nodu · Legal

Consumer Health Data Privacy Policy

Effective October 3, 2026 · version v10-2026-10-03

1. What "consumer health data" means here

nodu is a habit-change application that uses AI-generated audio sessions to support behavior change. The information you share during onboarding intake, ongoing journal entries, memory-card updates, and session-feedback prompts is the heart of what nodu does — and most of it qualifies as consumer health data under one or more of the Washington My Health My Data Act ("MHMDA"), Nevada SB 370, the Connecticut Data Privacy Act ("CTDPA"), and the Maryland Online Data Privacy Act ("MODPA").

This Policy governs consumer health data processed through the nodu service (the "Service"). The public marketing site does not collect consumer health data: no page about a specific habit carries any third-party tracker, and the site hosts no signup form and collects no email address or other information you provide about yourself. Its processing is the first-party, server-side traffic measurement described in Privacy Policy § 14 and, on the homepage named there only, a page that names no habit, Meta's advertising measurement pixel disclosed there. That pixel collects ordinary visit data from a page about nothing more specific than the product itself; it is never present on any page about a habit topic. If IRJG ever collects information on the marketing pages that is linked or linkable to a habit topic, IRJG will voluntarily treat it as consumer health data with the protections of this Policy, and will update this section before that collection begins.

For purposes of this CHD Policy, IRJG voluntarily applies a single broad definition of consumer health data, regardless of which state's narrower statutory definition would apply to a given user. This is a unilateral commitment to higher protection, not a description of statutory overlap. Specifically, nodu treats the following as consumer health data:

A note on HIPAA and clinical confidentiality. nodu is a self-help and wellness product, not a healthcare provider, and IRJG is not a HIPAA covered entity or business associate. The federal Health Insurance Portability and Accountability Act (HIPAA) therefore does not apply to the consumer health data you share with nodu, and telling nodu something is not the same as telling a doctor or therapist bound by HIPAA. This does not mean your data is unprotected: IRJG protects it under this Policy and the state consumer health data laws described here, including its commitments not to sell it, never to use it for third-party or targeted advertising, and to obtain your consent before collecting it.

2. How nodu collects consumer health data

nodu collects consumer health data:

nodu does not infer health data from your IP address, browsing history, location, or other indirect signals. nodu's consumer health data comes only from what you choose to tell it.

3. How nodu uses consumer health data

nodu uses your consumer health data only to:

nodu does not use consumer health data:

A specific note on AI training. nodu does not train its own AI models on your consumer health data. nodu's AI service providers process your data under each vendor's applicable, operator-verified terms; whether and how each provider may use inputs for model improvement is governed by that vendor's terms, not by IRJG. § 4 of this CHD Policy describes the per-vendor posture, including Anthropic's default-terms commitment not to train on API inputs and outputs (no opt-out required by nodu), and IRJG's affirmative opt-out election from ElevenLabs' default training use.

A specific note on MODPA's standard for sensitive data. Maryland's MODPA treats consumer health data as sensitive data and prohibits its collection or processing except where strictly necessary to provide or maintain the specific product or service the consumer has requested; consent does not authorize processing beyond that standard. Each purpose listed in § 3 is, in IRJG's assessment, strictly necessary to provide and maintain nodu for you — including the bounded 90-day diagnostic-artifact purpose (coach-conversation transcripts and generation records), which exists to verify and maintain the quality and safety of the contracted service, with a window sized to the operational review cadence and to investigating a reported issue with a specific session after the report arrives. IRJG documents its reasoning for processing decisions involving consumer health data in its internal data-protection assessment, which the Maryland Attorney General may request during an investigation under MODPA § 14-4710.

4. How nodu shares consumer health data

nodu does not sell your consumer health data. nodu does not share consumer health data with any third party for cross-context behavioral advertising, targeted advertising, or any other advertising purpose. The email provider that delivers nodu's own messages, including reminder email, is a processor acting on IRJG's instructions under contract, not a third party receiving data for advertising, and it receives your address and the message — never your habit, topic, or session content. nodu does not use device location data, geofencing, or proximity tracking; the Connecticut PA 23-56 prohibition on geofencing within 1,750 feet of mental-health facilities is satisfied by absence of the practice.

