Effective 17 August 2026 · Version v2026.08.17
This notice explains how Red Heroz Corp handles consumer health data. It is published under Washington's My Health My Data Act (ch. 19.373 RCW) for Washington residents and under Nevada's consumer health data law (NRS 603A.400 to 603A.550) for Nevada residents. Both laws are addressed together in this notice.
What this notice covers
We do not ask for, collect, or infer any information about your physical or mental health. We do not run health assessments, mood or stress scores, symptom questionnaires, diagnostic tools, or any form of health intake. The quizzes in our courses test whether you understood the course material; they do not test, score, or assess you.
We publish this notice because our courses concern subjects such as stress, focus, and resilience, and we would rather be clear about what we hold than argue about definitions. Where this notice describes "consumer health data", it means the limited information listed below, treated as consumer health data whether or not it meets the statutory definition.
Categories of consumer health data we collect, and why
The information covered by this notice is:
- Your email address, given at checkout or when you are invited to the Learning Center at learn.redheroz.com.
- Your name, if you provide one at checkout or set one on your student account. If you earn a certificate, the name on your account at that time is recorded on the certificate.
- The fact that you purchased and are enrolled in a named course, such as "The Unshakeable Mind", together with the order record for that purchase (order and payment identifiers, the item, amount, currency, status, and dates).
- Your course progress records: which lessons you have marked complete, your last playback position, the percentage of a lesson watched, your quiz attempts and the answers you selected, and any certificate issued to you.
- Account and security records created when you use the Learning Center: your sign-in session, the IP address and browser user agent recorded with it, server request logs, and a log of the emails we send you (recipient address, template, subject, and delivery status). We keep these to run the service, to keep accounts secure, and to diagnose faults.
- Account administration records: if an administrator accesses your account to support you, that access is recorded against the session as an impersonation; and if we ever have cause to suspend an account, the account carries a flag and the reason for it.
We use this information for one purpose: to deliver the course you asked for and to support it. Specifically, we use it to create and maintain your student account, to give you access to the lessons you bought, to resume video and audio where you left off, to show you your own progress, to score quizzes, to issue a completion certificate in your name, to send you the transactional emails that the course requires (invitation, password reset, email-change confirmation, and course notifications), and to handle refunds and support requests you send us.
We do not use this information for advertising, profiling, or any health-related purpose. We do not use it to draw conclusions about your health, and we do not attempt to.
Sources
We collect consumer health data from you, and from no one else:
- Directly from you at checkout, through Stripe's hosted checkout page.
- Directly from you while you use the Learning Center at learn.redheroz.com, as you work through lessons and quizzes.
We do not buy consumer health data, and we do not obtain it from data brokers, advertising networks, public records, or other third parties.
Sharing
We share consumer health data only with the service providers we use to run the business, and only so that they can perform those services for us. The categories of third parties, and the specific providers in each, are:
- Payment processing — Stripe, Inc. Receives your name and email address and the item purchased in order to take payment and to process refunds.
- Database hosting — Supabase. Stores the order and entitlement records for us.
- Email delivery — Resend. Sends the transactional emails we send you about your purchase and your course.
- Website hosting — Vercel Inc. Hosts redheroz.com and keeps standard server access logs.
- Learning Center hosting — Hostinger. Provides the server on which learn.redheroz.com and its database run.
- Video embeds — Google LLC (YouTube). Google receives no consumer health data. If an article on the public site at redheroz.com includes a video player, Google receives nothing at all unless you click to play it; if you do, it receives your IP address. That happens on the public site, not in the Learning Center, and it is not tied to your account.
Each provider acts on our instructions for the purposes above. We may also disclose information where the law requires it, such as in response to a valid legal demand.
One further disclosure is worth stating plainly. If you earn a completion certificate, it carries a verification code, and anyone who has that code can open learn.redheroz.com/verify/ followed by that code and see the name on the certificate and the course it was issued for. We do not publish the codes and the page is not a searchable directory, but it is public to whoever holds the code. If you would rather that record did not exist, ask us to delete it using the route below.
We have no affiliates. There is no parent company, subsidiary, or commonly controlled entity with which we share consumer health data.
We do not sell consumer health data. We have never sold it, and we will not sell it without first obtaining the separate, specific, written authorization that the law requires for such a sale.
Location data and geofencing
We do not collect precise location data. An IP address is recorded with your sign-in session for security, and we do not use it to work out where you are. We do not operate a geofence around any health care facility, and we will not use one to identify consumers seeking health care services, to send them advertisements, or to collect consumer health data from them.
Your rights, and how to exercise them
If you are a Washington or Nevada resident, you have the right to:
- Confirm whether we collect, share, or sell your consumer health data, and to access that data, including a list of all third parties and affiliates with which we have shared it, together with an active email address or other online contact for each.
- Withdraw your consent to our collection and sharing of your consumer health data.
- Delete your consumer health data.
To exercise any of these rights, email hello@redheroz.com from the email address associated with your purchase or account, and tell us which right you wish to exercise. That single address is the route for all requests. If we cannot verify that the request comes from you or from someone authorized to act for you, we will tell you so and explain what we need.
We will respond within 45 days of receiving your request. Where reasonably necessary, we may extend that period once by a further 45 days; if we do, we will tell you within the first 45 days that we are extending and why.
Withdrawing consent means we can no longer keep or process the records that run your course, so it will end your access to any course you are enrolled in. We will tell you this before we act on the request. Withdrawal is not retroactive: it does not undo processing already carried out.
If we refuse a request
If we decline a request, we will tell you in writing why, and we will give you instructions for appealing the decision. If you appeal, we will review the decision and give you a written answer explaining the outcome. If your appeal is denied, you may contact the Washington State Attorney General at www.atg.wa.gov/file-complaint or the Nevada Attorney General at ag.nv.gov to submit a complaint.
Deletion
When you ask us to delete your consumer health data, we delete it from our live systems within 30 days of receiving your request. That includes your student account, enrollment, lesson progress, quiz attempts, certificate record, session and email log entries at learn.redheroz.com, and your entitlement record in our Supabase database. We also ask the service providers listed above that hold that data on our behalf to delete it, except where they must keep their own records under their own legal duties.
Two honest limits apply:
- Backups. We keep encrypted backups on a fixed rotation. A deleted record can remain in a backup until that backup is overwritten in the normal course of that rotation. We do not use backups to restore deleted records, and we do not query backups for any other purpose.
- Order and tax records. We must keep basic transaction records — the order and payment identifiers, the item purchased, the amount, and the date — to meet tax, accounting, and anti-fraud obligations, and Stripe keeps its own records of the payment under its own legal duties. We keep these for as long as the law requires and no longer, and we do not use them for any other purpose. If you ask, we will tell you what remains.
Changes to this notice
This notice takes effect on 17 August 2026. If we change it, we will post the revised notice at redheroz.com/legal/consumer-health-data with a new effective date and version number. We will not apply a material change to consumer health data collected before the change without your consent where the law requires it.
Contact
- Red Heroz Corp
- 5900 Balcones Dr, Suite 100, Austin, TX 78731
- hello@redheroz.com