Consumer Health Data Privacy Policy

Effective Date: October 6, 2026 · Last Updated: November 13, 2026

This policy describes how VerseMine (operated by Kreyman Enterprises, LLC) handles "consumer health data" as defined by Washington's My Health My Data Act (RCW ch. 19.373) and similar state consumer-health-data laws. It is separate from, and in addition to, our general Privacy Policy. It covers only consumer health data.

What consumer health data we collect

VerseMine collects consumer health data if you use our AI assistant (an optional spiritual-guidance chat), and when something you share is held or blocked by the screening described under "Screening what you share" below. If you use the assistant, we may collect:

  • the messages you send and the assistant's replies. We do not keep the text of these on our servers. It is stored on your device, and deleting a conversation in the app removes it from there. In an in-room conversation, the whole transcript, including what each participant said, is kept on the phone of the person who started it, and that person can export it. Each time you send a message, that message and a recent part of the conversation are sent to our servers and on to our AI provider only to produce the reply;
  • records about the conversation, not its content — for a group guidance session: that it happened, who hosted it and in which group, when it started and ended and how long it ran, whether it was a marriage session, whether a safety concern changed how the assistant responded during it, how often its oversight check raised an alert, the result of the location check that decides which of the assistant's features are available there (not your location itself), and the display names participants chose (group sessions are not recorded: we keep no session audio). A one-person conversation leaves no such record; content-free safety records noting that a crisis resource was shown, the exact time, and the type of concern, kept for up to 732 days so we can report the number of crisis referrals that state law requires. They carry no account identifier, but they are not anonymous: for example, for up to 90 days the time on one can be matched to the daily crisis-check count described next, which is linked to your account and keeps the exact time of its latest match for a few hours, then only the day, and if the resource was shown in a group session, its time can be matched to that session's record while it is kept; a daily count of how many of your messages matched our crisis check, and of the extra replies it allowed, kept for 90 days and used to alert us to unusual volume and, in one-to-one assistant conversations, so that if a message of yours matched it within the last hour, reaching the daily limit does not stop the assistant from answering you, for up to 10 extra replies in any 7 days, which do not count toward your limit, and otherwise, if one matched it on a day your current limit still counts, the limit screen shows no upgrade offer, only the limit, when it resets, and the 988 crisis resources (it never limits crisis help); a daily count of how many assistant messages and voice requests you sent, used only to apply usage limits (a message our crisis check flags is not added to it, and is never refused for reaching a limit); a timestamp for each assistant search, used to rate-limit the feature and holding no query text; and a record that a conversation turn happened and when, which carries no account identifier. None of these contain message text; and
  • if you turn on conversation memory, information derived from those conversations about your spiritual walk and personal struggles, which may relate to your emotional, mental, or spiritual well-being. Conversation memory is turned off for accounts in the current release, so nothing of this kind is created today. If it is enabled for your account, the derived information is stored on our servers, and personal names and places are replaced with placeholders before it is stored.

Cross-conversation context is different. If you turn on the optional cross-conversation context setting (or ask the assistant what you said in an earlier conversation), short excerpts of your prior conversations — read from the copy on your device — are included with your request so the assistant can respond with that context. Those excerpts reach our servers and our AI provider along with the request, as every message does, but VerseMine's servers do not store them, do not store anything derived from them, and this setting does not create or store any profile about you. Crisis-related conversations are never included. You can turn the setting off at any time.

Reporting a reply. If you tap Report this reply on one of the assistant's replies, the text of that one reply is sent to us with your report and kept so we can review it. Your own messages are not included. It can include names and details from that conversation. In a group session, only your reason is sent, not the reply. It is deleted when you delete your account.

