Mai Consumer Health Data Privacy Policy

Mai was previously called Grace.

App: Mai (iPhone app, with home and lock screen widgets, Apple Watch app and iMessage stickers)
Effective date: 10 October 2026
Last updated: 12 October 2026

This policy is for people in Washington, Nevada, Connecticut and other places with consumer health data laws (for example the Washington My Health My Data Act and Nevada SB 370). It adds to our main Mai Privacy Policy. If the two differ on consumer health data, this policy applies to it. Mai is a wellbeing app, not a medical service.

Who we are: HOPIN.IT SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ (HopIn.IT sp. z o.o.), ul. Marsz. Józefa Piłsudskiego 74/320, 50-529 Wrocław, Poland. Contact: [email protected]

Where to find this page: it is linked from our main Mai Privacy Policy, which the app links from Settings › About and from the subscription screens.

1. What consumer health data Mai handles

1. Your mood picks. Mai lets you pick a mood (such as calm, anxious, tired, grateful, motivated, low or sad, confident, stressed). It stays on your device and tunes which affirmations you see. We do not receive it, and we do not send it to analytics or to any third party.
2. Your "About you" profile, if you turn on "Use my profile". Items you tell Mai about your life, goals, fears, relationships and feelings may include information about your mental or physical health. Mai stores the profile on your device. If you turn on "Use my profile", relevant items and your name are sent to AI providers when you use AI features (section 3). These requests go only to zero data retention endpoints: the providers may not store your profile or use it to train their models.
3. What you type or say in AI features (affirmations, the "tell me about your life" chat, stories and image prompts), which may describe how you feel or your health. Voice answers are converted to text on your device; only the text is used.
4. Feedback you choose to send about an AI result, if you include health-related information in it.

We do not collect biometric data, precise location, or data about health care services you receive. We do not use mood or health data for advertising and we do not sell it.

2. Why we collect it, and your consent

• To provide the feature you ask for: choosing affirmations on your device, and writing AI affirmations, stories, images and chat replies.
• To handle reports of harmful AI content, if you send feedback.

Consent. Mai asks for your permission before you first use any AI feature (text, images and stories), including your explicit consent to process any health information you type. If you say "Not now", nothing is sent. The "Use my profile" setting is off until you turn it on, and then Mai asks for your explicit consent to send your name and profile items to the AI providers below. You can withdraw either consent at any time: in Settings, AI & privacy, turn off AI features; and turn off "Use my profile". Nothing is sent from that moment.

We do not collect or share consumer health data beyond what is needed for these purposes without your separate consent.

3. Who receives it

Only when you use AI features, and only the content described above, Mai sends consumer health data to these processors, which process it only on our behalf under contract:

• Cloudflare, Inc. (USA), which runs our AI server. It does not store the text of your requests or replies.
• OpenRouter, Inc. (USA), which routes the request to a model host.
• AI model hosts chosen through OpenRouter: Amazon Web Services (Amazon Bedrock), Microsoft Azure, Mistral AI and Google Cloud (Vertex AI).
• Our text-to-speech provider (named on request at [email protected]), using a zero data retention endpoint, if you use story narration.
• Our internal support channel, if you send feedback that contains health information.

If you have allowed analytics, crash reports, app hangs and performance traces go to Functional Software, Inc. (Sentry, USA). They contain technical details only, not your mood, your profile or what you type.

We instruct our AI providers to use zero data retention endpoints for text, to deny data collection, and not to train on your data. For AI images, zero data retention is not guaranteed for every provider, which may keep requests for a limited time under their own terms. We do not use your health data to train AI models.

We do not sell consumer health data, and we do not share it with anyone else except as the law requires (for example a valid legal request) or in a merger or sale of our business, in which case this policy continues to apply.

4. Your rights

You can, by emailing [email protected] or [email protected] with your Support ID (shown on the Settings, AI & privacy, Delete my data screen; tap it to copy it):

• Confirm whether we collect, share or sell your consumer health data;
• Access it, including a list of all third parties and affiliates it was shared with and an email address or other way to contact them;
• Withdraw consent (you can also do this in the app, section 2);
• Delete it. We keep no consumer health data, profile or content on our servers; our AI server keeps usage counters that expire on their own (up to 2 days for daily counters, 48 hours for IP-based counters, 40 days for monthly counters and 24 months for free AI credit counters). Data on your device is deleted by you in the app (Settings, AI & privacy, Delete my data) or by deleting the app (main policy, section 10). For copies held by our providers (analytics, purchase records, crash reports, our support channel), email us and we will ask them to delete what they hold for your Support ID. Feedback cannot be traced to your Support ID, so to delete feedback, tell us its date and text. Data in iCloud is held by Apple; see the main policy for how to remove it.

We answer within 45 days. We will not charge you or give you worse service for using these rights.

5. Appeal

If we decline your request, you can appeal by replying to our answer with the subject "Appeal". We will answer within 45 days and explain the reasons in writing. If you are not satisfied, you can contact your state attorney general: in Washington, https://www.atg.wa.gov/file-complaint; in Nevada, https://ag.nv.gov/Complaints/File_Complaint/; in Connecticut, https://portal.ct.gov/ag.

6. Security

We limit access to consumer health data to what the features need. Connections use encryption in transit, the profile file is encrypted by iOS while your phone is locked, and our AI server keeps no request text. See section 14 of the main policy.

7. Changes

If we change this policy in a way that affects how we collect or share consumer health data, we will tell you in the app and get your consent where the law requires it. The "Last updated" date above shows the latest version.