Plants for Health
Consumer Health Data Privacy Policy
Version 1.0 — effective 28 July 2026
This policy explains how we handle consumer health data, as that term is defined in the Washington My Health My Data Act and in comparable laws such as the Nevada consumer health data law. It applies in addition to our Privacy Notice. Where the two differ in respect of consumer health data, this policy applies.
If you are a resident of Washington or Nevada, this policy sets out rights you have and how to exercise them.
1 Who we are
Plants for Health B.V., Stadhouderslaan 77, 3583 JE Utrecht, the Netherlands. Registered with the Dutch Chamber of Commerce under number 93914369. Contact: [email protected].
We are established in the Netherlands. This means the European General Data Protection Regulation applies to everything we do with your data, in addition to the laws of your own state. In practice this gives you more protection than the law of your state requires, not less.
2 What we treat as consumer health data
We take a deliberately broad view, and treat the following as consumer health data:
- the three declarations you give before you enrol, which concern eating disorders, unintended weight loss and upcoming medical procedures — and the fact that you gave them;
- anything about your health, symptoms, medication, diet or wellbeing that you choose to post in our Community;
- anything about your health that you choose to tell us in an email or a support message;
- the fact that you enrolled in, or enquired about, a programme concerned with inflammation;
- inferences that could be drawn about your health from which of our emails you opened and which lessons you completed.
The last two items matter. If you buy a programme about inflammation, or subscribe through a page about a specific condition, that could suggest something about your health even though you never told us a diagnosis. We treat that as consumer health data.
3 What we do not collect
We do not ask you what your condition is, and we do not ask you for a diagnosis, your medication, your weight, your BMI, or any test result. Nothing in our programme depends on your telling us. There is no intake questionnaire and no medical file.
For the three declarations in clause 4.2 of our Terms, we record only that you confirmed them, on which date, and against which version of our Terms. We do not record why, and we do not ask.
We do not provide individual consultations or individualised advice, so we have no reason to hold a health record about you.
You can take part in the Community under a name of your choosing. Other participants see only that name. We recommend using one if you intend to write about your health. This does not make your contributions anonymous to us — we know which account posted them, and this policy therefore continues to apply to them.
4 What we collect, and why
| What | Why | Where it is held |
|---|---|---|
| That you gave the three declarations, with date and version | To show that we asked, and that you confirmed, before enrolling you | Kajabi, and a separate record kept by us |
| What you post in the Community | To run the Community and answer your questions | Kajabi |
| What you tell us by email | To answer you | Microsoft |
| That you bought a programme about inflammation | To give you access and to take payment | Kajabi and Stripe |
| Whether you opened our programme emails, and which lessons you completed | To see whether the programme materials reach you and work | Kajabi |
We do not use consumer health data to make decisions about you other than those described here, and we do not use it for automated decision-making that has legal or similarly significant effects.
5 Where it comes from
Directly from you: in the declarations, in the Community, and in messages you send us. From how you use the learning platform and our programme emails. We do not buy health data about you from anyone, and we do not obtain it from any third party.
6 Who we share it with
We share consumer health data only with service providers who process it on our behalf, under a written contract that requires them to protect it, to follow our instructions, and to pass on the obligations in this policy.
| Provider | What they process | Role |
|---|---|---|
| Kajabi | Account data, enrolment, declarations, Community posts, course progress, video viewing, and automated programme emails to participants | Learning platform, community and programme email |
| Microsoft | Email correspondence with us, and documents | Email provider and document storage |
| Brevo | Your email address, and whether you opened our emails | Sending our newsletter. Established in France |
| Stripe | Payment data and the name of the product you bought. Not health data | Payment processing |
Both Kajabi and Microsoft are established in, or have parent companies in, the United States. We have a written data processing agreement with each of them. Where personal data is transferred out of the European Economic Area, that transfer is safeguarded by the European Commission’s Standard Contractual Clauses, or by another mechanism recognised under the GDPR.
We do not sell your consumer health data, and we have never done so. If that were ever to change, we would first obtain your separate written authorization, which is a distinct step from consent and which you could revoke at any time.
We do not share your consumer health data with advertising platforms. We do not place advertising pixels on our website, and we do not use website analytics. Nothing about your health, and no inference about it, is transmitted to any third party for advertising or measurement. Our Cookie Policy lists every cookie in use.
We may disclose data where the law requires it, or to protect someone from serious harm.
7 Your consent
We ask for your consent to the three declarations by a separate tick box when you enrol, distinct from your acceptance of our Terms. That box is never pre-ticked, and we do not bundle it with anything else.
Anything you post in the Community, or tell us by email, you share on your own initiative. You are never required to do so.
Kajabi sends automated emails to participants as part of running the programme. Every one of them contains an opt-out link. For anything beyond running the programme — in particular using health-related inferences for marketing — we ask for your separate, specific opt-in consent, and we do not make it a condition of purchase.
You can withdraw consent at any time, by emailing [email protected] or using the opt-out link in our emails. Withdrawing consent stops future use. It does not affect what we did before you withdrew it, and it does not affect data we must keep in order to provide a programme you are enrolled in.
8 Your rights
You have the right to:
- know and access what consumer health data we hold about you, where we got it, and who we shared it with;
- withdraw your consent to our collection and sharing of it;
- have it deleted.
To exercise any of these, email [email protected] with your request and the email address you use with us. We may ask you to confirm your identity, and we will ask only for what we need to do that.
We will respond within 45 days. If we need more time, we will tell you within those 45 days and explain why, and we will not take more than 45 additional days.
On deletion. If you ask us to delete your consumer health data, we will delete it from our active systems and instruct every service provider that holds it to do the same, including in their archives and backups. Posts you made in the Community will be removed. We will confirm when this is done. Where a law requires us to keep specific records, we will tell you what we kept and why.
If we refuse a request, we will explain why and tell you how to appeal. To appeal, reply to our response. We will decide the appeal within 45 days. If we refuse your appeal, you may complain to the Attorney General of your state.
9 How long we keep it
| What | How long | Why |
|---|---|---|
| That you gave the three declarations | 7 years after your access ends. We keep this record separately, so it survives the deletion of your account | To show we asked, for as long as a claim could be brought |
| Community posts | Indefinitely, unless you ask us to remove them | So later participants can read earlier discussions. You can ask for removal at any time |
| Email correspondence | 2 years after our last contact | To handle follow-up questions and complaints |
| Account, lesson progress and email engagement | Duration of your access, then 12 months | So you can return and so we can answer questions |
These periods are our own choice, not a legal minimum. If you ask us to delete something sooner, we will, unless a law requires us to keep it.
10 How we protect it
We limit access to consumer health data to the people who need it to do their work. Access is granted individually and reviewed periodically. Data is encrypted in transit and at rest by our providers. We require our providers to maintain comparable measures. Where health information reaches us by email, it is held in our email system and we do not copy it into other systems or documents.
Our Community is visible to other participants. Contributions remain there after a participant’s access ends, so that later participants can read earlier discussions. Our Terms ask all participants to treat what others share as confidential, and you can take part under a name of your choosing.
You can ask us to remove your contributions at any time, including after your access has ended. Email [email protected]. We will do it and confirm when it is done.
11 Changes to this policy
If we change this policy, we will publish the new version with a new effective date and keep previous versions available. Where a change materially affects your rights, we will notify you by email at least 30 days in advance. We will not use consumer health data we already hold for a materially different purpose without asking you first.
12 Contact
Plants for Health B.V., Stadhouderslaan 77, 3583 JE Utrecht, the Netherlands