Consumer health data

Updated October 20, 2026 ·

What consumer health data Herald handles

Categories include your entries about seizures, auras, symptoms, check-ins, sleep, stress, energy, mood, drinks, medications, doses, side effects, care plans, rescue kits, cycle information, notes and videos; Health data you permit Herald to read; and precise location used during heads-ups. They also include health-related inferences or comparisons, contact and device identifiers associated with a heads-up, its times and call timing, and health details you voluntarily send to support. Not all categories are sent to Done Marketing.

Where it comes from

Sources are you, a parent or guardian acting with authority, your devices, Apple Health when permitted, people sharing with you, service-delivery information and correspondence you send. A supporter's device can receive the information the person chooses to share.

What it's used for

Purposes are operating the journal and selected features, descriptive comparisons, reminders and reports, user-started heads-ups, sharing, security, support and applicable legal obligations. Optional on-device AI helps word patterns or summarize notes. Local prompts for Plus may depend on journal activity, such as an appointment or enough check-ins. We do not sell consumer health data, use it for cross-context behavioral advertising or submit it to train a cloud AI model.

Who it's shared with

Approved contacts receive the information selected under What you share, including the heads-up and its call time, and any enabled location, plan or other fields. Shared records are encrypted for authorized devices. Data already read or copied cannot be recalled. User-selected exports and messages go to the recipients or services you choose.

Apple provides CloudKit storage, push delivery, attestation and Maps; Cloudflare operates the relay and website infrastructure. These providers process the data needed for those functions. Encrypted contents, clear push metadata, coordinates sent for address lookup and network identifiers have different exposures. The relay also retains limited security entries in volatile memory across requests. Provider roles and retention depend on the service and applicable terms; we do not claim every provider acts solely for us or never for its own lawful purposes.

Done Marketing, Inc. handles support and privacy requests from the United States using Google Workspace. Google receives email addresses, messages and attachments, including any health information you send, to provide that service. US-only Google hosting is not promised. We do not disclose consumer health data to affiliates for their own marketing. You can request information about the actual third parties and affiliates involved to the extent required by law.

Where Herald never sends it

We do not sell consumer health data or provide it to data brokers. Herald does not use a geofence around a health-care provider. We do not use third-party advertising trackers to collect health data over time across unrelated sites or services. External sites opened by you have their own policies.

Your rights

You may request confirmation of collection, sharing or sale, access and the applicable list of recipients and contact mechanisms, withdrawal of consent, and deletion. You may correct journal entries in the app. Feature switches control future activity, but switching off sync or uninstalling does not erase every existing copy. Use Delete everything with iCloud connected to reach the synced journal; manage exports, recipient copies, Health and backups separately.

Write to support@heraldjournal.app without creating an account. We use proportionate authentication and do not ask for journal keys. We will assist with app-controlled records and address information in our systems rather than reject a request merely because the journal is encrypted. Washington requests are answered without undue delay and within 45 days of receipt, subject to a permitted notified extension. Nevada requests generally receive a response within 45 days after authentication; Nevada deletion is subject to a separate 30-day period after authentication, with statutory backup exceptions. Applicable shorter deadlines control.

Appeals and consent

If we refuse a request, reply to our decision and state that you wish to appeal. We explain the outcome in writing within the applicable period: 45 days in Washington and 45 days in Nevada. A denied appeal includes the required route to the relevant Attorney General. We do not unlawfully discriminate against you for exercising these rights.

Where consent is required, collection and sharing use the applicable separate, affirmative choices unless a statutory requested-service exception applies. A privacy notice is not itself consent. New categories, purposes or recipients requiring further consent will not be introduced solely by changing this notice.

We normally provide legally required responses without charge, subject only to permitted exceptions. Where required, we pass deletion requests to relevant recipients and processors and address backup copies within the statutory limits. We explain technical limits without treating them as a blanket exemption.

Policy changes

The date above identifies this version. Material changes will be explained before they apply, with renewed consent where required. See the main privacy policy for security, retention, international processing and other local rights.

Statutory references

Washington RCW 19.373: app6.leg.wa.gov/rcw/default.aspx?cite=19.373. Nevada NRS 603A.400 to 603A.550: leg.state.nv.us/NRS/NRS-603A.html.

Contact

Done Marketing, Inc., a California corporation, 440 N Barranca Ave, Unit 8081, Covina, CA 91723, United States. Email: support@heraldjournal.app.