Last updated: October 13, 2026
This Consumer Health Data Privacy Policy describes how Seylen ("Seylen," "we," "us") collects, uses, and protects consumer health data, and the rights you have over it.
It is provided specifically to satisfy the Washington My Health My Data Act (RCW 19.373) ("MHMDA"), which requires a regulated entity to maintain and prominently publish a separate consumer-health-data privacy policy, distinct from a general privacy policy. It also serves consumers in other states with consumer-health-data protections (for example, Nevada SB370 and Connecticut's health-data amendments), and it reflects the sensitive-data expectations of California's CMIA and CCPA/CPRA.
This policy supplements — it does not replace — our general Privacy Policy. Where a topic is common to all personal data (security architecture, account data, cookies, general contact details), the Privacy Policy governs and this policy cross-references it. See the general Privacy Policy at https://seylenapp.com/privacy. If any term of this policy conflicts with the general Privacy Policy specifically as applied to consumer health data, this policy controls.
What Seylen is. Seylen is a direct-to-consumer, non-clinical emotional-support and general-wellness app for adults (18+). It is not a healthcare provider, is not a HIPAA covered entity or business associate, and does not diagnose, treat, or provide therapy or crisis services. Because the app helps you reflect on stress and daily wellbeing, some of the information you share can reveal your mental or emotional state — which brings it within the broad MHMDA definition of "consumer health data." That is why this policy exists.
Definition we use. Under MHMDA, "consumer health data" means personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status — expressly including data that could reveal a mental-health condition or the seeking of mental-health services. We treat the categories in Section 2 as consumer health data and apply this policy to them.
We collect only the health-adjacent information needed to provide the reflective, memory-based support you ask us for. Specifically:
| Category | What it is |
|---|---|
| Conversation content | The full text of your chat messages with Seylen. Because you may write about how you feel, what you are struggling with, relationships, or your mental/emotional state, this content can reveal health information. This is the most sensitive category. |
| Mood check-ins | When you log a mood, we store one of five qualitative labels you select: lovely, good, okay, low, heavy, with a timestamp. This is a self-reported label you choose — it is not an AI-inferred score, and no numeric mental-health "score" is calculated or assigned to you. |
| AI-derived memories | Short facts or events our AI extracts from your own conversations (for example, that you mentioned an upcoming event or an ongoing worry), so Seylen can remember and follow up. |
| AI-derived topics / life themes | Evolving summaries of recurring themes you navigate, used to resurface relevant support over time. |
| Profile summary | A running narrative our AI maintains about you and your wellbeing to keep support continuous and personalized. |
| Care preferences & communication style | How you have told us (at onboarding or in chat) you want to be supported and spoken to. |
| Self-description | Self-descriptor selections you choose at onboarding. |
| People you mention | Names and relationship notes for people you bring up, so context stays coherent. This may include limited third-party information you choose to share. |
| Safety-relevant notes | Free-text notes relevant to your safety and wellbeing, derived from what you share. |
We do not collect biometric health data, precise health-facility location, genetic data, prescription or diagnosis records, or data from any wearable, health app, or medical device. Seylen integrates with no health platform (no Apple HealthKit, Google Fit/Health Connect, FHIR/HL7, or any EHR) — the app communicates only with Seylen's own service.
Note on encryption scope: most of the categories above (conversation content, memories, topic summaries, profile summary, care preferences, communication style, self-description, safety notes, people you mention) are encrypted at rest at the field level. Your mood labels and topic labels are stored without field-level encryption today; see Section 11 and .
We collect consumer health data in only two ways, and both begin with you:
We do NOT collect consumer health data from third parties. We do not buy, license, or receive your health data from data brokers, advertising networks, social platforms, other apps, public records, or any external source. The only sources of your consumer health data are you and the AI-derived inferences drawn from what you told us.
Age. Seylen is for adults 18 and older. During onboarding you affirm you are at least 18; we record this attestation. We do not collect a date of birth or otherwise verify age (), and we do not knowingly collect consumer health data from anyone under 18.
We use your consumer health data only to provide and improve the wellness service you asked for:
We do NOT use consumer health data for:
We do not share or sell your consumer health data to anyone for their own use. There is no sharing feature in the product, and we do not have one planned that would disclose your health data to a recipient.
