Jetty Health, Inc. ("Jetty," "we" or "us") provides this notice under Washington's My Health My Data Act. It covers health data protected by that law, including data about Washington residents and people whose health data is collected in Washington.
"Health data" means information linked, or reasonably linkable, to you that reveals your past, present or future physical or mental health. It includes health information we learn or infer from other information.
1 What we collect and why
What we collect depends on what you share, the features you use and the connections you allow. Each category may include identifiers that link it to your account. The examples below are not exhaustive. What you share may include other information about your health, care or daily life.
| Health data | How we use it |
|---|---|
|
Conditions and care: symptoms, diagnoses, allergies, medications, supplements, treatments, medical history, health goals, appointments and insurance information.
|
Organize records, track health, prepare for visits and provide requested conversations, summaries and insights.
|
|
Sensitive health details: mental health, mood, stress, disability, sexual and reproductive health, and menstrual information you share or connect. Documents or conversations may contain genetic information; it is not required for an account.
|
Provide the health features you request.
|
|
Measurements and daily life: heart rate and variability, activity, exercise, sleep, nutrition, body measurements, lifestyle and environmental information. Connections may provide past records and background updates.
|
Provide tracking, timelines, comparisons and personalized insights.
|
|
Medical records: authorized Apple Health records, including prescriptions, allergies, vaccinations, procedures, lab results, vital signs, notes, insurance details, source organizations, identifiers and attachments.
|
Import, store and display records for features you choose. Importing them does not itself permit third-party AI processing; that requires a separate choice.
|
|
Conversations and uploads: health information in messages, original audio recordings, transcripts, assistant responses, visit recordings, photos, documents, calendar events and support requests.
|
Respond, transcribe or summarize recordings, prepare for visits, maintain records and help you.
|
|
Voice recognition for doctor-visit recordings: enrollment audio and a voiceprint or speaker identifier, if you separately enable this optional feature.
|
Identify when you are speaking and distinguish your speech from other speakers in doctor-visit recordings. We do not use voiceprints for check-ins. Microphone permission alone does not authorize enrollment, and we do not enroll other people simply because they appear in a recording.
|
|
Location and app activity: precise location, location history, times, movement information, and information showing you seek or use health services. Screens and interactions can reveal symptoms or health interests.
|
Use permitted location data to find nearby providers and show weather details. Optional uses of app activity are described below.
|
|
Information Jetty learns: memories, profiles, timelines, reports, patterns, summaries and health inferences, including those drawn from information that was not itself health data.
|
Remember context, find records, personalize features and provide requested reports or insights.
|
We also use the minimum health data needed to secure and maintain requested services, fix problems, help you or meet a specific legal obligation where permitted. This notice is not consent. We ask for consent before collection or use when required, and separate sharing consent when required. Any exception for providing a requested service is limited by law.
Authorized Jetty staff may review health conversations to support you, check and improve response quality, fix problems and improve Jetty's features. We use health data for these purposes only as permitted by applicable law and obtain any additional consent required.
We do not use health conversations to train general-purpose AI models. We may use deidentified data to train or improve models that power Jetty features, such as predicting flare-ups. We obtain required affirmative consent before collecting a new health-data category or using health data for a new purpose not described here.
Analytics and session replay help us understand feature use and fix usability problems. We obtain consent where required and do not use health data for optional analytics where the law prohibits it. More details appear in Section 3.
2 Where it comes from
| Source | What we receive |
|---|---|
|
You
|
Account details, conversations, entries, photos, documents, recordings and support requests.
|
|
Your device and app use
|
Microphone input, permitted location and health-related interactions.
|
|
Services you connect
|
Information from Apple Health, Terra-supported wearables and health platforms, medical records from organizations connected through Apple Health, and Google or Microsoft calendars.
|
|
Other people and providers
|
Information you lawfully include about someone else, and information from providers helping operate Jetty.
|
|
Our analysis
|
Summaries, memories and health inferences we generate from these sources.
|
3 Who receives it
We do not sell or license personal health data. We disclose only information needed for the permitted purpose. Some providers handle information only for us, under contracts. Washington law excludes certain necessary disclosures to these providers from its definition of "sharing." Other disclosures require separate sharing consent unless a legal exception applies.
