Consumer Health Data Policy

NATEX Work, a service of NATEX AI, Inc.
Effective Date: [[OPEN-01]]
Previous versions: /legal/history
Contact: nshulman@natex.ai · NATEX AI, Inc., a Delaware corporation operated from Michigan. Registered office and address for legal notices: 16192 Coastal Highway, Lewes, DE 19958.

This page is part of the Privacy Policy. It covers the health entries that you make about yourself in NATEX Work. The rest of the Privacy Policy applies as well.

Definitions used on this page

Consumer Health Data: Personal Information that identifies a person's past, present or future physical or mental health status, as state consumer health data laws define it, that a person enters about themselves, for example workout, meal, habit or journal entries. It does not include Protected Health Information.

Controller: The party that decides why and how Personal Information is processed. It includes a "business" under US state privacy laws. We are the Controller for Account Data, billing, security, abuse, support and product-operations data. The Customer is the Controller for Content.

Processor: A party that processes Personal Information on a Controller's behalf. It includes a "service provider" or "contractor" under US state privacy laws. We are the Processor for Content.

Protected Health Information or PHI: Individually identifiable health information held or sent by a HIPAA covered entity or business associate. It does not include an individual's own wellness data.

Sell and Share: "Sell" means to disclose Personal Information to another party for money or other valuable consideration. "Share" means to disclose Personal Information to another party for cross-context behavioral advertising. We do neither.

1. What this page covers

1.1 Some states, including Washington and Nevada, ask a business that handles Consumer Health Data to publish a separate policy about it. This is that page. We apply it to everyone in the United States as company policy, wherever you reside, and we make no claim that any one state's law applies to you.

1.2 NATEX Work is not for Protected Health Information. We are not a HIPAA business associate, and we sign no business associate agreements. Do not put the PHI of a covered entity or a business associate into NATEX Work. See Section 19 (Sensitive data) of the Privacy Policy.

2. The health information we handle

2.1 The Consumer Health Data in NATEX Work is what a person enters about themselves: workout entries, meal entries, habit entries and journal entries (including a mood you can choose for each entry), and related items such as fitness goals and photos that the person adds to those modules. We do not collect it any other way. We do not infer health information from other Content.

2.2 NATEX Work has no biometric collection, no precise-location tracking of you by us, and no device that measures your body. Precise device location is a separate opt-in setting that stays in your browser.

3. Why we collect it, and where it comes from

3.1 Source. The person who enters it. We collect nothing from data brokers or other companies. If you make these entries in a Workspace that belongs to someone else, every Member of that Workspace except Guests can read the Workspace's records, and the Workspace's Owner and Admins can also read your AI conversations, so do not enter them there unless you are comfortable with that. See Section 17 (If you use NATEX Work through someone else's Workspace) of the Privacy Policy.

3.2 Purpose. We store the entries to give the feature to the person who made them: to show, search, remind, export and delete them. If you ask an AI Feature to use an entry, text from it goes to a Model Host for that request, as Section 6 (AI Features and your information) of the Privacy Policy describes. We use the entries for no other purpose. We do not use them for advertising, we do not Sell or Share them, and we do not train AI models on them. We do not use a geofence around any health facility.

3.3 AI exclusions. Health collections are excluded from AI Features by default: the collections for workouts, meals, habits, journal entries, progress photos and insurance claim follow-ups start excluded in a new Workspace, and any other collection whose name suggests health information is excluded when it is first used. You can turn AI Features back on for a collection in the Privacy Center module after you confirm a warning, and you can mark any collection as health data to exclude it.

3.4 Consent. By adding a health entry you ask us to collect and store it to give you the feature. You can withdraw that consent at any time, as paragraph 5.2 says.

4.1 We share Consumer Health Data only with our Processors and Sub-processors that help us provide the feature: hosting (Supabase and Cloudflare, including Backups), and, when you use an AI Feature on an entry, OpenRouter and the Model Hosts. Section 8 (Sub-processor List) of the Privacy Policy names them. We share it with no one else, except as the law requires and as Section 25 (Government requests, safety reports and copyright) describes. We do not Sell it. Every Member of the Workspace except Guests can read it if you enter it in their Workspace.

4.2 You can ask each recipient about its own handling at its own contact page: Supabase, Cloudflare, OpenRouter, Microsoft, Google, Amazon Web Services, Groq (privacy@groq.com), Deep Infra (policy@deepinfra.com) and Parasail. TypeSafe AI publishes no privacy contact that we found; write to us and we will pass your question on.

5. Your rights

5.1 You can:

access your Consumer Health Data, with a list of the companies listed in Section 4 that receive it;
delete it;
withdraw your consent to our handling of it at any time;
appeal if we refuse a request.

5.2 How. In NATEX Work, delete an entry or a collection, or use "Download my data" (Settings > Account > Download my data) and "Delete my account" (Settings > Account > Delete my account). You can also send a request with the form at /legal/privacy-request or in Settings > Account > Privacy requests. Deleting entries, switching off AI use for a collection or deleting your Account withdraws your consent. For anything else, email nshulman@natex.ai. Timing, verification and the appeal follow Section 26 (Your privacy rights) of the Privacy Policy.

5.3 A deleted entry stays recoverable for the 30-day Trash Window and then is erased. A copy in a Backup is gone within 60 days. Supabase and Cloudflare hold it only in the database and in Backups. The Model Hosts keep no copy beyond serving the request, apart from the exceptions in Section 6 (AI Features and your information) of the Privacy Policy. Section 23 (Retention Schedule and deletion) of the Privacy Policy has the details.

5.4 If we refuse your appeal, we will tell you why and how to contact the Washington Attorney General to file a complaint.

6. Contact and changes

6.1 Questions and requests: nshulman@natex.ai, or NATEX AI, Inc., a Delaware corporation operated from Michigan. Registered office and address for legal notices: 16192 Coastal Highway, Lewes, DE 19958.

6.2 We change this page in the same way, and with the same notice, as the Privacy Policy. See Section 29 (Changes to this Privacy Policy). The Effective Date is at the top.