Consumer Health Data Privacy Policy

# Consumer Health Data Privacy Policy

**Product:** Brainrise (the "Service")
**Operator:** Southwest CP Investment LLC, a Texas limited liability company ("Company," "we," "us," or "our")
**Version:** 1.1
**Effective Date:** August 16, 2026
**Last Updated:** 2026-08-24

**This is a separate policy, published separately from our general Privacy Policy, and linked from our homepage.** It describes how Company handles **consumer health data** as that term is used in Washington's My Health My Data Act (ch. 19.373 RCW) and comparable laws. It uses the same defined terms as the Brainrise Terms of Service ("Terms"), including "Parent," "Student," "User," "Account," and "AI Coach."

**Read this together with the Privacy Policy.** Where the two describe the same practice, they are intended to say the same thing; this policy governs consumer health data specifically.

---

## 1. Brainrise Is Not a Health Service

The Service is an educational study tool. **We do not ask for health information, we do not need it to provide the Service, and we ask Users not to submit it.** The AI Coach is not a crisis, counseling, medical, or mental-health service, does not ask unprompted questions about feelings or emotional state, does not infer or comment on a User's emotional or mental state, and does not hold itself out as helping with anxiety, stress, or mental health (see AI Disclosure and Student Safety Policy, Sections 5.1 and 5.6).

**We nevertheless publish this policy** because a Student typing freely into an AI study coach may volunteer health-adjacent information, and because the law treats information inferred by an algorithm the same as information a person types.

## 2. What We Treat as Consumer Health Data

We treat the following as consumer health data when it is linked or reasonably linkable to a User:

| Category | Examples that could appear |
|---|---|
| **Mental or behavioral health status, symptoms, or interventions** | Test anxiety, panic, stress, attention or learning conditions, therapy or counseling, self-harm or suicidal content |
| **Medications and treatments** | A medication named in passing in AI Coach chat |
| **Learning accommodations and disability information** | An IEP, a Section 504 plan, extended time, additional breaks, an assistive-technology need |
| **Bodily functions, vital signs, or physical health status** | Illness or a physical condition mentioned in chat or in a support message |
| **Data derived or inferred from non-health information** | Any of the above that our systems, including an automated safety rule or a machine-learning model, derive or infer from what a User writes |
| **Precise location that could reveal an attempt to obtain health services** | **We do not collect precise geolocation at all** (see Privacy Policy, Section 3) |

**Where we say we do not collect a category, we do not collect it.** This table describes what would be treated as consumer health data if it appeared, not a list of what we gather.

## 3. Where It Comes From (Sources)

Consumer health data, where it exists at all, comes only from:

(a) **free text a User types** into the AI Coach;
(b) **free text a User sends us** in a support message or feedback;
(c) **inferences our automated safety rules draw** from that text — for example, classifying a message as crisis-related; and
(d) **information a Parent voluntarily gives us**, for example in an accessibility or accommodation request.

We do not buy consumer health data, obtain it from data brokers, or receive it from any third party.

## 4. Why We Collect It, and What We Keep

We do not collect consumer health data for any commercial purpose. The only purposes are:

(a) **to generate a reply** in the AI Coach — the message is processed transiently and **is not retained by Company as a conversation transcript**; chat history exists only in the Student's browser session;
(b) **student safety and abuse prevention** — where an automated safety or misuse rule is triggered, we retain a **short excerpt of the triggering message (no more than 500 characters), the rule category, and a timestamp**, and nothing else;
(c) **to answer a support or accommodation request** you send us; and
(d) **to comply with law**, or where we believe in good faith it is necessary to prevent imminent harm.

**Retention.** Safety-rule excerpts are deleted after **12 months**, and are also deleted when the Account is closed or on a valid deletion request. Support records are deleted after **24 months** from the last interaction. These timeframes are enforced by an automated deletion process. See Privacy Policy Section 9.

## 5. Consent

**We obtain your consent to collect consumer health data separately from your acceptance of the Terms of Service, through its own distinct control.** Accepting the Terms, creating an Account, or checking any box that accepts another document does not constitute consent to collect consumer health data.

