Consumer Health Data Privacy Notice
Last Updated: July 22, 2026
This Notice supplements Slingshot AI’s Privacy Policy and applies to users in Washington, Nevada, and Connecticut under each state’s consumer health data laws.
Scope
This Consumer Health Data Privacy Notice covers only “consumer health data” — personal information that identifies your past, present, or future physical or mental health status. For details about how we collect and process other types of personal information, see our Privacy Policy.
What consumer health data we collect
Through your use of Ash, we may collect, infer, or otherwise generate:
Conversation content you share with Ash, including anything you say about how you’re feeling, your experiences, or any health-related topics you bring up.
Voice input processed for speech-to-text transcription. Voice input is not retained as a recording beyond what is necessary to provide transcription.
Account-linked activity showing how you use Ash, including analytics and technical data.
Inferences drawn from your interactions with our platform, including the above (e.g., mood indicators, topics of concern).
Where it comes from
Directly from you, automatically from the device you use to access Ash, and through inferences or other processing of your consumer health data.
How we use it
We use your consumer health data as described in this Consumer Health Data Privacy Notice or as otherwise disclosed to you. Except where we say otherwise below, each of these purposes may draw on any of the categories of consumer health data described above. For example, we use consumer health data for the following purposes:
Delivery and operation of our services, including to provide, operate, and secure our services, and to communicate with you regarding our services. This is the only purpose for which we use your voice input, which is retained only as long as needed to transcribe it.
Personalization, including to understand your needs and interests, personalize your experience with Ash and our related communications, and remember your selections and preferences as you navigate our platform.
Analytics and development, including use of account-linked activity data (such as product and email analytics events) and other consumer health data to improve our business, help us understand user activity on Ash and user interactions with our emails, and develop new products and services. Conversation content is never linked to account analytics.
Improving your experience with Ash. Where you have opted in, we use conversation content to improve the quality of Ash only after it has been de-identified so that it is not reasonably identifiable or linkable to you.
Research. We conduct research to understand how Ash is used and how well it supports our users. Research analyses are performed on data with your name, email address, and similar direct identifiers removed, and any results we share or publish are aggregated or otherwise not directly identifiable to you. Research involving the content of your conversations happens only where you have opted in, and formal research studies (such as randomized clinical trials) are conducted under separate informed consent.
Compliance and protection, including to comply with applicable laws, lawful requests, and legal process (such as to respond to disclosure orders, as well as demands, investigations or requests made by regulators, governments, courts and law enforcement authorities); to protect our, your or others’ rights, privacy, safety or property (including by making and defending legal claims); to audit our internal processes for compliance with legal and contractual requirements or our internal policies; to enforce the terms of agreements that govern access to Ash; and to prevent, identify, investigate and deter fraudulent, harmful, unauthorized, unethical or illegal activity, including cyberattacks and identity theft.
Creating aggregated or de-identified data. We may create aggregated or de-identified data from consumer health data and use and share that data as permitted by law, including to analyze and improve our services.
Corporate transactions, including to facilitate or carry out corporate transactions and associated diligence, such as financings or a sale, transfer, or merger of all or part of our business.
Who we share it with
We share consumer health data as needed to run Ash and operate our business. The content of your conversations is processed by our cloud infrastructure and model-inference providers to provide and improve the service, is stored encrypted, and is not shared with analytics or advertising partners. Any data we share with analytics and attribution providers is limited to activity data about how you use Ash — not the substance of your conversations. We may also disclose information to governmental authorities where required by law, and to parties to any corporate transaction (such as an investment or acquisition). We also share consumer health data with our affiliate Slingshot AI Ltd (UK), whose personnel help operate and support Ash. As with our own team, our encryption controls mean they cannot access the content of your conversations under normal operating circumstances. Where required by law, we will ask for your consent to share your data.
Your rights
If you are a resident of Washington, Nevada, or Connecticut, you can confirm whether we are collecting consumer health data about you and access that data, request a list of the third parties and affiliates with whom we have shared it, request deletion, and withdraw consent where we rely on it, in each case subject to applicable law and its exceptions.
The fastest way to access your consumer health data is in the Ash app, where your conversation history is available to you at any time. To delete your data, use the in-app “delete my data” control.
For any request the in-app controls don’t cover, email us at support@slingshotai.com with the subject line “Privacy Request — [your state].” To protect your privacy, requests must be sent from the email address associated with your Ash account, and we may need to verify your identity before acting on a request. We respond within the timeframe required by law. We may deny or limit requests where permitted by applicable law, including where requests are repetitive, excessive, unfounded, or where an exception applies.
Changes to this Consumer Health Data Privacy Notice
We reserve the right to modify this Consumer Health Data Privacy Notice at any time. If we make material changes to this Consumer Health Data Privacy Notice, we will notify you by updating the date of this Consumer Health Data Privacy Notice and posting it on our website or other appropriate means. Any modifications to this Consumer Health Data Privacy Notice will be effective upon our posting the modified version (or as otherwise indicated at the time of posting). In all cases, your use of Ash or our other services after the effective date of any modified Consumer Health Data Privacy Notice indicates your acknowledging that the modified Consumer Health Data Privacy Notice applies to your interactions with Ash and our business.
Contact
Slingshot AI, Inc.
