First Light — Consumer Health Data Privacy Policy

Version: 1.17 Effective Date: October 28, 2026 Originally Effective: August 1, 2026 Last Updated: October 28, 2026

For Washington State Residents and Consumers Whose Health Data Is Collected in Washington

This Consumer Health Data Privacy Policy is provided under Washington's My Health My Data Act (RCW 19.373). It describes how Legacy Build Inc. ("we," "us," "our"), the operator of First Light, collects, uses, shares, and protects Consumer Health Data.

This Policy applies to you if:

You are a Washington State resident, or
Your Consumer Health Data is collected while you are physically present in Washington State.

This Policy is in addition to our general Privacy Policy and our Terms of Service. Where this Policy differs from the general Privacy Policy with respect to Consumer Health Data of Washington consumers, this Policy controls.

1. What Is "Consumer Health Data"

Under MHMDA, Consumer Health Data means personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status. It includes, but is not limited to:

Individual health conditions, treatment, diseases, or diagnoses
Social, psychological, behavioral, and medical interventions
Health-related surgeries or procedures
Use or purchase of prescribed medication
Bodily functions, vital signs, symptoms, or measurements of the information listed above
Diagnoses or diagnostic testing, treatment, or medication
Gender-affirming care information
Reproductive or sexual health information
Biometric data
Genetic data
Precise location information that could reasonably indicate a consumer's attempt to acquire or receive health services or supplies
Data that identifies a consumer seeking health care services
Any information that we or our processor processes to associate or identify a consumer with the data described above that is derived or extrapolated from non-health information

2. Consumer Health Data We Collect

In the course of providing First Light, we collect the following categories of Consumer Health Data:

(a) Health and wellness metrics from your connected devices. You can connect health data two ways: on-device sources (Apple Health on iOS, Google Health Connect on Android), which the First Light mobile app reads on your device; and server-side wearables (such as Oura Ring, WHOOP, Fitbit), which you link directly. In both cases the data is received and normalized by Open Wearables, health-data software that we run ourselves rather than a third-party aggregation service. No separate aggregation company receives your health data before we do. The service runs on hosting provided by Railway. We may collect:

Sleep duration and quality
Heart rate variability (HRV)
Resting heart rate
Respiratory rate
Activity, steps, and workout data
Recovery scores

We import history, not only readings made from that day forward. When you link WHOOP or Fitbit, we ask that service for up to one year of readings already in your account, at the moment you connect. When you connect Apple Health in the First Light iPhone app, the app reads up to three years of readings stored on your phone, as far back as Apple Health lets you allow. This is so First Light can tell what is typical for you straight away, instead of spending weeks observing you before it can say anything useful. How far back we actually receive depends on what the device or your phone holds. These are the same categories listed above, and every other section of this Policy applies to them identically.

You control which data types are shared and can revoke access at any time — through Apple Health or Google Health Connect permissions for on-device sources, or by disconnecting the wearable in First Light's Settings for server-side sources. Disconnecting stops new readings; it does not delete readings we already hold, including imported history. To have those deleted, delete your account in Settings, or exercise your deletion right under Sections 8 and 9.

Fitbit and Pixel Watch reach us through Google Health. A Fitbit or a Pixel Watch is linked through your Google account, using Google's Health API, and Google's own screen is where you agree. We ask Google for read-only access to your sleep and your health measurements (such as resting heart rate, HRV and breathing rate) and nothing else. You can also remove First Light's access in your Google Account at any time. The use of information received from Google Health API and/or Developer Tools will adhere to the Google Health API Developer and User Data Policy, including the Limited Use requirements.

(b) Self-reported health-adjacent information. When you submit check-ins, entries, or voice notes, you may include information about your:

Mental health status, mood, or emotional state
Physical symptoms or sensations
Sleep, energy, or fatigue
Stress, anxiety, or overwhelm
Medications, treatments, or professional care you are receiving

We process this information as Consumer Health Data regardless of whether you intended it as such.

(c) Voice recordings. If you submit voice notes, the audio recording and its transcription may contain health-adjacent information. We process the full content as Consumer Health Data.

First Light does not use voice recordings to identify or authenticate users and does not create voiceprints or speaker-identification templates.

By default, we delete the underlying audio once it has been transcribed and keep only the transcript. If you choose to keep your recordings (an option you turn on yourself in Settings), we keep the audio you record from then on while your account is active, and delete it when you delete the check-in it belongs to, or your account. Turning the setting off again stops us keeping new recordings; it does not remove the ones we kept while it was on. See Section 13 for our full retention schedule.

(d) Derived and inferred data. We generate derived information from the above, including:

AI-generated pattern observations, prompts, weekly insight reports, and morning synthesis messages
Sentiment and emotional state inferences from text and voice
Observational correlations between your entries and health metrics
Depth scores, confidence scores, and other internal metrics
Vector representations of your entries used for pattern recognition

We treat all derived and inferred data that relates to your health status as Consumer Health Data.

