Washington law gives you the right to know every category of third party we share health data with, and to request a list of the specific third parties. Here are the categories. Section 8.2 explains how to get the specific list.
| Category of third party | What they receive | Why | Their limits |
|---|
| Email and marketing platform | Your contact details and which Commune programs you have enrolled in. Not Coach conversations, Coach Memory, journal entries, or check-in responses | To send you Commune's own emails, including which programs we tell you about | Service provider contract. May not sell or share it, may not use it for their own purposes, may not disclose it to any advertising platform |
| AI model providers | Your Coach conversation content and Coach Memory | To generate Coach responses | Service provider contract. May not train their models on it, may not use it for their own purposes, may not sell it. See 5.2. |
| Cloud hosting and database providers | Health data at rest, encrypted | To store and run the Services | Service provider contract; no independent use |
| Customer support platform | Only health information you include in a support message | To answer your question | Service provider contract; access limited to support staff |
| