into the filled file you download, the pre-filled Google Form you open (Google receives the answers when the form opens), or the website form Theia fills for you to check and submit yourself.

Networks that carry messages. Reminder texts and Theia’s replies pass through mobile carriers and, for iMessage, Apple, under their own terms.

When the law requires it, such as a valid court order, or when we believe in good faith that it is necessary to prevent imminent physical harm.

Business transfers. If Secure Data Solutions is involved in a merger, acquisition or sale of assets, consumer health data may be transferred as part of that deal, and whoever receives it must keep the promises in this policy.

We do not sell consumer health data. We will never sell it without your valid, signed authorization as the law requires.

How long we keep itLink to this section: How long we keep it

Consumer health data is part of your content. We keep it until you ask us to delete it or you delete the item it is in, because Theia is meant to remember things for you. Disconnecting an account stops new collection but doesn’t delete what Theia already saved. When you delete something in Theia, it is deleted right away. Leaving or ending a family deletes nothing: your Family Adults stop seeing your items, but what they already received can’t be recalled. Theia doesn’t chat with children and doesn’t store messages a child sends to it. Our service providers keep some information for their own periods, as the Privacy Policy describes.

Your rightsLink to this section: Your rights

You have the right to:

confirm whether we collect, share or sell your consumer health data;
access it, including a list of every third party and affiliate we have shared it with or sold it to, with their email address or other online contact (we have not sold it, and we have no affiliates). For sharing in a family, the list names the Family Adults of each family it was shared with;
withdraw your consent to our collecting and sharing it;
delete it. We delete it from our systems within 7 days after we confirm your request, remove it from any backup copies within 30 days, and tell our service providers to delete it too. This doesn’t reach earlier answers Theia gave your Family Adults in their chats with Theia, which can quote it and stay in their accounts. Your Family Adults otherwise stop seeing it, but copies already delivered to them, such as texts, emails and summary emails, events they added to their own calendars and files they downloaded, can’t be recalled.

How to make a request. Email support@asktheia.com from the email address on your Theia account, with "Health data request" in the subject. We will confirm the request comes from you, for example by asking you to reply from that address or to confirm a code sent to your linked phone number. Someone you authorize can make a request for you with your signed permission. A parent can make requests about their child’s information.

If you don’t have a Theia account but believe Theia holds health information about you, for example in a Theia user’s email, email support@asktheia.com with "Health data request" in the subject. We will ask for enough information to find it and to confirm who you are.

When we’ll respond. We respond within 45 days. If we need more time, we will tell you why, and we may take up to 45 more days. Requests are free. We may decline a request, or charge a reasonable fee, only if it is clearly unfounded, excessive or repetitive, and we will tell you why. We never charge for your first two requests in any 12 months.

Appeals. If we refuse your request, you can appeal by replying to our decision or by emailing support@asktheia.com with the subject "Health data appeal". We will respond in writing within 45 days and explain what we did and why. If we deny your appeal, you can contact your state attorney general. Washington residents can file a complaint at https://www.atg.wa.gov/file-complaint (opens in a new tab).

We won’t treat you differently for using these rights.

SecurityLink to this section: Security

We protect consumer health data with the safeguards described in the "How we protect information" section of our Privacy Policy. Only a small number of authorized people at Secure Data Solutions can access it. They do so only when needed to help you when you ask, to investigate and fix a problem or security issue, or to comply with the law.

Changes to this policyLink to this section: Changes to this policy

If we change this policy in a material way, we will tell you by email and in Theia at least 30 days before the change takes effect. We won’t use consumer health data we already collected in a materially different way without your consent.

Contact usLink to this section: Contact us

Email support@asktheia.com, or write to Secure Data Solutions LLC, San Francisco, California; mailing address: 30 N Gould St #66905, Sheridan, WY 82801, USA.

Theia Consumer Health Data Privacy Policy