Health Data & US State Privacy Notice
Version 2026-10-22 · Last updated 22 October 2026
This notice is our Consumer Health Data Privacy Policy for residents of Washington, Nevada, Connecticut and other US states with consumer health data laws, and our notice for residents of California and other US states with comprehensive privacy laws. It supplements the Privacy Policy. Data controller: Daniil Agalakov, individual entrepreneur (Georgia), identification code 322783065, 5 Avto Varazi Street, Vake-Saburtalo, Tbilisi, Georgia.
HIPAA. Cibeety is a consumer wellness app, not a healthcare provider or health plan. The information you enter is not covered by HIPAA, but we protect it as described here.
1. Consumer health data we collect
- Mood check-ins you record (five-level scale and time).
- Diary and exercise entries in which you describe situations, feelings, thoughts and your own notes (emotion diary, ABC model).
- AI reflections and weekly reports generated from those entries (they describe themes you mentioned; they are not assessments or diagnoses).
- Chat messages you send. They are processed to produce a reply and stored on your device only, not on our servers.
We collect this only from you, with your consent given on the consent screen, and only to provide the features you use, to keep the Service safe and secure, and to meet legal obligations.
2. Who receives it
We share consumer health data only with processors acting on our behalf: our AI provider (OpenAI, L.L.C.) to generate replies and reflections, and our hosting provider (Contabo GmbH (server in France)). They may use it only to provide services to us. We do not sell consumer health data, we do not share it with third parties for their own purposes or for advertising, and we do not use geofencing around healthcare facilities.
3. Your rights
- Access your consumer health data and see the list of third parties and affiliates it is shared with (download it in Settings → Privacy & data).
- Withdraw consent to collection or sharing at any time (Settings → Privacy & data → Withdraw consent).
- Delete your consumer health data (Settings → Privacy & data → Delete account). We delete it from our active systems and tell our processors to do the same, and delete it from archives and backups within the period stated in the Privacy Policy and no later than the law allows.
- Correct inaccurate information, and not be discriminated against for exercising your rights.
To exercise a right in another way, write to yasenpsyco@gmail.com. We respond within 45 days (and may extend once by a further 45 days where permitted, with notice).
Appeal. If we decline your request, you may appeal by replying to our decision or writing to yasenpsyco@gmail.com with "Appeal" in the subject. We respond within 45 days (60 where your state allows). If you are not satisfied you may contact your state attorney general (for example in Washington: atg.wa.gov/file-complaint).
4. California notice (CCPA/CPRA)
In the past 12 months we collected the following categories of personal information:
| Category | Examples | Source | Purpose | Sold or shared for advertising? |
|---|---|---|---|---|
| Identifiers | Name, Telegram ID, profile picture URL, IP address | You, your device, Google/Telegram sign-in | Account, security | No |
| Sensitive personal information: health | Mood check-ins, diary and exercise entries, AI reflections | You | Provide the Service you asked for | No |
| Sensitive personal information: account log-in | Session cookie | You | Keep you signed in | No |
| Internet or app activity | Screens and features used (only if you opt in) | Your device | Improve the Service | No |
| Inferences | AI reflections about themes in your entries | Generated from your entries | Provide the Service | No |
We use sensitive personal information only to provide the Service you requested and for other purposes permitted by the CCPA regulations, so we do not offer a "limit the use of my sensitive personal information" choice. We do not sell or share personal information. Retention is described in the Privacy Policy.
California residents may request to know, delete and correct, and may use an authorised agent. We verify requests by requiring you to be signed in or to confirm your account. Requests: Settings → Privacy & data or yasenpsyco@gmail.com. We will not discriminate against you for exercising your rights. We do not knowingly collect data from anyone under 18.
5. Other US state privacy laws
If you live in Colorado, Connecticut, Delaware, Montana, Oregon, Texas, Utah, Virginia or another state with a comprehensive privacy law, you may have the rights to confirm, access, correct, delete and obtain a copy of your data, to opt out of sale, targeted advertising and profiling (we do none of these), and to appeal a refusal. Sensitive data, including health data, is processed only with your consent, which you can withdraw. Contact us using the details above.
6. Contact
Daniil Agalakov, individual entrepreneur (Georgia), identification code 322783065 · 5 Avto Varazi Street, Vake-Saburtalo, Tbilisi, Georgia · yasenpsyco@gmail.com