(e) Your Google Calendar, only if you link it. Linking is optional and off until you do it yourself. If you link it, First Light reads each event's title, time, guests and notes, from two weeks before today to two weeks after, on the calendars in your Google Calendar list (your own, and ones other people share with you or that you subscribe to), fresh each time it writes you a reply. On each calendar it reads the events its owner made, said yes or maybe to, or that have no guest list; never invitations not yet answered or events declined. Events can carry health information: yours (an appointment, a treatment) and other people's (an appointment a family member has, on your calendar or on one they share with you). We treat what we read as Consumer Health Data. We keep no copy of your calendar: the events are held only while that reply is being written, and what a reply says about one stays in your conversation like anything else a reply says. We keep only the locked key Google gives us to read it, until you unlink in Settings, withdraw your consent, or delete your account, when we cancel our access at Google. First Light's use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.

(f) Writing you bring in from your own files. In Settings you can bring in notes, letters and other writing of your own from text, Markdown, Word or PDF files. Your browser reads each file and sends us only its words; the file itself never reaches us. Each piece is kept like a check-in, dated the day you wrote it, and it can carry health information about you and about people you wrote about. We process it as Consumer Health Data, and you can delete it the way you delete a check-in.

The crisis check is not an inference we keep. When the words in a check-in, conversation, inbound message or voice note match a list of crisis-related terms, the Service shows you where to get help. It matches words, not circumstances: it is not a diagnosis, involves no clinical assessment, will miss things, and will sometimes respond when nothing is wrong. It sets no flag on your account and keeps no record beyond the reply itself, which stays in your conversation like any other message. No person reads your entries for it, nobody is alerted when it happens, and we do not contact anyone — not emergency services, not a third party, not a contact of yours.

3. Categories of Sources

We collect Consumer Health Data from:

You directly — through check-ins, entries, voice notes, responses to prompts, profile information, and writing you bring in from your own files (Section 2(f))
Your connected devices and applications — through our own Open Wearables service, which receives data from Apple Health, Google Health Connect, and connected wearables (Oura, WHOOP, Fitbit, and similar). For server-side wearables this includes readings recorded before you connected, as described in Section 2(a)
Our own processing — through AI-derived inferences and patterns generated from the above
Your Google Calendar, only if you link it, as described in Section 2(e)

4. Purposes for Which We Collect and Use Consumer Health Data

We collect and use Consumer Health Data only for the purposes set out in this section — the necessary ones listed immediately below, and the one optional purpose described after them, which is off unless you switch it on.

The following purposes are each necessary to provide the Service you requested:

Generating daily prompts, pattern observations, weekly insight reports, and morning synthesis messages
Recognizing patterns within your data over time
Transcribing voice recordings you submit
Synchronizing your data across the web app, iOS app, and Chrome extension
Operating your account, including authentication and payment processing
Maintaining security, preventing fraud, and protecting against abuse
Communicating with you about your account and the Service
Displaying crisis resources when certain keywords or patterns are detected (this feature is not a crisis monitoring service and does not create any duty of care — see our Terms of Service)
Complying with legal obligations

One further purpose, which is optional, and which is off unless you switch it on.

Measuring how the Service is used — how many people check in, how often they come back, which of the three apps they use — is not necessary to provide the Service, so it is not in the list above and never will be. We ask for it separately, under Section 6, through a single setting in Settings → Health data called "Help us count how First Light is used." It is off for every account by default. Nothing is measured, and nothing is sent to the provider named in Section 5, until you turn it on, and turning it back off stops it.

If you switch it on, what we record is: that a check-in happened and when, roughly how long it was (a line, a paragraph, or a page), whether you tapped a feeling, which of the three apps and which capture method it arrived by, that a chat exchange happened and of what kind, that a weekly report was opened, and that onboarding was completed. Each of these is attached to your account number. We do not record the text of anything you write, which feeling you chose, or any health or wearable metric.

The same setting also lets us check our replies. When a reply draws on your earlier check-ins, and only if this setting is on, we send what you wrote (or, for a check-in with no words, the feelings you tapped) and those earlier check-ins to Anthropic a second time, to ask whether the reply picked the right ones. We keep only the answer, a yes or no for each earlier check-in, attached to your account, and no new copy of your words. This is measurement too, so it is part of the one optional purpose, not a second one, and nothing is sent for it while the setting is off.

Declining changes nothing else. Check-ins, chat, insights, voice notes, and connected wearables all behave exactly the same way whether this setting is on or off, and we will not ask you again in a way designed to wear you down.

5. How We Share Consumer Health Data, and With Whom

We share Consumer Health Data only with the following categories of third parties. Each of them, except Sendblue, is bound by a written contract that restricts their use of the data to providing services to us; Sendblue is the exception, explained below the table:

