Last revised on: October 29, 2026
This Consumer Health Data Privacy Policy ("Health Privacy Policy") supplements our general Privacy Policy and applies specifically to "consumer health data" as defined by the Washington My Health My Data Act (RCW 19.373) and similar state laws. This Policy describes how Take Helm Health, LLC ("TakeHelm," "we," "us," or "our") collects, uses, shares, and protects your consumer health data.
This Policy applies to:
In the event of any conflict between this Health Privacy Policy and our general Privacy Policy, this Health Privacy Policy will control with respect to consumer health data.
When consent is required and is the basis for processing, we present a dedicated, standalone choice that is separate from our Terms of Service and subscription agreement. For clinic-enrolled users, these choices apply to optional data you independently connect or upload; they do not govern Protected Health Information your healthcare practice provides under HIPAA and its Business Associate Agreement with TakeHelm. The consent flow:
You may withdraw this consent at any time through your account settings (Settings > Privacy > Health Data Consent). See Section 8.3 for details on the effects of withdrawal.
When we make material changes to our data collection or sharing practices, we will obtain your affirmative re-consent through a blocking notification before any new practices begin.
Apple Health: The current optional Apple Health rollout is limited to collection, storage and processing with fixed rules under a separate collection choice. It does not enable AI export or coaching sharing. The Apple Health disclosure explains the supported data types, separate Apple permissions, storage, withdrawal and deletion. Broader purposes described in this Policy do not expand that Apple Health permission.
Under the Washington My Health My Data Act, "consumer health data" means personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status. This includes:
TakeHelm collects the following categories of consumer health data:
We do not collect precise location data or biometric identifiers (fingerprints, facial recognition, etc.).
Information you enter into our platform (health history, goals, medications, supplements), documents you upload (lab results, genetic reports, medical records), responses to questions and questionnaires, and communications with our team.
When you connect these services, you authorize us to receive and process the health data they provide.
We use your data in connection with the Services to generate personalized insights, recommendations, and trend analyses. Our AI systems create derived health information based on patterns in your data.
If you are enrolled in TakeHelm through a healthcare practice, we may receive consumer health data from your healthcare provider's electronic health record (EHR) system, including:
This data is provided under your healthcare provider's authorization and instructions, its privacy practices, HIPAA, and a Business Associate Agreement between TakeHelm and your healthcare provider. You may request that your healthcare provider stop sharing your data with TakeHelm at any time by contacting your provider directly.
During TakeHelm enrollment, we present a notice explaining this provider-authorized relationship. We do not ask you to grant or revoke TakeHelm's status as your provider's Business Associate.
We collect and use your consumer health data for:
We do NOT use your consumer health data for: interest-based or targeted advertising, selling to third parties for their marketing purposes, employment decisions, insurance underwriting or coverage decisions, or any purpose not disclosed in this Policy.
We share the following categories of consumer health data with third parties as necessary to provide our Services:
We only share consumer health data as necessary to provide our Services or as required by law. We do not sell your consumer health data.
We share consumer health data with the following service providers who process data on our behalf (as of March 4, 2026):
Our payment processor (Stripe) processes subscription payments but does not receive consumer health data. See our general Privacy Policy for details on payment processing.
All service providers are bound by contractual obligations to process data only as instructed by TakeHelm, maintain appropriate security measures, delete data upon our instruction, and not use data for their own purposes.
Contact privacy@takehelm.io for a current list of specific providers.
If you are enrolled through a healthcare practice, we share the following with your healthcare provider:
This sharing is governed by HIPAA, the Business Associate Agreement, and your healthcare provider's instructions. TakeHelm asks you to approve the exact text of an AI-composed escalation message before it is delivered to your provider.
Chat summaries are shared only after you make a separate, affirmative choice to share them. Declining or withdrawing does not affect your care or your access to TakeHelm. You can withdraw at any time in Settings; we then delete the stored summary and stop sharing it.
TakeHelm currently has no affiliates with whom we share consumer health data.
We may share consumer health data with:
At your explicit request, we may share your data with third parties you designate, such as family members you authorize or other services you choose to connect. You are responsible for ensuring you have the right to authorize such sharing and for any consequences. TakeHelm is not responsible for how third parties use data once shared at your direction.
Unless you are enrolled through a healthcare practice (see Section 6.2), we do not share data directly with healthcare providers on your behalf. If you wish to share your TakeHelm data with a healthcare provider, you may export your data and share it yourself.
TakeHelm does not sell your consumer health data. We do not exchange consumer health data for monetary or other valuable consideration.
