Legal

Consumer health data

How we handle consumer health data under the laws of Washington, Nevada and the other US states that protect it. It adds to our privacy notice, which covers everything else.

Last updated 8 November 2026. This policy applies from 8 November 2026.

What this covers

Washington’s My Health My Data Act, Nevada’s law on consumer health data, and similar laws in other US states protect information that is linked to you and says something about your physical or mental health, including what can be worked out from what you do. On Heelar, much of what you write and share can say something about how you are. This policy names it, says where it comes from and why we use it, who we share it with, and how to use your rights.

Heelar is run by Heelar Ltd, a company registered in England and Wales (company number 17384191), at 90 Valley Road, Rickmansworth, England, WD3 4BJ. You can reach a person at support@heelar.com.

The consumer health data we collect, and why

• Your check-ins: how you feel, the parts of your body you mark, and your intention. So you can look back on them.
• Your journal: your entries, the feelings you pick for them, and your notebooks. So you can read them again. Entries are stored encrypted.
• What you write on a course or journey: your private reflections, what you came for, how you’re doing at the start, halfway and the end, your answers to its wellbeing questions, and a letter to yourself. So the journey can show you how far you’ve come.
• What you say in your circles and groups: your posts, the word you say when you arrive at a gathering, and when you stand with someone’s post. So the people in that space can see it.
• Reflections you publish about a practice. So other members can read them.
• The answers you give a practitioner before a session, and the agreement you sign. So they can prepare, and both of you have a record of what you agreed. Both are stored encrypted.
• Your messages with practitioners. So you can talk to them.
• Notes a practitioner keeps about your sessions. So they can look after you well.
• What you tell Heelar Talk. Your conversation stays on your phone. Each message is sent to Anthropic’s Claude, run for us by Amazon in the EU, to answer it, and isn’t kept on our servers. If Heelar Talk thinks you may be in crisis and you ask to speak to a person, we keep your request so a person can reach you.
• What you tell us when you report a problem with a booking. So we can decide what’s fair. It’s stored encrypted.
• Our records when someone’s safety may be at risk. So we can help.
• What you book, play, save and search for, which can say what kind of support you’re looking for. So we can give you what you booked, keep your History, and, only if you switch on Personalised recommendations, put the most useful things first. We count searches without keeping who searched.

We collect consumer health data only to give you the part of Heelar you’ve asked for, or with your consent where we ask for it. We don’t use your device’s location, and live sessions are never recorded.

Where it comes from

• You, as you use Heelar.
• The practitioners you work with, in the notes they keep about your sessions.
• Our team, in our records when someone’s safety may be at risk.
• What we work out from what you book, play, save and search for, as described above.

Who we share it with

• The practitioners you book or join: your answers before a session, the agreement you sign, and your messages to them. Never your check-ins, your journal or your private reflections.
• The people in a circle or group you’ve joined: what you post there.
• Anyone on Heelar: reflections you publish about a practice, with your first name if you choose to show it.
• Companies that run parts of Heelar for us, under contract, which may handle it only for that work: Amazon Web Services (our servers, storage and encryption keys), MongoDB Atlas (our database), Anthropic’s Claude run for us by Amazon in the EU (Heelar Talk), Anthropic in the US (answering the help requests you send us), LiveKit (live sessions), Stripe (payments for what you book), Postmark (emails about your bookings), and Expo, Apple and Google (notifications to your phone).
• The police, safeguarding services or other authorities, when the law requires it or someone’s safety is at risk.
• If Heelar is ever sold or merged, the new owner, who must keep to this policy.

We never sell consumer health data, and we never use it for advertising.

No company collects what you do on Heelar over time and across other websites, with two exceptions. On www.heelar.com, Google Analytics measures visits, but only after you tap Accept on the cookie bar, and it receives nothing from your Heelar account. When you pay, Stripe sets its own cookies to prevent fraud.

Your rights

You can ask us to:

• confirm whether we collect, share or sell your consumer health data, and give you a copy of it, with a list of every company we’ve shared it with and how to contact them;
• correct it, if it’s wrong;
• delete it. We delete it from our systems and tell the companies that run parts of Heelar for us to delete it too. Copies in our backups are deleted as those backups expire, within six months;
• stop using it where we rely on your consent. Switch off Personalised recommendations in Settings, under Privacy & data, or write to us.

Write to support@heelar.com from the email address on your account, so we know it’s you. You can also use “Download your data” and “Delete my account & data” in Settings. It’s free. We reply within 45 days. If we need longer, we’ll tell you why within those 45 days, and take no more than 45 days more.

If we turn down your request, you can appeal: reply to our answer, or write to support@heelar.com with “Appeal” in the subject. We look at it again and reply within 45 days, saying what we decided and why. If you’re still unhappy, you can complain to the attorney general where you live: in Washington at atg.wa.gov, and in Nevada at ag.nv.gov.

Changes to this policy

When we change this policy in a way that matters, we’ll tell you by email or in the app before the change applies, and ask for your consent again where the law requires it. The date at the top says when it last changed.

Questions about this policy

Write to support@heelar.com and a person will reply.