Consumer Health Data Policy

Draft, published early on purpose. This text has not yet been through outside counsel. It is here before launch so the commitments can be read and challenged while they are still cheap to change. Dated wording and a final review land before the network opens.

What counts as consumer health data here

Anything that identifies your past, present or future physical or mental health status — including things you write about yourself in the Recovery Room: burnout, depression, anxiety, substance-use recovery, injuries, fertility treatment, medications, diagnoses. Under Washington's definition it also covers information that could be inferred about your health, which is the part most platforms quietly fail.

What we collect

What you write. Posts, comments and anything you put on your own page. You wrote it; it is stored so it can be shown.
Nothing else. We do not collect health data from any other source, we do not buy it, and we do not receive it from your employer.

What we never do

No inference. We do not derive health topics, interests or conditions from what you read, post, search or linger on. There is no interest graph.
No ranking or recommendation. The feed is chronological and scoped by rooms and places you chose. There is no "for you" surface anywhere in the product, and no system that learns from the Recovery Room to decide what to show you next.
No targeting. We do not run behavioural advertising and do not build audiences from health topics.
No sale. We do not sell consumer health data. Not to data brokers, not to health systems, not to researchers, not de-identified, not as "insights". A sale would require a signed authorization under RCW 19.373 — we are not building the mechanism to ask for one, because we are not going to do it.

Who it is shared with

Service providers who operate the platform under contract — hosting, error monitoring, payment processing once the marketplace exists — limited to what the service needs, bound not to use it for anything else. We will keep a current list of those categories on this page. Otherwise: nobody.

How long it is kept

What you posted, for as long as you leave it up. Delete a post and it goes. Delete your account and your page, your verification record and your signing credential go with it — and any story you had claimed stops being claimed and goes back to anonymous. Stories you never claimed are not linked to your account in the first place, so account deletion does not reach them; the delete flow lets you take them down first, and afterwards nobody can find them, including us. The full account is in what we store.

Your rights

You can ask us to confirm what consumer health data we hold about you, to delete it, and to withdraw consent for its collection or sharing. One limit, stated rather than discovered: we cannot answer such a request about your pseudonymous posts, because we cannot tell which posts are yours — only your own device can. Those you read, export and delete yourself, and the answer we can give you is that we hold nothing linking them to you. Requests go to joel@statuspostcollective.com and we answer within the statutory window. If we deny a request you can appeal to the same address, and if we deny the appeal we will tell you how to complain to the Washington Attorney General.

Why a hospital worker should care about a Washington statute

The law gives Washington residents a private right of action, which makes it the sharpest consumer health data rule in the country. We apply this policy to every member regardless of state, because operating two standards would mean designing the weaker one.