Some questions are hard to ask. Knowing what happens to the answer should not be.
MyWhatIf is built for people to explore deeply personal questions. That makes privacy, control and safety part of the design rather than a policy attached to it.
Health information is handled under the standard that governs it in the United States.
Ask us and we delete your personally identifiable and protected health information.
Including what voice analysis contributes, which is described in plain terms further down this page.
The Board of Directors and the Clinical Development Board, which includes legal counsel for ethics and compliance, review the work.
The person stays at the centre of it.
Personalization means the system works from what someone tells it. That is the whole reason it can be useful, and the reason the arrangement around it matters. Five things hold that arrangement in place.
What can I decide?
Technology built for something this personal should not ask for blind trust. These decisions are yours.
The experience is self-guided. It works from your own question, and it does not require anyone to recount a traumatic event to take part. Avoiding unnecessary re-exposure is a principle the Foundation was built on.
If you ask us to delete your data, we delete your personally identifiable information and your protected health information. You do not need to justify the request, and you do not need to read a policy to find out whether this is possible.
Using MyWhatIf and taking part in research are two separate decisions. Research participation requires its own consent. If you consent, relevant anonymized data may be shared with approved researchers under the applicable ethics-board and IRB approvals. Researchers do not receive your personally identifiable or protected health information. If you do not consent, you can still use MyWhatIf.
Available in English, Hebrew, Arabic, Ukrainian and Russian, so that people can do this work in the language they think in.
What does the system learn about me?
A personalized experience has to learn from what you give it. Text and voice are in use today. Video and behavioral signals are in development through the research program and are not deployed as a clinical measure.
What you write carries belief and meaning. It is what the experience responds to most directly.
Voice analysis contributes signals and biomarkers relating to emotion and to stable psychological characteristics. It runs on proprietary technology licensed from another company. No single signal describes a person, and none of them is read as a profile on its own.
Facial expression and behavioral signals are being developed and validated through our research program. In development, not in deployment.
These signals are not a diagnosis and are not used to make one. They are not a clinical measure of your condition, and the objective measurement instrument built across modalities is still being validated in research rather than used to assess anyone. They are not sold, and they are not a personality report handed to a third party.
Personalization should not cost you your dignity.
MyWhatIf is HIPAA compliant. That standard governs how health information is protected and disclosed in the United States, and it is one part of the arrangement rather than proof that everything is safe. Privacy and cybersecurity are funded workstreams inside the Foundation's plan, with named owners, not something addressed once at launch.
Where the experience includes peer or group features, those are moderated with trauma-informed facilitation, because privacy between participants matters as much as privacy from us.
How is AI involved?
AI personalizes a defined intervention. It is not an open-ended chatbot that will follow a conversation anywhere. MyWhatIf runs on a proprietary, non-generative model built for control and safety. That constraint is deliberate: an unrestricted conversation cannot be held to a protocol, and anything that cannot be held to a protocol cannot be reviewed or studied.
It works from your question, your context and your values rather than toward a future we decided for you. Our goal is not to maximize the time you spend with MyWhatIf. It is to help you get something meaningful from it, which is what the Foundation measures itself against.
The shape of the experience is a clinical design decision before it is a technical one. Clinical leadership inside the Foundation decides what belongs in the intervention and what does not, the Clinical Development Board reviews that design, and the studies test whether it holds. The approach in full →
How we think about building this for people affected by trauma.
It shapes what the system is allowed to do, which is a decision made before anything is built rather than a warning added afterwards.
We are running clinical studies because we believe the intervention can produce measurable change, and because believing it is not the same as showing it. What is established and what we are still testing are kept separate everywhere on this site. The boundary in detail →
Where the work is used with a population, it goes through a partner institution and its own oversight. Where it is running now →
MyWhatIf is self-guided and it is not emergency care. If you are in immediate danger, contact your local emergency services.
We built this close to home.
MyWhatIf was not built for an audience we know only through research. Many of the people building it know these questions personally, and many belong to the communities it is meant to serve. We built it for ourselves, our families, our friends and our communities.
That changes the standard. The question is not only whether we are permitted to do something. It is whether we would want it done to someone we love.
Who holds MyWhatIf to this?
The Board of Directors governs the Foundation and holds its finances and accountability. A clinical development board of clinicians and researchers reviews how the intervention is designed, studied and deployed, and includes legal counsel covering ethics and compliance. Studies run under the oversight of the institutions that host them, including their ethics boards and IRBs.
None of these structures make the Foundation a regulator of itself. They are the people who can say no.
What we are not ready to state publicly.
A trust page is worth less if it answers questions the organization has not actually settled. Security certifications, retention periods and how long a deletion takes to complete are all being documented as part of the Foundation's quality, privacy and cybersecurity workstreams. When each is settled it will be stated here plainly.
If you need one of those answers before you can proceed, ask us directly and we will tell you where it stands.
Now you know how we hold it. The question is still yours.