Privacy Policy

Draft, under legal review. This privacy policy has not been finalized. Highlighted items are still being completed. Questions: hello@hodeahealth.com.

Last updated: November 4, 2026 · Effective on launch

Hodea Health ("Hodea," "we") is operated by Hodea Health LLC, a Texas limited liability company. This policy explains what we collect, why, and your choices.

The short version

• We don't ask for your health information. Your account holds only your name, email, home zip code and the practitioners you save.
• What you type into search is not stored. That includes symptoms. It isn't saved to your account, to your device, or in the web address, and it isn't sent to analytics.
• We don't sell your data, and we don't use ad-tracking pixels.
• We don't book appointments or pass your details to practitioners. When you tap "Book" or "Call," you go straight to the practitioner's own booking page or phone.

1. Information we collect

1.1 Information you give us

What	When	Notes
Name, email, home zip code	When you create or edit your account	The zip is used to show distances. We never ask for your street address.
Saved practitioners	When you tap Save	Private to you. Never shown to practitioners or sponsors.
Reviews: star rating, optional headline, text	When you write a review	Shown publicly with your first name and last initial, or a nickname, after moderation. We ask you not to include health details.
Review reports	When you report a review	Reason and optional note.
Suggestions ("Suggest a practitioner or store")	Optional form	Only the place's name, practice name, city, website or phone, and an optional 280-character note. We don't store who sent a suggestion (no account ID, email or IP address is saved with it). Notes that include first-person health details ("I have…", "my son's ADHD") are blocked before sending.
Provider claims	When a practitioner or staff member claims a listing	Name, role, work email, work phone, optional NPI, license attestation, and our verification results. Bio and Root Approach drafts go through moderation.
Messages to us	When you email us	Whatever you include. Please don't send health details.
Waitlist signup: email, and optionally first name, ZIP code and whether you're a parent, practitioner or store owner	When you join the waitlist on hodeahealth.com	Used only to tell you about our launch and updates, and (ZIP) to decide where we open next. No health questions. You can unsubscribe or ask us to delete it anytime at hello@hodeahealth.com.

1.2 Information collected automatically

• Location. If you tap "Use my location," your device's location is used only to center that one search. It isn't stored. Otherwise we use the zip you type.
• Device settings. Your light or dark theme preference is saved only on your device.
• Technical data. Our hosting and backend providers process standard technical data to deliver the service and keep it secure. This includes IP address, device and browser type, and request times. These logs are kept for 30 days or less (see Section 8).
• Map tiles (web). The map loads tiles from OpenFreeMap. Your browser sends the map area being viewed and your IP address to OpenFreeMap to fetch them. We don't send OpenFreeMap your search or any account data. OpenFreeMap's terms: https://openfreemap.org/tos/
• Directions. "Get directions" opens Apple Maps or Google Maps with only the practice's address. It never includes your location or search. Apple and Google then handle your data under their own policies.
• Analytics. None yet. If we add analytics, it will be cookieless and privacy-focused. For searches it will receive only:
  • how many filters were on (a number, never which ones)
  • the search radius
  • a result-count range

    It will receive no search words, symptoms, focus areas, categories, practitioner types or user IDs. We won't tie practitioner-page views to user IDs.

• No advertising trackers. No Meta Pixel, TikTok pixel or similar ad-tracking tools.

1.3 Information from public sources (about practitioners and shops)

We build listings from:

• the federal NPI Registry
• state licensing-board records
• public professional directories
• businesses' own public websites, for neutral facts only

We don't import practitioners' personal emails, and we don't copy health claims or testimonials.

2. Symptom and health-related searches

Searches can reveal something about your health or your family's, such as "fertility," a midwife search, or "postpartum mood." So we built search to forget:

• What you type stays in the app's memory on your screen and is gone when you leave or reload. It is not saved to your account, not stored on your device, and not put in the web address.
• Symptom search only matches your words to the focus areas practitioners list. It never suggests a diagnosis. Only the matched focus-area IDs are used to filter results.
• On our servers, searches are processed to return results and are not logged. That means:
  • no search terms or filters in server logs or database query logs
  • no search terms or filters in analytics, crash reports or the web address
  • [FILL: to be confirmed]
• Sponsored results are picked on your device or our server from the same search, but sponsors never learn what you searched. They get aggregate counts only.

3. Booking and contacting practitioners

• Hodea doesn't book appointments, take intake forms, or carry messages between you and practitioners.
• "Book" opens the practitioner's own booking link. "Call to book" opens your phone dialer. What you share there is governed by the practitioner's or booking service's privacy practices, not ours.
• We don't tell practitioners who viewed or saved their profile.

