Consumer Health Data Privacy Notice

This Consumer Health Data Privacy Notice ("CHD Notice") is a separate notice required by the Washington My Health My Data Act (RCW 19.373, "MHMDA"), Nevada SB 370 (NRS 603A.400 et seq.), and the Connecticut Data Privacy Act as amended by SB 1295 (effective July 1, 2026). It supplements, and does not replace, our Privacy Policy.

This Notice is linked directly from the footer of ophie.app, adjacent to — and distinct from — our Privacy Policy link, consistent with Washington Attorney General guidance.

• Residents of Washington, regardless of the residence we have on file.
• Consumers physically located in Washington when interacting with the Service.
• Residents of Nevada.
• Residents of Connecticut, for processing on or after July 1, 2026.

MHMDA defines "consumer health data" broadly. For users covered by this Notice, Ophie treats the following as consumer health data:

• voice audio (transient) and the text transcript derived from it;
• message content of your conversations with Ophie;
• memories and topics derived from your sessions;
• emotional snapshots, sentiment, valence/arousal, and wellness trajectory inferences;
• speech-emotion-recognition outputs (when persisted);
• crisis-detection signals (category, confidence, action taken);
• the fact of use (that you use Ophie) and derived usage facts (frequency, duration, topical focus).

We do not process CHD for targeted advertising, for sale, for training any AI model, or for profiling with significant effects.

MHMDA requires named disclosure. The following is the complete list as of the date above:

• Supabase, Inc. — managed Postgres database, authentication, file storage, and auth-flow email (account confirmation, password reset) (US).
• LiveKit Incorporated — real-time WebRTC voice transport and LiveKit Cloud hosting of our voice agent runtime (US).
• Deepgram, Inc. — speech-to-text transcription; last-resort text-to-speech fallback (US).
• Hume AI, Inc. — text-to-speech voice synthesis (Octave 2) — the default voice (US).
• Theai, Inc. (d/b/a Inworld AI) — text-to-speech voice synthesis (fallback when the default provider fails) (US).
• Cartesia AI, Inc. — text-to-speech and speech-to-text (selectable alternate; not selected in production) (US).
• DeepInfra, Inc. — primary inference provider for our conversational LLM (an open-weight Tencent Hy3 model) — generates the AI response (US).
• SILICONFLOW TECHNOLOGY PTE. LTD. — last-resort failover inference provider for the conversational LLM — serves the same model as the primary, and receives data only when both the primary and the first failover provider fail (Singapore).
• Weights and Biases, LLC (W&B Inference) — former primary inference provider for the conversational LLM (an open-weight Qwen 3 model); the integration and credentials remain but no production code path selects it (US).
• Together Computer, Inc. (Together AI) — former failover inference provider for the conversational LLM; the integration and credentials remain but no production code path selects it (North America).
• Groq, Inc. — inference for our crisis-detection safety classifier (the open-weight GPT-OSS-Safeguard 20B model), for background reasoning and sentiment models, and — as the first failover leg — for the conversational LLM itself when the primary provider fails (US).
• OpenAI OpCo, LLC — legacy/failover conversational-LLM path and optional batch speech-to-text (Whisper); neither is enabled in production (US).
• Voyage AI Innovations, Inc. (a MongoDB, Inc. company) — text-embedding and reranking models used for memory retrieval (US).
• Pinecone Systems, Inc. — managed vector database for memory retrieval (RAG) (US).
• Amazon Web Services, Inc. (AWS Key Management Service) — key management for our application-layer envelope encryption (US).
• Render Services, Inc. — backend API hosting (US).
• Netlify, Inc. — frontend application hosting and CDN (US).
• Functional Software, Inc. (d/b/a Sentry) — error monitoring and performance telemetry (backend and client apps) (US).
• PostHog, Inc. — product analytics — only if you opt in; the default is off (US).
• Stripe, Inc. — payment processing and subscription billing (not enabled during beta) (US).
• Plus Five Five, Inc. (d/b/a Resend) — transactional email delivery (verification codes, receipts, policy notices) (US).

Ophie has no affiliates receiving CHD at the date above. We do not sell CHD to any person or entity.

Before we collect, process, or share CHD beyond what is strictly necessary to provide the Service you have specifically requested, we obtain your affirmative, opt-in consent. That consent is freely given, specific, informed, unambiguous, and revocable at any time through Privacy Controls or by emailing health-team@ophie.app.

We separately obtain written authorization if we ever intend to sell CHD, in the form required by RCW 19.373.060. We do not currently sell CHD and have no plans to do so.

• Confirm whether we are processing your CHD.
• Access the specific CHD we hold.
• Access the list of third parties that have received your CHD, by name.
• Delete your CHD, with propagation to our processors and downstream recipients.
• Withdraw consent to further processing.

Response timing: 45 days, extendable once by 45 days when reasonably necessary. Appeal on denial; you may also complain to the Washington, Nevada, or Connecticut AG as applicable.

Submit requests at health-team@ophie.app or via in-product Privacy Controls.

We do not use geofences to identify, track, target, collect data from, or send notifications or ads to consumers in relation to their CHD. We do not operate a geofence around any in-person healthcare facility.

We protect CHD with the safeguards described in Section 10 of the Privacy Policy: transport and at-rest encryption; Postgres row-level security; scoped access; vendor due diligence; incident-response procedures. Production access to CHD is restricted and logged.

In the event of unauthorized access, acquisition, or disclosure of CHD, we will notify affected users and regulators per the FTC Health Breach Notification Rule, MHMDA, Nevada breach law, and Connecticut breach law.

Washington MHMDA is enforced by the Washington Attorney General and through the Washington Consumer Protection Act, which provides a private right of action. If you are a Washington resident and believe Ophie has violated MHMDA, you may have a claim in addition to filing with the Washington AG.

We retain CHD only as necessary for the purpose for which it was collected. Specific periods are in Section 9 of the Privacy Policy. Deletion flows propagate to our processors and, where feasible, to backups.

Regulator complaints:

• Washington AG: https://www.atg.wa.gov/file-complaint
• Nevada AG: https://ag.nv.gov/Complaints/CMPL_Main/
• Connecticut AG: https://portal.ct.gov/ag/consumer-filing-a-complaint

Material changes will be communicated by email and in-product notice at least 30 days before taking effect. If a change materially alters how we process CHD, we will solicit a refreshed opt-in consent before applying the change.