Consumer Health Data Privacy Policy

What we treat as health information, why we collect it, who we share it with, and your rights. It sits alongside the Privacy Policy, which covers everything else.

LAST UPDATED OCTOBER 3, 2026

Who we are

Innerfolk, PO Box 102, Annapolis, MD 21012. If anything here is unclear, email support@innerfolk.co and a person will answer.

What this covers

Some of what you give Innerfolk can describe your physical or mental health. In Innerfolk, that can include:

• What you write in your journal, on the site or by email
• Your profile answers, including your chapters and what you tell us you are working on
• The code on a practitioner's card, if you joined with one
• When your sessions are, if you tell us
• Anything you place on your session page

We treat all of it as consumer health data under Washington's My Health My Data Act and similar state laws, whether or not a court would.

How we collect it

Only from you, when you write, answer or reply. We do not buy health information or collect it from anywhere else. Practitioners do not send us information about you.

How we use it

Only to provide what you asked for: choosing and sending your questions, keeping your journal, making your book, sending the emails you signed up for, and answering you when you write to us. We do not use it for advertising, and we do not use it to train AI models.

Who we share it with

Only the companies that run Innerfolk for us, each limited to that work:

Who	What they receive	Why
Google Workspace	Your journal and profile	Stores them
Postmark	Our emails to you, and answers you send by email	Delivers them
Squarespace	The pages you visit	Hosts the website
Vercel	Your sign-in	Runs sign-in
Stripe	Payment details, never your writing	Takes payments
Our print partner, once chosen	The writing in a book you ordered	Prints and mails the Edition

We never sell health information, and we never share it with advertising platforms, data brokers or practitioners. We share it with anyone else only when you choose to, such as an answer you tap to share without your name, or a session page link you create, or when the law requires it.

Your rights

You can ask us to confirm what we hold, give you a copy, delete it, or stop collecting it, and you can withdraw your consent at any time. Email support@innerfolk.co. We act within the time the law requires, and we will not ask you why. If we turn down a request, you can appeal by replying to our answer.

How long we keep it

Your entries stay until you ask us to delete them. When you do, we delete your account, your entries and every record connected to you within 30 days, and confirm when it is done. Weekly backups age out within twelve weeks.

How we protect it

Each member's writing is stored in a file of its own that nothing else can read across, and it is encrypted in transit. No one at Innerfolk reads your entries unless you ask us to, for example to recover something.

If something goes wrong

If your information is ever disclosed without your authorization, we will tell you as the law requires, including under the FTC's Health Breach Notification Rule.

Changes

We will email every member before changing how we use health information, and ask for your consent again where the law requires it.