Consumer health data

Heirleaf is not a health product. We measure nothing about your health, we diagnose nothing, and we never ask anyone about their health.

But when a person tells their life, health turns up on its own. The difficult birth turns up, the father's illness, the year spent in bed, the mother's mind at the end. That is family memory, and to Washington law it is also consumer health data.

That law has no size threshold and does not stop at the border, so it reaches us. And we think it should: if somebody is going to tell us that, they deserve to know exactly what we do with it.

Only what the person writes or says when answering their questions, the recording if they answer by speaking, and the photos they choose to add to their book, with their captions. Nothing else.

A photo can say something about health without anyone meaning it to: a hospital bed, a wheelchair, a hospital ward. A caption says it even more plainly. We treat them like everything else in the book. We don't analyze photos, don't recognize faces in them, create no face templates or any other biometric data from them, and don't read anything into them. The camera's location data is removed before upload. If someone else is in a photo, please ask them first, especially if it shows them ill or in hospital. And if someone who appears in a book asks us to delete their health data, we deal with it as our privacy policy explains.

There is no health form, no checklist of conditions and no question in the bank that asks for a diagnosis. If health data is in a book, it is because the person writing it chose to tell it.

To make that person's book and give it to them as a PDF. And, only if a printed copy is ordered and the person who wrote it agrees, by ticking the box or by saying yes to the email we send them, to have that copy printed and mailed. Nothing else.

We do not sell it and we do not share it with anyone. None of it is used for advertising, analytics or profiling, and none of it goes to data brokers. Sending the book to the printer that makes a printed copy, when it is ordered, is not sharing in the law's sense: the printer works for us, as our processor, under a contract that lets it use the book only to print and mail that copy. If that ever changed it would need each person's prior consent, and this page would say so first.

Updated October 30, 2026: a printed copy can now also be ordered for delivery in Spain (the rest of the European Union will follow later). Lulu then prints it at a plant in Europe. Everything else on this page stays the same.

Updated October 29, 2026: printed copies. In the United States a printed copy of a book can be ordered. Only then, and only with the yes of the person who wrote it —the box they tick before paying, or, if someone else pays, the “Yes, print it” button in the email we send to the address on the book— does the book go to Lulu, which prints and mails it and deletes it on our instruction. See *Who sees it*.

Updated October 28, 2026: photos inside the book. You can now add photos at the end of each chapter. They are stored and deleted with the book, and only people with the link can see them. Before the first photo we ask for consent: from that day the box ticked at the start covers them, and anyone who started earlier is asked again. And a book that hasn't been paid for is deleted after a year with nobody writing in it, with notice first to anyone who gave us their email address.

Updated October 8, 2026: we now have an email list, and it is separate. If you ask for a printable list of questions by email, we keep your email address on a separate list, in our own database. That list never receives anything anyone writes or says in a book, is never matched against books, and is never used to decide who gets which email. Nothing on this page changes for your book.

Updated October 14, 2026: reminders when a book is waiting. If you stop at the payment page and tick the box to be reminded, we send you up to two emails saying your book is waiting and which question comes next. To decide whether to send them, we look only at how many questions you've answered and whether you've paid, never at what you wrote or said. The emails contain nothing from your book and nothing about your health. If you don't tick the box, we send nothing.

Updated October 21, 2026: on the gift page you can also ask us to remind you about Heirleaf once before Christmas. That address goes to the same separate list and follows the same rules: it never receives, and is never matched against, anything anyone writes or says in a book, and we delete it after we send you that email.

The person who wrote it, and anyone they give the link to their book. Nobody else, with one exception that only that person can open: if a printed copy is ordered and they agree, the printer's staff handle the pages in order to print, bind and check them.

Not whoever gave them the book, who sees not one word. Not us for curiosity's sake: we only look if somebody writes asking for help with something specific, and then we tell them so.

Four providers handle a piece of it along the way, and a fifth only if a printed copy is ordered, none with permission to do anything more: Supabase stores the data, including photos, Vercel serves the website, AssemblyAI turns speech into text, Fly.io lays out the book, with its photos, as a PDF, and Lulu Press, Inc. (United States) prints and mails a printed copy, at the plant it works with nearest the address, in the United States or in Europe, only if one is ordered and the person who wrote the book agrees. Lulu may use a file that breaks its content rules to train the systems that detect that abuse, and nothing more. The delivery company sees the name, address and phone number, never what is inside. Stripe, which takes the payment for a printed copy, never receives the book. All of them are named in the privacy policy, with where they are and what they delete.

You can ask us for a copy of what we hold, for it to be deleted entirely, or to withdraw your consent to our keeping sensitive data. All three are asked for the same way: by writing to hello@heirleaf.com.

A person answers, not a form, and within two days. We ask for no proof and no reasons.

Your voice recordings you can download yourself, without asking: once the book is paid for, its page has a link next to each recorded answer.

If you withdraw consent, we delete what you have told us. We cannot do it halfway: the book is made of that. If a printed copy had been ordered and hadn't yet gone to the printer, we cancel the order and refund it in full; if it had, the copy can't be called back, but we tell the printer to delete your book the same day.

If you think we have got it wrong and you live in Washington, you can complain to the state Attorney General.

We do not train models on what people tell us, and we do not let anyone else do it either. The provider that transcribes speech has that option switched off on our account, and deletes its copy after three days. The only exception is the printer's, and only for a file that breaks its content rules: it may use it to train the systems that detect that abuse.

We do not rewrite what people tell us. A machine writes it down, and it is printed as written, with only the spelling fixes the person accepts, under its question's title.

There are no trackers on this website. Not one. Nor in our emails. The only outside script is Paddle's checkout, which loads when you press pay and never on a page of your book.