Consumer Health Data Privacy Policy

Effective August 19, 2026 · Version 2.1

Using an HSV dating app says something about your health. We treat that fact, and everything you tell us about your HSV status, as consumer health data under the Washington My Health My Data Act, Nevada SB 370, and the Connecticut Data Privacy Act.

The short version: we collect the minimum, we encrypt it before storing it, we never sell it or use it for advertising, only two infrastructure providers ever touch it, and you can delete it — from backups included — whenever you want.

1. Who and What This Covers

This Consumer Health Data Privacy Policy explains how Subtxt LLC, doing business as Kind, handles consumer health data. It is published separately from our general Privacy Policy because the Washington My Health My Data Act requires a standalone document. It applies to everyone who uses Kind, and it gives residents of Washington, Nevada, and Connecticut specific additional rights described in Section 7.

Where this policy and our general Privacy Policy differ on consumer health data, this policy controls. Everything else about our data practices is in the Privacy Policy, and photo verification is covered in the Biometric Data Policy.

Kind is not a healthcare provider

Kind is a dating app, not a clinic, laboratory, testing service, health plan, or medical provider. We are not a covered entity or business associate under HIPAA, and the information you give us is not protected health information under HIPAA. We do not diagnose, test, treat, or advise on any health condition.

2. Consumer Health Data We Collect

"Consumer health data" means personal information linked or reasonably linkable to you that identifies your past, present, or future physical or mental health status. Because Kind is a dating app for people living with HSV, the following count as consumer health data:

Category	What it is	Source
HSV status	The fact that you use Kind at all, which reasonably implies an HSV diagnosis	Created when you register
HSV type	Oral or genital HSV-1 or HSV-2, any combination, or "Not sure" if you prefer not to specify	You provide it during onboarding or profile editing
Diagnosis year	The year you were diagnosed, if you choose to state it	You provide it during onboarding or profile editing
Health-adjacent self-description	Anything about your health you volunteer in your biography, prompts, voice note, or messages	You write or record it
Precise location inferences	We do not collect precise location. We derive an approximate city and distance only, and never use location to infer a visit to any health facility	Device location, with your permission, or entered manually
Bodily or biometric data	A transient facial geometry template measured during photo verification, never stored	Your reference photo and live capture

What we never collect

We do not collect test results, laboratory data, prescriptions or medication history, treatment or clinical records, symptom or outbreak tracking, reproductive or sexual health records beyond what you volunteer, gender-affirming care information, mental health records, insurance or claims data, genetic data, or any data about visits to any health facility. We do not track your location over time, and we do not buy health data from anyone.

3. Why We Collect It

We collect consumer health data only for these purposes, and only with your consent:

To let you display HSV information on your profile, if you choose to.
To let members filter and match on HSV type, which is the core function of the app.
To operate safety features, including moderation and fraud prevention.
To answer your support requests.
To fulfil your own access, correction, export, or deletion requests.
To comply with a legal obligation or to establish or defend a legal claim.

What we will never do with it

We will never sell consumer health data. We will never share it for advertising, targeted advertising, or cross-context behavioural advertising. We will never disclose it to a data broker, advertiser, insurer, employer, or credit reference agency. We will never use it to train a general-purpose artificial intelligence model. We will never use a geofence around any health facility.

Selling consumer health data would require a signed authorisation from you that meets the strict statutory requirements of RCW 19.373.030. We do not sell it, we have never sold it, and we have no plan to, so we will never ask you to sign such an authorisation.

5. Who We Share It With

We share consumer health data in only two situations.

With other members, because you chose to show it

Anything you put on your profile is visible to other Kind members, and anything you say in a message is visible to the person you send it to. You control what appears. We cannot control what another member does with information you show them, including taking a screenshot — share only what you are comfortable with another person seeing.

With processors that run the Service for us

Processor	Role	What it can see
Supabase	Database and file storage	Encrypted HSV fields only — the raw rows are ciphertext, and the keys are held separately
Railway	Application hosting	Data in transit through our API while a request is being served

Both are contractually bound to process the data only on our instructions, to protect it, and never to sell it or use it for their own purposes. No other processor receives consumer health data: our error monitoring, analytics, push notification, and payment providers are configured so that health fields never reach them.

We do not disclose consumer health data to any affiliate, third party, or government body except where we are legally compelled by a valid warrant, subpoena, or court order, or where disclosure is necessary to prevent an imminent threat to someone’s life or physical safety. Where we are permitted to, we will notify you before responding to a legal demand.

6. How We Protect It

HSV type and diagnosis year are encrypted at the application layer before they are written to the database, with encryption keys managed separately from the data.
All traffic is encrypted in transit with HTTPS/TLS.
Row-level security restricts which records any authenticated account can reach.
Access to production data is limited to authorised personnel with a genuine operational need, protected by multi-factor authentication, and logged.
Verification images and facial templates are never persisted at all.
The app offers an optional device biometric or passcode lock and screenshot protection on sensitive screens.

We retain consumer health data for as long as your account is active. When you delete your account, it is removed at the end of the 30-day grace period along with the rest of your data. No consumer health data survives in any post-deletion record: the deletion ledger we keep as proof that a deletion happened holds only display name (erased at permanent deletion), gender, city, join date, and any exit-survey reason — never HSV type, diagnosis year, or any other health field.

7. Your Rights Over Consumer Health Data

Wherever you live, you may at any time in the app: view the health information on your profile, change it, remove it, hide your profile, or delete your account and everything in it.

Washington residents (My Health My Data Act)

The right to confirm whether we collect, share, or sell your consumer health data, and to access it, including a list of every third party and affiliate with whom we have shared it and an active contact for each.
The right to withdraw consent to collection and to sharing.
The right to have your consumer health data deleted, including from our archives and backups. On a valid deletion request we will delete it from our live systems immediately, notify every processor holding it and require them to do the same, and ensure it is purged from backups on the next backup cycle and in any event within six months.
The right not to be discriminated against for exercising any of these rights.

Nevada residents (SB 370)

You have equivalent rights to confirm, access, know the third parties we share with, withdraw consent, and have your consumer health data deleted, including from backups.

Connecticut residents

Consumer health data is sensitive data under the Connecticut Data Privacy Act. We process it only with your consent, and you have the rights of access, correction, deletion, portability, and appeal described in our Privacy Policy.

How to make a request

Email info@kind.date with "Consumer Health Data Request" in the subject line. Tell us which right you want to use and give us the phone number or email on your Kind account so we can verify you. We will verify your identity before acting, respond within 45 days, and may extend once by a further 45 days where a request is complex, telling you why. Requests are free.

An authorised agent may act for you with written permission signed by you. If we deny a request, we will explain why and how to appeal. You may appeal free of charge by replying to our decision, and we will respond within 45 days. If we deny your appeal, you may complain to your state Attorney General.

8. Changes and Contact

We will post any change to this policy here with a new effective date and version number. We will not collect, use, or share consumer health data for a purpose that is materially different from the purposes in Section 3 without first obtaining your fresh consent.

Contact: Subtxt LLC, a Wyoming limited liability company, at info@kind.date.