Third Party	Purpose	Categories Shared
Anthropic	AI processing (the Claude models) that generates First Light's outputs; and, only if you have switched on "Help us count how First Light is used," a second look at the earlier check-ins a reply drew on, to check it picked the right ones (Section 4)	Text of your check-ins, entries, and chat, plus derived context, as needed for processing; and, only if you link your Google Calendar, its events as described in Section 2(e)
Supabase	Data infrastructure hosting	All Consumer Health Data categories, at rest
Railway	Hosting for the Open Wearables service we run — the software is ours; Railway provides the servers and database it runs on	Connected health & wearable metrics
OpenAI	Voice-to-text transcription (Whisper) and text embeddings that power search	Voice recordings and transcripts; the text of your check-ins, entries, chat messages, and search queries
Resend	Transactional emails (which may contain Service-generated content)	Limited Service-generated summaries sent to you
Sendblue (operated by Round One, Inc.)	Text messages: carries the check-ins you text us and the messages we text you, over iMessage, or as an ordinary text message (SMS) when iMessage is not available. Works under its own standard terms, not a contract restricting it to providing services to us; see below the table.	Content of check-ins you send by text, and of the messages we text you; phone number; and, only if you turn it on, your weekly report as a PDF locked with a 4-digit code you choose
Twilio	Our backup text-message line: inbound text-message capture and outbound SMS notifications, when we switch to it	Content of check-ins you send by text; phone number
Mailgun	Inbound email capture	Content of check-ins you send by email; email address
PostHog (EU region)	Product analytics — counting how often the Service is used. Only if you have switched on "Help us count how First Light is used" in Settings; off by default, and nothing is sent otherwise.	An account number, and: that a check-in happened and when, roughly how long it was, whether a feeling was tapped (yes or no), and which app and capture method it arrived by; that a chat exchange happened and of what kind; that a weekly report was opened; that onboarding was completed. Never the text of anything you write, never which feeling, never any health or wearable metric, and never your name, email address, or IP address.

About measurement, and why PostHog is in the table above. What PostHog is told is Consumer Health Data, and we want to be direct about that rather than argue the other way. It is not told the text of anything you write, or which feeling you chose, or any metric — but it is told that a particular account made a mental-wellbeing check-in at a particular time, and that is an inference about your health that the law reaches. The account number is not your name, but it is still you: a number that identifies one person consistently is pseudonymous, not anonymous, and we will not describe it as anonymous anywhere.

That is why this one is handled differently from everything else in the table. Every other row is necessary to run the Service you asked for. This one is not, so it is off by default and sends nothing at all until you turn it on — see Section 4 and Section 6. PostHog is contractually our processor, is called only from our servers and never from your browser, is not told your name, email address, or IP address, and is instructed not to derive your location from the connection. Its browser software — the kind that can record what is on screen — is not installed in First Light at all.

Sendblue, and why the sentence above the table names it as the exception. Since September 20, 2026, Sendblue has carried every text message between you and First Light; Twilio stays connected as a backup we can switch back to. Sendblue's Privacy Policy says it acts as a processor for the businesses that use it. Its Terms of Service, which are the only agreement we have with it, also allow it to use its customers' data, and how they use its service, to develop and improve its own systems and offerings. Sendblue offers a separate data processing agreement only on a larger plan than ours, so we do not have one, and we cannot switch that term off. We would rather say so than list Sendblue as if it were bound like everyone else in the table. If you link your phone, the check-ins you text us and the messages we text you are covered by those terms, and so is your weekly report if you turn on receiving it as a locked PDF (described just below). Nothing else reaches Sendblue: check-ins made on the web, in the browser extension, in the mobile app, or by email never pass through it. Sendblue has not told us how long it keeps messages; it deletes one person's messages when we ask its support team, and a deletion request under Section 9 includes that request. Deleting your account in Settings does not send that request on its own; email privacy@seefirstlight.com and we will make it for you.

Your weekly report as a locked PDF, only if you turn it on. This is off unless you turn on "Weekly Insight as a locked PDF" in Settings and choose a 4-digit code. Once it is on, and only if your phone receives our texts over iMessage, the weekly text that tells you your report is ready carries the whole report as a PDF locked with that code, in place of the usual link. If your phone is not on iMessage, or the PDF cannot be made that week, or Sendblue does not accept it, you get the link as before.

To send the file, we give Sendblue a private link to it on our own servers. The link works for 24 hours and opens only the locked PDF, which we make when the link is used and do not store; Sendblue fetches the file from it and keeps a copy. The file is named only by its week (for example, Week-of-Oct-12.pdf). A 4-digit code stops someone who picks up your phone from opening the PDF, unless they know the code or can open First Light on that phone, where your reports and your code (in Settings) are shown. It does not stop a computer: anyone who has the file can try all 10,000 codes in seconds, and Sendblue keeps a copy. We keep only the code you use now, as you typed it rather than scrambled the way a password is, because our server needs it to lock each new PDF. Changing the code, or turning the PDF off, affects future PDFs only: older PDFs still open with the code they were sent with, and we do not keep old codes, so we cannot look one up for you. Sendblue has not told us how long it keeps the PDFs it fetches from us, and offers no way for our software to delete them; a deletion request under Section 9 includes asking Sendblue to delete them along with your messages, though Sendblue has not yet told us whether it deletes those files the same way. As with your messages, deleting your account in Settings does not send that request on its own; email privacy@seefirstlight.com and we will make it for you. A PDF already delivered stays on your phone and on any device that shares your Messages: deleting a check-in or your account cannot reach it.

Sentry receives reports when our software breaks. It is deliberately not in the table above because it is never told who you are — no account number, no email address, no IP address — and the reports themselves are rebuilt from a fixed list of technical fields before they leave us, so no error message and no request contents ever reach it. See the Privacy Policy, Section 5.1.

How our AI providers handle your data. We send the text of your entries to Anthropic's Claude models through Anthropic's commercial API, and voice recordings to OpenAI's transcription API, in each case solely to generate the outputs you asked First Light for, with one exception: if you have switched on "Help us count how First Light is used," we also send Anthropic the same words a second time to check a reply that drew on your earlier check-ins, as described in Section 4.

