Consumer Health Data Privacy Policy
This policy explains how Studio Korvi inc. ("we," "us," "our") collects, uses and shares consumer health data through the HolaTheo mobile application (the "App"). It applies to you if you live in Washington, Nevada or Connecticut, or if we collect your information while you are in Washington, and we follow it for everyone who uses the App. It adds to our Privacy Policy, which covers everything else we collect.
1. The health data we collect
- What you write or say, when it reveals your health. Your practice conversations, texts, coach chat, Prep, drill and mission answers, and quiz answers can reveal how you feel, your physical or mental health, or your sexual orientation. We don't ask for this, but we receive whatever you choose to share.
- The crisis check's findings. Every message you send is checked, by a fixed word list and an AI safety classifier, for signs that you may be in crisis (such as thoughts of suicide or self-harm, an eating disorder, acute distress or someone threatening to hurt you) or may want to physically hurt someone. A finding is an inference about your mental health.
- The safety records the check leaves. When a conversation or answer ends for safety, a note of that reason; when the check finds signs that you may be at risk yourself (or of a crisis where it can't tell who is at risk), a note of which feature and when; when it finds a possible threat to hurt someone, a note of which feature and when, and a blocked-message record. Never the words you wrote.
- The "Voice confidence" recording. In this exercise, a short recording of your spoken answer is uploaded to our server, measured for pace, volume and pitch, then deleted immediately. We don't create a voiceprint or anything else that identifies you from your voice. The recording never goes to our AI provider; the measurements taken from it (such as pace, volume, pitch and pauses) do, with the text of your answer, to write your coaching.
- The age-check selfie, only if we ask you to confirm your age. If something you write suggests you may be under 18, or, in the United States, your app store hasn't told us you're 18 or over, we may ask you to take a selfie on the website of our age-check provider, Didit, which estimates your age from it (or, if the estimate isn't clear, checks a photo of an ID document). A scan of your face is biometric data. We never store the photo: Didit's message to our server carries the result and the check's details (such as the age it estimated, links to the photos, or what an ID shows), and we read only the result; we keep only whether you passed and when, and your consent to the check.
- Your health-data consent. Whether you gave it, the version you agreed to, and when you gave or withdrew it.
2. Why we collect it
- To provide the practice and coaching you ask for: the characters' replies, your feedback and your coaching.
- To keep you safe: the crisis check, the crisis services the App shows you, and the "talk to someone now" page if signs of a crisis come back within 30 days (see our Safety page).
- To confirm you're 18 or over, only if we ask you to: the age-check selfie (Section 1).
- To enforce our Terms of Service and to meet our legal duties.
We never use it for advertising, and we never sell it.
3. Where it comes from
From you (what you write or say, and your recording) and from our own safety checks (what they find in what you wrote). If we ask you to confirm your age, the selfie (or ID document) comes from you too, given on the website of our age-check provider, Didit, which sends us the result (with the check's details, which we never store or open). Apart from that, we don't get health data about you from anyone else.
4. Who receives it
- Anthropic, our AI provider, receives the text of your conversations and answers, and the measurements taken from a Voice confidence recording, to write the replies and your coaching and to run the safety checks. It may not use it to train its models, and it deletes it within 30 days under its own terms, unless the law requires longer or its own safety systems flag it (Section 5 of the Privacy Policy).
- Render, our hosting provider, stores it for us.
- Didit, our age-check provider, receives the selfie (or ID document) of an age check only after you agree to it, uses it only to check your age, and deletes it as soon as the check ends at our request.
- Inworld, our voice provider, receives only the lines the characters and the coach speak aloud, which can repeat something you said.
Each one processes it only to provide the App, under its contract with us. We share it with no one else, except where the law requires it, and no affiliate of ours receives it.
5. Your consent
Before the App's AI features start, we ask, as its own step on the screen that tells you everyone in the App is AI, for your consent to the collection and sharing this policy describes. You can withdraw it at any time in the App: Profile → Health data consent. The AI features can't run without it, so conversations, coaching and the other AI features then stop, and nothing new is sent to our AI provider, until you give it again. Your history stays available.
The age check has its own consent. Before the selfie, a separate screen in the App names Didit, says what the photo is for and that it is deleted right after the check, and links to this policy; nothing starts until you tap to agree. If you don't agree, no photo is taken, and you can ask a person on our team to review your account instead (Contact support in Profile).
6. Your rights
You can ask us:
- to confirm whether we collect or share your health data, to give you a copy of it, and to list the third parties we shared it with;
- to delete it: we delete it from our systems and pass your request on to the providers above that hold it. Deleting your account (Profile → Delete account) does the same for everything in it;
- to stop collecting it, by withdrawing your consent (Section 5).
Write to contact@holatheo.com. We may ask you to confirm the request comes from your account, and we answer within 30 days. Using these rights never costs you anything or changes how we treat you. If we decline a request, you can appeal: reply to our answer, or write to us with "Appeal" in the subject. We answer an appeal in writing within 45 days, saying what we did and why; if we deny it, our answer tells you how to complain to your state's Attorney General.
7. How long we keep it
As Section 5 of our Privacy Policy sets out: what you write stays with your history for the life of your account (a prepared moment, 30 days); the safety records, 365 days (the reason a conversation ended, as long as that conversation); the recording, not at all (the delivery notes drawn from its measurements, such as "Shaky" or "Monotone", stay with your practice history). The age-check selfie or ID document is never kept by us: Didit deletes it as soon as the check ends (anything left, by its own retention, set to its shortest: one month), and we keep only whether you passed, when, and your consent to the check, for the life of your account. Everything is deleted with your account.
8. Contact
Studio Korvi inc. · contact@holatheo.com