Consumer health data privacy policy

Effective 1 November 2026

This policy is for people in Washington State, Nevada and other US states with consumer health data laws, including Washington's My Health My Data Act. It adds to our privacy policy, which covers everything else. Redeem Labs Ltd (trading as Redeem), 128 City Road, London EC1V 2NX, United Kingdom, is responsible for this data. Contact us at support@getredeem.app.

What health data we collect

Redeem doesn't ask about your health. But a prayer request can say something about your physical or mental health, for example if you choose the Health or Anxiety topic or mention an illness in your note. We treat that as consumer health data:

• Prayer requests: the topic you choose, your note (up to 140 characters), whether it was answered and any praise word you pick.
• Safety records: if a request suggests someone may be at risk, our safety record of it.
• Problem reports and feedback: anything about your health you choose to write in a message to us.

What you tell Redeem about how you're feeling before a prayer stays on your iPhone, and we never receive it. We don't use location data and we don't geofence.

Where it comes from

Only from you, when you write a request or send us a message.

Why we use it

• To show your request to other Redeem users for 2 days, so they can pray for you, and to keep it in your history.
• To check requests before they're shown, and to offer help if someone may be at risk.
• To answer your message.

We never use it for advertising, and we never send it to analytics. Our usage counts never contain prayer text or topics.

Who receives it

• Other Redeem users see your request for 2 days, as coming from "Someone in" your country, never with your name.
• Our service providers process it only on our instructions and under contract: Supabase (hosting, UK), OpenAI (the automated check of request text before it's shown, US), Cloudflare (encrypted backups, EU), and Telegram and Resend, which deliver our team's internal alerts (these contain only an internal member number and the request's topic, never its text). The full list is in our privacy policy.

We have no affiliates that receive it. We never sell consumer health data, and we don't share it with anyone else for their own purposes.

Your consent

We collect it only with your consent, which you give when you tap "I understand, share it" before your first request. You can withdraw it at any time by deleting a request or your account in the app.

Your rights

You can:

• confirm whether we hold your consumer health data, and get a copy of it, plus a list of everyone we've shared it with (including their contact details);
• withdraw your consent;
• ask us to delete it. We delete it from our systems and tell our service providers to do the same. Backups are deleted within 90 days.

Email support@getredeem.app with your support code (in Settings, under Contact us), or delete it yourself in the app. We'll reply within 45 days. If we need longer, we'll tell you why within those 45 days, up to 45 more days in total. We may check the request comes from you, using your support code.

Appeals. If we turn down your request, reply to our email with "Appeal" in the subject within 45 days. We'll give you a written answer within 45 days of receiving it. If you're still unhappy, you can contact the Washington State Attorney General at atg.wa.gov/file-complaint, or your state's attorney general.

We won't treat you differently for using any of these rights.