Anthropic, PBC — AI processing. We use Anthropic's commercial API to generate certain First Light insights. Anthropic processes this information on our behalf under its Commercial Terms of Service and incorporated Data Processing Addendum. Anthropic states that it does not use commercial API inputs or outputs to train its models unless the customer affirmatively opts in. Under Anthropic's standard API practices, inputs and outputs are generally deleted from its backend within 30 days, subject to exceptions for features with different retention, safety and Usage Policy enforcement, special requirements applicable to certain covered models, legal obligations, or a different written retention arrangement. First Light does not opt in to model training and does not knowingly use a feature with materially different retention without first reviewing the change and updating our disclosures where required.

OpenAI — transcription and search. We use OpenAI's API to turn voice notes into text and to build the search index for your own entries. OpenAI states that API inputs and outputs are not used to train its models unless the customer affirmatively opts in, and First Light does not opt in. We use the transcription endpoint, which OpenAI documents as carrying no abuse-monitoring retention.

We do not share Consumer Health Data with:

Advertisers
Data brokers
Advertising or behavioral-tracking technologies of any kind, on any surface. We do not use Google Analytics, the Meta Pixel, the Reddit Pixel, or anything comparable — not inside the Service, and not on our public marketing pages either
Any analytics provider that can see what you write. We do use one product-analytics provider inside the Service, PostHog, and it is listed in the table above — and only for accounts that have switched the setting on, which is off by default. What it is told is limited to an account number and the countable facts listed in Section 4: that something happened, when, and which app it came from. It is never sent the text of an entry, never told which feeling, and never sent a health or wearable metric. Its browser software — the kind that can record what is on screen — is not installed in First Light at all, and an automated check in our code prevents it from being added
Research partners, academic institutions, or other external parties, unless we obtain your separate, explicit opt-in consent

6. Collection, Use, and Sharing That Requires Consent

We ask for your consent to collect and process your Consumer Health Data before you begin using the parts of First Light that create it, through a separate consent step that is not bundled with our Terms of Service. We collect, use, and share Consumer Health Data only for the purposes and with the third parties listed in Sections 4 and 5 above.

If we wish to collect, use, or share Consumer Health Data for any purpose beyond what is necessary to provide the Service you requested, we will obtain your separate, affirmative, opt-in consent before doing so. We will not pre-check consent boxes, condition access to unrelated features on consent, or otherwise design the consent request to degrade your choice. You may withdraw your consent at any time in Settings; withdrawal stops further collection and does not affect processing that already occurred.

There is exactly one such purpose today: measurement. It is described in Section 4, and the setting is "Help us count how First Light is used," in Settings → Health data, in the web and mobile apps. It ships off. It is not part of signing up or of onboarding — deliberately, so that agreeing to it can never be a side effect of trying to get started. Nothing is sent while it is off, including for accounts that existed before the setting did. Switching it off later stops any further collection.

7. We Do Not Sell Consumer Health Data

Legacy Build Inc. does not sell Consumer Health Data as that term is defined in MHMDA. We do not exchange Consumer Health Data for monetary or other valuable consideration with any third party. We have no plans to sell Consumer Health Data.

If, in the future, we ever wished to sell Consumer Health Data, we would first obtain a valid authorization from you that meets the requirements of RCW 19.373.030(2), including all required signed statements, the specific data to be sold, the purchaser, the purpose, and an expiration date not to exceed one year. You could revoke that authorization at any time.

8. Your Rights Under MHMDA

You have the right to:

(a) Confirm whether we are collecting, sharing, or selling your Consumer Health Data.

(b) Access your Consumer Health Data, including a list of all third parties and affiliates with whom we have shared or sold your Consumer Health Data, and an active email address or other online mechanism you may use to contact those third parties.

(c) Withdraw consent to our collection and sharing of your Consumer Health Data. Withdrawal of consent does not affect collection or sharing that occurred before the withdrawal.

(d) Delete your Consumer Health Data. Upon your request, we will delete your Consumer Health Data from our records and notify all third parties and affiliates with whom we have shared your Consumer Health Data of your deletion request, so that they delete it as well.

(e) Appeal the denial of any of the above requests.

9. How to Exercise Your MHMDA Rights

Email privacy@seefirstlight.com with the subject line "Washington Consumer Health Data Request". Include:

The right you wish to exercise (confirm, access, withdraw consent, delete, or appeal)
The email address associated with your account
Any other details that help us locate your data

We will:

Verify your identity (typically by confirming you control the email associated with your account)
Respond within 45 days of receipt. We may extend the response window by an additional 45 days when reasonably necessary, and we will notify you of any extension and the reason within the first 45 days.
Honor your request free of charge for the first request within a 12-month period. For subsequent requests within 12 months, we reserve the right to charge a reasonable fee if requests are excessive or manifestly unfounded.

For deletion requests, we will also:

Delete your Consumer Health Data from our active systems, and remove it from or render it inaccessible in any backup copies on our documented backup cycle — and, for Consumer Health Data subject to a verified deletion request, in no event longer than the six-month outer limit MHMDA permits (RCW 19.373.030)
Notify all third parties, affiliates, and processors with whom we have shared your Consumer Health Data that you have requested deletion, and direct them to delete accordingly

You can also withdraw consent and delete your data yourself, at any time, from Settings inside First Light. Deleting your account in Settings does not reach Sendblue's copies of your texts or weekly PDFs (Section 5); email privacy@seefirstlight.com and we will ask Sendblue to delete them.

