Your State Privacy Rights
Last updated: August 9, 2026
App-owned notice
This page is maintained by Simply Mindfull Moments to describe the privacy rights we honor and how to use them. It is a description of our current practices, not legal advice or independent certification. It supplements our Privacy Policy.
Which law protects your health data here
“Not covered by HIPAA” does not mean unprotected. Health information falls into two different legal buckets, and what you write in Simply Mindfull Moments sits firmly in the second one.
Protected health information (HIPAA)
Information held by a healthcare provider, health plan or clearinghouse — or by a vendor working on their behalf. Used directly by you for your own self-care, Simply Mindfull Moments is none of those, so what you record here is generally not protected health information.
Consumer health data (state law)
Your mood check-ins, journal entries and anything else you record about your mental wellbeing. This is protected — by Washington My Health My Data, Nevada SB 370, CCPA/CPRA and similar state acts, plus the FTC Act and the FTC Health Breach Notification Rule.
What the difference means for you
- You get either way: access to your own data, a portable export, deletion, withdrawal of consent, no sale, no targeted advertising, and opt-in consent before sensitive data is processed.
- HIPAA would add: a Notice of Privacy Practices, an accounting of disclosures, amendment rights, and provider-side obligations such as workforce training and signed agreements with every vendor in the path.
Simply Mindfull Moments would become covered if a licensed clinician delivered treatment through it, if we engaged with an employer health plan as its business associate, or if insurance were billed. Those triggers and the gaps we would close are listed in the HIPAA readiness & gap checklist.
Rights we honor for everyone
Rather than gate these behind a residency check, we extend the following rights to every Simply Mindfull Moments user, wherever you live.
Know & access
Request the categories and specific pieces of personal data we hold about you.
Correct
Ask us to fix inaccurate account or profile information.
Delete & withdraw consent
Delete individual entries, your health data, or your entire account.
Portability
Receive a machine-readable export of your mood and journal data.
State-specific notices
Washington & Nevada — consumer health data
Mood check-ins, journal entries, and anything you record about your mental wellbeing are treated as consumer health data. We collect this data only to provide the features you use. We do not sell consumer health data, and we do not share it with third parties for advertising or profiling. You may request a list of any third parties we have shared your health data with, and you may withdraw consent and request deletion at any time.
California — CCPA/CPRA
California residents may request to know the categories and specific pieces of personal information we collect, request correction or deletion, and limit the use of sensitive personal information. Simply Mindfull Moments does not sell or share personal information as those terms are defined under California law, and we honor Global Privacy Control (GPC) signals as an opt-out request. We do not discriminate against you for exercising any right.
Colorado, Connecticut, Virginia, Oregon, Texas, Montana and similar states
You may confirm whether we process your personal data, access a portable copy, correct inaccuracies, delete your data, and opt out of targeted advertising, sale, and profiling with legal or similarly significant effects. We ask for your opt-in consent before processing sensitive data such as mental health information.
Illinois, Texas and biometric laws
Simply Mindfull Moments does not collect biometric identifiers, faceprints, voiceprints, or genetic data of any kind.
No sale, no sharing, no targeted ads
Simply Mindfull Moments does not sell your personal data, does not share it for cross-context behavioral advertising, and does not use your mood or journal content to train AI models or build advertising profiles. Because we do not engage in these activities, there is no separate "Do Not Sell or Share My Personal Information" process to complete — but you may still submit a request in writing and we will confirm this in our response.
How to submit a request
- Email us with the subject line "Privacy Request" and tell us which right you want to use.
- We verify your identity by matching your request to the email address on your account. We only use verification details to process the request.
- You may use an authorized agent; we may ask for written permission from you and verify your identity directly.
- We respond within 45 days and may extend once by another 45 days where the law allows, telling you why.
- Requests are free unless they are excessive or repetitive, in which case we will tell you before charging anything.
Appeals
If we decline your request, you may appeal by replying to our decision with the word "Appeal". A different reviewer will assess it and respond within 45 days with a written explanation. If your appeal is denied, you may contact your state attorney general's office to file a complaint.
Minors
Simply Mindfull Moments is for users 13 and older, and we do not knowingly collect personal data from children under 13. We do not sell or share the personal data of anyone under 16 under any circumstances. If you believe a child has created an account, contact us and we will delete it.
Breach notification
If unauthorized access to your identifiable health-related data occurs, we will notify affected users and applicable regulators without unreasonable delay and describe what happened, what data was involved, and what steps to take.
Contact
Use these rights now
These aren't just promises on a page — you can act on them from your account.
You'll be asked to sign in first — we verify every request against the email address on your account, and these tools are private to you.
See also our Privacy Policy, Cookie Policy, Security Practices, and Consumer Disclosures.