This policy explains how Consequential Flowers LLC ("Consequential Flowers", "we", "us" or "our") handles consumer health data, as defined by Washington's My Health My Data Act and Nevada's consumer health data law, in PRIM, our AI mentor. Our Privacy Policy explains how we handle other information.
1. The consumer health data we collect, and why
When a member sends a message in PRIM, an automated check gives the message a safety level, with a short written reason. The safety level shows whether the message may contain signs of crisis, such as thoughts of suicide or self-harm (including eating disorders), harm to others, or abuse. This safety level is the only consumer health data we collect.
We use it only to keep members safe: to show crisis resources, to adjust PRIM's reply, and to count, without names, how often the crisis safeguard is triggered, including for reports the law requires.
Conversations are free text, and a member may choose to share health information in them. We do not ask for it, and we do not identify, classify or track it.
2. Where it comes from
The safety level is created by our systems from the messages you send in PRIM.
3. Who we share it with
We do not sell consumer health data. We share it only:
a) with the service providers that process it for us to run PRIM, under contracts that limit them to our instructions: our cloud hosting provider, which stores it, and our AI model provider, which decides the safety level;
b) if we decide in good faith, case by case and never through an automated PRIM feature, that sharing a conversation is necessary to prevent serious and imminent harm to someone's life or safety;
c) when the law requires it, such as a valid court order or subpoena; and
d) as part of a sale or merger of our business, under the same protections.
We have no affiliates that receive consumer health data. Your organization never receives your safety levels. It is told only how often the crisis safeguard was triggered, as a range, for groups of 10 or more members, which does not identify anyone.
4. Your rights and how to use them
You may:
a) confirm whether we collect or share your consumer health data, and get a copy of it, with a list of everyone we have shared it with and how to contact them;
b) ask us to delete it. We delete it from our live systems within 45 days, and from our backup systems within 6 months; and
c) withdraw consent. The safety level is necessary to provide PRIM, so if you do not want it collected, you may stop using PRIM and ask us to delete your data.
To make a request, email hello@consequentialflowers.com from the email address you use for PRIM. We will verify your identity and respond within 45 days. If we need more time, we will tell you, and we may take up to 45 more days.
If we decline your request, you may appeal by replying to our decision within 30 days. We will answer your appeal within 45 days. If we deny it, you may contact the Washington State Attorney General at www.atg.wa.gov.
5. Changes to this policy
If we change this policy, we will post the new version here with a new effective date. We will tell PRIM members, by email and in PRIM, before a material change takes effect.
6. Contact
Consequential Flowers LLC, 650 Clark Avenue, King of Prussia, PA 19406, United States. Email: hello@consequentialflowers.com.