Consumer Health Data Privacy Notice

1. What this notice is

This Consumer Health Data Privacy Notice explains how Menthra Inc. ("Menthra," "we") collects, uses, shares, and protects information that qualifies as consumer health data under laws including:

• Washington's My Health My Data Act ("MHMDA"), RCW 19.373
• Nevada's Consumer Health Data Privacy Act ("NHDPA"), SB 370 / NRS 603A.300 et seq.
• Comparable consumer-health-data provisions in other US state privacy laws

Consumer health data under these laws is broader than "Protected Health Information" under HIPAA. It includes information that identifies your past, present, or future physical or mental health status — including information you provide to an AI wellness companion, mood signals you log, and inferences derived from those interactions — regardless of whether Menthra is acting as a HIPAA-covered entity at the time.

This notice is in addition to, and does not replace:

• Our general Privacy Policy
• Our HIPAA Notice of Privacy Practices (which applies when Menthra processes data as a HIPAA-covered entity or business associate)
• The individual consents catalogued in our Consent Center

Where this notice and the Privacy Policy describe overlapping practices, the protections in this notice apply to consumer health data specifically.

2. Consumer health data we collect

The categories of consumer health data Menthra may collect include:

• Conversation content with AI Companions (text and voice transcripts) where that content discusses mental-wellness state, symptoms, history, treatment, or related topics.
• Mood, energy, and check-in signals you choose to log in the app.
• Self-reported information you provide during onboarding, profile setup, or in-session — including any history of conditions, prior care, medications, or family/social context you choose to share.
• Crisis-detection signals generated when our safety classifier identifies language patterns associated with crisis. We retain the classification result and the surrounding context as required to deliver crisis support and meet our duty of care.
• Session metadata — timestamps, duration, companion style chosen, language of session, device type.
• Inferences drawn from the above — for example, pattern observations surfaced in your Insights view.
• Where you provide it explicitly: precise or approximate location (used only for crisis routing to local emergency resources), demographic information, payment information for clinical sessions, and information you share when connecting with a licensed therapist or coach.

3. Where this data comes from

• Directly from you — when you converse with a Companion, log a mood, complete onboarding, or share information during a coaching or therapy session.
• From your device — session metadata, language preference, IP-derived approximate location for crisis routing.
• From Menthra's safety and quality systems — crisis classifier output, automated pattern detection used for Insights, and human review by our clinical quality team when triggered by safety events.
• From a licensed clinician on Menthra — clinical notes, assessment results, and care plan records, where you have engaged with a Menthra clinician. This data is governed primarily by HIPAA and our HIPAA Notice of Privacy Practices, and additionally by this notice as consumer health data.
• From an organization that provides Menthra to you (employer, school, clinic) — only the minimum information required to enroll you and verify eligibility. Conversation content is never shared back with the organization.

We do not purchase consumer health data from data brokers, marketing lists, or third-party advertising networks.

4. How we use consumer health data

We use consumer health data only for the purposes you would reasonably expect from a wellness companion platform, and only as described below:

4.1 Service delivery

• Operating the AI Companion conversation, including memory carrying from session to session.
• Surfacing Insights and patterns observed across your sessions.
• Connecting you with coaches or licensed therapists you choose to engage with, and providing them the context you authorize.
• Routing crisis sessions to our on-call Care team and, where authorized or required, to emergency services and crisis hotlines.

4.2 Safety

• Running the crisis classifier in front of every Companion conversation.
• Human review by our clinical quality team of conversations flagged by automated systems for safety, accuracy, or boundary concerns.
• Maintaining a record of safety events as required to meet our duty of care and applicable law.

4.3 Quality and improvement

• De-identified analysis of aggregate usage patterns to improve the product.
• Targeted quality review of specific conversation patterns where required to debug an issue or improve safety. This review uses the minimum data necessary and is performed by a small team under written confidentiality obligations.

4.4 What we do not do

To be explicit, Menthra does not:

• Sell consumer health data. We have not, do not, and have no plans to.
• Share consumer health data with advertisers, ad networks, or marketing platforms. There is no Meta, Google, TikTok, or similar advertising pixel that receives conversation content, mood logs, or any consumer health data signal from the Menthra app or this website. Marketing pixels on our public marketing pages do not have access to your account or your conversations.
• Use consumer health data to train foundation AI models — ours or anyone else's. Your conversations are not used as foundation-model training data.
• Provide consumer health data to data brokers.
• Disclose consumer health data to your employer, school, or organizational sponsor. Organizations that fund Menthra access for their members receive only de-identified aggregate engagement statistics, never individual consumer health data.

If we ever propose a use of consumer health data that falls outside the categories above, we will obtain your specific, separate, prior consent — and for sales of consumer health data, the signed authorization MHMDA § 7 and NHDPA equivalent require. Standing consent to this notice is not sufficient for any of those uses.

