Health Data Disclosure
DRAFT — pending legal review. Not yet legally binding. This page is a beta-stage disclosure summary, not a final legal document. It has not been reviewed by counsel.
Washington "My Health My Data" Disclosure
[Effective date: ____]
Washington's My Health My Data Act (MHMDA) asks businesses that collect "consumer health data" to disclose that collection on its own, separate from a general privacy policy. This page is that disclosure for Hai Inc. ("we," "us"), the operator of Pulse.
What counts as health data here
Pulse's heart-rate feature estimates your heart rate and heart-rate variability (HRV) from your phone's front camera, using a passive technique called rPPG (remote photoplethysmography). An inferred signal like this can qualify as consumer health data under MHMDA — so we're disclosing it here, even though Pulse is a dating app rather than a health app.
How we collect and use it
- On-device video; server-side signal. The camera video itself never leaves your phone — the heart-rate estimation (rPPG) runs entirely on-device. What is sent to our servers is the resulting heart-rate signal: an encrypted, per-capture time-series of heart-rate values (not a single number). This happens at baseline capture, during the onboarding photo-reaction flow, and at moments you initiate — for example, attaching a reaction to a like, or during a "Glance" call.
- Separate, explicit consent. We ask for your specific consent before processing this signal, apart from any other consent you give us, and you can withdraw it at any time. Declining it does not block the core of Pulse — browsing, matching, and messaging still work.
- What we use it for. We use your heart-rate signal to (a) help confirm you're a real, live person (liveness / verification), (b) power the in-app heart-rate feature you choose to share, and (c) inform matching — your heart-rate reactions (for example, changes relative to your own baseline) help infer likely interest or affinity and help rank and match candidates. We do not build emotion or psychological profiles beyond this matching use, we never sell your heart-rate data, we never share it with other users beyond what you choose to reveal, and we never use it for advertising.
- Encrypted at rest, like the rest of your sensitive profile data.
Your rights
You can withdraw your consent to heart-rate processing at any time in the app (Settings → Withdraw Consent), and you can request access to, correction of, or deletion of your data — including this data — through the same Settings menu, or by contacting us. Washington residents have rights under MHMDA to access, delete, and withdraw consent for consumer health data; we honor these through the same in-app tools available to every Pulse user, regardless of where they live.
Sharing, appeals, and contact
- Categories of third parties. We share consumer health data only with service providers under contract who process it on our behalf — see the processor table in our Privacy Policy. We do not sell it, and we do not share it for advertising.
- Appeals. If we deny a rights request, you may appeal by contacting us at the address below; we will review the appeal as required under MHMDA.
- Contact. For any question about your consumer health data, or to exercise or appeal a request, contact us at
[privacy contact email].
The full picture
This page is a short summary. The complete description of what we collect, why, who we share it with, and how long we keep it — including this signal — lives in our Privacy Policy, particularly the section on sensitive and biometric information.
This page is not legal advice. It is a draft pending review by qualified counsel.