AI processing is entirely in-house. All AI inference — every response, memory, and summary — is performed by Seylen's own self-hosted AI running on hardware we control. Your conversation content is never sent to any third-party AI provider (no OpenAI, Anthropic, Google, or any external model API). This is the single most important fact about how your health data is handled.
Service providers ("processors"), not recipients. A small number of infrastructure providers help operate the app. They act only on our behalf, under our instructions, and are not permitted to use your data for their own purposes. Under MHMDA these are our processors, not third-party recipients of health data:
| Category of provider | What it handles | Role |
|---|---|---|
| Network delivery and security | Network transit between your device and our servers; edge/DDoS protection; your connecting IP address. Your connection is encrypted between your device and this provider, and again between the provider and our servers. As is standard for services of this kind, the provider terminates the encrypted connection at its own network edge in order to route and protect the traffic, so it is technically able to process it at that point. It acts only on our instructions and may not use your information for its own purposes. | Secure network transit |
| Push notification delivery | If you enable notifications: your device push token and the title and body text of a notification. Notification text is generated by our own AI and may reference something you logged (for example, "How did your meeting go?"), so limited contextual content transits this pipeline to reach your device. | Notification delivery |
| Email delivery | Your email address and the content of account, billing and onboarding emails. No conversation content, memory, topic or mood data is placed in any email — verified against every template in the codebase. What this pipeline reveals is the fact that you hold a Seylen account, which is itself sensitive given what the app is. | Email delivery |
We disclose the notification pipeline candidly because notification copy can contain contextual references; see. You can disable notifications at any time to stop this.
Payment processing. If you subscribe to a paid plan, a payment processor handles the payment. It receives your email address, a customer identifier it holds, and your subscription status, plan and renewal dates. Card details go directly to the processor on a page it hosts; we never receive or store your full card number. The processor does not receive your consumer health data — billing is entirely separate from your conversations, memories, mood entries and wellbeing data.
The specific companies. We maintain a current list of the named providers in each category above and will provide it on request — write to [email protected].
Consent-log reality. Because no sharing occurs, our internal consent ledger records "share" consent as a permanent never-granted (false) state — we never ask you to consent to sharing, because we never share. If we ever introduced any feature that would share consumer health data, we would first obtain your separate, affirmative opt-in consent as MHMDA requires, and update this policy before any such sharing began.
Legal exceptions. We may disclose data if required by a valid legal process (such as a court order) or to protect against imminent harm. Any such disclosure would be limited to what is legally required.
For clarity, MHMDA asks us to state the sources of consumer health data and the purposes of collection:
MHMDA gives you specific rights over your consumer health data. Below is each right and — candidly — whether the mechanism is fully built today. Where a right currently requires manual handling or is partial, we say so and are building toward self-service.
| Right | What it means | Status today |
|---|---|---|
| Right to confirm / access | Confirm whether we are collecting, sharing, or selling your consumer health data, and access that data. | Partial. In-app you can view what Seylen remembers (your memories, topics, and personalization). A full machine-readable download/export is not yet available (). We can confirm on request that we do not share or sell your data. |
| Right to delete | Have your consumer health data deleted. | Implemented. You can delete your account in-app, which permanently deletes your conversations, memories, topics, mood entries, profile, and related data in a single operation. You can also delete individual memories and topics. See Section 9 on two legally-retained ledgers. |
| Right to withdraw consent | Withdraw consent to the collection (and, where applicable, sharing) of consumer health data. | Partial. You can withdraw consent by deleting your account, which stops all collection and removes stored data. A standalone in-app toggle to withdraw collection consent without deleting your account is not yet built (). Sharing consent is moot — we never share. |
| Right against discrimination | Not be discriminated against for exercising these rights. | Honored. We will not deny service, charge a different price, or degrade your experience for exercising a right (except that deleting your data necessarily ends the personalized service that depends on it). |
Related rights we honor as a matter of practice: you can correct your personalization and delete individual AI-derived memories; a general "correct this specific AI inference about me" flow is not yet built (). We do not sell or share, so an opt-out-of-sale / Global Privacy Control mechanism is not yet implemented and is presently moot ().
