SashaSasha helps people living with chronic conditions find and understand online health communities. We know the conditions you track and the communities you look at can be deeply personal, and we treat that information with care. This Privacy Policy explains what we collect, why, who we share it with, and the choices and rights you have.Sasha is operated by Williams CX LLC, a Utah limited liability company ("Williams CX," "we," "us," or "our"), located at 95 E 350 N, Orem, UT 84057. This Policy covers the Sasha website at asksasha.health and the Sasha mobile apps (together, the "Service"). By using Sasha, you agree to this Policy.
A note on health informationSasha is not a healthcare provider, and we are not a HIPAA "covered entity." The conditions you choose to track are not protected health information under HIPAA. They are, however, sensitive to you, and we treat condition information you enter as sensitive personal information. We do not require you to enter any health information to use the basic Service.
1. Information we collectWe collect the following categories of information:
•Account information: your email address and password. We store your password only as a salted one-way hash, never in readable form.
•Health-related preferences you choose to provide: the conditions you track, the communities you save, any private notes you add to a saved community, and any ratings you give a community (such as its activity level, tone, or moderation).
•Subscription and billing information: your subscription tier and status. If you subscribe on the website, we receive customer and subscription identifiers from Stripe. If you subscribe in a mobile app, we receive the purchase identifiers, product, status, trial, renewal, and expiry details from Google Play or the Apple App Store. Payment card details are collected and stored by Stripe, Google, or Apple, not by us.
•Trial and abuse-prevention information: a keyed, pseudonymous digest derived from your normalized email address, trial status and dates, Stripe customer and subscription identifiers, and, only if that safeguard is enabled, a payment-card fingerprint supplied by Stripe. We do not store your raw email address or any health-related information in the trial-abuse record.
•Communication preferences: your digest frequency and your email and push notification settings.
•Mobile app and notification information: if you allow notifications in a Sasha mobile app, we store a push notification token for your device, the device platform (Android or iOS), your time zone, and when you last opened the app. We use these to send notifications at reasonable local times and to avoid reminding you about a dispatch you have already seen. Notification text is generic and does not name your conditions.
•Search terms: the condition names and terms you search for. We log them without a link to your account, to operate and improve search.
•Feedback you send: the text you submit, the page and any condition or community it refers to, and your browser or app details. Feedback is stored without a link to your account and is copied into our issue tracker so we can act on it.
•Usage and technical information: log data (including your IP address), device and browser type, app version, and error and diagnostic data, collected to operate, secure, and improve the Service.
•Cookies and similar technologies: used to keep you signed in and to remember your preferences, as described below.
2. How we use your information
•To provide and personalize the Service, including tracking conditions, saving communities, and generating your digests.
•To process subscriptions, payments, and donations.
•To send you transactional and product emails and the digests you have opted into, to send push notifications you have allowed (such as when a new dispatch is ready), and to honor your notification preferences.
•To secure the Service, prevent abuse and automated misuse, and enforce our Terms.
•To analyze usage and improve and develop the Service.
•To comply with legal obligations and respond to lawful requests.
3. Our legal bases for processingWhere European or UK data-protection law applies, we process account, subscription, and service data as needed to perform our contract with you; comply with legal obligations; and pursue our legitimate interests in operating, securing, and improving the Service. Our legitimate interests include preventing fraud, repeated free-trial claims, automated account creation, and misuse of paid features. We balance those interests against your rights, minimize the information used, and provide a right to object as described below.
4. How AI processing worksWhen you search for a condition or we generate a community profile or digest, the condition name and related search terms are sent to our AI and search providers so they can generate the results. Community profiles are built from publicly available information about those communities, not from your private account data. We do not sell or use your personal information to train third-party advertising models.
5. How we share informationWe do not sell your personal information. We share information only as needed to run the Service, with service providers ("sub-processors") who act on our behalf under contract. These currently include, for example:A current list of sub-processors is available on request. We may also disclose information to comply with the law, enforce our Terms, protect the rights, safety, and security of our users and the Service, or in connection with a merger, acquisition, or sale of assets.
•Stripe: payment processing and subscription billing on the website.
•Google: Google Play billing for subscriptions bought in our Android app, and Firebase Cloud Messaging to deliver Android notifications.
•Apple: App Store billing for subscriptions bought in our iOS app, and the Apple Push Notification service to deliver iOS notifications.
•Expo: routing push notifications from our servers to Google and Apple for delivery.
•Cloudflare: Turnstile registration verification and bot-abuse prevention. Turnstile may process technical signals such as IP address, browser and device characteristics, and challenge results.