4. How we use information

We use information to:

• run the service: accounts, saved lists, distances, reviews
• moderate reviews and suggestions
• verify Provider claims
• prevent fraud and abuse (for example, new accounts reviewing many practitioners)
• send service emails: sign-in links, moderation and claim notices
• comply with law

We don't use your information for targeted advertising, and we don't sell it.

5. How we share information

• Publicly: approved reviews, with your first name and last initial or nickname.
• With Providers: only your public review. We never share your account details, saved list or searches with Providers.
• With service providers who process data for us under contract:
  • Supabase: database, authentication and file storage
  • Cloudflare: web hosting
  • Resend: email delivery
  • Expo: app builds and updates
  • OpenFreeMap: map tiles on web

    [FILL: to be confirmed]

• For legal reasons: to comply with law or valid legal process, or to protect rights and safety.
• Business transfers: in a merger or sale, subject to this policy.
• No sale: we don't sell personal data, including any sensitive data.

6. Health-privacy laws: where Hodea stands

6.1 HIPAA

• Likely not a covered entity. HIPAA applies to covered entities (health plans, healthcare clearinghouses, and healthcare providers who transmit health information electronically in standard transactions) and to their business associates (HHS: https://www.hhs.gov/hipaa/for-professionals/covered-entities/index.html).
• Why we think so. Hodea is a consumer directory. It doesn't provide care, bill insurers, or handle patient records for providers. So we believe it is neither.
• What could change that. Booking, intake or messaging on providers' behalf.

6.2 Texas Health & Safety Code ch. 181 (Texas Medical Records Privacy Act)

• Broad definition. Texas defines "covered entity" broadly. It includes any person who, for commercial gain or otherwise, assembles, collects, analyzes, uses, evaluates, stores or transmits protected health information, expressly including a "person who maintains an Internet site" (§181.001, https://tcss.legis.texas.gov/resources/HS/htm/HS.181.htm).
• What would apply if covered:
  • staff training (§181.101)
  • a ban on selling protected health information (§181.153)
  • notice and separate authorization before electronic disclosure (§181.154)
• Our position. Our design aims not to collect protected health information at all: no health fields, searches not stored, and health details discouraged and moderated out of reviews and suggestions.

6.3 Texas Data Privacy and Security Act (TDPSA, Bus. & Com. Code ch. 541)

• Sensitive data. The TDPSA treats "mental or physical health diagnosis" and precise geolocation as sensitive data. A covered controller may not process sensitive data without the consumer's consent (§541.101(b)(4)).
• Small-business exemption. The Act generally doesn't apply to businesses that are small businesses as defined by the U.S. Small Business Administration (§541.002(a)(3)). But even a small business may not sell sensitive personal data without prior consent (§541.107). https://tcss.legis.texas.gov/resources/BC/htm/BC.541.htm
• Our position. We don't sell any personal data, and we try not to collect health diagnoses. We don't store precise location.
• If covered, the consumer rights are:
  • access, correction, deletion and a portable copy (§541.051)
  • a response within 45 days, extendable once by 45 (§541.052)
  • an appeal process with a 60-day decision (§541.053)
  • a privacy notice listing the categories of data, purposes, sharing and how to exercise rights (§541.102)

    This draft offers those rights to everyone (Section 9) so we're ready either way.

6.4 FTC Health Breach Notification Rule (16 CFR part 318)

• What it covers. The rule covers vendors of "personal health records" that aren't HIPAA entities. A PHR is an electronic record of identifiable health information that "has the technical capacity to draw information from multiple sources" and is managed by or for the individual.
• "Health care services or supplies" includes any website or app that provides mechanisms to track diseases, symptoms, fertility, sleep, diet and similar, or "other health-related services or tools" (§318.2, https://www.law.cornell.edu/cfr/text/16/318.2).
• Our position. Hodea doesn't keep health records for users. Our design goal is that no user-linked health information exists to be breached.

6.5 Texas breach notification (Bus. & Com. Code ch. 521)

• What it requires. A business that owns computerized "sensitive personal information" must notify affected individuals of a breach without unreasonable delay and no later than 60 days after determining it occurred (§521.053, https://tcss.legis.texas.gov/resources/BC/htm/BC.521.htm).
• Definition (verified Oct 30). "Sensitive personal information" is either (A) a first name or initial and last name plus an unencrypted SSN, driver's license or government ID number, or a financial account or card number with its access code; or (B) information that identifies an individual and relates to their physical or mental health or condition, the provision of health care to them, or payment for it (§521.002(a)(2)). Publicly available government information is excluded (§521.002(b)).
• Thresholds (verified Oct 30).
  • Individuals: notice within 60 days (§521.053(b)).
  • Attorney General: notice through the AG's online form "not later than the 30th day" after determining the breach, if it involves at least 250 Texas residents (§521.053(i)).
  • Consumer reporting agencies: notice if more than 10,000 persons must be notified at once (§521.053(h)).
  • Substitute notice (email, website, statewide media) is allowed if notice would cost more than $250,000, more than 500,000 people are affected, or contact information is insufficient (§521.053(f)).

