Legal

Consumer health data privacy policy

Effective and last updated 12 October 2026 (version 2026-10-12.2)

This policy covers consumer health data: information about your past, present or future physical or mental health that is linked, or could reasonably be linked, to you. That's how Washington's My Health My Data Act and Nevada's consumer health data law define it. Clickless, LLC is responsible for it. It sits alongside Clickless's privacy policy. This policy took effect on the date at the top of this page.

Clickless runs automated shopping assistants ("agents") for brands, creators and itself, on web chat, Instagram, Facebook Messenger, text message and WhatsApp. It also lets developers' own agents search its offers. Agents don't ask about your health. But you might mention a symptom, a condition, a medicine, a pregnancy or another health matter while asking for products, or be shown a health-regulated offer such as a telehealth consult. Clickless then collects consumer health data, and this policy covers it.

The consumer health data Clickless collects, and why

The words of your messages that mention a health matter, and the rest of the conversation they're in: to answer you and find products that match what you asked for.
A mark on the conversation saying it touched on health. Clickless's code sets it from your words (an inference), and it stays on the conversation: to keep the conversation private, as described below.
Which health-regulated offers you were shown and tapped, and any consult booked or order placed through them, as the brand or an affiliate network reports it: to record the commission on that sale.
The words of a health-related search, which Clickless keeps with each offer it showed, but only the words that also appear in the product's own title, description or category: to record what led to the offer. When the conversation, the product or the brand touches on health, or the words name a health matter Clickless's health check recognizes, Clickless's tools show them to no one: not the brand, the agent's owner or Clickless's own admins.

Each of these is tied to an identifier:

for web chat, a hash of a random id in your browser;
for Instagram, your Instagram-scoped id;
for Facebook Messenger, your Page-scoped id;
for texts and WhatsApp, a hash of your phone number or WhatsApp id;
for a developer's agent, a hash of the id the developer sends, if any.

Clickless also uses this data to look into a report about what an agent said in your conversation. It doesn't use it for advertising, doesn't sell it, and doesn't use it to train AI models.

How Clickless answers a health question

Clickless's code, not an AI model, checks your words against a list of words about health matters, and picks one of three fixed answers:

product options, under a note that the agent isn't a doctor and this isn't medical advice;
a suggestion to check with your doctor first, when you mention a condition or a medicine;
for an emergency or self-harm, where to get help, with no products.

The list can miss words, and Clickless adds to it when it does.

Later in that conversation, an AI model may write the agent's replies about products and everyday topics. Clickless's code checks every line it writes, and replaces with fixed words any line that names a condition, a medicine or a crisis, or says a product does something for a health matter. A health-regulated brand's own agent uses fixed words only.
To find matching products, the words of your request, with contact details removed, are sent to Anthropic, which ranks the products. For the rest of the conversation, none of its words go to Voyage AI, which Clickless's search uses for other requests. In later messages, Anthropic may also read your recent messages to tell what you're asking for, and write the agent's reply, which is checked as above.
On Instagram and Facebook Messenger, when a new message isn't clearly about shopping, its first 300 characters may go to Anthropic to decide whether the agent should answer or leave it to the account's owner. A message in which the health check finds a health word never does: it's left to the owner, and Clickless keeps none of its words.

Clickless in AI assistants

When you search Clickless from an AI assistant you added it to (such as Claude or ChatGPT), Clickless receives only the words your assistant sends for that search and which assistant sent them. If those words mention a health matter, Clickless uses them only to answer that one request: it doesn't store them, doesn't link them to you, doesn't send them to any AI model or other company, and never sends them to Meta or any other advertising or analytics tool. A search that describes an emergency or thoughts of self-harm gets crisis resources and no products; one that mentions a condition or a medicine gets products under a fixed note to check with a doctor first.

Where it comes from

From you: your messages in web chat, Instagram direct messages, Facebook Messenger, texts and WhatsApp. A comment on a brand's Facebook Page that mentions a health matter gets no public reply from its agent, and its words aren't kept.
From developers' agents, which send your shopping request through Clickless's Agent API or MCP server.
From brands and affiliate networks, which report orders and bookings made through health-regulated offers. When you tap through from a Clickless agent to a brand's store, the store can tell Clickless when an order is completed, using only the agent's link reference — never your name, email or payment details.
From Clickless itself, which marks a conversation as touching on health.

