Consumer Health Data Privacy Policy
Last updated: September 30, 2026
Some states, including Washington, Nevada and Connecticut, have laws that protect health information collected outside of doctors’ offices. This policy explains how Xenith Studios, which operates Memento, handles that kind of information, and it applies to everyone who uses Memento, wherever they live. It adds to our Privacy Policy. Memento is not a healthcare provider, and the information described here is not covered by HIPAA.
What health information we collect
• Intake and consent forms: your answers about allergies, blood thinners and other medications, bleeding disorders, diabetes, heart conditions, pregnancy or breastfeeding, skin conditions, recent alcohol or drug use, and fainting, plus anything else you write in. We store them with the consent statements you agreed to, your typed legal name, your drawn signature, and when you signed.
• Healing-concern threads: your answers to the “Is This Infected?” checklist, the symptoms you describe, photos of the healing area, and the messages in the thread.
We collect this information only from you, or from a parent or guardian booking for a minor. We do not infer health information from anything else you do on Memento. We do not use location to identify visits to healthcare facilities, and we do not set up geofences around them.
Why we collect it
Intake forms let the artist doing your procedure decide whether, and how, they can work on you safely, and give both of you a signed record of your consent. Healing-concern threads let you ask that artist about how your work is healing.
We also use this information when we need to for security, to prevent fraud, or to comply with the law.
We never use it for advertising, for the For You feed or other recommendations, or for marketing, and we never sell it.
Who we share it with
• The artist for that appointment (intake forms) or that thread (healing concerns), and nobody else on Memento. It is never public. Artists receive it as independent businesses with their own legal obligations.
• Supabase, which hosts our database and file storage and processes the information only on our behalf.
• Authorities, when a valid legal process such as a subpoena or court order requires it.
Push notifications about a healing thread say only that a message has arrived, and never include your answers or photos. We have no affiliates that receive this information.
Your consent
We ask for your consent before we collect health information, and separately before we share it with your artist. On the intake form you tick one box for each. When you open a healing-concern thread, the screen tells you that what you send goes to that artist before you send it.
You can withdraw consent at any time by emailing privacy@mementomods.app. Withdrawing stops any further collection and sharing, but it cannot recall information an artist has already received.
How long we keep it
A signed intake and consent form stays with its appointment, and only that artist can see it, so the artist can meet their record-keeping obligations. It cannot be edited once it is signed. If you delete your account, the form is kept with restricted access rather than deleted.
If you delete your account, we erase your healing-concern threads: your checklist answers, every message in the thread, including the artist’s replies, and the photos. The artist keeps only a record that a thread existed, with no content and no longer linked to your name.
You can ask us to delete a specific form or thread at any time (see below).
Your rights
You have the right to:
• confirm whether we collect, share or sell your health information (we never sell it);
• get a copy of it, together with a list of every third party we have shared it with and how to contact them;
• withdraw your consent; and
• have it deleted, including from our backups. If a law requires us or the artist to keep a particular record, we will tell you what we kept and why.
To use these rights, email privacy@mementomods.app from the address on your account. We may ask you to confirm your identity first. We respond within 45 days and will tell you if we need up to 45 more.
If we decline your request, you can appeal by replying with “Appeal” in the subject line, and we will answer within 45 days. If you are still unhappy, you can contact your state attorney general; Washington residents can file a complaint with the Washington State Attorney General’s office. We will not treat you differently for exercising your rights.
Contact
Xenith Studios, 1201 Princeton Ave, Bakersfield, CA 93305-1121, or privacy@mementomods.app.