6.6 Washington's My Health My Data Act and similar state laws (flag only)

• Who it protects. Washington's law protects "consumer health data" of Washington residents, or of anyone whose data is collected in Washington (RCW 19.373.010, https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.010).
• What counts as consumer health data. It includes "data that identifies a consumer seeking health care services" and inferences derived from non-health data.
• Consent rules. Collection needs consent or must be necessary for a requested service. Sharing needs separate consent (RCW 19.373.030, https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.030).
• Why it matters here. Hodea launches in Texas, but anyone can open the website. A saved practitioner could be "data that identifies a consumer seeking health care services."
• Other states (verified Oct 30; flag only).
  • Nevada (SB 370, 2023; NRS 603A.400–603A.550, effective March 31, 2024): a regulated entity must post a consumer-health-data privacy policy (603A.495) and get consent before collecting or sharing consumer health data unless necessary for a requested service (603A.500). It also bans geofencing near health-care sites (603A.540). Violations are deceptive trade practices with no private right of action (603A.550) (https://www.leg.state.nv.us/nrs/NRS-603A.html).
  • Connecticut (Public Act 23-56, SB 3, 2023): amends the CT Data Privacy Act. "Consumer health data" means personal data a controller uses "to identify a consumer's physical or mental health condition or diagnosis." Selling it without consent is barred, and so is geofencing within 1,750 feet of mental-health or reproductive/sexual-health facilities. These consumer-health-data provisions apply "notwithstanding section 42-516" (the CTDPA's size thresholds) (https://www.cga.ct.gov/2023/act/pa/pdf/2023PA-00056-R00SB-00003-PA.pdf).
  • Other states were not surveyed (unverified).

7. Children

• Accounts and reviews are 18+ only. Hodea is for adults and isn't directed to children. No one under 18 may create an account, write a review or submit content.
• Parents may look for pediatric care. Please don't enter information about your children in reviews, suggestions or messages. Our moderation removes children's health details.
• If we learn we collected personal information from a child under 13, we'll delete it. Contact hello@hodeahealth.com.
• COPPA. COPPA applies to operators of services directed to children under 13, or with actual knowledge of collecting their personal information (16 CFR §312.2, https://www.law.cornell.edu/cfr/text/16/312.2). The amended COPPA Rule took effect June 23, 2025, with general compliance required by April 22, 2026 (https://www.federalregister.gov/documents/2025/04/22/2025-05904/childrens-online-privacy-protection-rule).
• Texas SCOPE Act. Texas Bus. & Com. Code ch. 509 adds duties for digital services that know a user is a minor under 18, when the service lets users interact, create profiles and post content (§509.002, https://tcss.legis.texas.gov/resources/BC/htm/BC.509.htm).

8. Retention and security

How long we keep things :

Data	Kept for
Account data	Until you delete your account, then removed within 30 days, except backups that roll off within 35 days
Published reviews	Until you delete them or your account. On account deletion we delete your reviews.
Rejected or removed reviews and moderation records	24 months, for abuse prevention and legal claims
Provider claim records and board-check evidence	While the listing is managed, plus 3 years
Suggestions	Until reviewed, plus 12 months. They carry no submitter identity.
Server and technical logs	30 days or less. No search terms are logged.
Waitlist signups	Until you unsubscribe or ask us to delete them. If you never create an account, we delete waitlist signups 24 months after launch

Security:

• encryption in transit (HTTPS)
• row-level security on every database table; users can read and write only their own private rows
• admin access limited to named moderators
• license-verification fields writable only by our verification job, never by account holders

No system is perfectly secure.

9. Your choices and rights

Wherever you live, you can ask us to:

• see the personal data we hold about you, and get a copy
• correct it
• delete it, including your account and reviews
• appeal if we decline a request

How it works:

• You can edit or delete most data yourself in Account. Or email hello@hodeahealth.com.
• We'll verify your request, respond within 45 days (extendable once by 45 days with notice), and decide appeals within 60 days.
• If we deny an appeal, Texas residents may contact the Texas Attorney General.
• We don't sell personal data or use it for targeted advertising, so there's nothing to opt out of. If that ever changes, we'll update this policy first and ask for consent where required.

10. Changes

We'll post updates here and notify you in the app or by email for material changes before they take effect.

11. Contact

Hodea Health LLC, 610 Big Oak Ct., Rockwall, TX 75087, hello@hodeahealth.com.