Under the Washington My Health My Data Act, "sale" of consumer health data requires a separate, signed authorization from you. We do not engage in such sales and have no plans to do so.
If this ever changes, we will:
If you are a Washington State resident or your consumer health data was collected in Washington, you have the following rights:
You have the right to confirm whether we are collecting, sharing, or selling consumer health data about you, and to access that data.
You have the right to request that we delete your consumer health data, including data derived from your inputs. Upon receiving a valid deletion request, we will delete your consumer health data from our systems, direct our processors to delete your data, and confirm deletion to you.
Exceptions: We may retain data required by law, and de-identified and aggregated data that cannot reasonably be linked to you (see Section 10).
For PHI TakeHelm receives as a Business Associate, we may route your request to your healthcare provider. Deletion, return, or retention of that PHI is handled under the provider's instructions, HIPAA, and the BAA; TakeHelm does not independently override the provider's legally permitted retention obligations.
You have the right to withdraw your consent for the collection and sharing of your consumer health data at any time. Withdrawal of consent will not affect the lawfulness of processing conducted prior to withdrawal.
Important: If you withdraw consent for the collection or processing of optional patient-provided data, we stop future collection through that capability. A clinic-enrolled user may continue using TakeHelm with provider-supplied data. To leave a clinic program and stop future provider exchange, use the clinic-program control in Settings and contact your healthcare provider; records already received are handled under the provider's retention and disposition instructions and the BAA. For direct-to-consumer users, withdrawal may prevent TakeHelm from providing the Services and may result in termination as described in the Terms of Service.
Withdrawing the optional Apple Health collection permission does not remove ordinary TakeHelm access and is not itself a deletion request. See the Apple Health disclosure for those controls.
You have the right to receive a list of all third parties and affiliates with whom we have shared your consumer health data during the prior 12 months.
If we deny your request to exercise any of these rights, you have the right to appeal our decision. You may also file a complaint with the Washington State Attorney General.
You may exercise your rights by contacting us:
Email: privacy@takehelm.io
Mail: Take Helm Health, LLC, Attn: Privacy Rights, 1522 Western Ave STE 24699, Seattle WA 98101
To protect your privacy, we will verify your identity before processing your request.
We will respond to your request within 45 days of receipt. If we need additional time, we will notify you of the extension (up to an additional 45 days).
We will process your requests at no charge. We may charge a reasonable fee for requests that are manifestly unfounded or excessive, but we will explain why before imposing any fee.
You may designate an authorized agent to submit requests on your behalf. We may require proof of authorization and verify your identity directly.
If we deny your request, you may appeal by emailing privacy@takehelm.io with "Appeal" in the subject line. We will respond to appeals within 45 days. You may also file a complaint with the Washington State Attorney General or call (800) 551-4636.
TakeHelm may create de-identified and aggregated data from consumer health data for service improvement and research purposes. We commit to:
De-identified data that meets these standards is not subject to deletion requests under applicable law, as it cannot reasonably be linked to you.
We implement administrative, technical, and physical safeguards designed to protect your consumer health data, including encryption in transit (TLS) and at rest, role-based access controls, multi-factor authentication, security monitoring and logging, vendor security assessments, and employee training on data protection practices.
While we strive to protect your data, no system is completely secure. We cannot guarantee the absolute security of your consumer health data.
We retain your consumer health data for as long as necessary to provide the Services, maintain your account, comply with legal obligations, resolve disputes, and enforce our agreements.
When you delete your account or request deletion of your data, we will delete or de-identify your identifiable consumer health data, including data derived from your inputs, within 45 days, except where retention is required by law, for de-identified and aggregated data (see Section 10), or data in encrypted backups (purged within an additional 90 days).
We may update this Health Privacy Policy from time to time. If we make material changes, we will post the updated Policy on our website, update the "Last Updated" date, and notify you by email.
For material changes to data collection or sharing practices: We will obtain your affirmative re-consent through a dedicated in-app notification before any new practices begin. We will not rely on continued use as acceptance for changes that expand how we collect, use, or share your consumer health data.
For non-material changes (clarifications, corrections, security improvements), your continued use of the Services after notice constitutes acceptance of the updated Policy.
If you have questions about this Consumer Health Data Privacy Policy or our privacy practices, please contact us:
Take Helm Health, LLC
Email: privacy@takehelm.io
Mail:
Take Helm Health, LLC
Attn: Privacy
1522 Western Ave STE 24699
Seattle WA 98101
United States