**We do not share consumer health data**, so we do not ask for a sharing consent. If that ever changes, we will obtain a **separate and distinct consent to share**, presented apart from the collection consent and apart from acceptance of any other document, and we will update this policy first.

**You may withdraw consent at any time** by emailing southwest@southwestcpinvestment.com. Withdrawal takes effect prospectively and does not affect processing already carried out.

## 6. Who Receives It

**We do not share consumer health data with any third party for that third party's own purposes.** The only parties that process it, and only on our instructions and only to provide the Service, are the subprocessors listed in Privacy Policy Section 10 — currently **Supabase** (database and backend), **Cloudflare** (hosting and AI inference), and **Meta Llama 3.3 via Cloudflare Workers AI** (generates the AI Coach reply). **Stripe** and **Resend** do not receive AI Coach content.

**We collect no category of consumer health data for the purpose of sharing it.**

We may disclose consumer health data where required by law, in response to a lawful request, or where we believe in good faith it is necessary to prevent imminent harm to any person — as described in the AI Disclosure and Student Safety Policy.

**Company has no corporate affiliates with whom consumer health data is shared.**

## 7. We Do Not Sell Consumer Health Data

**Company does not sell consumer health data, has never sold it, and does not seek or accept any authorization to sell it.** We do not exchange consumer health data for money or other valuable consideration with any person.

Because we do not sell, we do not ask any User to sign a written authorization to sell consumer health data. **If any person ever presents you with such a document in Company's name, it is not ours — report it to southwest@southwestcpinvestment.com.**

## 8. No Geofencing

**Company does not operate, and will not operate, a geofence around any health care facility, and does not use any geofence to identify, track, collect data from, or send notifications or advertisements to any consumer related to their consumer health data.** The Service does not collect precise geolocation at all.

## 9. Your Rights

You (or, for a Student under 18, the Parent, and for a Student who has reached 18, the Student directly) have the right to:

(a) **confirm** whether we collect, share, or sell your consumer health data, and **access** it, including a list of all third parties and affiliates with whom we have shared it and an active contact for each;
(b) **withdraw consent** to our collection and any sharing of your consumer health data; and
(c) **delete** your consumer health data.

**How to exercise them.** Email **southwest@southwestcpinvestment.com** with the subject line "Health Data Request." We will verify the request, and:

- **respond within forty-five (45) days**, extendable once by a further forty-five (45) days where reasonably necessary, in which case we will tell you before the first period ends;
- on a **deletion request, delete the data from our active systems and instruct our subprocessors to do the same**, and confirm to you when it is done. **Where a copy of the data persists in an encrypted, access-controlled backup or archive that cannot be selectively edited, we do not restore that copy into any active system, we do not use it for any purpose, and it is overwritten in the ordinary course of our backup rotation within ninety (90) days.** Backup deletion follows the same schedule as Privacy Policy Section 9, and legal holds are as described there. **Where the request is a Parent's request to delete a Student's personal information, we act on the shorter timeframe in the Privacy Policy — within thirty (30) days of verifying the request — and the 45-day period above does not extend it;** and
- **not charge you** for the first two requests in any twelve-month period.

**Appeal.** If we decline a request, we will tell you why in writing and how to appeal. We will decide an appeal within **forty-five (45) days**. If we deny the appeal, we will give you a method to contact the Washington Attorney General, or your own state's Attorney General, to submit a complaint.

**We make these rights available to every User, in every state**, whether or not their state's law requires it.

## 10. Changes to This Policy

We may update this policy from time to time. **We will not collect, use, or share consumer health data in any way that materially differs from what this policy said at the time we collected it, unless we first obtain your affirmative consent.** Material changes will be posted with a new version number and a new "Last Updated" date.

## 11. Contact

Southwest CP Investment LLC
7301 State Highway 161, #148, Irving, TX 75039
Consumer health data requests and questions: **southwest@southwestcpinvestment.com**

---

*This policy is part of the Brainrise legal pack and should be read together with the Privacy Policy and the AI Disclosure and Student Safety Policy.*