First Light — Consumer Health Data Privacy Policy

Version: 1.0 Effective Date: August 1, 2026 Last Updated: July 25, 2026

For Washington State Residents and Consumers Whose Health Data Is Collected in Washington

This Consumer Health Data Privacy Policy is provided under Washington's My Health My Data Act (RCW 19.373). It describes how Legacy Build Inc. ("we," "us," "our"), the operator of First Light, collects, uses, shares, and protects Consumer Health Data.

This Policy applies to you if:

You are a Washington State resident, or
Your Consumer Health Data is collected while you are physically present in Washington State.

This Policy is in addition to our general Privacy Policy and our Terms of Service. Where this Policy differs from the general Privacy Policy with respect to Consumer Health Data of Washington consumers, this Policy controls.

1. What Is "Consumer Health Data"

Under MHMDA, Consumer Health Data means personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status. It includes, but is not limited to:

Individual health conditions, treatment, diseases, or diagnoses
Social, psychological, behavioral, and medical interventions
Health-related surgeries or procedures
Use or purchase of prescribed medication
Bodily functions, vital signs, symptoms, or measurements of the information listed above
Diagnoses or diagnostic testing, treatment, or medication
Gender-affirming care information
Reproductive or sexual health information
Biometric data
Genetic data
Precise location information that could reasonably indicate a consumer's attempt to acquire or receive health services or supplies
Data that identifies a consumer seeking health care services
Any information that we or our processor processes to associate or identify a consumer with the data described above that is derived or extrapolated from non-health information

2. Consumer Health Data We Collect

In the course of providing First Light, we collect the following categories of Consumer Health Data:

(a) Health and wellness metrics from your connected devices. You can connect health data two ways: on-device sources (Apple Health on iOS, Google Health Connect on Android), which the First Light mobile app reads on your device; and server-side wearables (such as Oura Ring, WHOOP, Fitbit), which you link directly. In both cases the data is received and normalized through Terra, our health-data aggregation provider, before it reaches us. We may collect:

Sleep duration and quality
Heart rate variability (HRV)
Resting heart rate
Respiratory rate
Activity, steps, and workout data
Recovery scores

You control which data types are shared and can revoke access at any time — through Apple Health or Google Health Connect permissions for on-device sources, or by disconnecting the wearable through Terra for server-side sources.

(b) Self-reported health-adjacent information. When you submit check-ins, entries, or voice notes, you may include information about your:

Mental health status, mood, or emotional state
Physical symptoms or sensations
Sleep, energy, or fatigue
Stress, anxiety, or overwhelm
Medications, treatments, or professional care you are receiving

We process this information as Consumer Health Data regardless of whether you intended it as such.

(c) Voice recordings. If you submit voice notes, the audio recording and its transcription may contain health-adjacent information. We process the full content as Consumer Health Data.

First Light does not use voice recordings to identify or authenticate users and does not create voiceprints or speaker-identification templates.

By default, we delete the underlying audio once it has been transcribed and keep only the transcript. If you choose to keep your recordings (an option you turn on yourself in Settings), we retain the audio while your account is active and delete it when you delete the recording or your account. See Section 13 for our full retention schedule.

(d) Derived and inferred data. We generate derived information from the above, including:

AI-generated pattern observations, prompts, weekly insight reports, and morning synthesis messages
Sentiment and emotional state inferences from text and voice
Observational correlations between your entries and health metrics
Depth scores, confidence scores, and other internal metrics
Vector representations of your entries used for pattern recognition

We treat all derived and inferred data that relates to your health status as Consumer Health Data.

3. Categories of Sources

We collect Consumer Health Data from:

You directly — through check-ins, entries, voice notes, responses to prompts, and profile information
Your connected devices and applications — through Terra, which receives data from Apple Health, Google Health Connect, and connected wearables (Oura, WHOOP, Fitbit, and similar)
Our own processing — through AI-derived inferences and patterns generated from the above

4. Purposes for Which We Collect and Use Consumer Health Data

We collect and use Consumer Health Data only for the following purposes, each of which is necessary to provide the Service you requested:

Generating daily prompts, pattern observations, weekly insight reports, and morning synthesis messages
Recognizing patterns within your data over time
Transcribing voice recordings you submit
Synchronizing your data across the web app, iOS app, and Chrome extension
Operating your account, including authentication and payment processing
Maintaining security, preventing fraud, and protecting against abuse
Communicating with you about your account and the Service
Displaying crisis resources when certain keywords or patterns are detected (this feature is not a crisis monitoring service and does not create any duty of care — see our Terms of Service)
Complying with legal obligations

5. How We Share Consumer Health Data, and With Whom

We share Consumer Health Data only with the following categories of third parties, each of whom is bound by a written contract that restricts their use of the data to providing services to us:

Third Party	Purpose	Categories Shared
Anthropic	AI processing (the Claude models) that generates First Light's outputs	Text of your check-ins, entries, and chat, plus derived context, as needed for processing
Supabase	Data infrastructure hosting	All Consumer Health Data categories, at rest
Terra	Wearable/health-data aggregation and normalization	Connected health & wearable metrics
OpenAI	Voice-to-text transcription (Whisper) and text embeddings that power search	Voice recordings and transcripts; the text of your check-ins, entries, chat messages, and search queries
Resend	Transactional emails (which may contain Service-generated content)	Limited Service-generated summaries sent to you
Firebase Cloud Messaging	Mobile push notifications (which may contain Service-generated content)	Limited Service-generated summaries sent to you
Twilio	Inbound text-message capture and outbound SMS notifications	Content of check-ins you send by text; phone number
Mailgun	Inbound email capture	Content of check-ins you send by email; email address

How our AI providers handle your data. We send the text of your entries to Anthropic's Claude models through Anthropic's commercial API, and voice recordings to OpenAI's transcription API, in each case solely to generate the outputs you asked First Light for.

Anthropic, PBC — AI processing. We use Anthropic's commercial API to generate certain First Light insights. Anthropic processes this information on our behalf under its Commercial Terms of Service and incorporated Data Processing Addendum. Anthropic states that it does not use commercial API inputs or outputs to train its models unless the customer affirmatively opts in. Under Anthropic's standard API practices, inputs and outputs are generally deleted from its backend within 30 days, subject to exceptions for features with different retention, safety and Usage Policy enforcement, special requirements applicable to certain covered models, legal obligations, or a different written retention arrangement. First Light does not opt in to model training and does not knowingly use a feature with materially different retention without first reviewing the change and updating our disclosures where required.

OpenAI — transcription and search. We use OpenAI's API to turn voice notes into text and to build the search index for your own entries. OpenAI states that API inputs and outputs are not used to train its models unless the customer affirmatively opts in, and First Light does not opt in. We use the transcription endpoint, which OpenAI documents as carrying no abuse-monitoring retention.

We do not share Consumer Health Data with:

Advertisers
Data brokers
Analytics providers inside the authenticated Service (we use Google Analytics 4, Meta Pixel, and Reddit Pixel only on our public marketing pages, not inside the Service where Consumer Health Data is processed)
Research partners, academic institutions, or other external parties, unless we obtain your separate, explicit opt-in consent

6. Collection, Use, and Sharing That Requires Consent

We ask for your consent to collect and process your Consumer Health Data before you begin using the parts of First Light that create it, through a separate consent step that is not bundled with our Terms of Service. We collect, use, and share Consumer Health Data only for the purposes and with the third parties listed in Sections 4 and 5 above.

If we wish to collect, use, or share Consumer Health Data for any purpose beyond what is necessary to provide the Service you requested, we will obtain your separate, affirmative, opt-in consent before doing so. We will not pre-check consent boxes, condition access to unrelated features on consent, or otherwise design the consent request to degrade your choice. You may withdraw your consent at any time in Settings; withdrawal stops further collection and does not affect processing that already occurred.

7. We Do Not Sell Consumer Health Data

Legacy Build Inc. does not sell Consumer Health Data as that term is defined in MHMDA. We do not exchange Consumer Health Data for monetary or other valuable consideration with any third party. We have no plans to sell Consumer Health Data.

If, in the future, we ever wished to sell Consumer Health Data, we would first obtain a valid authorization from you that meets the requirements of RCW 19.373.030(2), including all required signed statements, the specific data to be sold, the purchaser, the purpose, and an expiration date not to exceed one year. You could revoke that authorization at any time.

8. Your Rights Under MHMDA

You have the right to:

(a) Confirm whether we are collecting, sharing, or selling your Consumer Health Data.

(b) Access your Consumer Health Data, including a list of all third parties and affiliates with whom we have shared or sold your Consumer Health Data, and an active email address or other online mechanism you may use to contact those third parties.

(c) Withdraw consent to our collection and sharing of your Consumer Health Data. Withdrawal of consent does not affect collection or sharing that occurred before the withdrawal.