10. Right to Appeal

If we deny your request, we will notify you in writing of the denial and the reasons. You may appeal by replying to that denial email with the word "APPEAL" in the subject line. We will respond to your appeal within 45 days with a written decision.

If your appeal is denied, you may contact the Washington State Attorney General's Office to submit a complaint:

Washington State Attorney General's Office Consumer Protection Division Online: https://www.atg.wa.gov/file-complaint Phone: 1-800-551-4636

11. No Geofencing

Legacy Build Inc. does not, and will not, implement a geofence around any in-person healthcare facility (including but not limited to hospitals, clinics, medical offices, pharmacies, counseling offices, reproductive health facilities, or gender-affirming care facilities) to:

Identify or track consumers seeking health care services
Collect Consumer Health Data from consumers
Send notifications, messages, or advertisements to consumers related to their Consumer Health Data or health care services

12. Security

We use administrative, technical, and physical safeguards designed to protect Consumer Health Data, including encryption in transit and at rest, role-based access controls, vendor security due diligence, and incident monitoring. Our general Privacy Policy describes these measures in more detail.

13. Consumer Health Data Retention

We keep Consumer Health Data only for as long as it is reasonably needed for the purpose it was collected, and no longer. We use these maximum periods:

Check-ins, entries, transcripts, and writing you bring in — kept while your account is active, because keeping them is the Service (your longitudinal record). When you delete your account, they are removed from our live systems immediately. Export a copy from Settings first if you want to keep it.
Voice recordings — deleted after transcription by default. If you have turned on keeping your recordings, those recorded while it is on are kept while your account is active and deleted when you delete the check-in it belongs to, or your account. Turning the setting off again stops us keeping new recordings; it does not remove the ones we kept while it was on.
Derived and inferred insights (weekly reports, pattern observations, sentiment, embeddings) — kept for no longer than the underlying entries they were generated from, and deleted with them.
Google Calendar events (only if you link it): not kept; read for each reply and discarded once it is written. The locked key Google gives us is kept until you unlink, withdraw your consent, or delete your account, and then cancelled at Google; if Google cannot be reached we keep trying, and keep the key only for that.
Deleted health data in backups — purged or rendered inaccessible on our documented backup cycle, and in no event retained longer than the six-month outer limit MHMDA permits after a verified deletion request.
Billing and tax records — kept for up to 7 years as required by law, held separately from and stripped of your journal, voice, and health content.
Consent records — we keep evidence that you gave (or withdrew) consent for as long as needed to establish that we had your permission, but not a duplicate of your health content.
Security logs — up to 12 months.
Support communications — up to 3 years from your last contact.

We may retain specific data for longer only where it is subject to a documented legal hold, and only for as long as that hold requires.

14. Children

The Service is not directed at anyone under 18. We do not knowingly collect Consumer Health Data from anyone under 18. If we learn we have, we will delete it.

15. Changes to This Policy

If we change this Policy in a way that materially affects how we collect, use, or share Consumer Health Data, we will:

Notify you at least 30 days in advance by email and in-app notification
Obtain your renewed consent before applying the change to Consumer Health Data collected before the change takes effect
Update the "Last Updated" date above

Corrections take effect when we publish them, and every one is logged.

Sometimes a change here corrects something this Policy said inaccurately, rather than changing what we do. Waiting thirty days to publish a correction would mean leaving a statement we already know to be wrong in front of you for thirty more days, which helps nobody. So corrections take effect on publication.

A change is a correction only if it leaves all four of these untouched: what we collect, how we use it, who receives it, and how long we keep it. A change that alters any of them is not a correction and carries the full notice above — and if it widens any of them, the renewed-consent commitment applies as well. Narrowing what we do, or describing it more accurately, is the only thing this paragraph covers.

Every correction is recorded in the Revision History at the end of this Policy, naming what the previous version said and why it was wrong. That record is the check on this paragraph: it is what stops a correction from being made quietly.

16. Contact Us

Privacy requests: privacy@seefirstlight.com Questions about this Policy: privacy@seefirstlight.com

Legacy Build Inc. 30 N Gould St, Ste R, Sheridan, WY 82801

Revision History

Version 1.17 (effective October 28, 2026)

A correction to how far back we go when you connect a device. Since Version 1.2 this Policy said that we ask a server-side wearable for up to three years of readings already in its account, and that Apple Health and Google Health Connect give no history. Neither is how First Light connects devices today: when you link WHOOP or Fitbit we ask that service for up to one year of readings, and the First Light iPhone app reads up to three years of readings stored in Apple Health on your phone. Section 2(a)'s history paragraph now says so.

How this version is classified under the change-notice commitment. A correction: it describes what already happens more accurately, and changes nothing about what we collect, how we use it, who receives it, or how long we keep it. The previous wording described how devices connected through the service we used before our own Open Wearables service. No notice was owed in any case: First Light has no users yet, so there is nobody whose agreement predates this version.

Version 1.16 (effective October 23, 2026)

You can now bring in writing from your own files, such as notes and letters. A new Section 2(f) says how it reaches us (your browser sends only the words, never the file), that it can carry health information about you and about people you wrote about, and that you delete it the way you delete a check-in. Section 3 adds it as a source; Section 13 names it beside check-ins.

