Consumer Health Data Privacy Notice

(Washington My Health My Data Act)

Effective Date: April 17, 2026 Last Updated: April 17, 2026

This Consumer Health Data Privacy Notice is published by Life of Adventure and Change, LLC, a Utah limited liability company ("Company," "Planted," "we," "us," or "our"), operator of the Planted web service (the "Service"). It describes how we handle "consumer health data" under the Washington My Health My Data Act, RCW 19.373 et seq. ("MHMDA"), and it is the notice required by RCW 19.373.020.

This notice applies to Washington State residents and to any consumer whose consumer health data we collect, use, share, or sell. It supplements, and should be read together with, our Privacy Policy. If there is a conflict between this notice and the Privacy Policy with respect to consumer health data of Washington residents, this notice controls.

The Service is offered only to adults aged 18 and older and only to U.S. residents. We do not knowingly collect consumer health data from anyone under 18.

1. Categories of Consumer Health Data Collected — RCW 19.373.020(1)(a)

Because the Service is a mental-wellness and nervous-system coaching tool, information you share with us often relates to your mental and physical health. We treat the following as consumer health data under MHMDA:

• Conversation transcripts of your voice and text sessions with AI coaches;
• Your user profile document (the user-maintained summary of your context, goals, and preferences);
• Check-ins, reflections, notes, and session summaries you create in the Service;
• Inferences derived from the above that we use to operate the Service (for example, which coach or framework you chose, the in-session state used to generate the next response, and patterns used to surface crisis-safety resources);
• Crisis-risk signals detected by our safety-resource-surfacing feature (for example, whether a session triggered the display of 988 resources);
• Audio input that you choose to speak into the Service. Raw audio is not stored on our servers. Audio is transcribed by your browser's built-in speech-recognition feature (see Section 2).

Specific sub-categories include:

• Individual health conditions, status, symptoms, and diagnoses you choose to mention, including mental-health and nervous-system conditions;
• Physical, mental, or behavioral health interventions, practices, or activities you discuss;
• Social, emotional, or psychological information you share during sessions;
• Information that identifies your attempts to seek health services, including mental-wellness coaching;
• Data derived or inferred from the above through your use of the Service.

Crisis-event audit retention. When the safety system surfaces crisis resources, a 500-character excerpt of the message that triggered it is retained in a separate audit table for safety review. This excerpt persists across session and message deletion. To request deletion of these records, email support@getplanted.health with the subject line "WA MHMDA Crisis-Event Deletion"; deletion is processed manually by the operator within the same 45-day window described in Section 4.

2. Sources of Consumer Health Data — RCW 19.373.020(1)(b)

We collect consumer health data from the following sources:

• Directly from you, through your voice and text interactions with the Service, the profile document you maintain, and any messages you send us;
• Automated collection tied to your sessions. When you use the Service, we automatically collect limited technical telemetry — such as IP address, browser type and version, device class, session timestamps, error logs, and similar operational data — that is linked to your consumer-health-data sessions because it is generated in the course of those sessions;
• From Google OAuth, limited to your name, email address, profile photo URL, and a stable Google account identifier. These fields are not themselves health data, but because they link to your Planted account they are treated as linked-to consumer health data under this notice.

Audio note. When you use voice input, your audio is transcribed by your browser's built-in speech-recognition feature (the Web Speech API). Depending on your browser, your audio may be transmitted to a third-party speech-recognition service operated by the browser vendor (for example, Chrome and Microsoft Edge transmit audio to Google; Safari typically transcribes on-device). That flow is controlled by your browser vendor, not by us, and is governed by your browser's own terms and privacy policy. We do not store raw audio and do not contract with a speech-to-text vendor.

We do not purchase consumer health data, acquire it from data brokers, or derive it from tracking technologies across third-party websites or services.

3. Purposes for Collection, Use, and Sharing — RCW 19.373.020(1)(c)

We collect, use, and share consumer health data only for the following purposes:

• Provide the Service. Generate AI coach responses, present coach personas, store and retrieve your sessions and profile, and deliver text-to-speech audio playback.
• Retain your history. Make prior sessions and profile state available to you when you return.
• Personalize within the Service. Use your profile document and prior sessions to contextualize new sessions (subject to the Washington resident's right to withdraw consent, below).
• Surface crisis-safety resources. Analyze conversation content for language associated with self-harm, suicidality, or acute crisis, and surface crisis resources (such as 988, 911, the Crisis Text Line, and the Veterans Crisis Line) in-product. This is a best-effort safety aid, not a substitute for contacting emergency services yourself.
• Secure the Service. Detect and prevent fraud, abuse, and unauthorized access.
• Comply with law. Respond to valid legal process and enforce our Terms of Service.
• Human-coach access, for clients with a Coaching Engagement only. See Section 10.

We do not use consumer health data for advertising, marketing profiling, targeted advertising, sale, or AI model training. We do not disclose consumer health data to data brokers.

4. Categories of Third Parties and Affiliates With Whom Data Is Shared — RCW 19.373.020(1)(d)

We share consumer health data only with the categories of sub-processors necessary to operate the Service. A current, dated list of the specific vendors in each category is published at /subprocessors on our website. Each sub-processor acts on our behalf under contractual confidentiality and data-protection obligations.

Basis for sharing with sub-processors. We share consumer health data with sub-processors on the basis that it is necessary to provide the consumer-requested product or service, consistent with RCW 19.373.030(1)(b). Sharing is limited to what each sub-processor needs to perform its role.

