Consumer Health Data Privacy Policy

This Consumer Health Data Privacy Policy describes how Naia Haulani collects, uses, and discloses consumer health data associated with NaiaHaulani.com, discovery inquiries, the Harmony in Hormones waitlist, the Your Cycle, Your Story journal signup, related Instagram resource-request automation through LinkDM, and health information provided for coaching sessions and intake. Naia Haulani operates from Texas, United States. It describes the categories, sources, purposes, recipients, and rights related to that data.

Categories and Sources of Consumer Health Data

Information you provide directly through a form, resource signup, or correspondence may include general wellness goals, menstrual or hormonal concerns, symptoms, or other health information you choose to disclose. Do not submit detailed medical information through website forms.

Your signup for a hormone-related program or menstrual-health resource, together with your name or email, may reveal or support an inference about your health interests or your attempt to seek health-related support. Related form records and email engagement may include submission dates, IP addresses, resource or program selections, and email interactions. Those records are received through the hosting, form, automation, and email services used to fulfill your request. Downloading the journal does not send me the entries you write in your own copy.

When you request a menstrual-health resource through an Instagram comment or automated DM, the keyword, comment or message content, Instagram username or account identifier, related post or Reel, and associated interaction records may reveal a health-related interest. These records originate from your Instagram interaction and are processed through Instagram/Meta and LinkDM to respond to your request. Do not disclose symptoms, diagnoses, or medical records in public comments or automated messages.

Client information may also include health histories, symptoms, medication or treatment details, wellness goals, completed intake PDFs, and related correspondence or notes. These originate directly from clients during online or in-person sessions, telephone conversations, and emailed intake submissions.

Purposes of Collection and Use

Health-related information is used to respond to your inquiry, coordinate the discovery call you request, deliver your requested journal, send the program updates you request, and send a requested resource signup link through Instagram. Client health information is used to understand the client’s goals, prepare for and provide agreed coaching, communicate about that service, and maintain necessary records. Related records support delivery, communication preferences, and security. Health information is not used to diagnose you or build advertising profiles. Collection or sharing beyond what is necessary to provide your requested product or service requires any separate consent applicable law requires. This notice itself is not that consent.

Recipients and Categories of Data Disclosed

The information disclosed for these purposes may include your contact details, program or resource selection, consent and communication preferences, optional message, related submission or delivery records, and Instagram resource-request interactions linked to your username or account identifier. An optional discovery message can include health information if you choose to provide it. The Harmony waitlist does not include a free-text message field; it collects name, email address, and consent for program updates.

Service providers processing this information include website-hosting and form services (Netlify), email and signup services (MailerLite), workflow automation services (Zapier), email delivery and inbox providers used for correspondence and notifications, and social-platform and messaging-automation services (Instagram/Meta and LinkDM) used to receive and respond to Instagram resource requests. Waitlist records pass through Netlify and Zapier to MailerLite. Discovery submissions are handled through Netlify for direct follow-up; journal signups are handled through MailerLite. Where LinkDM automation is enabled, it sends the requested MailerLite signup link through Instagram; the subsequent email signup and journal delivery occur through MailerLite. The automation is not designed to solicit detailed health information or collect email addresses within Instagram DMs. Client histories, session information, and completed intake records are separate from those marketing workflows; applicable recipients for client work include email and attachment-storage services and telephone or communications providers. Their supporting infrastructure providers may process records as part of delivering those services. No general permission to share client health histories with marketing services is granted by a website signup.

Consumer health data is not sold or disclosed to advertisers, data brokers, or affiliates for their independent use. There are no affiliate recipients for these website activities. Disclosures legally required or expressly permitted by applicable health-data law are handled within those limits.

Texas Location and Applicable State Protections

Texas is the business’s home state. Where Texas medical-record privacy requirements apply, electronic disclosures of protected health information require the applicable notice and authorization unless a lawful exception applies. This policy is not a disclosure authorization. Texas privacy complaints may be directed to the Texas Attorney General. Applicable legal protections depend on the information and activity involved; being outside federal HIPAA coverage does not by itself establish an exemption from state health-information law.

Privacy Rights and Requests

Where applicable health-data law provides these rights, you can confirm collection, sharing, or sale; access your health data and a list of third-party and affiliate recipients with contact information; withdraw consent to collection or sharing; and request deletion.

Email Naia@naiahaulani.com with your request. Requests should be submitted from the email address associated with the signup, where possible. Do not include medical records or government identification. Reasonable identity verification may be needed, but no new account is required. These requests are available to all website users; additional statutory protections apply where required.

For requests governed by Washington’s My Health My Data Act, I will respond within 45 days. If reasonably necessary, one additional 45-day extension may be taken with notice and an explanation during the initial period. Access responses are free up to twice annually, subject to statutory exceptions for excessive or unfounded requests. Deletion requests will be passed to relevant recipients; backup deletion may take up to six months after verification where permitted.

An appeal of a denied request may be submitted to the same email address with the subject line “Health privacy appeal.” For appeals governed by Washington’s My Health My Data Act, a written decision will be provided within 45 days. If denied, the Washington complaint channel is the Washington Attorney General or your applicable state regulator. Withdrawing consent may prevent further delivery of a service that needs that information. Privacy requests will not result in unlawful discrimination.