How this version is classified under the change-notice commitment. Not a correction: it widens what we collect, for accounts that bring writing in, and it carries the notice and consent commitments in Section 15 for anyone whose agreement predates this version. Nobody's does: First Light has no users yet. From the first real user onward, nothing is brought in unless they choose the files themselves under this wording.

Version 1.15 (effective October 23, 2026)

If you link your Google Calendar, First Light now reads the calendars other people share with you and the ones you subscribe to, as well as your own. Section 2(e) says so, and that a calendar a family member shares with you can carry their health information.

How this version is classified under the change-notice commitment. Not a correction: it widens what we read, for accounts that link a calendar, and it carries the notice and consent commitments in Section 15 for anyone whose agreement predates this version. Nobody's does: First Light has no users yet. From the first real user onward, nobody's calendar is read unless they link it under this wording.

Version 1.13 (effective October 19, 2026)

Section 2(a) now says how a Fitbit or a Pixel Watch reaches us: through your Google account, using Google's Health API, with read-only access to your sleep and health measurements only. It carries the statement Google requires about its Limited Use rules.

How this version is classified under the change-notice commitment. A correction: Fitbit was already listed as a wearable you can link, and what we collect, how we use it, who receives it and how long we keep it are unchanged. This version says the link runs through Google, which is how every Fitbit connects now, and adds a commitment rather than a use.

Version 1.12 (effective October 18, 2026)

First Light can now read your Google Calendar, if you choose to link it. It is optional and off until you link it. Calendar events can carry health information about you and about other people in them, so this Policy now covers them.

What changed here: a new Section 2(e) says what is read, when, that events can carry other people's health information, that we keep no copy, how to unlink, and carries the statement Google requires about its Limited Use rules. Section 3 adds your Google Calendar as a source; Section 5 adds calendar events to what Anthropic receives, for accounts that link; Section 13 says calendar events are not kept, and how long the key is.

How this version is classified under the change-notice commitment. Not a correction: it widens what we collect and what Anthropic receives, for accounts that link a calendar, and it carries the notice and consent commitments in Section 15 for anyone whose agreement predates this version. Nobody's does: First Light has no users yet. From the first real user onward, nobody's calendar is read unless they link it under this wording.

Version 1.11 (effective October 16, 2026)

How the locked weekly PDF reaches Sendblue changed. We used to upload the file to Sendblue, which stored it under a name with letters added to it. Now we give Sendblue a private link to the file on our own servers instead: the link works for 24 hours, opens only the locked PDF, and the file is made when the link is used rather than stored. Sendblue still fetches the file and keeps a copy.

What changed here: Section 5's paragraph on how the PDF works says so, and speaks of the PDFs Sendblue fetches from us rather than the PDFs we upload to it.

How this version is classified under the change-notice commitment. Not a material change: who receives your Consumer Health Data (Sendblue, as before), what we collect, and how long it is kept are unchanged; only the way the file reaches Sendblue is. No advance notice was owed in any case: First Light has no users yet, so there is nobody whose agreement predates this version.

Version 1.10 (effective October 15, 2026)

First Light can now send your weekly report as a PDF in iMessage, locked with a 4-digit code you choose. It is off unless you turn it on in Settings. Weekly reports are Consumer Health Data, and when this is on the PDF goes through Sendblue, which keeps a copy, so Sendblue now receives Consumer Health Data it did not receive before.

What changed here: Section 5 adds the locked PDF to Sendblue's row and to the sentence before "Nothing else reaches Sendblue," and gains two paragraphs, on how it works and on what it does not protect and how its copies are deleted. A 4-digit code stops someone who picks up your phone from opening the PDF, unless they know the code or can open First Light on that phone, where your reports and your code (in Settings) are shown. It does not stop a computer: anyone who has the file can try all 10,000 codes in seconds, and Sendblue keeps a copy. We keep only the code you use now, and changing it or turning the PDF off affects future PDFs only. Sendblue has not told us how long it keeps the PDFs, or whether it deletes them when asked; a deletion request under Section 9 includes asking it to. Deleting your account in Settings does not send that request on its own, for PDFs or for messages; Sections 5 and 9 now say so, where Version 1.9 said it only in the Privacy Policy. A PDF already delivered stays on your phone and on any device that shares your Messages, and deleting a check-in or your account cannot reach it.

How this version is classified under the change-notice commitment. Not a correction. It widens who receives Consumer Health Data (Sendblue receives your weekly report), for accounts that turn it on, so it carries the notice and renewed-consent commitments in Section 15 for anyone whose agreement predates this version. Nobody's does: First Light has no users yet (the only accounts belong to the operator, testing the Service before launch), so there is nobody to notify and no earlier agreement to renew. From the first real user onward, no weekly report reaches Sendblue unless its owner has turned this on under this wording.

Version 1.9 (effective October 10, 2026)

Section 5 named Twilio as the company that carries text messages, and did not name Sendblue. Since September 20, 2026, Sendblue has carried every text between you and First Light, over iMessage or as an ordinary text message, and Twilio has been connected only as a backup. Sendblue receives your phone number and the full content of those messages, in both directions, and the check-ins you text us are Consumer Health Data. Leaving it out was our error.