•Resend: transactional and digest email delivery.
•Anthropic: AI generation of community profiles and digests.
•Tavily: web search used to gather publicly available community information.
•Sentry: error monitoring and diagnostics for the website, the apps, and our servers. Error reports can include technical data such as IP address, device and browser type, and app version.
•Linear: issue tracking for feedback you send us.
•Our cloud hosting and database providers: to host the Service and store data.
6. Cookies and trackingWe use cookies and similar local-storage technologies that are necessary to sign you in, keep your session active, and remember your preferences. Our mobile apps keep your sign-in in your device’s secure storage. We do not use advertising cookies or usage-analytics tools. We use Sentry only to monitor errors and app stability, as described above. If we add usage analytics in the future, we will update this Policy before doing so. You can control cookies through your browser settings; disabling them may affect how the Service works.
7. Data retentionWe keep your information for as long as your account is active or as needed to provide the Service, and afterward only as required to meet legal, accounting, security, fraud-prevention, or dispute-resolution obligations. When you delete your account, we delete or de-identify the personal information associated with the account within a reasonable period, subject to the limited retention described below.Feedback you send is stored without a link to your account, so it is not removed when you delete your account. Email [email protected] to have specific feedback removed. Error reports are kept by our error-monitoring provider for its standard retention period.To prevent repeated free-trial claims, we retain the pseudonymous trial-abuse record for no more than 180 days after the trial decision, even if the account is deleted during that period. The record is used only for trial eligibility, checkout safety, and abuse prevention, contains no health or product-usage data, and is automatically deleted when that period ends. Pseudonymization reduces risk but does not make this record anonymous.
8. SecurityWe use reasonable administrative, technical, and organizational measures, including encryption in transit and access controls, to protect your information. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you and any regulators as required by applicable law.
9. Where we operate and process dataSasha is operated from the United States, and the Service is intended for users located in the United States. Your information is stored and processed on servers in the United States and may be processed by service providers in other countries. If European or UK data-protection law applies, we use applicable contractual or other recognized transfer safeguards with our service providers. You may contact us for information about the safeguards relevant to your information. The Service is not directed to users in the European Economic Area or the United Kingdom.
10. Your choices and controlsYou have direct control over much of your data from within the Service:
•Download your data: export a copy of your account data from your account settings.
•Delete your account: permanently delete the data associated with your account from account settings on the website or in the app, subject to the limited trial-abuse, legal, security, and dispute records described in this Policy. You can also follow the steps at asksasha.health/legal/delete-account.
•Manage tracking: add or remove tracked conditions and saved communities at any time.
•Email and notifications: adjust digest frequency and notification settings, or unsubscribe from digests using the link in any digest email.
•Push notifications: turn off notifications for Sasha in your device settings at any time, or use the notification switches in the app’s settings where available.
•App store subscriptions: a subscription bought through Google Play or the App Store is billed and managed by that store. Cancel it in your device’s subscription settings before deleting your account. When you delete your account we also ask Google Play to stop renewing it, but we cannot cancel App Store subscriptions for you.
11. Your privacy rights (United States and California)Depending on where you live, you may have rights to know what personal information we hold about you, to access or receive a copy of it, to correct it, and to delete it. We will not discriminate against you for exercising these rights.If you are a California resident, the CCPA/CPRA gives you the right to know, access, correct, and delete your personal information, the right to opt out of the "sale" or "sharing" of personal information, and the right to limit the use of sensitive personal information. We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We use the sensitive information you provide (the conditions you track) only to provide the Service you have asked for. You may exercise these rights using the controls in your account settings or by contacting us at [email protected], and you may use an authorized agent to do so.
12. European and UK privacy rightsIf European or UK data-protection law applies to our processing of your information, you may have rights to access, correct, erase, restrict, or receive a portable copy of your personal data, and to object to processing based on legitimate interests. If you object to our trial-abuse processing, we will stop and erase the matching record unless we can demonstrate compelling legitimate grounds that override your rights or the information is needed for legal claims. You may also complain to the data-protection authority where you live or work. Contact [email protected] to exercise these rights.
13. ChildrenThe Service is intended for adults 18 and older. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal information, contact us and we will delete it.
14. Changes to this PolicyWe may update this Privacy Policy from time to time. If we make material changes, we will update the "Last updated" date above and, where appropriate, provide additional notice. Your continued use of the Service after changes take effect means you accept the updated Policy.
15. Contact usFor privacy questions or to exercise your rights, email [email protected] or write to Williams CX LLC, 95 E 350 N, Orem, UT 84057.