Privacy policy
This policy describes how MyWhatIf Foundation, a 501(c)(3) nonprofit organization, collects, uses, protects and handles information through mywhatif.org and the MyWhatIf platform.
Why we build this way
We built MyWhatIf to be aligned with the people who use it. Many of the people who built it also carry lived experience of trauma. We built this for ourselves, our families, our friends and our communities too. That does not replace our legal obligations. It is the standard we are trying to hold ourselves to as you read the policy below.
The short version
1. HIPAA
MyWhatIf is HIPAA compliant. Where we hold protected health information, we handle it under the safeguards HIPAA requires. HIPAA does not govern every piece of information collected in every context on this site, for example information submitted through a general contact form is treated under the standards described in this policy rather than as protected health information.
2. Information we collect
Account and contact information. Name, email and similar details you provide.
Information you share. Text, questions, responses and reflections you provide during MyWhatIf experiences.
Voice. Where voice functionality is used, we process voice recordings and information derived from your voice.
Video and behavioral signals. Where enabled and appropriate, we may process video or other behavioral signals.
Technical information. Information reasonably necessary to operate and secure the website and platform.
Research information. Information collected under a separately consented research protocol, described in section 7.
3. Voice and inferred characteristics
Where voice functionality is used, MyWhatIf can infer stable psychological characteristics from the way you speak, using technology licensed from a specialized provider. These inferences inform how the experience is personalized. A voice signal is one input among several, and it does not diagnose you or define you. It does not by itself determine any clinical judgment about you.
4. Video and multimodal signals
Where video or other multimodal features are enabled for you, MyWhatIf may use those signals to personalize or calibrate the experience. Analysis done locally. No video or audio are being saved on our servers.
5. Why we use information
We use information to provide the platform, personalize your experience, generate narrative content appropriate to you, calibrate interactions, support safety and security, provide support, conduct research where you have separately consented, and improve the service where legally and contractually permitted. We do not use your information for advertising.
6. AI processing
MyWhatIf uses artificial intelligence and other computational systems to process your information and personalize your experience. Hero data is used only to train MyWhatIf's own models, never third party models. We maintain signed business associate agreements with our vendors to protect protected health information and personal information, and our data policy does not permit vendors to train their models on any MyWhatIf related data.
7. Research is separate
Using MyWhatIf is not the same as consenting to research. If you separately choose to participate in a research study, anonymized relevant data, not your personal information, may be shared with approved researchers. This is governed by the study's informed consent process, its research protocol, review by the applicable ethics board or IRB, and any other applicable legal or institutional requirements.
If you later ask us to delete your data or withdraw from a study, that request applies to your identifiable information going forward.
8. Your right to delete your data
When you ask us to, we delete your personal information and protected health information. You can make this request through your MyWhatIf account, or through our contact page. Some information may need to be retained where the law requires it, and we will tell you if that applies to your request.
9. Sharing information
We share information with service providers who process it on our behalf to operate MyWhatIf, with researchers only through the separately consented, anonymized framework described in section 7, where required by law or legal process, and in connection with an organizational transaction if one occurs and it is legally appropriate to do so.
10. Sale of information and advertising
MyWhatIf personalizes your experience using the information described above, but that personalization is separate from advertising. We do not sell your personal information or protected health information.
11. Third party processors
Specialized providers may process information on our behalf to support platform functionality, including the voice analysis capability described in section 3. We maintain signed business associate agreements with these providers to protect protected health information and personal information, and our vendors are not permitted to train their own models on data used for MyWhatIf.
The public website uses Amazon Web Services for hosting and for delivering messages sent through our forms. Where a message you send us contains personal or health information, AWS processes it in the course of transmitting it to us, in the same way any email provider would. AWS acts as our infrastructure provider and does not use the contents for its own purposes.
Separately, and only where you have consented, the website uses the analytics and error-monitoring providers named in section 16. These providers do not receive the contents of anything you submit through our forms: our website records that a form was submitted and does not send field values with it.
