This is a separate notice, required by consumer-health-data laws including Washington's My Health My Data Act (MHMDA), Nevada's SB 370, and Connecticut's health-data amendments. It explains, in the specific terms those laws use, how Graphophone treats "consumer health data." It supplements — and where these laws apply, controls over — our general Privacy Policy.
What these laws cover
"Consumer health data" is defined broadly — it can include information that identifies your past, present, or future physical or mental-health status, mental-health information, and biometric data such as voice recordings. A journal, and a spoken entry, can contain exactly this kind of information. Graphophone is built so that none of it is ever collected by us.
Categories of consumer health data we collect: none
Everything you write, say, and record in Graphophone — journal entries, conversations with the on-device AI, voice recordings and their on-device transcripts, moods, and tags — is encrypted on your device with a key derived from your passphrase, and stays there. Voice is transcribed on your device. Under these laws, to "collect" means to process data in a way that reaches us; because your content is never transmitted to us, received by us, or accessible to us, we do not collect consumer health data. We have no server-side copy and no account that holds it.
How it is used, sourced, and shared
- Purpose of processing. Your content is processed only on your own device, only to provide the journaling and reflection features you use. It is never used for advertising, and it is never used to train AI models.
- Sources. The only source of your content is you, on your device.
- Categories shared: none. We do not share consumer health data with any third party or affiliate, because we never receive it.
- Categories sold: none. We do not sell consumer health data, and we would need your separate written authorization to do so — which we neither seek nor have any way to act on.
- Optional cloud AI (bring-your-own-key). If a future opt-in feature lets you send specific requests to a third-party AI provider using your own API key, those requests go directly from your device to the provider you chose, under that provider's policies; we do not proxy, receive, or log them. This is off by default and surfaced in the app before it happens.
Your rights and how to exercise them
Because your consumer health data lives only on your device, you exercise these rights directly, without needing to ask us:
-
Confirm and access. Your data is readable in the app at any time, and the whole vault exports to plain Markdown with one tap, free.
-
Delete. Delete any entry, or delete the vault or the app, to erase your data. There is no server copy for us to retain, and the data is unrecoverable once deleted.
-
Withdraw consent. Turn off any optional network feature at any time; on-device processing is the default.
-
Non-discrimination. Exercising any of these rights never limits your use of the app.
Because we hold no consumer health data about you, there is nothing on our side to access, correct, or delete. If you have a question about this notice or believe we hold data about you, contact hello@graphophone.app. You may also have the right to complain to your state Attorney General.
This page is plain HTML — no analytics, no scripts, no third-party fonts. See also our Privacy Policy and Terms of Service.