InnerSmith Consumer Health Data Privacy Policy
Version 1.0 · Effective date: October 28, 2026 · InnerSmith, Inc.
This policy explains how InnerSmith, Inc. ("InnerSmith", "we", "us") collects, uses and shares consumer health data under Washington's My Health My Data Act, Nevada's consumer health data law (SB 370) and Connecticut's consumer health data provisions. We apply it to everyone who uses InnerSmith, wherever in the United States you live. It supplements our Privacy Policy (innersmith.com/app-privacy).
1. What consumer health data means
Consumer health data is personal information that is linked or reasonably linkable to you and identifies your past, present or future physical or mental health status, including information that could be used to infer it. InnerSmith is a wellness app, not a healthcare provider or medical device, but some information you share with us meets this definition.
2. What we collect, where it comes from, and why
| Category | Examples | Source | Why we collect it |
|---|---|---|---|
| Mood check-ins | Moods you select, such as Stressed, Anxious or Tired, and when | You | To personalize suggestions and show you your own patterns |
| Wellbeing answers | Goals you choose when setting up the app, such as sleeping better, easing stress or feeling less alone | You | To suggest sessions that suit you |
| Listening history | Which wellness sessions you play, when, and for how long | Your use of the app | To resume sessions, show streaks and personalize suggestions |
| Linked identifiers | Account ID, device information, IP address, push token | Your device and the app | To run your account and deliver the Services |
| Inferences | Sessions we suggest based on the categories above | Derived from the categories above | To personalize the Services |
We don't collect your journal entries; they stay on your device and, if you use iCloud, in your own private iCloud account. We don't collect precise location, and we don't use geofencing around any healthcare facility.
3. Consent
We ask for your consent on a separate screen in the app before we collect mood check-ins, wellbeing answers or listening history. This is separate from accepting our Terms of Service, and it is not pre-ticked. You can withdraw consent at any time in Settings › Privacy; we then stop collecting this data and delete what we hold within 30 days. The app continues to work without personalization.
4. Who receives consumer health data
We share consumer health data only with service providers that process it for us under contracts limiting their use to providing services to InnerSmith:
| Category of recipient | Recipient | Consumer health data they receive |
|---|---|---|
| Cloud hosting | Amazon Web Services (United States) | Mood check-ins, wellbeing answers, listening history, linked identifiers |
| App development and support | Our software development and support provider (India) | Mood check-ins, wellbeing answers and listening history, only as needed to support, maintain and secure the Services, as our processor under a written contract |
| Database hosting | MongoDB Atlas, on Amazon Web Services (United States, Northern Virginia) | Mood check-ins, wellbeing answers, listening history, linked identifiers |
We don't sell consumer health data, and we don't share it with advertising partners, data brokers or anyone for their own purposes. We measure our advertising only through Apple's aggregate attribution system, which identifies no one. We have no affiliates that receive consumer health data.
If we ever want to share consumer health data for another purpose, we'll ask for your separate consent first.
5. Your rights
You can ask us to:
- confirm whether we collect, share or sell your consumer health data;
- give you access to it, including a list of every third party and affiliate we've shared it with and how to contact them;
- stop collecting and sharing it, by withdrawing your consent; and
- delete it. When we delete it, we delete it from our backups within 35 days and tell our service providers to delete it too.
Make a request in the app's privacy settings or by emailing [email protected]. We'll confirm it's you (for signed-in users, signing in is enough), respond within 45 days, and may extend once by a further 45 days where needed, in which case we'll tell you why. Requests are free for at least two a year.
Appeals. If we decline your request, email [email protected] with "Appeal" in the subject line. We respond to appeals in writing within 45 days, explaining what we decided and why. If you're not satisfied:
- Washington: file a complaint with the Washington State Attorney General at www.atg.wa.gov/file-complaint.
- Nevada: contact the Nevada Attorney General at ag.nv.gov.
- Connecticut: contact the Connecticut Attorney General at portal.ct.gov/ag.
- Other states: contact your state attorney general.
6. Contact us
InnerSmith, Inc.
2810 N Church St, Wilmington, DE 19802
Email: [email protected]