1. Who this policy covers
This policy explains how Andry Hamida ("we") collects, uses and shares consumer health data. It is written for the Washington My Health My Data Act (RCW 19.373) and Nevada's consumer health data law (NRS 603A.400 to 603A.550), and we apply it to everyone who uses Sabotype.
"Consumer health data" means personal information that is linked or reasonably linkable to you and that identifies your past, present or future physical or mental health status. Sabotype is a self-reflection tool, not a health service, but some of what we handle could fall under that definition, so this policy covers it.
2. Consumer health data we collect, why, and how we use it
| Category | Source | Why we collect it and how we use it |
|---|---|---|
| Optional free text you choose to save after the quiz, if it mentions your health | You | Only with your consent (the box's own checkbox). Used to tailor your emails and, with your name removed, to improve our content. Checked against a phrase list for safety. Deleted after 12 months. |
| Safety marker (yes/no) that our server sets when your free text or a message to us suggests you may need support | Inferred by our server from what you write | To stop all offers and marketing to you, send you support resources, and have a person check within 24 hours. Never used for anything else. |
| Quiz answers, result and "About you" choices, to the extent they could be read as information about your mental health status | You | Necessary to provide what you asked for: your result, the profile emails and, if you buy, your program. |
| Purchase records showing you bought a self-reflection program | You and our payment partner | Necessary to deliver the program, handle refunds and keep tax records. |
| Messages you send us by email or Instagram that mention your health | You | To answer you. A person reads them; we never send an AI-written reply. |
3. Consumer health data we share, and with whom
We do not sell consumer health data. We share it only with service providers (processors) that act on our instructions to provide the service you asked for:
- Our cloud server provider stores the free text, safety marker, quiz record and purchase records.
- MailerLite (email) receives your pattern name and area to send the emails you asked for, and only a neutral "paused" setting when the safety marker is set. It never receives your free text or the reason for a pause.
- Resend (program emails) receives the lessons we send you as a buyer.
- Our payment partner (Creem, or as a backup Lemon Squeezy) receives your email and what you bought.
- Cloudflare and Google Gmail forward and store the emails you send to [email protected]; ManyChat and Meta carry Instagram messages you send us.
We have no corporate affiliates that receive this data. We share no consumer health data with advertising platforms. If you click Accept on our ad banner (a separate choice from anything above), Meta learns that you visited this self-reflection site and whether you signed up or bought, and Meta can recognize your browser on other sites over time. Reject, or a Global Privacy Control signal, keeps this off.
4. Your consent
- We collect consumer health data beyond what the service needs only with your consent, asked before collection: the free-text box saves nothing unless you tick its consent checkbox.
- Sharing beyond our service providers would need a second, separate consent. We don't do it.
- You can withdraw consent anytime by emailing [email protected]. We then stop collecting and delete the data covered by that consent.
- If we ever want to collect a new category of consumer health data or use it for a new purpose, we will tell you first and ask for your consent.
- We will not discriminate against you for using any of these rights.
5. Your rights and how to use them
- Confirm and access: ask whether we collect, share or sell your consumer health data, and get a copy, with a list of every third party it was shared with and how to contact them.
- Correct: ask us to fix data that is wrong.
- Stop: ask us to stop collecting or sharing it, or withdraw your consent.
- Delete: ask us to delete it. We delete it from our systems and tell our service providers to delete it too. Backups clear within 14 days.
How to ask: email [email protected] with the subject "Health data request", from the address you used with us, so we can confirm it's you. An authorized agent may ask for you. We answer within 45 days (deletions within 30 days of confirming it's you). If we need more time, we will tell you why within the first 45 days, and the extension is at most 45 more days. Requests are free up to twice a year.
Appeal: if we refuse a request, reply with the word "appeal" within 45 days. We answer in writing within 45 days and explain why. If we still say no, you can complain to the Washington Attorney General (atg.wa.gov/file-complaint) or the Nevada Attorney General (ag.nv.gov).
6. Changes and contact
If we change this policy in a meaningful way, we will post the new version here and email you before it takes effect. This policy is effective from November 9, 2026.
Andry Hamida, 350 Fifth Avenue, Suite 6800, New York, NY 10118, United States. Email: [email protected].