How to make a request. Use the in-app controls where available (Delete Account; the memory viewer), or contact us at [email protected]. We will verify your request against your account and respond within the timeframe MHMDA requires (45 days, extendable once by an additional 45 days where reasonably necessary, with notice). If we deny a request, we will explain why and how to appeal.
) and standalone consent-withdrawal () mechanisms are either built or that the manual/account-deletion fallback is legally sufficient at launch.]`
Collection consent (opt-in). MHMDA requires opt-in consent to collect consumer health data, except where collection is necessary to provide a product or service the consumer requested. Storing and using your conversations, memories, and preferences is the service you request from Seylen — a memory-based support app cannot work otherwise. We nonetheless ask for your explicit opt-in rather than rely on that exception. At onboarding you are asked to tick a box reading "I agree to let Seylen store my conversations so it can support me over time," and you cannot continue without it. We log your consent, with a policy version and timestamp, in an append-only consent record.
Sharing consent (separate opt-in). MHMDA requires a separate opt-in consent to share consumer health data. We do not share consumer health data, so we do not ask for — and you never grant — sharing consent. If we ever introduced sharing, we would obtain separate, unbundled, affirmative opt-in consent before any sharing occurred.
Unbundled and revocable. Consent for collection, sharing, and age attestation are recorded as separate items — never bundled together or with the Terms of Service. You may withdraw consent as described in Section 6.
Seylen does not sell your consumer health data. MHMDA prohibits selling consumer health data without a valid, signed authorization that meets its specific requirements. We do not sell such data under any definition, we do not seek any such authorization, and we have no business model that depends on selling data. We also do not exchange consumer health data for any advertising, analytics, or monetary or other valuable consideration.
Seylen does not use geofencing. MHMDA prohibits implementing a geofence around any facility that provides in-person healthcare in order to identify, track, collect data from, or send messages to consumers about their health data. We do not build geofences, we do not collect precise device location for this or any purpose, and we do not target you based on proximity to any health facility.
Security. We protect consumer health data with administrative, physical, and technical safeguards. Although we are not a HIPAA covered entity, we apply administrative, physical, and technical safeguards aligned with the HIPAA Security Rule's standards. Controls include field-level encryption at rest for the sensitive categories listed in Section 1, encryption in transit (TLS/HTTPS/WSS), password hashing, short-lived session tokens, rate limiting, an append-only audit log, restricted administrative access, and optional biometric app-lock on your device. Full detail — and its current limitations — is in our general Privacy Policy (https://seylenapp.com/privacy). Known gaps we are candid about include host/volume encryption not yet enabled (), single-key management without a KMS/HSM (), and the plaintext fields noted in Section 1 (). No system is perfectly secure, and we cannot guarantee absolute security.
Retention. Today, we retain your consumer health data until you delete it (by deleting an individual item or your account). The one exception: notes about upcoming plans, like an appointment or a trip, are cleared automatically a few weeks after they're over; anything lasting stays in your profile until you delete it.
Two ledgers survive account deletion, by design. Deleting your account removes your health content, but two minimal, non-health legal-evidence records are retained: an append-only consent log (proof of the consents you gave, with your account no longer linkable to health data) and an audit log with your identifier removed (user_id nulled). These contain no conversation or health content.
Effective date: October 5, 2026.
Changes. If we materially change how we handle consumer health data, we will update this policy, change the effective date, and — for material changes — provide notice in the app before the change takes effect. We will not use previously collected consumer health data for materially new purposes without obtaining any consent MHMDA requires.
Policy version: aligned to the in-app consent policy version (currently 2026-10-01).
Legal entity: Harmonia LLC, a South Carolina limited liability company, 6650 Rivers Ave, STE 100, Charleston, SC 29406, United States — operator of the Seylen app.
Contact / to exercise your rights: [email protected]. Washington residents may also contact the Washington State Attorney General's Office regarding MHMDA.
Canonical location of this policy: https://seylenapp.com/consumer-health-data. This URL must be prominently and separately linked wherever the general Privacy Policy is linked (app, website, and app-store listings).
This Consumer Health Data Privacy Policy supplements the general Privacy Policy at https://seylenapp.com/privacy.
This policy is published at https://seylenapp.com/consumer-health-data.