State: Consumer Health Data Privacy Policy
Last updated: 2026-08-06.
This is a separate policy required by Washington's My Health My Data Act and Nevada's consumer health data law (SB 370). It sits alongside our main Privacy Policy and covers the same practices from the angle those laws require. Where the two documents describe the same thing, they agree; if you ever find that they don't, the more protective reading is the one we'll honor.
We apply everything in this policy to every user, not only to residents of Washington and Nevada.
What we mean by consumer health data
State is a text assistant that helps you get into and out of mental states, focus, calm, confidence, energy, motivation, using techniques you record yourself. It is a performance and self-management tool. It is not therapy, not medical care, not diagnosis or treatment, and it makes no claim to improve or treat any clinical or behavioral health condition.
That said, the information you give us describes your mental states, so we treat it as consumer health data under these laws and give it the protections below. We would rather over-apply the protection than argue about the category.
1. Categories of consumer health data we collect, and why
| Category | What it is | Why we collect it |
|---|---|---|
| Mental state information | The states you tell us you want more or less of, how you're feeling when you text, and intensity where you give it | To understand what you're asking for and reply usefully |
| Behavioral and self-management interventions | Your recipes and routes, the specific things you do to change state, and whether they worked | This is the product: State recommends your own techniques back to you |
| Free-text messages | Anything you write, which may describe your health, circumstances or state of mind | To generate a reply |
| Derived and inferred information | Notes the assistant writes summarizing what it has learned about you, and patterns across your logged states | So it doesn't ask you the same questions repeatedly |
| Crisis-related signals | Whether a message matched our fixed crisis-detection patterns | Safety: to reply with crisis resources before the AI sees the message |
We do not collect biometric data, precise location, health records, diagnoses, prescription information, insurance or payment data, or data from any wearable, health app, calendar or other outside source.
2. Where the data comes from
Only from you, and only through messages you send State or entries you make on the island web page at island.stateagent.co.
We receive nothing from data brokers, advertising networks, health providers, employers, insurers, other apps, or any other outside source. State has no integrations that import your data from anywhere.
3. What we share, with whom, and why
We do not sell consumer health data. Under Washington law, selling consumer health data requires a signed authorization; we do not seek one, because we do not sell it.
We do not share it for advertising, and we use no advertising or analytics services of any kind.
We share it only with the service providers required to operate State, each of which processes it on our instructions:
| Category of recipient | Specific company | What they receive |
|---|---|---|
| Messaging delivery | Sendblue | Message content and your phone number |
| AI model provider | Anthropic | Recent messages, profile and recipes, assistant notes |
| Database hosting | Supabase | All stored data |
| Application hosting | Railway | Data in transit through the application |
| Cache and rate limiting | Upstash | Profile data briefly, phone number in counters |
| Web page delivery | Cloudflare | IP address and browser details on the island page |
| Web search (when the assistant searches) | Anthropic's search infrastructure and the sites in the results | A search query derived from your request |
We have no affiliates. We share nothing with any parent, subsidiary, or related company, because none exist.
A disclosure we owe you about Sendblue. Sendblue's current public terms permit them to use customer data to improve their own services, which is broader than a service provider acting solely on our instructions. We have asked them for a written agreement removing that right and setting a retention limit. Until that is signed, we are disclosing it here rather than describing them as a purely purpose-limited processor. We will update this policy and its date when it changes.
Legal process. We will disclose data if required by valid legal process, and will tell you unless prohibited.
4. Your rights
You have the right to:
- Confirm whether we are collecting, sharing or selling your consumer health data, and access it, including a list of everyone it's been shared with;
- Withdraw consent to our collection and sharing of it;
- Delete it, including from our backups and from our service providers;
- Appeal if we refuse a request.
How to use them. Text State, or email dylanbryan2002@gmail.com. We will respond within 45 days. If we need more time we will tell you why, and take no more than an additional 45 days.
Deletion specifically. Text DELETE to State. During the beta, deletion is processed by hand within 7 days, we notify our service providers to delete their copies, and we text you when it's done. Two limits we won't paper over: encrypted backups age out over up to 6 months, and messages already delivered to your phone or held in carrier systems cannot be recalled by anyone.
Appeals. If we deny a request, reply to our response or email us the word "appeal." We'll give you a written decision with our reasoning. If we deny the appeal, you may contact the Washington State Attorney General at www.atg.wa.gov/file-complaint or the Nevada Attorney General.
5. Consent
We ask for your consent to collect this data when you sign up, separately from any terms of service, and we do not treat continuing to use State as consent by itself. We ask again, separately, before any use beyond replying to you, and today there is no such use.
You can withdraw consent at any time by texting State. Withdrawing consent stops collection going forward; if you also want what we already hold removed, text DELETE.
6. Who can see it inside the company
Access is limited to the people who need it to run the service. We do not read conversations casually and there is no internal browsing tool. Access happens to fix a bug, investigate abuse, answer a support request from you, or comply with a legal order.
Changes
We'll post changes here with a new date.
- 2026-08-06: First published.
Contact
Text State, or email dylanbryan2002@gmail.com.