Genie Consumer Health Data Privacy Policy
Effective September 15, 2026
Health-related details can help Genie understand a request, such as finding food that fits an allergy or planning an accessible outing. They also deserve particular care. This Policy explains how Genie Travel, Inc. (Genie, we, or us) handles consumer health data, and how to ask us for help with it.
This Policy applies to consumer health data to the extent the Washington My Health My Data Act governs our handling of it. That Act determines which people, data, activities, and exemptions are covered. This Policy does not extend Washington rights to everyone or change the treatment of information outside its scope. Where it applies, this Policy controls conflicting general privacy language. Our Privacy Policy describes our other information practices.
Questions or requests? Contact hi@geniegetsme.com or Genie Travel, Inc., 151 SE 1st St., #630, Miami, FL 33131, USA. You do not need a Genie account to contact us or exercise applicable rights.
1. The health data involved
Consumer health data is personal information linked or reasonably linkable to a person that identifies health status within the applicable law's definition. It can include an inference drawn from information that did not originally look health-related. An inference can be wrong and still be covered.
Depending on what you provide, the sources you enable, and the features you use, we may collect or derive the following covered categories:
| Category | Information that may be involved |
|---|---|
| Physical and mental health | Conditions, symptoms, diagnoses, medical history, treatment, medication use or purchases, disabilities, allergies, and accessibility needs. |
| Reproductive, sexual, and gender-affirming health | Related conditions, care, services, medications, procedures, and efforts to research or obtain them. |
| Health-related measurements and identifiers | Bodily functions or measurements, vital signs, fitness, sleep, nutrition, and genetic or biometric information contained in content or processed by an enabled feature, when covered by the applicable definition. This does not mean Genie offers genetic testing or every kind of biometric processing. |
| Care-seeking and location | Information identifying efforts to obtain health services, communications or appointments about care, and location or movement that reveals visits to or attempts to obtain covered services. |
| Health-related inferences and linked records | Memories, summaries, preferences, or profiles indicating health status, together with associated account identifiers, communications, purchases, payment or group-contribution records, and interaction data where they reveal or are used to identify that status. |
We use these categories only for the purposes and under the conditions below. A data category listed here does not mean we collect it from every person or through every feature.
2. Where health data comes from
Sources may include information you give Genie in messages, voice interactions, photos, files, settings, and support requests; accounts you connect, such as email, calendars, messages, contacts, and photos; other users and people communicating with you; suppliers, payment services, and other parties involved in Actions you request; device, location, and interaction information from enabled features; and memories or inferences produced from those sources.
Other people may provide information about someone who does not use Genie. Their agreement with us does not replace that person's required consent. Source-platform restrictions also apply to the original information and its derivatives.
3. Why and how we use health data
We may process covered health data to provide the assistance you request, remember relevant preferences, personalize recommendations, communicate or share on your behalf, and arrange purchases, bookings, payments, or other Actions. Processing may involve reading, indexing, storing, summarizing, inferring, retrieving, and transmitting information, with automated systems, AI providers, and permitted human review.
Other disclosed purposes are support; lawful security, abuse prevention, and compliance; evaluation, development, and improvement of Genie and other services, including model training; personalized sponsored recommendations and measurement; and promotional use of content within the Terms' license. Listing these purposes is not consent to them. Each use must have the specific consent or other basis that applicable consumer health data law permits. General service improvement, shared-model training, advertising, and promotion are not treated as necessary to a requested service merely because they help fund or improve Genie.
Collection and sharing have separate rules. We obtain consent before collection or sharing when required. Where the law permits it, we may collect or share without separate consent only to the extent necessary to provide the product or service requested by the person the health data concerns, or under another applicable statutory exception. When Washington law requires sharing consent, it is separate and distinct from collection consent. Consent requests explain the covered data, specified purposes, recipient categories, and how to withdraw. We do not use acceptance of a general agreement or an AI-risk warning as a substitute.
A request can authorize continuing assistance within its valid scope; these rules do not necessarily require approval of every individual message. But ordinary social-sharing defaults do not authorize otherwise restricted health disclosures. Marking information private helps express your intentions; possible AI errors do not remove our legal duties or your rights.
Training choices. The Privacy Policy's prospective training opt-out and limited safety-review exception remain, but neither permits health-data training without a required legal basis. The exception cannot override withdrawal of required consent, applicable cessation or deletion rights, or source restrictions. Continued use of an already-trained model remains subject to those requirements.
