Consumer Health Data Privacy Policy
Some US state laws protect "consumer health data" with extra rules. This page explains what that could mean at Whoo, and the rights you have.
Draft for legal review · not yet in effect · last updated 19 October 2026
[counsel: whether Whoo's data is in scope of the Washington My Health My Data Act, Nevada SB 370 and similar laws, and which categories below count as consumer health data.] We've written this page so it applies if they do.
1. Who this policy is for
This policy applies to people whose consumer health data is covered by laws such as the Washington My Health My Data Act, Nevada SB 370 and similar state laws. It adds to our Privacy Policy; it doesn't replace it.
Whoo is run by Xava Labs Hong Kong Limited, 7F, 262 Des Voeux Road West, Sheung Wan, Hong Kong 999077.
2. What consumer health data might mean at Whoo
Whoo is not a health app. We don't ask for medical information. But these laws define health data broadly, so some things members share might count:
- Sexual orientation and who you're interested in. You tell us this so we can seat you with the right people in Dating mode. Where the law counts it as health data, this policy applies.
- Gender identity details. For example, if you share that you're trans or nonbinary, or details related to gender-affirming care. Where these count as health data, this policy applies.
- Health information you choose to share. For example, something about your physical or mental health you mention while talking to your Twin in Twin Talk, in the "Meet your Twin" chat, or in a chat with another member.
- Inferences. If your Twin or our AI could draw a health-related conclusion from what you share, that conclusion could count too.
We don't collect precise location to work out whether you've visited a health care provider. We don't buy health data from anyone.
3. How we collect it
- From you directly: when you set up your account, choose who you're interested in, chat with your Twin, or chat with other members.
- From our AI: when your Twin learns from what you share. On Basic, your Twin stays as you set it up. On Whoo Plus, it keeps learning from Twin Talk, your own messages and your own Yes or No choices. It never learns from the other person's messages.
We don't collect it from data brokers, other apps or advertising networks.
4. Why we use it
We use this data only to provide what you asked for:
- seating you at tables with people who fit who you're interested in, both ways;
- running your Twin, including Auto-Date if you're on Whoo Plus and turn it on;
- delivering and translating chats;
- keeping Whoo safe, including reviewing reports;
- meeting legal obligations.
We ask for your consent before we collect or use consumer health data, where these laws require it. Using your chats to train AI models only happens if you turn on "Help improve Whoo's AI". It is off unless you turn it on.
We never use this data for advertising.
5. Who we share it with
We never sell consumer health data. We share it only:
- With service providers who process it for us under contract, such as hosting, AI and translation providers. They may only use it to provide their service to Whoo. Names: [to be listed].
- With other members, as part of the service. What you write in a chat is seen by the person you're chatting with. Your Twin may chat for you in Auto-Date if you're on Whoo Plus and turn it on.
- When the law requires it, such as a valid court order, or to protect someone from serious harm.
- With your consent, for anything else.
If Whoo is ever part of a merger or sale, this data would only move with the protections in this policy, and we'd ask for consent where the law requires it.
6. Your rights
Depending on where you live, you can:
- Access: confirm whether we collect, share or sell your consumer health data, see that data, and get a list of the third parties and service providers we've shared it with.
- Delete: ask us to delete it. We'll also tell our service providers to delete it.
- Withdraw consent: stop us collecting or sharing it from now on.
- Appeal: if we say no to a request, ask us to look again.
We won't treat you differently for using these rights.
7. How to use your rights
- In the app: go to Your Twin to see, edit or delete what your Twin knows. This is free on every plan. You can also delete your account in the app or on the web.
- By email: write to privacy@meetwhoo.com with "Health data request" in the subject.
We'll check it's really you, usually through your signed-in account, before we act. We respond within 45 days. If we need more time, we'll tell you why, and we may take up to 45 more days where the law allows.
To appeal a decision, reply to our response or email privacy@meetwhoo.com with "Appeal" in the subject. We'll reply in writing with our decision and reasons. If you're still unhappy, you can contact your state attorney general.
8. No geofencing
We don't set up virtual boundaries around health care facilities to identify, track, collect data from or send messages to people who enter them.
9. Security and retention
We protect this data with security measures suited to how sensitive it is, and limit who at Whoo can see it. We keep it only as long as described in our Privacy Policy, then delete it.
10. Changes
If we change this policy, we'll update the date at the top. If we want to use consumer health data in a new way, we'll ask for your consent first.
11. Contact
Email privacy@meetwhoo.com, or write to Xava Labs Hong Kong Limited, 7F, 262 Des Voeux Road West, Sheung Wan, Hong Kong 999077.