Your health data at Haven
Haven is a space to think through what's on your mind, so the things you share can reveal information about your mental and emotional health. This page explains, in plain language, what that means and how we handle it. It is written to be honest — not reassuring for its own sake.
What we mean by "health data"
When you reflect with Haven you may describe how you're feeling, what you're struggling with, or your mental wellbeing. Privacy laws treat that kind of information as sensitive "consumer health data," even though Haven is a reflection tool and not a healthcare provider, and even though we are not your therapist.
How we protect it
- Encrypted at rest. The sensitive content stored on our server — your memory profile and your synced conversation history — is encrypted, so a stolen database copy is not readable.
- Encrypted on your device. The conversation history saved in your browser is encrypted too, so it isn't readable from a shared computer's storage.
- Encrypted in transit. Everything travels over HTTPS between your device and Haven.
- Identifiers stripped before we generate a reply. When your message is sent to our AI or voice provider to write or speak a reply, we first strip identifiers we can detect reliably — things like email addresses, phone numbers, card and Social Security numbers, web links, and street addresses.
- One deliberate exception — the safety check. Every message also passes a short automated safety check that looks for signs someone is in danger. That check sees your message as you wrote it, because removing details from it could cause us to miss a real crisis. We think keeping that check accurate is the right call, and we would rather tell you than let you assume otherwise.
- Never in billing. Nothing you write, and no health information, is ever sent to our payment processor — only your email, plan, and billing period.
Who can access it
You can — it's your account, and you can read, export, or delete your data at any time from Settings. Access is otherwise limited to operating and supporting the service: our systems process your data to make Haven work, and a small number of staff may access it when needed to run Haven or help you. We do not sell your data and we do not use it for advertising. This is the honest picture — we can't truthfully say no one but you could ever see it.
Your choices
Agreeing to this notice is part of creating a Haven account — you accept it at sign-up, alongside our Terms and Privacy Policy. If you'd rather not, you don't create an account. At any time you can export a copy of your data or delete your account and its data from Settings.
Your rights under the law
Being outside HIPAA does not leave this data unregulated. Depending on where you live, it may be covered by the U.S. Federal Trade Commission's Health Breach Notification Rule (which requires us to notify you of a qualifying breach), Washington's My Health My Data Act, and California's Confidentiality of Medical Information Act, among others. If a breach of your unencrypted health data ever occurs, we will notify you as those laws require.
What Haven is not
Haven is a reflection tool. It is not therapy, not medical care, and not a crisis service, and it doesn't diagnose or treat anything. The full details of how we handle all your data are in the Privacy Policy.