Version 1.8 also said that every third party in Section 5 "is bound by a written contract that restricts their use of the data to providing services to us." That was not true of Sendblue. We use it on its standard terms, which also let it use customer data to improve its own systems, and we have no separate data processing agreement with it. Section 5 now lists Sendblue in the table, names it as the exception in that sentence, and explains the exception below the table, including how its copies are deleted. Twilio stays in the table, described as the backup it is.

How this version is classified under the change-notice commitment. A correction: it describes a provider that already received this data, on terms that already applied, and changes nothing about what we collect, how we use it, who receives it, or how long we keep it. It narrows nothing and widens nothing; it says more accurately what already happens. No advance notice was owed in any case: First Light has no users yet, so there is nobody whose agreement predates this version.

Version 1.8 (effective October 8, 2026)

This Policy did not describe a check our software makes on its own replies.

When a reply draws on your earlier check-ins, the software can send what you wrote and those earlier check-ins to Anthropic a second time, to ask whether the reply picked the right ones, and keep only a yes or no. Version 1.7 said we send your words to Anthropic "solely to generate the outputs you asked First Light for," and that measurement was limited to the counts listed in Section 4. Neither covered this check. Before this version, the software ran it for any account that had given health-data consent, whether or not the measurement setting was on. First Light has no users yet, so the only account it ever ran on is the operator's own, testing the Service before launch.

What changed, in the software and here: the check now runs only for accounts that have switched on "Help us count how First Light is used," which is off by default, and Section 4 now describes it under that setting. Section 5 names it in the Anthropic row and in the paragraph on how our AI providers handle your data. The setting's own description in the web and mobile apps says the same. Section 6 is unchanged: measurement is still the one optional purpose, and this check is part of it.

How this version is classified under the change-notice commitment. Not a correction. Compared with what Version 1.7 said, it widens how we use Consumer Health Data within the optional purpose, so it carries the notice and renewed-consent commitments in Section 15 for anyone whose agreement to that setting predates this version. Nobody's does: First Light has no users yet, so there is nobody to notify and no earlier agreement to renew. From the first real user onward, nobody is checked this way without having switched the setting on under this wording.

Version 1.7 — effective September 15, 2026

Quiet Mode has been removed from the product, and so from this Policy.

Version 1.5 named a Quiet Mode signal as Consumer Health Data in its own right: a flag our software set when your words matched a list of crisis-related terms, and which made the following week quieter. To exist lawfully it needed its own consent, its own retention rule, and its own place in your data download. We decided that a change of tone for a week was not worth any of that, and removed the feature and the flag entirely on September 15, 2026. The table that held the flag and the consent record for it have been deleted from our systems.

What has gone from this Policy: the Quiet Mode bullet and the six paragraphs that followed it in Section 2. In their place, one paragraph describes the crisis check that remains and states what it does not do.

What has not changed. The crisis check itself. When your words match the list, the Service shows you where to get help, exactly as before, and Settings still carries a permanent link to a directory of free crisis lines. That check sets no flag, keeps no record beyond the reply in your conversation, tells no one, and contacts no one.

Why this document goes from 1.5 to 1.7. The three policies carry one version number between them. Version 1.6 changed the Privacy Policy and the Terms of Service only (text-message disclosures) and did not touch this document, which is why there is no 1.6 entry here.

How this version is classified under the change-notice commitment. A correction paired with a narrowing: it removes a processing activity and the data it produced, and it widens nothing about what we collect, how we use it, who receives it, or how long we keep it. No renewed consent is required. No advance notice was owed in any case: First Light has no users yet, so there is nobody whose agreement predates this version.

Version 1.5 — effective September 9, 2026

We were not telling you about a decision our software makes about you.

If a check-in or a conversation mentions self-harm or suicide, our software sets a flag on your account, by itself, and for the next seven days First Light behaves differently toward you — fewer prompts, no daily question, a gentler reply, no patterns surfaced, no reminders. It has worked this way since launch. Nothing in the product told you it had happened, and this Policy described it only under the general heading of AI-derived inferences.

Two external law firms independently identified this as the most significant gap in our disclosures. Section 2 now names the Quiet Mode signal as Consumer Health Data in its own right and describes in full what it does, what it never does, that it is not a diagnosis, that no person reviews it, and how to see it and switch it off. Section 2.8 of the Privacy Policy carries the same description, and Section 16.6 there sets out the GDPR safeguards.

In the product, at the same time: Quiet Mode is now something you turn on rather than something that happens to you — we ask for it separately, it is off unless you say otherwise, and you can change that in Settings whenever you like. While it is on, your dashboard says so and Settings explains it and offers a switch; switching it off keeps it off for the rest of that week. The record is deleted once the week ends, so no history accumulates, and your data download shows it only while it is active. An internal severity score, recorded and never used for anything, has been removed entirely.

Nothing about what we collect, keep, delete or share has changed. Quiet Mode is not new; describing it is.

How this version is classified under the change-notice commitment. Most of what changed here is a correction as newly defined: it alters what we say, not what we do. The exceptions are three, and all three narrow what we do rather than widen it — Quiet Mode now requires your consent before it can happen at all, its record is now deleted rather than kept, and an internal score was removed. Nothing here expands what we collect, how we use it, who receives it, or how long we keep it, so no renewed consent is required. And no advance notice was owed in any case: First Light has no users, so there is nobody whose agreement predates this version.