Clickless doesn't ask for health information, and there's no separate consent step. When you mention your health in a request, Clickless collects and uses that information only as needed to give you what you asked for: an answer and products that fit. Clickless won't collect or use your consumer health data for any other purpose, or share it beyond what this policy describes, without first asking for and getting your consent.

Who receives it

Clickless shares consumer health data with these categories of recipients, and no others. Its service providers process it on Clickless's behalf under their terms of service and, where Clickless has accepted them, their data processing terms.

Anthropic, a service provider that receives the words, for search, to tell what you're asking for and to write the agent's replies.
Supabase (database), Fly.io and Vercel (hosting), Inngest (background jobs, which receive messages only in encrypted form) and Twilio (texts), service providers that store or carry it. Twilio keeps records of texts, including their words, under its own retention settings; on request, Clickless can ask Twilio to delete your texts.
Google, the service provider for Clickless's email inbox, if you write to Clickless about health data.
Meta, which carries Instagram, Facebook Messenger and WhatsApp messages. On Instagram and Messenger, the account or Page you message sees the whole thread in its own inbox, as with any message.
The agent's owner (the brand or creator) and the teammates and managers they invite. They see the mark that the conversation touched on health, where it started and how it ended (the offers shown and any sale), never its words.
The brand whose health-regulated offer you buy or book. It receives what you give it on its own site, under its own policy. The order's record in Clickless shows it none of your search words.

Clickless has no affiliates that receive consumer health data, and it doesn't sell consumer health data.

Collection across other sites

No third party collects consumer health data about you over time and across websites through Clickless. Product pictures in a chat load from the brand's store or an affiliate network's image servers. Like any web image, those servers see your IP address and which picture loaded, but not your messages. Once you tap a link to a brand's site or an affiliate network, that site may set its own cookies and collect information under its own policy.

How long Clickless keeps it

Clickless deletes the words people wrote, and the agent's model-written replies, in a conversation that touched on health 30 days after they were sent. The mark that the conversation touched on health, its times, the agent's fixed lines, the offers it showed and any sale stay, with the conversation's identifier. You or the agent's owner can ask Clickless to delete a conversation sooner.

Records of sales and commissions are kept for at least seven years for tax and accounting. They include the search words that matched the product's own text, which can name a health matter. When Clickless can tell they touch on health, its tools show them to no one, as described above.

Your rights

You can ask Clickless:

to confirm whether it collects, shares or sells your consumer health data;
for a copy of it, with a list of every third party and affiliate it has shared it with and how to contact them;
to correct it;
to stop collecting it, or to withdraw any consent you gave;
to delete it. Clickless deletes it from its own systems and tells its service providers to delete it too, and it's gone from backups within six months.

Clickless won't treat you differently for using these rights. It can't delete messages from Instagram, Facebook Messenger, WhatsApp or the inbox of the account or Page you messaged; ask its owner or Meta.

How to use your rights

Email info@getclickless.ai and say it's about health data.

If you chatted with an agent, Clickless doesn't know who you are, so it asks for something that finds your conversation and shows it's yours. On Instagram, Messenger, texts or WhatsApp, it gives you a short code to send to the agent from the same account or number. On web chat, tell Clickless the agent, when you chatted and what you asked about. Clickless deletes a conversation it can match with reasonable confidence, but sends a copy only when it can be sure it's yours. If it can't match your request, it tells you why.
Someone you authorize can ask for you, with your signed permission. Clickless may still confirm with you directly.
Clickless confirms it received your request within 10 business days, and answers within 45 days of receiving it. If it needs longer, it tells you why, and takes at most 45 more days. Requests are free, up to twice in any 12 months.

Appeals

If Clickless turns down your request, fully or partly, reply to its answer and say you're appealing. Clickless will answer in writing within 45 days, explaining its decision. If it still says no, you can complain to the Washington Attorney General or the Nevada Attorney General, or to the attorney general where you live.

Who at Clickless can see it

In Clickless's tools nobody can open the words of a conversation that touched on health: not the agent's owner, their managers, or Clickless's own admins. The few staff who run Clickless's database can, and only when they need to, for example to answer your request. The privacy policy describes how Clickless protects information.

Changes

This policy took effect on the date at the top of this page. Clickless posts each new version here before it takes effect, and emails account holders about material changes. It won't use consumer health data it already holds for a new purpose without your consent.

Contact

Clickless, LLC, 4979 MT HWY 1, Hall, MT 59837. Email info@getclickless.ai.