| Recipient and role | Health data involved and why |
|---|---|
|
Storage and security: Google Cloud and infrastructure providers.
|
Health data, account identifiers and information we generate, to store, retrieve, secure and run the service.
|
|
AI and memory: OpenAI and Google Cloud AI.
|
May process permitted health content, records, images, transcripts, measurements and inferences for responses, summaries, analysis and remembering context.
|
|
Voice: LiveKit, Deepgram, ElevenLabs and Speechmatics.
|
Relevant recordings, spoken health information, text, transcripts and session identifiers, to transmit audio, transcribe and generate speech. Speechmatics and necessary storage providers process voiceprints only for separately authorized voice recognition in doctor-visit recordings.
|
|
Health and calendar connections: Terra, Apple, Google, Microsoft and other sources you connect.
|
Permitted measurements, records, calendar details and identifiers needed for those connections.
|
|
Analytics and troubleshooting: Firebase Analytics, Mixpanel, PostHog and, where enabled, LangSmith.
|
Help us understand feature use, identify usability problems and troubleshoot the service. Mixpanel and PostHog also provide session replay, with user-entered text masked.
|
|
Communications and support: Customer.io and Apple notification services.
|
May process delivery identifiers and health information needed for a requested message or included in a support request.
|
|
Recipients you choose.
|
The report, export or other health information you select for a person or service.
|
|
Legally permitted recipients.
|
Necessary health data for a valid legal requirement or qualifying business transfer, only where this law and other applicable laws allow it.
|
Any acquirer receiving your health information must honor the privacy commitments that applied when it was collected. A business transfer does not permit incompatible new uses of your health information.
4 Your rights and how to use them
You can ask us to:
- Confirm whether we collect, share or sell your health data, and give you access to it.
- List all third parties and affiliates with whom we shared or sold your health data, with an active email address or other online contact for each.
- Withdraw consent to collection or sharing.
- Delete your health data.
Email privacy@myjettyhealth.com. Tell us what you want to request and provide enough information to find your account. We reasonably verify your identity without requiring a new account. If we cannot verify you with reasonable effort, we explain what additional information is needed.
We respond without undue delay and within 45 days after receipt. If a permitted extension is reasonably necessary, we explain why within those 45 days and take no more than 45 additional days. Requests are free at least twice a year. We explain any fee or refusal for excessive or manifestly unfounded requests, allowed only when the law permits.
Withdrawing consent stops related consent-based processing. It does not undo earlier lawful processing. If a feature cannot work without the data, we explain the limitation. Disconnecting a source or changing a device permission can stop future access without deleting imported information; you can request deletion separately.
| Your action | What happens |
|---|---|
|
Stop medical-record syncing on this device
|
Stops new imports from Apple Health on that device. Records already saved in Jetty remain, and other devices may continue syncing. Contact us to withdraw health-data consent across your account or request deletion.
|
We keep saved health records, chats and audio until you delete them or close your account. We delete covered data from active systems within 30 days of your request, after reasonably verifying your identity. Backups are purged on a rolling 30-day cycle, so backup copies may remain for up to 30 additional days after removal from active systems. Any shorter legal deadline still applies.
We do not unlawfully discriminate against you for using these rights. If we refuse a request, we explain why and how to appeal. Reply to our decision or email privacy@myjettyhealth.com with "Privacy Appeal." We give you our written decision and reasons within 45 days. If we deny the appeal, we explain how to complain to the Washington Attorney General at https://www.atg.wa.gov/file-complaint. You may contact the Attorney General without first appealing to us.
5 Voiceprint retention
This table covers your voiceprint and the short recording used to create it. Your saved doctor-visit recordings follow the separate retention periods explained in this policy.
| Information | How long we keep it |
|---|---|
|
Enrollment audio held by Jetty
|
Only while setting up your voiceprint. We delete the recording when setup finishes, fails or is cancelled.
|
|
Enrollment audio held by Speechmatics
|
Speechmatics processes the recording to create your voiceprint.
|
|
Your voiceprint
|
While you keep voice recognition enabled for doctor-visit recordings, but no longer than 12 months after enrollment or your last use of this feature, whichever is later. We permanently delete it sooner if it is no longer needed, you withdraw permission, request deletion or delete your account, or the law requires earlier deletion.
|