Screening what you share. Text you share with other members -- reflections, comments, your name, username and profile details, and group and church details you enter -- and photos you add are checked by our moderation provider, OpenAI, for safety categories, one of which is self-harm; its moderation service keeps nothing. A reflection you keep private is not sent to OpenAI while it stays private: not its text, not its photos, and not your own comments on it or those comments' photos; a crisis check on our own servers reads the text and stores nothing. When you change a private reflection to shared, its text, its photos, and the text and photos of your own comments on it are checked at that moment. If a photo or one of your comments is blocked or cannot be checked, the reflection is not shared; if its text cannot be checked because the moderation service is unreachable, it is shared without that check. If the text itself is blocked, the reflection is not shared either. A photo on any other comment is checked when you upload it. GIFs, which you pick from a G-rated GIF catalogue, are never sent to OpenAI. A passage you mark private inside a shared reflection is removed before that reflection is checked. If OpenAI cannot be reached, new reflections and comments, your username and group study materials can be published without the check, and an edit to a reflection or comment keeps the status it had; your display name, bio and church, a group's name, church and description, a reading plan's name and the church name typed when buying a church plan are refused until they can be checked, and a photo is not accepted. What we keep:

  • for something that passes, only that the check happened, for 90 days;
  • for something that could not be checked, only that the check could not run, for 90 days, and for a photo uploaded while it could not be checked, also a moderation report naming the reason and where the photo is stored, until your account is deleted;
  • for something that is blocked, which safety category blocked it, for 90 days, and for a blocked photo also a moderation report naming the categories and where the photo is stored, kept until your account is deleted; and
  • a reflection or comment the screening flags -- including one flagged for signs of distress -- is held, hidden from other members, for a moderator to review. The moderator reads it, even if you later make it private, and the record that it was held is kept for 90 days, or for as long as the post stays held, if that is longer.

We do not keep the moderation scores, and none of these records outlives your account. If a moderator removes one of your posts, a copy of it is kept with the record of that action until your account is deleted, when the copy is erased. A report another member files about one of your posts is theirs: it keeps the reason they wrote, but once your account is deleted nothing in it links to you.

We do not collect consumer health data unless you use the AI assistant or share content that the screening holds or blocks. If neither happens, we collect no consumer health data about you.

Where we collect it from

We collect it directly from you — from the messages and posts you write in the app — except for what you say in an in-room conversation someone else started, which reaches us through their phone. We do not collect consumer health data from any other source, and we do not buy it, rent it, or receive it from any third party.

Why we collect it

To provide the AI assistant to you and to keep shared posts safe — to generate its responses, to screen what you share, to review a reply you report, and, if you enable conversation memory, to let it remember your prior conversations and continue them. We do not use it for advertising, we use no advertising trackers, and we never sell it. We also use the usage events and error reports described next to understand how the assistant is used and to fix what breaks. Our product-analytics service, PostHog, receives a few usage events from the assistant screens, tied to your account: voice or dictation model downloads; voice dictation starting, finishing or failing; a subscription offer being shown, bought or cancelled; a session host or group admin managing parked topics or study materials; a care-team outreach check failing; and app-wide error diagnostics -- never message text. Current app versions send no usage events about your conversations themselves (a message being sent, a crisis resource being shown, a suggested topic tapped); an older version may still send a few, under a random identifier instead of your account (PostHog still sees the network address they arrive from), until it updates. Our crash-reporting service, Sentry, receives error reports from those screens with your account identifier and with message text removed.

What is never collected or stored on our servers

If a message indicates a crisis, VerseMine surfaces the 988 Suicide & Crisis Lifeline (or a local resource) instead of normal guidance. Messages caught by our first-line crisis check are never stored on our servers; on your phone they are kept with the rest of that conversation, and deleting the conversation deletes them. If crisis signs emerge during a conversation, the affected messages are flagged and excluded from search, summaries, memory, and every other derived feature.

