Consumer health data privacy policy
Effective 19 September 2026
This policy is for people in Washington and Nevada, and for anyone else who wants to read it. Those two states have laws about health data, and this page follows them.
It sits next to the main privacy policy. Where they overlap, they say the same thing.
Who runs this
Arkhelion is run by one person, Brock VomSteeg, in Southern California. There is no company yet. You can reach me at brock@arkhelion.ai.
Why this page exists
The website never asks you a health question. It asks for one thing: your email address.
But Arkhelion is a health app, so the fact that you reserved could hint at something about your health. Washington and Nevada law may count that as consumer health data. I would rather treat it that way than argue that it isn't.
What this covers, and what it does not
- Covered: the arkhelion.ai website and the early access list.
- Not collected: your health history. The Arkhelion Mac app keeps it encrypted on your own Mac and sends none of it to me. I never see it.
What I collect, and why
When you reserve, my signup server stores:
- Your email address, to send a confirmation link, then the emails you asked for, plus a scrambled copy of it that can't be turned back, to look you up.
- Your status: pending, confirmed or unsubscribed.
- Timestamps for when you signed up and consented, when I sent the confirmation, and when you confirmed or left.
- Scrambled link copies, so your confirm and unsubscribe links work.
- A source tag: the tag on the link you arrived by, if any.
- How you heard about Arkhelion, only if you pick an answer. It is optional.
- A shortened IP address, a scrambled copy of your browser's name and a country code, to block spam and abuse.
- Email delivery results: whether each email arrived or bounced.
The only part that could be health data is your email address together with the fact that you reserved. I use it only to email you about Arkhelion, and never to guess anything about your health.
The site also counts visits as daily totals. Those counts hold nothing about any person, so they are not health data about you.
Where it comes from
- From you, when you fill in the form.
- From your browser, when it sends the form (the shortened IP, browser string and country).
- From my email provider, when it reports whether an email arrived.
I don't buy data about you, and I don't combine your email with data from anywhere else.
How it is handled
Your record is stored in a database run by Cloudflare. Emails are sent by Resend. Only I can see the list.
I keep your record while you are on the list. If you unsubscribe, I keep only your email and "unsubscribed", so I don't add you back by mistake. If you ask me to delete everything, that goes too.
Who it is shared with
Only two service providers, who work for me and may use it only to provide their service to me:
- Cloudflare runs the website, the signup server, the database and the human check on the form (Turnstile). It receives everything listed above.
- Resend sends my emails. It receives your email address and the email it is sending.
I have no affiliates. No one else receives your data. I may give data to a court or the police if the law truly requires it, and I'll tell you if I'm allowed to.
Tracking across other websites
No third party collects data about you over time or across other websites through this site. There are no ads, no ad pixels, no analytics company and no tracking cookies.
No selling
I do not sell your data, for money or for anything else. I would need your signed permission first, and I will not ask for it.
Your consent
The line under the form says what reserving means before you press the button. You confirm again by clicking the link in the first email. No other email goes to you until you click.
If I ever want to collect more, or use it in a new way, I will ask you first.
Your rights
You can ask me to:
- tell you whether I collect, share or sell your health data,
- show you the data I hold, and list everyone I have shared it with,
- stop: withdraw your consent, and I stop collecting and sharing it,
- delete it, and I tell Cloudflare and Resend to delete it too,
- fix it if anything is wrong.
It is free, and asking will not change how I treat you.
How to ask
Email brock@arkhelion.ai from the address you signed up with, and say what you want. If you write from another address, I may send a link to the signup address to check it's really you.
To stop the emails at once, use the unsubscribe link at the bottom of any email.
I answer within 45 days. If I truly need more time, I can take up to 45 more, and I'll tell you why within the first 45. In practice it is usually the same day. I delete data within 30 days of confirming a deletion request.
If I say no: how to appeal
Reply to my answer, or email brock@arkhelion.ai with "Appeal" in the subject line. I will answer in writing within 45 days and say what I did, or did not do, and why.
If I still say no, you can complain to your Attorney General: in Washington, at atg.wa.gov; in Nevada, at ag.nv.gov.
Geofencing
I do not use geofencing. I do not draw a virtual fence around any hospital, clinic or other health care place, and I do not track, collect data from or message people near one. The only location I store is a two letter country code.
Children
The list is for adults 18 and over. I do not knowingly collect anything from children.
Changes to this policy
For a big change, I will email everyone on the list before it takes effect, and update the date at the top. If a change means collecting or sharing more health data, I will ask for your consent first.
Contact
Brock, brock@arkhelion.ai.