(d) Delete your Consumer Health Data. Upon your request, we will delete your Consumer Health Data from our records and notify all third parties and affiliates with whom we have shared your Consumer Health Data of your deletion request, so that they delete it as well.

(e) Appeal the denial of any of the above requests.

9. How to Exercise Your MHMDA Rights

Email privacy@seefirstlight.com with the subject line "Washington Consumer Health Data Request". Include:

The right you wish to exercise (confirm, access, withdraw consent, delete, or appeal)
The email address associated with your account
Any other details that help us locate your data

We will:

Verify your identity (typically by confirming you control the email associated with your account)
Respond within 45 days of receipt. We may extend the response window by an additional 45 days when reasonably necessary, and we will notify you of any extension and the reason within the first 45 days.
Honor your request free of charge for the first request within a 12-month period. For subsequent requests within 12 months, we reserve the right to charge a reasonable fee if requests are excessive or manifestly unfounded.

For deletion requests, we will also:

Delete your Consumer Health Data from our active systems, and remove it from or render it inaccessible in any backup copies on our documented backup cycle — and, for Consumer Health Data subject to a verified deletion request, in no event longer than the six-month outer limit MHMDA permits (RCW 19.373.030)
Notify all third parties, affiliates, and processors with whom we have shared your Consumer Health Data that you have requested deletion, and direct them to delete accordingly

You can also withdraw consent and delete your data yourself, at any time, from Settings inside First Light.

10. Right to Appeal

If we deny your request, we will notify you in writing of the denial and the reasons. You may appeal by replying to that denial email with the word "APPEAL" in the subject line. We will respond to your appeal within 45 days with a written decision.

If your appeal is denied, you may contact the Washington State Attorney General's Office to submit a complaint:

Washington State Attorney General's Office Consumer Protection Division Online: https://www.atg.wa.gov/file-complaint Phone: 1-800-551-4636

11. No Geofencing

Legacy Build Inc. does not, and will not, implement a geofence around any in-person healthcare facility (including but not limited to hospitals, clinics, medical offices, pharmacies, counseling offices, reproductive health facilities, or gender-affirming care facilities) to:

Identify or track consumers seeking health care services
Collect Consumer Health Data from consumers
Send notifications, messages, or advertisements to consumers related to their Consumer Health Data or health care services

12. Security

We use administrative, technical, and physical safeguards designed to protect Consumer Health Data, including encryption in transit and at rest, role-based access controls, vendor security due diligence, and incident monitoring. Our general Privacy Policy describes these measures in more detail.

13. Consumer Health Data Retention

We keep Consumer Health Data only for as long as it is reasonably needed for the purpose it was collected, and no longer. We use these maximum periods:

Check-ins, entries, and transcripts — kept while your account is active, because keeping them is the Service (your longitudinal record). After you delete your account, they are removed from our live systems within 30 days.
Voice recordings — deleted after transcription by default. If you have turned on keeping your recordings, they are kept while your account is active and deleted when you delete the recording or your account.
Derived and inferred insights (weekly reports, pattern observations, sentiment, embeddings) — kept for no longer than the underlying entries they were generated from, and deleted with them.
Deleted health data in backups — purged or rendered inaccessible on our documented backup cycle, and in no event retained longer than the six-month outer limit MHMDA permits after a verified deletion request.
Billing and tax records — kept for up to 7 years as required by law, held separately from and stripped of your journal, voice, and health content.
Consent records — we keep evidence that you gave (or withdrew) consent for as long as needed to establish that we had your permission, but not a duplicate of your health content.
Security logs — up to 12 months.
Support communications — up to 3 years from your last contact.

We may retain specific data for longer only where it is subject to a documented legal hold, and only for as long as that hold requires.

14. Children

The Service is not directed at anyone under 18. We do not knowingly collect Consumer Health Data from anyone under 18. If we learn we have, we will delete it.

15. Changes to This Policy

If we change this Policy in a way that materially affects how we collect, use, or share Consumer Health Data, we will:

Notify you at least 30 days in advance by email and in-app notification
Obtain your renewed consent before applying the change to Consumer Health Data collected before the change takes effect
Update the "Last Updated" date above

16. Contact Us

Privacy requests: privacy@seefirstlight.com Questions about this Policy: privacy@seefirstlight.com

Legacy Build Inc. 30 N Gould St, Ste R, Sheridan, WY 82801