Consumer Data Addendum

Why this Addendum exists

Some state laws define "consumer health data" very broadly — broadly enough to include general personal information that is not collected for any health, medical, or clinical purpose. Washington State's My Health My Data Act is one such law: its definitions can sweep in everyday data such as self-recorded moods or reflective notes, regardless of why that data was collected or how it is used.

Arbor is a journaling and emotional-exploration tool that uses AI. It is not a health, medical, clinical, diagnostic, or treatment service, and the data described in this Addendum is not collected, used, or intended for any health, medical, diagnostic, or treatment purpose. This Addendum exists solely because the broad statutory definitions referenced above may reach a generalized category of the personal data Arbor handles for self-reflection. Providing this Addendum is a matter of regulatory compliance and transparency; it is not a representation that Arbor is a health product or that the data it handles is health information in any ordinary sense.

1. Scope

This Addendum applies to the generalized category of personal data that a broadly worded consumer health data law may reach. For clarity and to avoid any ambiguity, Arbor applies the protections in this Addendum uniformly to all users, rather than attempting to determine any individual user's state of residence. Arbor does not collect precise geolocation and does not use location data to determine state residency or to geographically segment privacy rights.

2. The categories of data this Addendum covers

The following user-created data could fall within a broad statutory definition of "consumer health data." All of it is created by you, for your own self-reflection, and none of it is collected for a health, medical, or clinical purpose:

• Emotion logs — feeling labels you select, a pleasant/painful lean, an intensity rating you assign, and any free-text note you choose to write.
• Reflection session content — your messages within a reflection (Sage) session and the automated responses generated for you, along with session records and any automated summaries.
• Values — value themes surfaced through your reflections.
• Goals and check-ins — behavioral goals you set and the check-ins you record against them.
• Ways of Being entries — intentions and reflective notes you author, and the tending check-ins you record, which may include an optional feeling and intensity at the time of check-in.

3. How this data is collected

This data is collected only when you create it — by logging an emotion, writing a note, having a reflection session, setting a goal, or recording a check-in. Arbor does not derive, infer, purchase, or acquire this data from any outside source. It comes entirely from your own voluntary entries within the app.

4. How this data is used

This data is used solely to provide the Arbor experience to you: to display your own entries back to you, to power your reflection sessions, to surface patterns in your own self-recorded data, and to operate the goal and check-in features. It is not used for advertising, and it is not sold.

5. How this data is shared

Arbor does not sell this data and does not share it for advertising or any cross-context behavioral advertising.

This data is processed by a small set of service providers strictly to operate the app on your behalf:

• Supabase — secure database and storage.
• Anthropic and Google — AI processing that generates reflection-session responses and classifies the feelings you enter. Under Arbor's commercial API arrangements, this content is not used by these providers to train their models.
• Sentry and PostHog — limited technical processors for crash reporting and anonymous usage analytics. These providers do not receive the content of your entries, your name, email, or account identifier. Sentry receives crash diagnostics with no identity attached. PostHog receives anonymous, per-device behavioral signals (such as that a reflection entry was completed) with no account linkage and with your IP address discarded.

These providers act on Arbor's behalf under contract and may not use your data for their own purposes.

You can export your own data. Arbor includes a "Share Log" feature that lets you generate a summary of your own entries and export it through your device's standard share options. When you use this feature, you choose whether to export, what time period to include, and — through your own device — who receives it. This is a user-directed export of your own data, comparable to saving or emailing your own file. Arbor does not transmit this data to any recipient on its own; it prepares the document and hands it to your device for you to direct. Any recipient information you save is stored only on your own device, never on Arbor's servers.

6. Your rights regarding this data

Consistent with the Arbor Privacy Policy and applicable law, you may:

• Access the data Arbor holds about you, and export it via Settings (the in-app settings menu). If any information is not included in the automated export, you can obtain it by request to the Privacy Officer (Arbor AI's designated privacy contact) at support@yourarbor.app.
• Delete this data and your account at any time via Settings or by contacting support@yourarbor.app. Deletion of active data is irreversible; residual encrypted backup copies are purged on our standard rotation schedule, typically within 30 to 90 days. When required by law, we will also notify our service providers and other recipients with whom covered data was shared so they can delete it from their systems, subject to lawful backup and security-retention limits.
• Withdraw consent to collection at any time. Because this data is only created by your own entries, you may stop creating it at any time, and you may delete what already exists. Withdrawing consent and deleting your data will end your ability to use features that depend on it.

To exercise any of these rights, use the in-app tools under Settings → Data & Privacy, or email support@yourarbor.app. We will verify that the request comes from you (or your authorized agent) before acting on it, and we will respond within the timeframe required by applicable law.

Appeals. If we deny your request, you may appeal by emailing support@yourarbor.app with "Privacy Appeal" in the subject line, along with your account email address. We will review the appeal and respond within the timeframe required by applicable law. If we deny your appeal, we will provide information on how to contact the relevant regulator, such as your state attorney general, to submit a complaint.

7. Consent

Before Arbor collects the data described in this Addendum, you are asked to provide consent through an affirmative action that is separate from your acceptance of the Terms of Service (the "Terms of Service"). You may decline; however, because Arbor's core features consist of creating and reflecting on this data, declining means the app cannot function as intended.

8. No health-care relationship

Using Arbor does not create a therapist-client, provider-patient, or any other professional or health-care relationship. Arbor is not a healthcare provider, is not a HIPAA covered entity, and does not provide medical, psychological, psychiatric, or clinical services of any kind. Nothing in this Addendum should be read to suggest otherwise.

9. Contact

Questions about this Privacy Policy & Consumer Data Addendum: Arbor AI, LLC — support@yourarbor.app.