LullaWave Consumer Health Data Privacy Policy

1. The consumer health data we collect

• What you say during the voice-led ritual (as text), and the tiles you select in Touch Mode, which may reveal your emotional or mental state.
• The general category the app picks from what you share, which decides your soundscape, and a short record of recently heard prompts that reflects the categories of your recent rituals.
• A record that a crisis-phrase recognition occurred (time, which message played, whether it was treated as postpartum-related, a scrambled account identifier, a keyed one-way fingerprint), never your words.

2. How we use it and why

• To provide the ritual you ask for: shaping that night's prompts and soundscape.
• To run the ritual's safety feature, which brings crisis resources forward.
• To keep LullaWave secure and prevent abuse.
• Nothing else. We don't use it for advertising, profiling, or AI training.

3. Where it comes from

• You, through the app.
• Apple's Speech Recognition, which turns your speech into text.

4. How it's processed and who receives it

• OpenAI (interprets ritual text; receives no name, email, or account identifier).
• Our hosting provider (runs our backend and stores session data).
• Each works under contract to provide LullaWave and not for its own purposes.
• We don't share consumer health data with any other third party or affiliate, and we don't sell it.
• Third parties can't collect consumer health data about you across websites through LullaWave. The advertising pixel that ran on our website July 5–7, 2026 didn't receive anything shared in the app (see Privacy Policy section 6).

5. How long we keep it

• Ritual words and Touch Mode selections are erased from our backend when the ritual ends, or within about an hour if it's interrupted. Short-term recovery copies expire within 30 days.
• OpenAI keeps what it receives for up to 30 days.
• The soundscape category is kept with your session until your next ritual begins. The short record of recently heard prompts keeps only the most recent few per step.
• Recognition records follow Privacy Policy section 4.

6. Your rights

You can:

• confirm whether we collect, share, or sell your consumer health data;
• get a copy, plus a list of the third parties and affiliates that received it;
• withdraw consent;
• ask us to stop collecting or sharing it;
• ask us to delete it. We'll pass the deletion on to our service providers.

Email [email protected] with "Health data request."

• We may verify the request using the email on your account.
• We respond within 45 days, extendable once by 45 days with notice.
• There's no charge, up to twice a year.
• If we decline, reply "appeal." We'll respond within 45 days, and if we still decline we'll explain how to contact your state Attorney General.

7. Changes

• We'll update the effective date.
• If a change is material, we'll tell you by email first.
• We won't collect or use consumer health data for a new purpose without your consent.

8. Contact

[email protected] · LullaWave, LLC, 1500 N Grant St #7745, Denver, CO 80203