Selah Space Consumer Health Data Privacy Notice
Operator: Workbird LLC
Effective date: September 22, 2026
Policy version: 2026-09-22-v1
1. Purpose and scope
Workbird LLC operates Selah Space. This separate notice describes consumer health data that may arise when you use pastoral conversations, booking notes, messages, preferences, reviews, or support. It supplements the Privacy Policy. Where applicable consumer-health-data law provides additional protection, that protection controls.
Selah is not a clinical treatment or emergency service. Nevertheless, a person may disclose a health concern while seeking spiritual support. Information does not lose an applicable privacy protection because it appears in a pastoral conversation or is outside HIPAA. Religious affiliation by itself is not automatically a diagnosis or health condition.
This notice addresses information within applicable consumer-health-data definitions, including the Washington My Health My Data Act where it applies. It does not assert that every user, every piece of spiritual information, or every activity is subject to that law.
2. Categories and sources
You may choose to disclose mental or physical health concerns, symptoms, diagnoses, treatment experiences, medication information, disability, addiction or recovery experiences, reproductive or sexual-health concerns, or efforts to seek related support. A message, booking note, public review, or support request may contain that information even though we do not require a clinical history.
Associated information can include your name and account identifier, appointment details, the pastor involved, and a pastor's notes that reveal the health-related concern. We do not use the matching feature to generate a diagnosis or health-risk score. The current service does not collect biometric identifiers, precise device location, wearable-device readings, or medical-provider records through an integration.
Sources include you; a participant who communicates with you or writes a relevant note; someone making a support or safety report; and the service systems that associate a message or appointment with an account. We do not purchase consumer health profiles from data brokers. A reference to another person's health in a message may concern that person as well as the sender; avoid identifying them unnecessarily.
3. Purposes and choices
We use relevant information to deliver a conversation or message you request, support continuity of the pastoral relationship, administer the associated booking, respond to your request, address a service problem, and handle legally permitted safety, security, or legal matters. We do not use consumer health data for targeted advertising, unrelated marketing profiles, or general-purpose AI training.
Where the law requires consent, we seek a specific affirmative choice before collecting the information for the stated purpose. Required consent to sharing is separate from consent to collection. We do not treat acceptance of general terms as a substitute. Where the law permits processing necessary to provide a product or service you request without separate consent, we limit reliance on that permission to what is necessary for that request.
You may omit unnecessary health details and decline to discuss a topic. If a feature cannot be provided without particular information, we explain that dependency. We do not condition the basic service on agreeing to sell health data. A new category or purpose requiring consent must be disclosed and accepted before the new processing begins.
4. Disclosures and recipients
The pastor or participant you choose receives information you send or share in the conversation, including relevant health details. A pastor can create private session notes; these are not automatically shown in the member interface. “Private” describes ordinary application access, not an exemption from applicable rights or lawful disclosures.
Hosting and database providers process stored text and associated identifiers as needed to operate the service. Netlify provides the current application hosting and database services. Zoom processes audio and video when you choose to participate through Zoom; Selah does not operate the media connection or store a recording or transcript through its current integration. Meeting-creation requests use a generic title and agenda and do not include your private notes or messages.
Payment and email providers receive information needed for payments and account communication. Stripe is used for payments and Resend for sign-in email. Ordinary payment and sign-in requests do not include the content of your pastoral notes or private conversations. Depending on context, a service identifier may itself reveal an association with a requested service, so we do not represent every such identifier as incapable of being sensitive.
Authorized support personnel and service providers may receive relevant information to resolve a request or incident. Other potential recipients are authorities or other persons entitled to a disclosure by law, and parties involved in a lawful business transfer subject to continuing protections. We do not list any corporate affiliate as a routine recipient because none has been identified in the current service arrangement. We will update this notice before adding a recipient or use that requires a new disclosure or consent.
A health detail you put in a published review may be visible to the public with your first name and other review information. Do not place private health information in a review unless you intend the disclosure. We do not infer consent to public disclosure from information shared privately with a pastor.
These descriptions identify actual disclosure situations in plain language. Whether a particular transfer is statutory “sharing,” processor activity, or a permitted requested-service disclosure depends on the applicable law and arrangement; we do not use a label to avoid its protections.
5. No sale or health-location targeting
We do not sell consumer health data. We do not use geofences around healthcare facilities to identify or track people, collect their health data, or send them health-related advertising. The current service does not collect precise device location for that purpose.
6. Access, withdrawal, deletion, and appeals
Contact support@workbird.co to request access, withdraw consent, request deletion, or exercise another applicable right. Use “Consumer health privacy” in the subject if helpful. Identify the account and request without sending unnecessary medical records or identity documents. You need not create a new account. We may reasonably verify identity and an authorized agent's authority before releasing or changing sensitive records.
Where Washington's law applies, you can confirm whether covered data is collected, shared, or sold; access it and information about relevant third parties and affiliates, including a means to contact them; withdraw consent to future collection and sharing; and request deletion. Requests are free up to twice annually, subject to the law's limited rules for manifestly unfounded, excessive, or repetitive requests. We do not unlawfully discriminate for exercising these rights.
For a covered Washington request, we respond without undue delay and within 45 days of receipt. A permitted extension of up to 45 additional days requires an explanation within the initial period. Verification does not automatically restart that deadline. If we decline, we explain the reason and the appeal process. Send an appeal to the same address with “Consumer health privacy appeal.” We provide a written appeal decision within 45 days and, if denied, information for a complaint to the Washington Attorney General. Different mandatory protections in another applicable jurisdiction remain available.
When the Washington deletion obligation applies, we address our records and notify recipients required by the law to honour deletion, including relevant processors and other third parties. For covered data in archived or backup systems, any permitted delay may not exceed six months from authentication of the deletion request. That limit is a legal requirement for covered deletion, not a statement that the current database automatically purges every backup on that schedule. Any lawful exception must be specific and explained where required.
Withdrawal can affect a feature that needs the information to provide the requested conversation. It does not by itself reverse an already completed payment or cancel an unrelated renewal. Tell us if you also want account closure or membership cancellation; we will address those requests expressly rather than leave you with an unexpected recurring charge.
7. Retention, protection, and updates
We limit retention to the disclosed purpose and a specific lawful need. Intimate conversation content should not be retained merely because an accounting record must be retained. Applicable deletion rights and deadlines take priority over a general retention practice. The main Privacy Policy explains account access, cookies, payment records, and the distinction between expiration and deletion.
Access restrictions and account authentication protect the ordinary application workflow. Zoom credentials are encrypted in storage; that does not mean messages or notes are end-to-end encrypted. We do not promise absolute secrecy or immunity from a legally required disclosure.
We will post the effective version and give appropriate notice of a material change. A policy update alone does not authorize a new sensitive use that requires affirmative consent.
Privacy requests: support@workbird.co
Workbird LLC · Effective September 22, 2026 · support@workbird.co