Consumer health data privacy
Version 29 October 2026. DREAM TUESDAY LLC, Washington State, United States. Contact: hello@getavori.com. This separate notice applies when we process “consumer health data” protected by Washington’s My Health My Data Act or a comparable applicable law. It supplements the Privacy Notice and is subject to any stricter legal requirement. Employment-context exclusions and other statutory exemptions apply only where their actual conditions are met. A small business or invitation-only launch is not automatically exempt.
Information purposes and sources
Avori is a general work assistant, not a health-care or emergency service. We do not ask you to create a medical profile. However, prompts, messages, files, recordings, connected results or authorized browser pages can contain information about physical or mental health, symptoms, conditions, treatments, reproductive or sexual health, disability, medication, health-care searches, precise location revealing a health-service visit, or inferences from those materials. Content can identify you or another person. We do not operate a health-location geofence or use voice features to create a biometric identifier.
Sources are the people who supply or authorize the material, their permitted collaborators and connected services or pages, and results generated for their requested task. We use covered information only as necessary for the service you request and legally permitted related operation, or with the separate consent required by law. Do not provide another person’s sensitive health information without authority. The Terms’ restrictions on unsupported regulated data remain in force; incidental receipt still requires legal protection.
Sharing and limits
The health-information categories shared can be the relevant content, authorized task context, generated results and identifiers necessary to process and deliver your requested function. Necessary hosting/storage, selected AI or transcription providers, connector processors and delivery providers can handle those categories in their processor role under appropriate restrictions. The relevant provider categories and available routes are described in the Privacy Notice. People or independent connected services receive information only as you lawfully direct or separately consent. We have no affiliate identified as a routine health-data recipient in this notice.
We do not sell consumer health data, use it for advertising or health-based audience profiling, or authorize its use to train general-purpose models. We do not share it for an unrelated purpose through a general Terms acceptance. When law requires consent to collect or share, we obtain the required separate permission before the processing; a new category or purpose requires the legally required new notice and consent. A vendor route that cannot honor these restrictions is unsuitable for covered health data. Necessary processing to provide a requested service and legally defined processor transfers remain subject to their statutory conditions.
Rights requests and appeals
Where applicable, you can ask whether we collect, share or sell your consumer health data; access it and obtain the required recipient information; withdraw consent; and request deletion. Email hello@getavori.com with “Consumer health data request,” your account email and the requested action. Do not send medical records to verify identity. We use proportionate verification and a secure method for delivering responsive data. We respond within the applicable statutory deadline, explain lawful extensions or exceptions and direct processors and relevant recipients as required.
To appeal a refusal, reply with “Consumer health data appeal.” We provide a reasoned response within the applicable period and information about further review. You may submit a complaint to the Washington State Attorney General through atg.wa.gov. We do not discriminate for exercising protected rights. A deletion request covers applicable active data and legally required recipient instructions; controlled backup processing follows the law’s permitted timing and restrictions rather than an indefinite retention exception. Questions and withdrawals go to the same contact. Updates cannot themselves authorize a new category, purpose or sale.