Consumer Health Data Privacy Policy
This is a draft. It has not had legal review yet and will change before Hecate launches. Highlighted text still needs filling in.
Some of what you tell Hecate is about your health. Several US states, including Washington, Nevada and Connecticut, give that information extra protection and ask apps to describe it on its own page. This is that page. It sits alongside our privacy policy, which covers everything else.
The short version: the health information Hecate holds comes only from you, it is used only to put together your practice, and it is never sold or shared.
Who we are
Hecate is made by [LEGAL NAME OF OWNER], [MAILING ADDRESS] ("Hecate", "we", "us"). Hecate is not a healthcare provider or health plan, so the federal health privacy law HIPAA doesn't apply to it. The state laws on this page do.
The health information we collect
- Where you are in the transition (for example, perimenopause or post-menopause), if you choose to set it.
- Your check-ins. How today feels, for example achy, foggy, running hot, or feeling strong. Some of these describe your body or your mood.
- Your pattern over time. Hecate notices when the same kind of day keeps coming back, so it can keep offering what fits. This is worked out from your check-ins.
- Your practice. Which cards you were offered, opened, finished, left early or saved, and how long you spent with them. Because the cards cover movement, sleep and coping, this can say something about your health too.
- What you'd like from your practice, chosen when you first open the app.
That's all of it. Hecate doesn't access your location, Apple Health data, contacts, photos or microphone, and doesn't track you across other apps or websites.
Where it comes from
Only from you, through the app. We don't buy health information, receive it from other companies, or combine it with information from elsewhere.
Why we collect it
- To choose the cards in your daily practice and keep them suited to how you are.
- To remember your progress, so your practice builds on what you've already done.
- To find and fix problems, and to understand, in aggregate and only internally, how Hecate is used so we can improve it.
It is never used for advertising, never compared with other people, and never shown back to you as a score.
Your consent
We ask for your consent to use this information when you create your account, and we record when you gave it. [Confirm wording and screen once the sign-up consent is built (B75).] You can withdraw consent at any time by deleting your account (below). Hecate can't put together a practice without check-ins, so withdrawing ends your use of the app.
Who processes it for us
These companies handle your health information only on our instructions, to run Hecate. They are not allowed to use it for their own purposes.
- Supabase stores your account and practice data on servers in the United States.
- Cloudflare delivers the app's audio and images. It sees which files your phone requests, which can show which cards you play, but not your check-ins.
- [Crash reporting provider, once chosen (B53). Remove this line if crash reports are kept free of health information.]
Apple (sign-in and payments), RevenueCat (subscription status), Expo (app updates) and Beehiiv (the newsletter) do not receive your health information.
Sharing and selling
We don't share your health information with anyone other than the processors above, and we don't sell it. If that ever changed, we would ask you first, separately, and you could say no. We may disclose information if the law requires it.
Your rights
Wherever you live, you can:
- See your information. Ask for a copy of the health information we hold about you, and a list of everyone it has been shared with or sold to (for Hecate, that list is empty).
- Delete it. In the app, open Settings, then Account, then Delete account, or see how to delete your account without the app. Your account closes straight away and is permanently erased after 30 days, from our processors too. [Confirm backup retention with Supabase.]
- Withdraw consent, by deleting your account.
To ask for a copy, email hello@tryhecate.com from the address on your account. We'll confirm it's you, then reply within 30 days. If we ever need longer, we'll tell you why. It's free, and we won't treat you differently for asking.
If we say no, you can appeal by replying to that email with "Appeal" in the subject. We'll answer within 30 days and explain our decision. If you're still not satisfied, you can contact your state's Attorney General (in Washington: atg.wa.gov).
Security
Your information is encrypted in transit, and each account can only read its own data. Only the people who run Hecate can reach the database, and only to keep it working. If a breach affects your information, we'll tell you.
Changes to this page
If we change this page, we'll update the date at the top. If a change affects how your health information is used or shared, we'll ask you in the app before it takes effect.
Contact
Email hello@tryhecate.com or write to [MAILING ADDRESS].