Consumer Health Data Privacy Policy

Effective October 28, 2026

This policy describes how Goalaxi, operated by Bear Flinn of Georgia, United States ("Goalaxi," "we," "us," or "our"), collects, uses and shares consumer health data, as required by Washington's My Health My Data Act (RCW 19.373).

"Consumer health data" is personal information that is linked or reasonably linkable to you and identifies your past, present or future physical or mental health status. We do not ask for health information, but what you write in Goalaxi can include it, so we treat all of your content as consumer health data.

1. Consumer health data we collect, why, and how we use it

Your content: everything you enter, because any of it can concern your health, for example goals, routines and recorded activity relating to sleep, exercise, eating, drinking, medication, mood or a health condition, messages you send to the AI assistant, and updates you write for a person you invite.
Information we generate from your content: AI-generated classifications and suggestions, records of your progress, and records that crisis support resources were shown to you.

We collect and use this data only as necessary to provide the Goalaxi service you request: to store it and show it to you, to provide the features you use, including the AI assistant and its safety screening, to send it to people you choose, to keep the service secure, and to comply with law.

2. Sources of consumer health data

You, through what you enter into Goalaxi.
Our own processing of what you enter.

3. Consumer health data we share

We share consumer health data only with people you direct us to send it to, such as a person you invite to receive updates you write. The data shared is the content you choose to send them.

4. Third parties and affiliates that receive consumer health data

Third parties: individuals you direct us to send your content to.
Affiliates: none. Goalaxi has no affiliates.

5. Your rights and how to exercise them

You have the right to:

confirm whether we collect, share or sell your consumer health data, and access it, including a list of all third parties and affiliates with whom we have shared or sold it and a way to contact them;
withdraw your consent to our collection and sharing of it, for example by removing the person you send updates to or deleting your content or account; and
have it deleted. When we delete it, we also instruct our processors to delete it. Copies in our encrypted backups are deleted within 30 days.

You can export your data and delete your account in Goalaxi's Settings. To make any request, email support@goalaxi.com from the email address on your account, which is how we verify it. An authorized agent may make a request for you with your signed permission. Requests are free of charge.

We respond within 45 days of receiving a request. If we need more time, we will tell you why within that period, and respond within a further 45 days.

If we decline your request, you can appeal by replying to our decision. We will respond in writing within 45 days, explaining what we did and why. If we deny your appeal, you can submit a complaint to the Washington State Attorney General at atg.wa.gov/file-complaint, or to the attorney general of your state.