Draft document notice These documents were drafted in house and have NOT been reviewed by a lawyer. They are published so they can be read and corrected, not because they are final.
Consumer Health Data Privacy Policy
Effective September 18, 2026 ยท Version 2026-09-18
DRAFT PENDING LEGAL REVIEW. This document was written in-house and has not been reviewed by counsel. It is published so it can be read and corrected, not because it is finished.
This policy provides the disclosures required by Washington's My Health My Data Act. It supplements our general Privacy Policy at /privacy, which describes the same data in Sections 2.6 and 14. The two documents describe the same handling. Where a state consumer-health-data law protects the data described here, this policy applies in addition to the Privacy Policy, and nothing here reduces a right the Privacy Policy gives you.
1. Who we are
Coherent is operated by Malloy Labs LLC, 2466 N Oakland Avenue, Milwaukee, Wisconsin 53211, USA. Coherent is a private tool for traders: you write your own trading rules, and Coherent warns you before you break one. Malloy Labs LLC decides why and how the data described here is processed, which makes it the regulated entity under Washington's law and the controller under others.
2. What consumer health data we collect, and where it comes from
We collect consumer health data from one source only: you, and only if you turn on the optional pre-session wellness check-in. It is off by default. Nothing in Coherent requires it, the price is the same without it, and no other feature is degraded or withheld if you never turn it on.
If you turn it on, before a trading session you pick a category, such as poor, fair, or good, for: sleep quality, stress level, energy level, whether you drank alcohol in the last 24 hours, hydration, caffeine, whether you are dealing with illness or pain, and how long it has been since you last ate. Every answer is a category you choose. None is a number, a measurement, a diagnosis, or a clinical record.
From those answers Coherent derives a readiness inference about your own state for that session. We treat that inference as consumer health data too. We also record, as its own event, the fact that you used the feature at a given time; because that fact links an identified person to a health feature, we treat it as consumer health data as well.
We do not collect health data from any wearable, sensor, or device. Heart rate, HRV, and similar readings from an Apple Watch or any other wearable are not collected today, and this policy will be updated, with its own consent, before any such collection begins.
We do not infer health data from anything else you do in Coherent. Your trades, rules, and journal are not used to guess at your health.
3. Why we collect it
One purpose: to show you your own readiness inference and to time the warnings you asked for around it. We never use consumer health data for advertising, we never sell it, we never use it to set your price or decide whether you may use Coherent, and we never use it to train a model for anyone else. If we ever wanted to use it for a new purpose, we would have to ask you again before that use started.
4. Who receives it
Categories of consumer health data we share: none. We do not share consumer health data as that term is defined by Washington's My Health My Data Act. Our processors may process it on our behalf, solely to operate the feature described here.
No one outside those processors receives it. The categories of recipient are our hosting provider, which stores the application database, and our email provider, which delivers the warnings you asked for. Both are listed by name in Section 4 of our Privacy Policy, and both act on our instructions under contracts that limit them to that.
We have no affiliates that receive this data. We do not sell consumer health data, we have never received anything of value in exchange for it, and we do not share it for advertising of any kind. Washington's law requires a separate, signed authorisation before consumer health data may be sold; we hold none, because we do not sell it. We may disclose data if the law compels us to, and we will tell you if we lawfully can.
5. How long we keep it
Your check-ins and the readiness inference are kept until the earliest of: you withdraw your consent, you use the "Delete my readiness data" action in Settings, or you delete your account. Withdrawing consent erases the stored check-ins and the inference, not only future collection. The only records that outlive a withdrawal are those a legal obligation requires us to keep, such as the record that you gave the consent and when you withdrew it.
The engagement event that records you used the feature is deleted with your account, and otherwise expires no later than 90 days after the event.
Our database backups are encrypted and kept for no longer than 14 days on our side, so a deletion reaches every backup we hold within 14 days under our normal schedule. In every case, deletion of consumer health data is completed in backups no later than six months after we authenticate your request.
6. Your rights
Where a state consumer-health-data law applies to you, and as a matter of our own policy everywhere, you have the right to:
- confirm whether we hold consumer health data about you, and see it, including a list of the third parties and affiliates with whom we shared or sold it and an active email address or other online mechanism you can use to contact them. Today that list is empty, because there are none;
- have it deleted, from our production systems straight away and from our backups within the period in Section 5;
- withdraw your consent at any time, which also erases the data as described in Section 5;
- not be discriminated against for exercising any of these rights.
How to exercise them. The consent control and the "Delete my readiness data" action are in Settings and act immediately, with no request needed. For anything else, email noah@coherent.fyi from the email address on your account, with "Health data" in the subject line. We confirm who you are before acting, and we respond within the time the applicable law requires; for Washington that is 45 days, extendable once by 45 days where reasonably necessary and we tell you why. If we refuse, you may appeal by replying to our decision. We will answer the appeal in writing within 45 days with our reasons, and if we still refuse we will tell you how to reach your state attorney general. We do not charge for a request unless the law allows a fee for one that is repetitive or manifestly unfounded, and we would tell you first.
Your consent. The consent you give when you turn the feature on is shown on its own screen. It states the categories collected, the purpose, who receives the data, and how to withdraw. It is not bundled into accepting the Terms of Service or acknowledging the Privacy Policy, it is not a condition of holding an account, and declining it has no other effect.
7. No geofencing
We do not use geofencing around any facility that provides in-person health care services, to identify or track anyone, to collect health data, or to send messages or advertising. We never have, and Coherent has no feature that could.
8. Changes to this policy
We do not change this policy silently or apply a change backwards to data we already hold. A change to what we collect, why, who receives it, or how long we keep it applies only going forward, is published here with a new effective date and version, and where it affects the consent you gave, we ask for that consent again first.
9. Contact
Email noah@coherent.fyi, or write to Malloy Labs LLC, 2466 N Oakland Avenue, Milwaukee, Wisconsin 53211, USA.