12. Security
We use administrative, technical and organizational safeguards appropriate to the sensitivity of the information we handle, consistent with our HIPAA obligations. No system is completely secure, and we work to reduce that risk continuously rather than claim it away.
13. Retention
We retain personal information only for as long as reasonably necessary for the purpose it was collected for, to provide and secure MyWhatIf, to meet applicable legal, regulatory, research, accounting or compliance obligations, or as otherwise described in an applicable research consent.
When you request deletion, we delete your personal information and protected health information, subject to information we are legally required to retain. Research data collected under a separate consent may be retained according to the applicable IRB approved protocol and research requirements, including where that data has already been anonymized.
Where you consent to the optional website analytics described in section 16, we intend the following retention periods to apply: Google Analytics, 14 months; PostHog, 12 months; Google BigQuery where linked, 26 months; Sentry, 30 days.
14. Children and age
MyWhatIf is intended for people age 18 and older, with one exception: our supervised youth program, which is open to people age 14 and older with parental or guardian consent and institutional oversight for that program.
15. International use
16. Cookies and analytics
We use a small number of cookies and similar technologies that are necessary for the website to work and to keep it secure. These cannot be turned off.
We also use analytics services to understand how the website is used so that we can improve it. These are optional, they are switched off until you agree to them, and the website works fully without them. No optional service loads until you have given your consent.
When enabled, we use Google Analytics 4 (Google Ireland Limited) and PostHog, using its European Union hosting region, to measure aggregate website usage and understand how people move through the site. We also use Sentry, using its European Union data region, to be told when something on the website breaks. If we link Google Analytics to Google BigQuery for longer-term analysis, the exported data is the same technical information already described here.
These services receive technical information such as your IP address, browser and device type, and the pages you visit. The contents of any form, any question you compose, and anything you tell us about your health or your experiences are not sent to an analytics service. We record that a form was submitted, not what was in it.
We do not use session replay: no recording is made of your screen, your cursor or your typing.
You can change or withdraw your choice at any time using the Cookie choices link in the footer of every page. Our Cookie Policy lists the individual cookies, what each is for, and how long each is kept.
17. Donations
Donations made through this site are processed by Zeffy, a third party donation platform. Information you submit to make a donation, including payment details, is handled under Zeffy's own privacy practices, and MyWhatIf Foundation does not directly process your card information.
18. Contact, volunteer and partner forms
The Contact, Volunteer, Partner With Us and Request Access pages collect professional and contact information you choose to share, such as your name, email and how you would like to help. We use it to respond to you. These forms are not intended for medical records, clinical detail, or sensitive health information. Please avoid including that kind of information unless you are specifically asked for it through a research study or a platform workflow designed to receive it, each of which carries its own consent and safeguards.
If you do choose to include personal or health information in a message, we handle it as ordinary correspondence rather than as protected health information, with the same care as the rest of your communication with us — unless you separately become a Hero using the platform or a research participant, in which case the protections described elsewhere in this policy apply instead.
Your submission is transmitted to us through Amazon Web Services, which we use to host this website and to deliver the resulting email to our inbox. AWS processes your submission for the purpose of transmitting it to us. We do not intentionally persist the contents of public website form submissions in the website application or its application logs; the submission is processed through AWS services for delivery to our inbox and then retained as ordinary email correspondence in line with section 13.
We do not send the contents of these forms to our analytics or error-monitoring providers. Where you have consented to analytics, we record only that a form was submitted, not what it contained.
19. Your rights
You can ask us to delete your personal and health information as described in section 8. Additional rights may be available to you depending on your location and applicable law, or the terms of a research study you have joined. Contact us and we will tell you what applies to you.
20. Changes to this policy
We may update this policy as MyWhatIf develops. The date at the top of this page shows when it last changed.
21. Contact us
Questions or requests about this policy can be sent to MyWhatIf Foundation through our contact page.