5. Sharing of consumer health data

We share consumer health data only with the following categories of recipients, only as needed, and only under written agreements that bind them to the same protections in this notice:

• Service providers ("processors") that operate cloud infrastructure, voice and language models, payment processing for clinical sessions, communication (e.g. transactional email and SMS), and observability. A current list is published in our Subprocessors page.
• Licensed clinicians on Menthra whom you have engaged with, only as needed to deliver the care you have requested.
• Crisis support services and emergency responders — only where you have authorized us to do so at registration, where you are in active crisis, or where law requires.
• Authorities — only where we are legally compelled (subpoena, court order, or specific statutory obligation), and we will challenge overbroad requests where appropriate.
• A successor entity in the event of a merger, acquisition, or restructuring — but only if the successor agrees in writing to maintain at least the protections in this notice. If a successor would not commit to those protections, we will not transfer consumer health data.

6. Your consumer health data privacy rights

Under MHMDA, NHDPA, and comparable laws, you have the following rights with respect to your consumer health data. You can exercise every right below from your account, without contacting support. If you do not have an account, see Section 8 for how to request access.

6.1 Right to access

Request a copy of the consumer health data Menthra holds about you, including categories collected, sources, recipients with whom it has been shared, and the purposes for which it has been used.

6.2 Right to delete

Request deletion of your consumer health data. We honor deletion requests within the statutory timeframe (no later than 30 days for MHMDA; sooner where possible). We will also direct any service provider that received the data on our behalf to delete it. Note that records we are legally required to retain (for example, records of a crisis intervention, or records subject to a litigation hold) may be retained for the minimum period required by law and remain protected under this notice.

6.3 Right to withdraw consent

Withdraw any consent you have previously given for the collection or sharing of your consumer health data, with prospective effect. Withdrawal is as easy as the original opt-in and is available from your account at any time. Withdrawing consent does not invalidate processing carried out lawfully before the withdrawal.

6.4 Right against discrimination

We will not deny you service, charge you a different price, or provide a different quality of service because you exercised a right under this notice. The only exception is where consumer health data is reasonably necessary to deliver the feature you are requesting — for example, you cannot have an AI Companion conversation while simultaneously refusing the collection of that conversation as consumer health data. Where that necessary relationship exists, we will explain it transparently before you act.

6.5 Right to appeal

If we decline a rights request, you may appeal in writing to privacy@menthra.ai. We will respond within 45 days with our reasoning and, if our decision stands, your options for further escalation, including to your state Attorney General.

6.6 Where to exercise these rights

• From inside the app: Settings → Privacy → Data Rights. Access, delete, withdraw, and appeal options are all there.
• By email: privacy@menthra.ai.
• Through our Consent Center: menthra.ai/legal/consents.

7. Security and retention

Consumer health data is encrypted at rest and in transit. Our broader security posture is documented in our Security overview.

Staff access to consumer health data is governed by a documented internal policy with role-based controls, trigger requirements, immutable access logging retained for at least seven years, quarterly cross-officer review, and explicit prohibitions on uses such as model training, demos, or external AI tools. No Menthra staff member has standing access to consumer health data; every read requires a specific documented trigger and a reason code. Emergency ("break-glass") access is permitted only for active life-safety situations and is reviewed within 24 hours.

Menthra maintains demonstrable role-based access controls over user content, as required by the Washington My Health My Data Act, the Nevada Consumer Health Data Privacy Act, and similar consumer health data laws. The full Staff Access to User Content Policy — including the role-based access matrix, the trigger list that justifies access, the access logging requirement, the break-glass procedure for emergencies, and the absolute limits binding every Menthra staff member — is published at menthra.ai/downloads/staff-access-to-user-content.md.

We retain consumer health data only as long as needed to provide the service, comply with our legal obligations (including duty of care for crisis events), and resolve disputes. When the retention purpose is satisfied, we delete or de-identify the data per our retention schedule.

If a breach of consumer health data occurs, we will notify affected individuals and applicable regulators within the timeframes required by law — including the 60-day requirement under MHMDA and equivalent timelines under NHDPA and HIPAA where applicable.

8. If you do not have a Menthra account

If you believe Menthra holds consumer health data about you and you do not have an account from which to exercise rights, write to privacy@menthra.ai with enough information for us to identify you (typically: name, email associated with any prior account, and a description of when you used Menthra). We may need to verify your identity before acting on a request.

10. Contact and updates

• Privacy Officer: privacy@menthra.ai
• Postal address: Menthra Inc., Frisco, TX, United States
• For Washington residents: You may file a complaint with the Washington State Attorney General's Office.
• For Nevada residents: You may file a complaint with the Office of the Nevada Attorney General.

Material changes to this notice are recorded in our Legal Changelog and, where they affect the rights described above, communicated to you directly. The current version is shown at the top of this page.