Consumer Health Data Privacy Policy

Effective: October 13, 2026  ·  White Rose LLC (“Marmalaid”, “we”)

This policy describes how Marmalaid collects, uses and shares consumer health data, as required by the Washington My Health My Data Act and Nevada’s consumer health data law, and how you can exercise your rights.

1. Consumer health data we collect, why, and how we use it

• Health information you share with Marmalaid in messages, voice notes, photos and files — for example conditions, symptoms, medications, treatments, appointments or mental-health information. Used to remember what you tell it, answer your questions, keep track of appointments and reminders, and help you plan.
• Health information in accounts you connect (such as Gmail, Google Calendar and Google Drive) — for example messages or events from doctors, pharmacies or insurers. Used to prepare your briefings, reminders and follow-ups, and to answer your questions about them.
• Health-related purchases in receipts and expenses you ask Marmalaid to track (for example pharmacy or doctor payments). Used to organise and report your expenses.
• Information Marmalaid derives about your health or wellbeing from what you share — for example sleep or exercise habits, or what tends to cause you stress. Used to tailor its help to you.
• Safety signals. If something you write suggests you may be at risk of suicide or self-harm, Marmalaid sends you crisis resources and records that it did so. Used to keep you safe; see our Safety & Crisis Support page.
• Security and legal compliance. Any of the above may also be used to keep Marmalaid secure, prevent fraud and abuse, and meet our legal obligations.

We do not keep your precise location at health care facilities: when a shared location is at a hospital, clinic, pharmacy or similar place, Marmalaid keeps only the town.

2. Where this data comes from

• You — your messages, voice notes, photos and files.
• Accounts and services you choose to connect.
• Marmalaid itself — what it derives from the above.

3. Consumer health data we share

We do not sell consumer health data, and we do not share it for advertising. We have no affiliates.

Any of the categories of consumer health data listed in section 1 may be disclosed to:

• People and organisations you ask Marmalaid to contact, at your direction — for example when you ask it to email your doctor or send a calendar invitation;
• Service providers that process it on our behalf, under contract, to run Marmalaid (listed below);
• Government authorities or others when the law requires it — for example a valid court order — or to protect someone’s health or safety;
• A successor organisation if Marmalaid is part of a merger, acquisition or sale of assets, which must then honour this policy.

Our service providers:

• AI processing and search: Anthropic, OpenAI, Brave Search
• Hosting, storage and computing: Hetzner, Supabase, E2B
• Message delivery: Linq, Telnyx, Meta (WhatsApp)
• Notifications and maps: Expo, Amazon Web Services

4. Your rights and how to use them

You have the right to:

• Confirm and access whether we collect, share or sell your consumer health data, get a copy of it, and get a list of everyone we have shared it with and how to contact them;
• Delete your consumer health data — we delete it from our systems and tell our service providers to delete it too;
• Withdraw consent to our collection and sharing of your consumer health data. Because Marmalaid works from what you send it and the accounts you connect, you can also limit future collection at any time by not sharing health details, disconnecting an account, or closing your account.

You can also correct what Marmalaid knows at any time — tell it what’s wrong, or ask it to forget something.

How to make a request: tell Marmalaid in your chat (for example “show me my health data”, “delete my health data” or “stop using my health data”), or email hello@marmalaid.ai from the email address on your account. We verify requests through your account. You don’t need to create a new account.

Timing and cost: we respond within 30 days, free of charge.

Appeals: if we decline your request, you can appeal by replying “appeal” in your chat or emailing hello@marmalaid.ai with the subject “Appeal”. We will tell you in writing what we decided and why within 45 days. If we deny your appeal, you can contact the Washington State Attorney General at atg.wa.gov/file-complaint, or your own state’s attorney general.

5. Tracking across websites

No third party collects consumer health data about you over time or across other websites or apps through Marmalaid.

6. Changes to this policy

If we change this policy, we will update the effective date above. If we want to collect, use or share consumer health data in a new way, we will tell you first and ask for your consent where the law requires it.