Spiral Consumer Health Data Privacy Policy

Last updated: September 3, 2026

This policy is provided by Time Machine Automation LLC, a Pennsylvania limited liability company ("Spiral," "we," "us") and describes how we handle consumer health data as defined by applicable state health data privacy laws, including Washington's My Health My Data Act and similar state laws. It supplements the Spiral Privacy Policy. A link to this policy appears on our website homepage.

Consumer health data we collect

• The text conversations you have with the Spiral AI service, which may reveal information about your mental, emotional or physical health and wellness.
• Wellness-related inferences, sentiment and safety or risk flags derived from those conversations.
• Usage and engagement information tied to your account, such as how many messages you exchange, when you were last active and how long you have subscribed, along with which partner therapist's AI Persona you subscribe to.
• Account and contact information associated with that data: phone number, name, email address and the role or context you select at signup.

Engagement metrics (Added 2026-08-30)

We collect engagement metrics tied to your account, including the number of messages you send, how frequently you message and which therapist persona you are subscribed to. We collect this data directly from your use of the service and it is necessary to operate the core features you have requested, such as monitoring conversation activity and supporting your subscribed persona. We do not sell this data and we do not share it with third-party advertisers or analytics providers. We use it only internally for service operation, safety monitoring and account support. You may withdraw consent for any category of consumer health data collection that is not necessary to provide the service. You may also request access to or deletion of your consumer health data at any time by contacting admin@talktospiral.com. Where required by the Washington My Health My Data Act, we will honor your deletion request within the statutory timeframe and will not collect or share additional categories of consumer health data beyond those disclosed here without first updating this policy and obtaining your affirmative consent.

Onboarding intake. When you set up your account, we ask open, narrative questions rather than only dropdowns, so we collect freeform text you choose to share about how you are feeling, what is going on in your life, what you are hoping for and how you like to be supported. This text can reveal information about your mental or emotional health and wellness, so we treat it as consumer health data. You may leave any question blank. This intake is text you type. We do not record your voice during onboarding.

Information about other people. The intake also asks, optionally, about people in your life, such as a partner, a family member, a friend or a colleague as well as who you confide in. When you share this, we hold identifiable information about people who are not Spiral users and who did not give it to us themselves. We collect it only because you chose to share it and only so the Service can follow along when you mention them later. We do not contact those people, we do not build a separate profile of them and we never sell this information. It is handled under the Spiral Privacy Policy, is kept as part of your account and is deleted when you delete your account or request deletion.

Sources

We collect consumer health data directly from you (your messages and signup information) and derive it from your use of the Service. We do not purchase consumer health data from anyone. We retain consumer health data only as long as reasonably necessary to fulfill the purposes described in this policy, unless a longer retention period is required by law.

Why we collect it

To provide, operate and personalize the Service; to train, develop and improve our AI models and the Service; to detect crisis-related messages and route you to safety resources; to secure and debug the Service; and to comply with law. We collect and process consumer health data with your consent, except where processing is permitted or required by applicable law without consent.

We also use it to provide account support and to troubleshoot problems you report or that we detect. That can require authorized Spiral personnel to view the affected conversation in identified form, only as needed to resolve the issue. Such access is limited to personnel who need it, is logged and is not used to train or improve the AI.

Sharing

We share consumer health data only with service providers who process it on our behalf under contract, such as SMS and telecommunications carriers, AI infrastructure providers, cloud hosting and database providers, payment processors and email delivery providers. We do not currently have affiliates. We do not sell consumer health data and we do not share it with advertisers or ad platforms. We may disclose data if required by law or to protect safety.

If you subscribe to a partner therapist's AI Persona, that therapist can see general usage and engagement information about the subscribers to their AI Persona (for example message volume over time, last-active and tenure), never the content of your conversations. We treat this activity information as consumer health data and disclose it here and in the Spiral Privacy Policy.

De-identified data

We may create de-identified data that can no longer reasonably identify you. We take reasonable measures to keep de-identified data from being re-associated with you, we will not attempt to re-identify de-identified data (except to test whether our de-identification process works) and we contractually require anyone we share it with not to attempt re-identification.

Geofencing

We do not use geofencing around any facility that provides health care services to identify, track, collect data from or send notifications to consumers.

Your rights

You have the right to: confirm whether we collect, share or sell consumer health data about you and access that data, including a list of the third parties and affiliates with whom we have shared it; withdraw your consent; and have your consumer health data deleted. To exercise any right, email admin@talktospiral.com or use your in-app settings. We will verify and honor authenticated requests on the timelines your state's law requires, including deletion from our active systems and, as backup copies reach their normal expiration, from backups as well. We will also notify third parties who received the data. If we deny a request, you may appeal by replying to our response and if your appeal is denied you may contact your state attorney general.

Contact

admin@talktospiral.com or Time Machine Automation LLC, 3706 Butler Street, Suite 208, Pittsburgh, PA 15201.