Consumer Health Data Privacy Notice

This notice explains how Steady handles your consumer health data and the rights you have over it. It sits alongside our Privacy Policy and goes into more detail specifically about health information. It’s written to meet Washington’s My Health My Data Act and similar laws in Nevada and Connecticut, and we apply these protections to everyone.

The short version (full detail below)

• The health data Steady holds is yours. We don’t sell it and don’t use it for ads.
• We share it only with the providers that run Steady (named in section 3). Our AI provider keeps nothing after answering you and never trains on it.
• You can confirm what we hold, get a copy, withdraw consent, or delete it (and we’ll tell our providers to delete too).
• To delete: account icon → Delete account, or email hashim@withsteady.health. We respond within 45 days.

“Consumer health data” means information that is linked to you and identifies your past, present, or future physical or mental health. For Steady, that includes the categories below.

1. The consumer health data we collect, and where it comes from

We collect this directly from you when you use Steady:

• Conditions and diagnoses you record
• Medications and dosages you log
• Symptoms, check-ins, and how you’re feeling over time
• Documents and labs you upload (clinic letters, results, discharge summaries, and similar)
• The content of your chats with Steady about your health
• Feedback you send us about Steady, when it includes health details
• Appointment information you add
• Voice recordings and transcripts of visits (only when recording is available, and only if you choose to record)
• Insights Steady generates from the above (for example, a pattern worth raising with your doctor)

2. How we use it

• To remember and organise your health history for you
• To make sense of your records and surface what’s worth raising with your care team
• To prepare you for appointments
• To provide and maintain the Steady service you asked for

We do not use your consumer health data for advertising or marketing, and we do not sell it.

3. Who we share it with

We share the minimum necessary, only with providers that help us run Steady:

• Anthropic, PBC — generates Steady’s replies. Receives your chat content and uploaded document content to answer your request. Operates under zero data retention: it does not keep your content after answering and does not use it to train its models.
• Railway (Railway Corp.) — stores your data securely.
• Clerk, Inc. — handles sign-in (name and email only; no health data).
• Voice transcription (coming with recording): when recording launches, a dedicated provider will convert your recordings to text under the same zero-retention terms. We’ll name it here before the feature goes live.

PostHog, Inc. (our analytics tool) does not receive any consumer health data. It only receives usage events such as which screen you opened.

We do not disclose your consumer health data to advertisers, data brokers, or anyone not named here.

4. We do not sell your consumer health data

We do not sell your health data, and we have no plans to. If that ever changed, the law requires us to obtain your separate, written authorization first, and we would.

5. Your rights

You have the right to:

• Confirm whether we collect, share, or sell your consumer health data, and to access it.
• Withdraw your consent to our collection or sharing of your consumer health data at any time.
• Delete your consumer health data. When you ask, we delete it and instruct the providers above to delete it too.
• Not be discriminated against for exercising any of these rights. Using your rights will never get you worse service or a worse price.

How to exercise them: delete your account and data any time from your account icon → Delete account, or email hashim@withsteady.health for anything else. We’ll respond within 45 days (and will tell you if we ever need a short extension for a complex request). We won’t charge you for a normal request.

6. How we protect it

Your consumer health data is encrypted in transit and at rest. Access is limited to the small team that runs Steady and protected by multi-factor authentication. We collect only what we need to provide Steady to you, and we don’t keep it longer than we need to.

7. Contact

Steady is operated by STEADY HEALTH LTD (company no. 17302077), registered office 30 Churchill Place, London, United Kingdom, E14 5RE.

Questions or requests about your health data: hashim@withsteady.health.