Consumer Health Data Privacy Policy

Depending on what you voluntarily choose to enter, information that may qualify as consumer health data under applicable state law may include information concerning:

• Emotional or mental wellbeing
• Mental-health concerns you voluntarily mention
• Stress or emotional experiences
• Intimate or sexual relationship matters
• Personal safety concerns
• Self-harm or suicidal thoughts you disclose
• Domestic violence or coercive-control concerns
• Child-safety concerns
• Vulnerable-adult safety concerns
• Other relationship information that may reveal or reasonably relate to physical or mental-health status

Rooted may also generate interpretations from information you provide, including relationship observations, themes or patterns, Relationship Health information, Relationship DNA, milestone readings, personalized recommendations, and other derived relationship information.

Generated relationship information is educational and may be incomplete or inaccurate. It is not a diagnosis, treatment, psychological assessment, or professional evaluation.

Potentially qualifying consumer health data may come from information you voluntarily enter into Couples Rooted, including:

• ROOTED Check-In responses
• Relationship Inventory responses
• Reflections
• Rooted Guide conversations
• Information you provide through lessons and practices
• Relationship context you provide during onboarding
• Safety clarification responses
• Other interactive features where you choose to provide information
• Information Rooted generates from your use of those features

Rooted does not purchase health records or receive medical records from doctors, insurers, pharmacies, hospitals, or health systems.

Rooted uses potentially qualifying consumer health data only as reasonably necessary to provide and operate the relationship-education service you request, including to:

• Provide personalized Rooted Experiences
• Generate educational observations and relationship insights
• Personalize lessons and recommendations
• Provide Rooted Guide responses
• Generate Relationship Health, Relationship DNA, and milestone readings where applicable
• Maintain privacy and sharing preferences
• Respond to safety-related language through Rooted's bounded safety experience
• Provide customer support when requested
• Maintain security and prevent misuse
• Comply with applicable legal obligations

Rooted does not use private relationship content or potentially qualifying consumer health data for targeted advertising, generalized AI training, or data-broker purposes.

Rooted may disclose or transmit potentially qualifying consumer health data only as reasonably necessary to operate and provide the features you request, including to processors and service providers performing functions on Rooted's behalf.

Relevant service-provider categories may include:

• An AI processing provider for personalized features
• A database, storage, and authentication provider
• Hosting and application infrastructure providers
• A transactional email provider, only where the message itself requires relevant information
• Other processors necessary to operate requested functionality

Google Analytics does not receive private relationship content. Stripe does not receive private relationship content for payment processing. Date Planner venue, weather, event, and location providers do not receive private relationship content merely because they receive location or search information.

Rooted currently uses OpenAI through server-side API requests for certain personalized features. Depending on the feature, AI requests may include:

• ROOTED Check-In responses
• Relationship Inventory responses
• Reflections
• Rooted Guide messages
• Relationship context you provided during onboarding
• Previously generated observations
• Lesson and completion history
• First names used for natural personalization

AI request content does not include passwords, payment-card information, email addresses, internal account IDs, or internal couple IDs. Date Planner AI requests may include city, region, or ZIP/postal code, but not raw GPS coordinates.

See the main Privacy Policy for additional information about AI processing and OpenAI's practices.

Rooted Connection, LLC does not sell consumer health data.

Rooted does not sell private relationship reflections or potentially qualifying consumer health data to advertisers or data brokers. Rooted does not use private relationship content or potentially qualifying consumer health data for targeted advertising.

Potentially qualifying consumer health data entered privately by one member is not shown to the connected partner as originally submitted unless that member intentionally chooses to share information through a feature designed for sharing.

Shared couple experiences may contain appropriately qualified themes, patterns, summaries, or non-attributive observations according to Rooted's existing privacy and evidence safeguards. Safety-held information is excluded from ordinary couple-visible relationship output under the current architecture.

A limited number of authorized personnel and service-provider credentials may have technical access to stored information where needed to operate, support, secure, or maintain the service. See the main Privacy Policy for full partner-privacy and access details.

Consumers covered by applicable consumer-health-data laws may have rights that include:

• Confirming whether Rooted collects, shares, or processes their consumer health data
• Accessing qualifying consumer health data
• Receiving information about categories of third parties or affiliates with whom qualifying data has been shared
• Withdrawing consent where processing is based on consent
• Requesting deletion of qualifying consumer health data
• Appealing a refusal of an applicable consumer-health-data request
• Exercising applicable rights without unlawful discrimination

Available rights vary depending on the law and jurisdiction that apply to you. This section does not represent that every user nationwide has every listed statutory right.

To submit an applicable consumer health data request, email privacy@couplesrooted.com. You do not need to create a new account solely to submit a privacy request.

If you already have an account, Rooted may use existing account information to authenticate your request. Rooted may need to verify the identity of the person making a request before acting on it.

Where applicable, existing members can also use Account → Privacy & Data to request a data export or permanent account deletion.

If Rooted declines a consumer health data request that you believe should have been honored under applicable law, you may appeal the decision by emailing privacy@couplesrooted.com with the subject line “Consumer Health Data Appeal.” Please describe the request and why you believe the decision should be reconsidered. Rooted will review the appeal and respond as required by applicable law.

Where applicable law requires deletion of consumer health data, Rooted will process qualifying deletion requests consistent with applicable law.

Under Rooted's current account-deletion process:

• Your account and the history stored with it are removed
• Feedback screenshots you uploaded are removed
• Couple-derived readings based on your evidence are removed where their source identifies your contribution
• Couple-derived information that cannot safely separate your contribution is withheld or rebuilt from surviving evidence
• Your connected partner's own account and private information are preserved

Limited information may remain temporarily in routine backups or where retention is reasonably necessary or permitted for legal, billing, security, fraud-prevention, dispute, or recordkeeping purposes, subject to applicable law.

Rooted restricts access to sensitive information according to role and operational need and uses reasonable administrative, technical, and organizational safeguards. A limited number of authorized personnel and service-provider credentials may have technical access where necessary to operate, support, secure, or maintain the service.

No online service can guarantee perfect security. Rooted does not claim end-to-end encryption or zero human technical access. See the main Privacy Policy for detailed security information.

The Date Planner may process a ZIP or postal code, city and region, and coordinates needed for venue, event, and weather discovery. GPS location is used only when you explicitly request location-based functionality.

Private relationship content is not sent to venue, weather, event, or location providers merely because they receive location or search information. Date Planner AI may receive city, region, or ZIP/postal code, but not raw GPS coordinates. GPS coordinates used for reverse geocoding after an explicit request are not saved as your stored location under the current architecture.

Ordinary Date Planner location information is used for local discovery. Rooted does not characterize that information as health-location data unless it reveals, or is used to infer, health-care seeking.

Rooted may update this policy as the service or applicable law changes. Material changes will receive additional notice where appropriate or legally required.