Consumer Health Data Privacy Policy
Version 1.1 — 6 September 2026. This separate notice supplements our Privacy Policy for consumer health data, including where Washington’s My Health My Data Act or Nevada’s consumer health data law applies. KarmicCompass is operated by Diksha Dutt, Panchkula, Haryana, India. Contact: app.karmiccompass@gmail.com.
Data we collect and its sources
You may provide journal entries, chat messages, mood and wellbeing information, photographs, microphone recordings and transcripts, and account details such as your name, date of birth and country. We generate AI reflections, summaries, wellbeing inferences and crisis-related signals from the content you choose to submit. Account identifiers, consent choices, usage and subscription records may reveal that you use a wellbeing service. We receive purchase and entitlement events from Apple or Google through RevenueCat. We do not buy health information from data brokers, collect biometric templates, or use precise location to identify visits to health facilities.
Why we collect and use it
We use this information to provide the journalling and AI features you request, save and synchronise your records, return personalised output, apply safety safeguards, manage subscriptions, protect accounts, and fulfil access or deletion requests. Health-data and AI-processing consent are required before sensitive processing; notifications and crash reporting have separate choices. The entire App is for adults aged 18 and over. Product access requires a valid declared date of birth; parental approval cannot grant access. Declared age is not independently verified. Account support, data-access requests, consent withdrawal and deletion remain available to restricted accounts. We do not use consumer health data for targeted advertising, sell it, or create geofences around health facilities.
Who receives it
Google LLC provides Firebase storage, authentication and backend processing, and Vertex AI receives the text or media needed for the AI request. These are separate processing stages. Authorised operator access is limited to the purposes described in our Privacy Policy. RevenueCat and Apple or Google process subscription identifiers, status and purchase records. Expo receives notification delivery metadata and tokens when notifications are enabled. Google mail services process addresses and operational email messages. Sentry receives sanitised error diagnostics when enabled, rather than journal, photo, audio or chat bodies; failure-only backend diagnostics exclude account identifiers. These service providers may process data outside your state or country. The current provider register is linked below. We do not share consumer health data with independent advertisers or affiliates for their own marketing.
Your choices and rights
You can request confirmation of whether we collect or share your consumer health data, access to it, the third parties or affiliates with whom it has been shared and their contact information where applicable, withdrawal of consent, and deletion. Use Settings to review consent, export data or delete your account, or email app.karmiccompass@gmail.com. If locked out, use the account deletion page linked below. We verify requests using account access or an ownership-verification process; do not send health records or identity documents unless specifically necessary and requested. Withdrawing consent stops new consent-based processing but does not by itself erase previous records. Request deletion if you want those records removed.
Deletion and retention
Deletion covers account records, stored and derived health content, media and applicable processor copies through our erasure process. We restrict further processing while deletion is pending and retry failed processor deletions. Limited security, transaction and legal records may be retained where law permits; they are not a reason to retain your journal or chat content indefinitely. Backups and provider retention are subject to the limits described in the main Privacy Policy and retention schedule. We do not represent a deletion request as completed merely because an upstream provider request was sent. App-store subscription cancellation is separate from data deletion.
Requests, appeals and complaints
We aim to respond within 30 days and comply with applicable statutory deadlines. If we deny a request, we explain the decision and how to appeal. To appeal, email app.karmiccompass@gmail.com with “Consumer health privacy appeal” and the request reference; no new account is required. We review the appeal and provide a written result. You may also contact the Washington Attorney General or Nevada Attorney General using their official complaint channels. Exercising privacy rights does not waive legal remedies.
Changes
We publish the current version here and obtain new consent before introducing a new consent-based health-data purpose or sharing that requires it. This notice does not certify vendor agreements or replace our obligation to implement the rights described above.