Draft. Effective on publication.
Sittings Consumer Health Data Privacy Policy (Washington) — DRAFT (publishes with the main policy)
This page covers "consumer health data" — information that identifies you and reveals something about your health — as Washington law defines it. It contains nothing else on purpose: Washington asks for this notice to stand alone. Our general privacy policy covers everything else.
What consumer health data Sittings can hold
- Health conditions or treatments you volunteer in a message's free text ("I'm on blood thinners").
- Structured health-intake answers, where enabled — asked only with your specific, affirmative consent at the moment of asking.
- Your consent record for those questions: your choice, region, IP address, and browser user-agent, kept as proof of the consent itself.
- Tattoo request details that can reveal health status even though they aren't health questions: the description and placement of the tattoo and reference images you send (a request can reference scars, reconstructive work, gender-affirming care, or similar).
Where it comes from
You directly (forms and messages); your artist, when they forward your email; and the email systems that carry that forwarded mail.
Exactly what it's used for
Storing your inquiry · showing it to the artist you contacted · AI parsing of the message text to size the request and draft the artist's reply · proving your consent · administering deletion. Nothing else. Never advertising. Never sold.
Exactly who can receive it
The artist you contacted; Supabase (storage); Vercel (transport); Anthropic (AI parsing of message text); Postmark, when live (email carriage). It is NOT shared with our analytics (PostHog), payments (Stripe), or any outreach tooling. To contact a recipient about your data, email us and we include their contact points in our response.
Your rights, and exactly how to use them
Email chapman@getsittings.com with "health data request." You can: confirm whether we process your consumer health data; access it (including the recipient list and how to reach them); withdraw consent for structured health questions; and have it deleted — from live systems promptly, and from backups no later than six months after we authenticate your request, with our processors notified.
- We verify you against the email of record (plus confirmation questions if needed) and respond within 45 days.
- Withdrawal vs deletion: withdrawal stops the structured questions and further use of your structured answers; health details you volunteered inside a message are part of the inquiry service you requested — to remove those, ask for deletion of the message.
- If we refuse anything, we say why. Reply "appeal" for a fresh review, answered with reasons and your right to contact the Washington Attorney General.
Consent, plainly
Structured health questions appear only where both the artist's region and your region permit them, and only after you give specific, informed, affirmative consent that names the purpose and recipients — collected at the moment of asking, withdrawable at any time. A privacy-policy update is never treated as consent; any expansion of health-data collection, use, or sharing gets fresh consent first.
One honest limit
Deletion produces a deletion record so the deletion itself is provable; for health-related deletions that record keeps only the minimum needed as proof — not the health content or its category.
A link to this page appears prominently on our homepage and on every surface where health questions can be asked.