Consumer health data privacy policy
Prayer may involve health, loss or care for someone you love. This policy explains how Coro handles health information and adds to the Privacy policy. It covers consumer health data within applicable Washington and Nevada law. Coro offers spiritual support, not health care.
Categories, sources and purposes
We receive the health information you choose to type, or provide through a supported consented voice feature, and requests another person expressly shares with your circle. Examples include a condition, treatment, mental health concern, pregnancy or disability. Derived prayer topics, dates, safety indicators and associated identifiers can also be health data. We do not obtain medical records from health providers or use health-facility geofences. Self-reported residence and telephone-region hints are used for availability, timing and resources, not verified physical tracking. Please use nonidentifying words about other people.
The requested first prayer involves temporary intake and a local reply before continuing-chat consent; it is not sent to the model. Continuing ordinary chat requires DATA YES after the notice. With that consent, we use necessary information for prayer and safety responses. Adults can save prayer subjects and request follow-ups; teens use only current-session context, never prior-session personal information or information over 12 hours old, and receive no personal future follow-ups. From January 1, 2027 or an earlier configured date, adult context and follow-ups are also restricted. See Privacy for cleanup, withdrawal and retention limits.
Recipients and sharing
Anthropic processes eligible generated replies; Telnyx and carriers carry SMS; the hosting provider and Cloudflare support storage, security, backups and supported transcription. The completed processor register in Privacy must identify actual providers and locations before publication. WhatsApp is off; Meta is not a launch chat processor. Providers may have separate permitted safety and legal retention. Our local deletion is not proof of theirs.
A circle receives the exact request only after separate SHARE confirmation. The proposed wording about another person omits their health details. Consent to chat is not consent to circle disclosure or marketing. Necessary safety or legal disclosures may go to responsible authorities as the Safety protocol describes. We do not sell consumer health data, use it for targeted advertising or share it for unrelated purposes.
Rights and requests
You can ask whether we process your health data, obtain a copy and the relevant list of third parties and affiliates receiving it, correct it, withdraw consent or request deletion. Use DATA NO to withdraw and DELETE MY DATA or BORRAR MIS DATOS to request deletion. STOP stops messages. A payer's choices do not replace a teen's choices. Request help at [LEGAL CONTACT EMAIL]; verification must match the relevant number or web identity without exposing another person's prayers.
The proposed standard is a response within 45 days, with notice and reasons before any legally permitted extension. Appeal a refusal by replying to it. The appeal process, including a response within 45 days for Washington requests, must be operational before publication. If denied, contact the Washington Attorney General or Nevada Attorney General.
Ordinary active-data deletion is proposed within 30 days after verification and residual backups within six months, with required processor and recipient notification. These commitments require verified operations. Restricted safety evidence follows Privacy's case-specific retention policy; policy adoption, human coverage, recovery and provider-deletion evidence remain prerequisites for publication. Records cannot be kept for ordinary prayer, advertising or training merely because they were once safety-related.