Consumer Health Data Privacy Policy

This policy applies if you live in Washington State, or if your consumer health data is collected while you are in Washington. It adds to the Privacy Policy; it does not replace it. Vita Florentis, the operator of the Last Hour Experience, is the regulated entity.

The Last Hour Experience never asks you a health question. But you write freely, and what you write about your own life can reveal information about your physical or mental health, including past conditions, treatment, grief, or recovery. That free-text content is the only category of consumer health data that may be collected, and only if you choose to write it.

• to let you pick up your hour where you left off, on this device or on any other one you sign in from
• to create your personal document and make it available to you
• to publish something only if you explicitly choose to publish it

It is never used to infer anything about you, never for advertising, never for profiling, and never to train AI.

From you, and only from you: the reflections and letters you type during the experience. Nothing is collected from other sources.

Vita Florentis does not sell consumer health data and does not share it with third parties for their own purposes. No affiliate receives it. Technical processors act only on my written instructions: Supabase (encrypted storage, Ireland) and Cloudflare (delivery). There is one more path: while your first-deed reminder is on, the single sentence you wrote about your first step travels through Convex, my mail layer, and Resend, so that reminder email can reach you. Each processor is bound by a data processing agreement.

• to confirm whether consumer health data about you is collected, and to access it
• to withdraw your consent for future collection
• to have it deleted, including from backups and from processors within the periods below
• to know which third parties would receive it (none, apart from the processors above)

Email me from the address on your account, or use the delete button in your account, which immediately erases your reflections from active systems. One thing can stay behind: while your first-deed reminder is switched on, the single sentence you wrote about your first step is kept encrypted until you switch that reminder off. I verify your identity by matching the email address on the account; you never need to create a new account or send a copy of an identity document.

Within 45 days. If a request is complex I may extend that period once by another 45 days, and I tell you why before the first period ends. A deletion request is passed on to processors within 72 hours, and the encrypted platform backups follow a few days after that. There is no charge unless a request is manifestly unfounded or excessive.

You can appeal by replying to my decision within 30 days. I answer an appeal within 45 days and explain the reasons in writing. If the appeal is denied, you may contact the Washington State Attorney General.

If I ever add a new category of consumer health data, a new purpose or a new recipient, this policy is updated first and, where the law requires it, I ask for your consent again before the change takes effect.

This page describes the state of the service today. The full data lifecycle, including the 30-day deletion limit for your words, is set out in the Privacy Policy.