AI language model inference — retention. Under our AI inference sub-processor's (Anthropic, PBC) standard commercial terms of service, the sub-processor may retain prompts and responses for up to 30 days for abuse-monitoring and Trust & Safety purposes, after which that data is deleted, and the sub-processor does not use our or your prompts or completions to train its models. We will update this description if those terms change in a way that affects these commitments.

Advance notice before adding new CHD-processing sub-processors. We will give at least 14 days' advance notice on /subprocessors before adding a new sub-processor that will process consumer health data, so you may review the change and, if you object, withdraw consent or close your account before the new sub-processor begins processing.

Affiliates. Company has no affiliates at this time. If that changes, we will update this notice before sharing consumer health data with any affiliate.

Other third parties. We do not disclose consumer health data to any other third parties except (i) to comply with a lawful subpoena, court order, or other legal process, (ii) to protect the rights, safety, or property of Company, our users, or the public, or (iii) with your express consent or valid authorization.

5. Consumer Rights Under MHMDA — RCW 19.373.020(1)(e), RCW 19.373.040

Washington residents have the right to:

• Confirm whether we are collecting, sharing, or selling your consumer health data, and to access that data;
• Withdraw consent to our collection and sharing of your consumer health data;
• Delete your consumer health data;
• Port your consumer health data in a portable, readily usable format;
• Appeal our denial of any of the above requests.

Response time. We will respond within 45 days of receiving your request, with one 45-day extension available where reasonably necessary and with notice to you.

Consent vs. authorization. Consent under MHMDA is the clear, affirmative, opt-in agreement required before we collect, use, or share consumer health data beyond what is necessary to provide the Service you requested. Authorization is the separate, signed written document required before any sale of consumer health data; we do not sell consumer health data and therefore do not seek such authorizations. See Section 6.

6. No Sale Without Valid Authorization — RCW 19.373.030

We do not sell consumer health data. We have not sold consumer health data in the preceding 12 months and have no intention of doing so. We will not sell consumer health data without first obtaining a valid written authorization from you that meets every requirement of RCW 19.373.030.

7. How to Exercise Your Rights — RCW 19.373.020(1)(f)

Email support@getplanted.health with a subject line that matches your request:

• "WA MHMDA Request" — for access, withdrawal of consent, deletion, or portability.
• "WA MHMDA Appeal" — for an appeal of a denial (see Section 8).

Include (a) the right you wish to exercise, (b) the email address associated with your Planted account, and (c) any additional information reasonably needed to verify your identity.

Verification. We verify your identity by confirming control of the account email on file. For deletion and portability requests, we additionally require in-app re-authentication (completing a fresh Google sign-in) because those requests are high-risk if processed for the wrong person. Once verified, we process the request without discrimination and without requiring you to pay a fee.

Withdrawing consent. If you withdraw consent to our collection and sharing of your consumer health data, we will stop collecting new consumer health data from you, stop sharing it with our sub-processors for processing going forward, and, at your option, delete the data we have collected. Continuing to use the Service after withdrawing consent may not be feasible, because the Service cannot function without processing your conversation content to generate responses.

8. How to Appeal a Denial

If we deny your request in whole or in part, we will tell you why in writing. You may appeal by replying to our denial or by emailing support@getplanted.health with the subject line "WA MHMDA Appeal" within 30 days of the denial. We will respond to your appeal in writing within 45 days, explaining any action taken or the reason for denial.

If your appeal is denied, you may contact the Washington State Attorney General:

• Online: www.atg.wa.gov/file-complaint
• Phone: 1-800-551-4636

9. No Geofencing Around Health-Care Facilities — RCW 19.373.070

We do not use geofencing around any entity that provides in-person health-care services (including mental-health or reproductive-health facilities) to identify or track consumers, to collect consumer health data, or to send notifications, messages, or advertisements related to consumer health data.

10. Human Coach Access (Coaching Clients Only)

If you have entered into a separate Coaching Engagement contract with Life of Adventure and Change, LLC or with Eric Page as your human coach (a "Coaching Engagement"), and you have separately provided an express, opt-in written consent acknowledging that your human coach will access your Planted consumer health data, the human coach may access your profile document, session transcripts, and conversation content for coaching purposes.

The consent is provided on a dedicated consent form (or an equivalent in-product consent flow) that is separate from the Coaching Engagement contract itself. We collect that consent before the coach is granted access. The consent is specific to human-coach access to Planted data, informed, freely given, and may be refused without affecting the Coaching Engagement contract on its other terms.

You may withdraw consent at any time by emailing support@getplanted.health; withdrawal ends human-coach access prospectively. Transcripts created while human-coach access was authorized may remain accessible to the coach for legitimate coaching recordkeeping, subject to the Coaching Engagement contract.

If you are not a Coaching Engagement client, or if you have not provided the separate human-coach-access consent, no human coach or other Company personnel reads your session content, except as described in the Privacy Policy (for example, security, safety, and legal-compliance purposes, and with separate opt-in consent for any product-improvement review).

11. Security

We describe our security program in Section 8 of the Privacy Policy, including TLS 1.2+ in transit, AES-256 at rest, role-based access controls, and documented access-control and credential-management policies.

12. Contact

Life of Adventure and Change, LLC 2336 North Point St, San Francisco, CA 94123 Email: support@getplanted.health (subject line "WA MHMDA Request" or "WA MHMDA Appeal" for MHMDA matters)

Changelog

• April 17, 2026 — Published (v1).