Version 1.4 — effective September 7, 2026

We replaced the company that used to sit between your wearable and us.

Until now, health data from a connected device reached us through Terra, a separate health-data aggregation company. Terra received your readings, normalized them, and passed them on. We have replaced Terra with Open Wearables — health-data software that we run ourselves. The practical effect is that one fewer company receives your health data: what used to be an outside service is now software under our own control, and no aggregation provider sits in front of us any more.

The software runs on servers provided by Railway, which is now listed as a service provider in the same way our other hosting and database providers are. Railway stores the data for us; it is not a health-data company and does nothing with it.

Nothing about what we collect, how long we keep it, or what we do with it has changed. The list of who we share Consumer Health Data with is shorter as a result, not longer.

No advance notice was owed for this change: First Light has no users yet, so there is nobody whose agreement predates it. Once the Service has users, material changes carry thirty days' notice as described in this Policy.

Version 1.3 — effective September 5, 2026

An audit compared every statement in this Policy against the software as it runs. This version corrects the two statements in this Policy that did not match, and spells out one thing it had left unsaid. Nothing here changes what we collect or share; it changes what we say, to match.

Where the measurement setting is. Section 6 said "Help us count how First Light is used" is in Settings on all three apps. The browser extension has no such setting; the web and mobile apps do. Corrected. The setting still ships off, and the extension sends nothing either way.
Firebase removed. Section 5 named Firebase Cloud Messaging as a recipient of push notifications. Nothing in the software sends anything to Firebase — mobile reminders are set locally on your phone. A recipient that receives nothing has been removed from the table.
Turning off "Keep my voice recordings." Sections 2(c) and 13 said kept audio is deleted when you delete the recording or your account, and said nothing about what turning the setting off does. They now say it: turning the setting off stops us keeping new recordings; the ones kept while it was on stay until you delete the check-ins they belong to, or your account.

On the 30 days' notice promised in Section 15. No notice was given for these changes, and none was owed, for the same reason recorded under Versions 1.1 and 1.2: First Light still has no users. The only accounts in existence belong to the operator, testing the Service before launch. There is no consumer to notify, and no earlier-collected consumer health data to which a change could be applied. We are recording that here rather than leaving it to be inferred. The Section 15 commitment stands unchanged and applies in full from the first real user onward.

Version 1.2 — effective September 2, 2026

We import history when you connect a wearable, and now we say so. Section 2(a) previously listed what a connected device contributes and was silent on how far back. That was accurate while First Light only ever received readings a device made after you linked it. It stopped being accurate when we began requesting up to three years of readings that already exist in the device's account at the moment you connect. The categories collected have not changed; the reach of the collection has, and the reach is part of what you are agreeing to rather than a detail beneath it. Section 2(a) now states the three-year request, that the provider — not us — decides how much of it we actually receive, and that on-device sources (Apple Health, Google Health Connect) contribute no history at all.
What disconnecting does, and does not do. Section 2(a) now says plainly that disconnecting a wearable stops new readings but does not delete readings we already hold, and points to the deletion right in Sections 8 and 9. This was already true and already governed by those sections; it was not stated where somebody deciding whether to disconnect would read it.
Section 3 now notes that the connected-device source includes pre-connection readings, so the sources list does not imply a start date the collection section contradicts.

On the 30 days' notice promised in Section 15. No notice was given for this change, and none was owed, for the same reason recorded under Version 1.1: First Light still has no users. The only accounts in existence belong to the operator, testing the Service before launch. There is no consumer to notify, and no earlier-collected consumer health data to which this change could be applied — nobody has connected a wearable to a First Light account except the operator. We are recording that here rather than leaving it to be inferred. The Section 15 commitment stands unchanged and applies in full from the first real user onward.

Version 1.1 — effective August 28, 2026

Consolidates every change made since Version 1.0 took effect on August 1, 2026:

Deletion timing. Corrected a promise of up to 30 days to export your data before deletion; deletion is immediate, and the export is available beforehand rather than during a wait.
Two processors we had not named. Added Sentry (error reporting) and PostHog (product analytics) to our disclosures, and stated plainly that we run no advertising or behavioral-tracking technology on any surface.
Measurement became a stated purpose. Removed a sentence asserting that PostHog "is not sent Consumer Health Data." That framing was wrong: the events are keyed to an account number, and a number that identifies one person consistently is pseudonymous, not anonymous. Section 4 now separates the purposes necessary to run the Service from the one optional purpose — measurement — which is off by default and sends nothing until you switch it on in Settings. Section 5 describes exactly what is sent, and Section 6 names the setting.

On the 30 days' notice promised in Section 15. Section 15 commits us to 30 days' advance notice, and to renewed consent, before a material change applies to Consumer Health Data collected earlier. No such notice was given for any of the changes above, and none was owed: First Light had no users during this period. The only accounts in existence belonged to the operator, testing the Service before launch, so there was no consumer to notify and no earlier-collected consumer data to which a change could be applied. We are recording that here rather than leaving it to be inferred.

The Section 15 commitment stands unchanged and applies in full to every version from this one onward.

Version 1.0 — effective August 1, 2026. Initial published policy.