Consumer Health Data Privacy Policy
Effective as of September 16, 2026
Thoughts ACC, Inc., d/b/a Untold (“Untold,” “we,” “us” or “our”) provides this Consumer Health Data Privacy Policy to describe how we collect, use and share consumer health data, and the rights you have over it. It supplements our Privacy Policy. Where the two differ with respect to consumer health data, this document controls.
It applies to consumer health data as defined by the Washington My Health My Data Act, the Nevada consumer health data law, the Connecticut Data Privacy Act and similar laws. Its protections apply to everyone who uses Untold, wherever you live.
We never sell your health data, never use it for advertising, and never use it to train AI models. Nothing is read from Apple Health until you have accepted a consent screen in the app and approved each category with Apple.
What consumer health data is
Consumer health data is personal information that is linked or reasonably linkable to you and that identifies your past, present or future physical or mental health. In Untold this includes:
Health and fitness measurements you share from Apple Health, if you connect it: sleep and sleep stages, steps, walking and running distance, flights climbed, stand hours, workouts, heart rate through the day, resting heart rate, walking heart rate, heart rate recovery, heart rate variability, respiratory rate, blood oxygen, wrist temperature during sleep, breathing disturbances during sleep, cardio fitness (VO2 max), environmental sound levels and headphone sound levels. Apple asks you to approve each category, and we only receive the ones you approve.
Menstrual flow dates and the cycle day we derive from them, only if you separately turn on cycle tracking. We treat reproductive health data as consumer health data and never use it for marketing.
Mood check-ins you make in the app, and moods we detect in your journal entries.
Health-related information you write or say in your journal entries, such as how you feel, symptoms, illness, sleep, exercise, therapy or substance use.
Information we derive from the above: daily summaries of your measurements, trends and patterns between your measurements and your moods, tags describing health-related topics in your entries, and insights that describe those patterns.
Completed meditations and mood check-ins, if you turn on writing them back to Apple Health.
How we collect it
From Apple Health on your iPhone, only after you read and accept the consent screen in Untold and then approve categories in Apple's permission screen. Measurements are read while the app is open and, if you choose "Import all history", for the full period Apple Health holds.
From you, when you create journal entries or mood check-ins.
From our own processing of the above, when we compute summaries, detect moods, or generate insights.
Measurements written to Apple Health by other devices and apps, such as an Apple Watch or a third-party tracker, reach us through Apple Health in the same way, together with the name of the source.
Why we use it
We use consumer health data only to:
Provide the features you ask for: showing your measurements alongside your entries and moods, computing summaries and trends, and, if you separately turn it on, generating AI insights about patterns between your body and your mood.
Save your completed meditations and mood check-ins to Apple Health, if you turn on write-back.
Operate, secure, debug and support the Service, including answering your support requests.
Comply with law and protect rights and safety, as described in our Privacy Policy.
We do not use consumer health data for advertising or marketing, to build advertising audiences, to make eligibility decisions, or to train AI models, ours or anyone else's.
How we obtain your consent
Consent to collect. We read measurements from Apple Health only after you accept the consent screen in Untold and approve categories in Apple's permission screen. Nothing is read before that.
Consent for cycle tracking. Menstrual flow is never included in the first permission request. It has its own consent screen and its own switch in Untold.
Consent to share with an AI provider. Connecting Apple Health does not, by itself, send your health data to any AI provider. Before we first do so, we ask for your separate, explicit consent in the app, and that screen tells you who receives it and what is sent.
Consent to write to Apple Health. We save meditations and mood check-ins to Apple Health only while the write-back switches in Untold are on.
Withdrawing consent. You can turn any of these off at any time in Untold under Settings › Apple Health, or for Apple Health categories in the iPhone Health app under Sharing › Apps › Untold. Withdrawal stops future collection or sharing. It does not by itself delete data we already hold; see Your rights below.
We do not use terms of service, pre-checked boxes or design that steers you toward consent to obtain consent for consumer health data. Untold's health features are for adults only. We confirm you are 18 or older before you can connect Apple Health, and we do not store your date of birth.
With whom we share it
We share consumer health data only with the recipients below. Each is contractually required to use it solely to provide services to us, to keep it confidential and secure, and not to use it for their own purposes or to train AI models.
Google LLC (Google Cloud Platform and Firebase), which hosts our servers and database. Consumer health data is encrypted in transit and at rest.
Anthropic, PBC, only if you turn on AI insights. It receives summaries of your recent measurements together with your moods, without your name, email or account identifiers, to write the insight. It may not train on your data.
Apple Inc., on your own device, only if you turn on write-back. Meditations and mood check-ins are written to Apple Health on your iPhone and do not pass through our servers.
The service providers that transcribe, index and process journal entries, as described in our Privacy Policy, to the extent an entry contains health-related information you wrote or said.
We have no affiliates that receive consumer health data. We do not share it with advertising or attribution providers, analytics providers, data brokers or other users. We may disclose it when required by law or to protect rights and safety, as described in our Privacy Policy, and to a successor in a merger or acquisition, in which case this policy continues to apply to it.
We do not sell consumer health data
We do not sell consumer health data and we do not share it for targeted advertising. We would only sell consumer health data with your separate, signed authorization meeting the requirements of applicable law, and we do not seek such authorizations.
Your rights
Regardless of where you live, you may:
Confirm and access. Confirm whether we collect, share or sell your consumer health data, access it, and receive a list of the third parties with whom we have shared it together with a way to contact them.
Withdraw consent to collection or sharing, as described above.
Delete. Have your consumer health data deleted, and have us instruct our service providers to delete it. Deleting your account (Settings › Account › Delete Account) deletes your data. To delete only your health data and keep your account, email us at the address below with the subject "Delete health data".
Appeal a decision we make on your request.
To exercise these rights, use the controls in the app or email privacy@untoldapp.com with the subject "Consumer Health Data Request". We verify requests using the email address on your account. We respond within 45 days and may extend once by 45 days where reasonably necessary, in which case we will tell you. Requests are free, except that we may charge a reasonable fee for a second or later request in a twelve-month period where the law allows. If we deny your request we will tell you why and how to appeal. To appeal, reply to our decision or email privacy@untoldapp.com with the subject "Appeal". We respond to appeals within 45 days. If your appeal is denied you may contact your state attorney general, including in Washington at https://www.atg.wa.gov/file-complaint, in Nevada at https://ag.nv.gov/Complaints/File_Complaint/ and in Connecticut at https://portal.ct.gov/ag/common/complaint-form-landing-page. You may authorize someone to make a request on your behalf. We will ask for proof of that authorization.
Retention
We keep consumer health data for as long as your account is active and the related feature is on. When you turn Apple Health sync off, nothing new is read. When you delete your health data or your account, we delete it from our production systems as soon as reasonably possible and from backups on their normal rotation.
Security
Consumer health data is encrypted in transit and at rest. Access within Untold is limited to people who need it to operate and support the Service, under confidentiality obligations. No system is perfectly secure. If we discover a breach involving your health information we will notify you as required by the FTC Health Breach Notification Rule and state law.
Changes
If we change the categories of consumer health data we collect, the purposes for which we use it, or the recipients with whom we share it, we will update this policy and, before applying the change to your data, notify you and obtain your affirmative consent. We do not make such changes retroactively.
How to contact us
Thoughts ACC, Inc., d/b/a Untold 250 Broadway, Office 2913, New York, NY 10007 privacy@untoldapp.com