A specific note on MODPA's absolute prohibition on sensitive-data sale. Maryland's MODPA prohibits the sale of sensitive personal data — which includes consumer health data — regardless of whether the consumer consents. This is stricter than the CTDPA, MHMDA, or Nevada SB 370, each of which permits sale with consent (or with separate written authorization in the case of MHMDA). nodu's no-sale commitment in this section satisfies MODPA's stricter standard.

nodu shares consumer health data only with the service providers listed in § 4 of the Privacy Policy, and only to the extent strictly necessary for each provider to perform the service IRJG has contracted them to provide. IRJG has no affiliates and shares consumer health data with none. Correspondence you choose to email to IRJG's contact addresses transits IRJG's email-infrastructure providers (Cloudflare for inbound routing and Google Workspace for the operator's mailbox) under the same contractual protections; see § 4 of the Privacy Policy. Each provider is bound by a written contract (a Data Processing Addendum and, where applicable, EU Standard Contractual Clauses) that requires the provider to:

The providers that may process your consumer health data, and the specific data each receives, are:

nodu may also disclose consumer health data:

Under each of the four laws referenced in § 1, where applicable to nodu, IRJG generally must obtain your consent before collecting, using, or sharing your consumer health data for purposes beyond what is strictly necessary to provide the Service you have requested.

You provide that consent during onboarding through a separate consent step — a distinct affirmative act, separate from your acceptance of the Terms of Service — that states the categories of consumer health data collected, how they are used, who receives them, and how to withdraw, and that covers this CHD Policy and the Privacy Policy. That consent covers:

A separate written authorization is not required, because nodu does not sell your consumer health data. Under MHMDA RCW 19.373.070, a separate "valid authorization" with specific statutory elements (expiration date, identified recipient, statement of right to revoke, etc.) is required only for the sale of consumer health data. nodu does not sell consumer health data — to anyone, for any consideration — so the authorization regime does not apply.

You may withdraw your consent at any time, and you may do it two ways.

In the app. Settings contains a Consent & Policies screen listing each consent you gave, with a control to turn any of them off. This is the same kind of act, through the same interface, as giving the consent in the first place. Because consumer health data processing is core to how nodu generates your sessions, turning off the consumer health data consent means you can no longer use nodu: the coach, new session generation, and the sessions already in your archive all become unavailable. Your data is not deleted. It is retained, and remains unavailable to you, until either you turn the consent back on (which restores your access, including to your existing sessions) or you delete your data. Deletion is offered on the same screen you are returned to, and is described in § 9 of the Privacy Policy.

By email. You may instead withdraw by emailing privacy@trynodu.com. When you withdraw by email, IRJG will treat the withdrawal as a request for account deletion (see § 9 of the Privacy Policy) unless you specify otherwise.

Withdrawal does not affect the lawfulness of processing conducted before withdrawal. Whichever route you use, you may request deletion of your consumer health data at any time under § 6.

If nodu's practices change such that consumer health data may be sold (in jurisdictions where sale is permissible with authorization), IRJG will obtain a separate signed authorization meeting the statutory requirements of each applicable state law before any sale. In Maryland, however, the sale of sensitive personal data — including consumer health data — is prohibited under MODPA regardless of consent or authorization, and no future change to nodu's practices would permit sale of Maryland residents' consumer health data.

nodu is for adults only. The children's privacy rule appears in § 11 of the Privacy Policy.

6. Your rights as a Washington, Nevada, Connecticut, or Maryland resident

If you are a resident of Washington, Nevada, Connecticut, or Maryland, you have the rights described below.

A note on voluntary scope. The CTDPA and MODPA each have entity-applicability thresholds. The CTDPA's thresholds changed on July 1, 2026: the general threshold is now 35,000 Connecticut consumers, with no-threshold triggers for processing of sensitive data and for the sale of personal data; MODPA has its own separate thresholds. IRJG extends Connecticut-style and Maryland-style rights to Connecticut and Maryland residents regardless of whether any CTDPA or MODPA entity-applicability threshold is met for nodu in any given year. Where this is a higher standard than required, it is a voluntary commitment, not a description of compelled compliance.

Rights available to all WA, NV, CT, and MD residents

Additional rights for Washington residents (MHMDA)

Additional rights for Connecticut residents (CTDPA)

Additional rights for Maryland residents (MODPA)

MODPA data-minimization standard. MODPA prohibits the collection or processing of sensitive personal data — including consumer health data — except where strictly necessary to provide or maintain the specific product or service you have requested. § 3 of this CHD Policy is intended to comply with this standard. If you believe IRJG is processing more consumer health data than is reasonably necessary, you may exercise the opt-out described above and, if dissatisfied, appeal under § 8.