How it is shared

We do not share consumer health data with any third party. These processors handle it on our behalf, only to provide the assistant, to screen what you share, and to measure and fix the app, under contracts that restrict their use of it:

  • Anthropic, PBC, our AI model provider: each message and the recent part of the conversation sent with it, to generate the reply and run safety checks. It receives no account identifier. If your date of birth shows you are 13 to 17, the instructions sent with your conversation state that you are a verified minor, so that it applies stricter protections; they do not say who you are. It is contractually barred from training its models on your content;
  • Supabase, Inc., our database and storage provider: it stores the records about the conversation and the screening records described above, and the text of a reply you choose to report (above). It does not store the text of your conversations, because we do not keep it;
  • the US cloud host of VerseMine's own servers, which handle each request while the reply is produced and keep no conversation text;
  • PostHog, Inc., our product-analytics provider: the usage events described under "Why we collect it", with no message text;
  • Functional Software, Inc. (Sentry), our crash-reporting provider: error reports from the assistant screens, with message text removed; and
  • only if a feature that is off today is turned on: Google LLC, if conversation memory is enabled for your account (it turns anonymized memory notes, and the anonymized text of each message, into search data to find relevant notes), and ElevenLabs, Inc., if premium cloud voices are enabled (it receives a reply's text to speak it).

OpenAI, LLC, our moderation provider, screens what you share (see "Screening what you share") and keeps nothing. Neither it nor Voyage AI, which our Privacy Policy also names, receives your assistant conversations.

List of third parties with whom we share consumer health data: none. Under Washington's My Health My Data Act, processors acting on our instructions are not third parties; ours are listed above.

Affiliates with whom we share consumer health data: none. We do not share consumer health data with any affiliate of Kreyman Enterprises, LLC.

No third party collects consumer health data about you over time and across other websites or online services through VerseMine. We use no advertising trackers.

Your rights

You may ask us to:

  • confirm whether we collect consumer health data about you, and access it. An access response cannot include the text of your conversations, because we do not hold it — you can read that on your device in the app; the text of an in-room conversation someone else started is on their phone, not yours;
  • correct consumer health data we hold about you that is inaccurate. We hold no conversation text, so there is nothing of that kind to correct; account and profile details can be corrected in the app or by asking us;
  • withdraw your consent to our collection and use of it — this stops further collection without deleting your account; and
  • delete it. We delete what we hold on our servers, including copies in our backups. We cannot delete the text of your conversations, because we do not hold it: that copy is on your device, and you remove it by deleting your conversations in the app, by deleting your account — which wipes the conversation store on this device — or by removing the app and its data. Current versions of the app keep the conversation store out of Google's backup on Android, and out of transfer to another Android phone. On iPhone the app asks iOS to leave the store out of iCloud Backup, and that request arrives with version 1.0.4 — versions before it do not make it. These are requests to the system, not guarantees. A device backup — iCloud or Google — may still hold a copy under Apple's or Google's terms rather than ours. The text of an in-room conversation someone else started is kept on their phone. Only they can delete it there; we cannot. Notes or recaps made from it, if those features are enabled for the person who started it, are stored with their account. Our AI provider holds the messages we sent it only for the retention window described in Section 3.1 of the Privacy Policy — it deletes inputs and outputs within 30 days, except content flagged for a safety review, which may be kept for up to two years — and we have no way to delete them sooner. We do not send it a deletion notice: no request it receives carries your account identifier, so it cannot tie any request to your account (a message's own words may still name you, and it keeps those only for the window above). Error reports already sent to Sentry carry your account identifier; Sentry deletes them within 90 days, and we do not send it a deletion request. Deleting your account also deletes from our database the daily crisis-check count, which can match a safety record to you for up to 90 days. Safety records and the conversation-turn record (a conversation identifier and a timestamp) carry no account identifier, so deleting your account does not remove them; safety records are deleted automatically after 732 days, and the turn record is kept with no set end date.

To exercise any of these, use Settings → AI & Privacy in the app, or email privacy@versemine.app. We will respond within 45 days (extendable once by another 45 days where reasonably necessary, with notice to you). You may authorize another person to make a request on your behalf.

Appeals

If we decline a request, reply to our response and we will review the decision. You may also contact your state Attorney General.

Changes

We will post material changes to this policy at this address with a new effective date and tell you by email to your account address. We will also request your consent again before collecting or using consumer health data for any new purpose.

Contact: Kreyman Enterprises, LLC — privacy@versemine.app