Consumer Health Data Privacy Policy

Last updated: August 12, 2026

Effective Date: August 2, 2026
Last Updated: August 12, 2026

This Consumer Health Data Privacy Policy explains how Nastvix Inc., a Delaware corporation operating HeroMi (“HeroMi,” “Nastvix,” “we,” “us,” or “our”), handles information that may qualify as “consumer health data” under applicable U.S. state laws.

This Policy supplements our Privacy Policy and applies only where consumer health data laws apply.

HeroMi is a parent-directed service. Information about a child is provided or generated through the activity of an adult parent or legal guardian. Children do not independently provide information through HeroMi.

1. Consumer Health Data We Collect

Depending on applicable law, some information used by HeroMi may be considered consumer health data because it relates to emotional, behavioral, or developmental information.

This may include:

  • moods recorded by the parent;

  • behaviors and situations reported by the parent;

  • triggers associated with reported behavior;

  • focus goals selected for a child;

  • completed and saved practices;

  • emotional-skill levels and progress information;

  • recommendation history;

  • whether recommendations were marked helpful or not helpful; and

  • information derived from these activities for personalization and progress tracking.

We do not collect medical records, prescriptions, medical diagnoses, biometric data, genetic data, or information about healthcare providers through HeroMi.

2. Sources of Consumer Health Data

We obtain consumer health data from:

  • the adult parent or legal guardian using HeroMi;

  • the parent’s activity within the Service; and

  • information generated or derived by HeroMi from completed practices, reported situations, and skill progress.

Children do not independently submit consumer health data through HeroMi.

3. Why We Collect and Use Consumer Health Data

We collect and use consumer health data to provide the HeroMi service requested by the parent, including to:

  • personalize practices and recommendations;

  • provide age-appropriate support;

  • understand reported moods, behaviors, and triggers;

  • track emotional-skill development and progress;

  • remember previously completed or saved practices;

  • avoid unnecessary repetition;

  • determine which practices or recommendations may be most relevant next; and

  • maintain the functionality and security of the Service.

We do not use consumer health data for advertising or advertising profiling.

Where applicable law requires consent for a collection or use that is not necessary to provide a service you requested, we will obtain the required consent before beginning that processing.

4. How Consumer Health Data Is Processed

Consumer health data associated with HeroMi profiles is primarily stored and processed using Supabase infrastructure in the United States.

HeroMi uses internal systems to personalize recommendations based on information associated with the child profile and previous HeroMi activity.

We also use Google Gemini through a paid Google Cloud project for certain personalized responses.

Information provided to Gemini is limited to what is reasonably necessary for that purpose and may include:

  • generalized age or age group;

  • relevant triggers;

  • mood information when recorded; and

  • de-identified skill-level information.

We do not send the child’s name, full date of birth, parent’s email address, account credentials, or payment information to Gemini as part of a personalization request.

Access to consumer health data is restricted according to business need and appropriate access controls.

5. Disclosure of Consumer Health Data

We do not sell consumer health data.

We do not disclose consumer health data for:

  • targeted advertising;

  • cross-context behavioral advertising;

  • creation of advertising audiences; or

  • data-broker purposes.

Consumer health data may be processed on our behalf by service providers where reasonably necessary to operate HeroMi.

These providers may include:

  • Supabase — database infrastructure, backend services, authentication, and storage; and

  • Google Gemini / Google Cloud — limited AI-assisted personalization.

We may also disclose information where required by law or reasonably necessary to protect legal rights, prevent fraud or security threats, or comply with valid legal process.

We do not currently disclose consumer health data to affiliates for their independent use.

6. No Cross-Site Health Data Tracking

We do not permit third parties to collect consumer health data through HeroMi over time and across unrelated websites or online services for advertising or profiling purposes.

Google Analytics is used for general website and product analytics, but we do not intentionally send moods, behaviors, triggers, child profile information, skill data, or other consumer health data to Google Analytics.

7. Your Consumer Health Data Rights

Where applicable law provides these rights, you may request to:

  • confirm whether we collect, use, share, or sell consumer health data relating to you;

  • access consumer health data;

  • receive information about entities with whom applicable consumer health data has been disclosed;

  • withdraw consent where processing is based on consent;

  • request that we stop certain collection or sharing;

  • request deletion of consumer health data; and

  • appeal a decision we make regarding a consumer health data request.

We do not discriminate against users for exercising applicable privacy rights.

8. How to Exercise Your Rights

You may exercise available rights through HeroMi account controls where the relevant functionality is available or by contacting:

support@heromi.app

Please identify your request as a Consumer Health Data Request.

We may verify your identity before processing a request to protect account and child information.

We will respond within the period required by applicable law. Where permitted, we may extend the response period when reasonably necessary and will inform you of the extension.

If we deny a request and applicable law provides a right to appeal, you may submit an appeal to support@heromi.app with the subject:

Consumer Health Data Appeal

We will review the appeal and provide the information required by applicable law.

9. Deletion

You may delete your entire HeroMi account through your account settings.

Account deletion initiates deletion of the associated:

  • child profiles;

  • reported moods, behaviors, and triggers;

  • completed and saved practices;

  • skill-progress information;

  • recommendation history; and

  • other associated HeroMi personalization data.

You may also archive an individual child profile. If it remains archived, the profile and associated information are scheduled for deletion within 30 days.

When applicable law requires us to notify processors or other recipients of a valid consumer health data deletion request, we will do so.

Information stored in archived or backup systems may be deleted on a delayed basis where permitted by applicable law and will remain subject to applicable security and deletion requirements.

10. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect consumer health data, including:

  • encryption in transit;

  • authentication controls;

  • role-based access restrictions;

  • logging and monitoring;

  • secured backups; and

  • contractual restrictions applicable to service providers.

No electronic system can be guaranteed to be completely secure.

11. Changes to This Policy

We may update this Policy when our practices, technology, service providers, or legal obligations change.

If we intend to collect, use, or disclose additional categories of consumer health data or use existing consumer health data for a materially different purpose, we will provide notice and obtain affirmative consent before doing so where required by applicable law.

The current version and “Last Updated” date will remain available through HeroMi.

12. Contact

Questions or requests concerning consumer health data may be submitted to:

Nastvix Inc.
HeroMi
Registered office: 8 The Green, STE A
Dover, Delaware 19901
United States

Email: support@heromi.app