4. What may be shared and with whom
Any of the categories in Section 1 may be shared when needed for a disclosed, lawfully permitted purpose. The permitted recipients depend on the request and legal basis:
| Recipient category | Purpose and limits |
|---|---|
| Connections, group members, and people you direct us to contact | Communications and sharing within a valid request or consent, rather than automatic disclosure of restricted health information. |
| Suppliers, organizers, payment services, and other Action counterparties | Carrying out the relevant requested arrangement, including necessary health-related requirements or transaction details. |
| Hosting, AI, communications, support, security, and other processors | Processing on our behalf under contracts restricting the data to authorized purposes. Applicable health-data rules determine when a processor disclosure is treated as sharing. |
| Business, advertising, measurement, and promotional partners | Only the specifically disclosed use for which the required health-data consent or other lawful basis exists. Their own-purpose uses are not automatically covered by a processor arrangement. |
| Professional advisers, authorities, courts, and parties to a business transaction | Only where the applicable law permits the particular disclosure, including required legal process, permitted protection of rights, or a qualifying financing, merger, acquisition, or transfer. A transaction does not create unrestricted new purposes. |
Affiliates. No affiliate is authorized to receive covered consumer health data under this Policy. Before adding an affiliate recipient, we will name it in this Policy and obtain any required consent. The general Privacy Policy's reference to affiliates does not replace that identification.
Sales. We do not sell consumer health data. This includes non-monetary exchanges that the applicable law treats as a sale. A general partner permission or promotional license does not override this commitment.
Tracking across services. Where specifically disclosed and supported by required collection and sharing consent, third-party advertising or measurement partners may collect covered health data over time and across websites or online services when you use Genie. They are not authorized to do so merely because this Policy is posted. Source prohibitions, the no-sale commitment, and your applicable choices continue to apply. Independent services you visit have their own practices. We do not use geofences around in-person health-service locations for identification, tracking, health-data collection, or messages and advertising where prohibited by applicable consumer health data law.
5. Your choices and requests
Email hi@geniegetsme.com, use an available privacy control, or write to our address above. Please tell us what you want us to review and provide enough information to locate your data. You may use an authorized representative where law permits. Please do not send passwords or unnecessary health records. We may use an existing account or request information reasonably needed to authenticate you and the request; we do not require a new account.
Under the Washington My Health My Data Act, you can confirm whether we collect, share, or sell your health data; obtain access; request the required list of third parties and affiliates, including an active email address or other online contact mechanism for third parties; withdraw consent to collection or sharing; and request deletion.
Withdrawing consent operates going forward. It may affect assistance that needs the information, but we do not unlawfully discriminate for exercising rights. Closing your account is not a prerequisite to making a request. Requests may be declined or limited only on an applicable legal ground, which we explain as required.
Response timing. We act without undue delay and within 45 days of receipt; authentication does not restart that period. A reasonably necessary extension of up to 45 additional days is available with notice and reasons within the initial period. Other applicable deadlines control where different.
We provide the free responses required by Washington law, including up to twice annually. For manifestly unfounded, excessive, or repetitive requests, we may charge a reasonable fee or decline only where the applicable law allows; an additional request is not automatically chargeable simply because it is the third one.
Asking us to reconsider. If we decline your request, you can appeal by replying to our decision or emailing the same address with the decision and what you would like reconsidered. No particular subject line is required. We respond in writing within 45 days of receiving an appeal, explaining the outcome and reasons. If denied, we provide the required route to contact the Washington Attorney General, whom you can also contact directly. Genie's contractual dispute process does not replace these rights.
6. Keeping and deleting health data
We retain covered health data only for a permitted purpose and period, taking account of the request, applicable consent, operational need, source restrictions, and law. Access is limited as required, and we use technical and organizational measures designed to protect it. No system is error-free, but that does not waive applicable protection or incident-response duties.
A deletion request covers the identifiable health information within its scope, including associated memories, inferences, and indexes, not only the original message. We notify the affiliates, processors, contractors, and other recipients required by law so they can carry out their deletion obligations. General retention language, account closure rules, or prior model training do not override a required deletion.
Deletion follows the applicable Washington request deadline. Necessary restoration-related deletion from archived or backup systems may be delayed only as permitted, and no longer than six months after authentication. This is a statutory outer limit for those systems, not a routine retention period or permission to keep using deleted data. A shorter requirement under another applicable law or source restriction still controls. Any exemption or refusal must actually be available under the governing law.
7. Changes and contact
We update the effective date when this Policy changes and notify you of material changes through Genie or an available account contact. Before collecting, using, or sharing additional covered categories or for additional purposes, or adding recipients where the law requires, we provide the required disclosure and obtain affirmative consent. A published update does not replace that consent or erase applicable prior commitments.
For questions, requests, or an appeal, contact hi@geniegetsme.com or Genie Travel, Inc., 151 SE 1st St., #630, Miami, FL 33131, USA.