Note on universal opt-out signals. Beginning April 1, 2026, MODPA requires controllers to recognize universal opt-out preference signals such as Global Privacy Control. nodu honors GPC where applicable law requires (see § 21 of the Privacy Policy).

7. How to exercise your rights

To exercise any right described in § 6, email privacy@trynodu.com from the email address tied to your nodu account. If you do not have access to that email address, you may submit a written request to IRJG at the address in § 1 of the Privacy Policy.

IRJG may request one round of clarifying information to verify your identity. IRJG will respond to your verified request within 45 days (extendable by an additional 45 days where reasonably necessary, with notice).

This 45-day commitment is uniform across all four states covered by this CHD Policy.

Where verification is not possible, IRJG may deny the request and explain why.

You may use an authorized agent to submit a request. IRJG may require proof of your authorization (a signed authorization from you naming the agent, plus identity verification of you directly).

nodu does not charge a fee to process a verifiable consumer-health-data request unless the request is excessive, repetitive, or clearly unfounded. If IRJG determines a fee applies, IRJG will notify you and provide a cost estimate before completing the request.

8. Appeals

If IRJG denies your request, you have the right to appeal. The first-step appeal path is the same across all four states; the second-step regulator differs by state.

First step (all four states)

Reply to the denial email within a reasonable period to request reconsideration. Within 45 days of receipt of an appeal, IRJG will inform you in writing of any action taken or not taken, including an explanation of the reasons for the decision.

Second step — state-specific regulators

9. Retention of consumer health data

nodu may retain the following data, which may be considered consumer health data, only as long as needed to provide the Service to you and to meet the obligations described below. Specifically:

When you delete your account, vendor-side deletion follows the mechanism each provider actually offers, under the contracts described in § 4. ElevenLabs' speech-generation history is erased by the automated purge described above on its rolling cycle, so your script content does not wait for any request at all. Where a provider's standard service tier offers no per-user deletion channel, the contracted retention limit is itself the deletion mechanism — Anthropic's standard API terms delete inputs and outputs within 30 days, and they are never used for training. That mechanism has one limit worth stating plainly rather than leaving to the vendor's terms: where content is flagged under Anthropic's usage policy the window extends to up to two years for the inputs and outputs, and up to seven years for the trust-and-safety scores derived from them. In that case deletion of your nodu account does not shorten the vendor-side window, because IRJG has no per-user deletion channel on that tier. Where any other provider offers deletion of stored content on request, IRJG initiates it promptly, and in any event within the rights-request response windows in § 7. The vendor step is not part of the synchronous app-side deletion endpoint; IRJG confirms completion within the response windows in § 7.

10. Security of consumer health data

IRJG protects consumer health data using the technical and organizational safeguards described in § 12 of the Privacy Policy, including:

If IRJG determines that a breach affecting consumer health data has occurred and that the breach triggers a notification obligation under applicable law, IRJG will notify you by email without undue delay and within any period required by applicable law; IRJG's goal is to provide that notice within 72 hours of confirming the breach.

11. AI processing and consumer health data

nodu's personalized sessions are generated by AI providers operating under each vendor's default terms and applicable Data Processing Addenda (see § 4 above and § 4.1 of the Privacy Policy). Three points worth naming here:

Crisis resources. nodu is not monitored in real time. If you're in crisis, please reach out to one of the resources below immediately.

In the United States:

In Europe (EEA, United Kingdom, and Switzerland):

If you're in immediate danger, call your local emergency services now.

12. Changes to this CHD Policy

If this CHD Policy changes in a material way, IRJG will update the version and effective date and may require renewed consent. Non-material updates (clarifying language, formatting, additional explanation) are reflected as a version bump without renewed consent.

A change in nodu's practices that would result in (a) the sale of consumer health data, (b) the sharing of consumer health data for advertising, (c) the use of consumer health data to train nodu's own AI models, (d) the reversal of the ElevenLabs training opt-out, or (e) the introduction of any new vendor whose default terms permit broader use of consumer health data than the vendors named in § 4, would be a material change requiring renewed consent and, in the case of sale, a separate signed authorization meeting the statutory requirements of each applicable state law (subject to MODPA's absolute prohibition on the sale of Maryland residents' sensitive personal data).

13. Contact

For any question about this CHD Policy, including to exercise a right or appeal a denial:

14. Effective date and version

Effective date: 2026-10-03 Version: v10-2026-10-03

Terms·Privacy·Health data·EEA·Notices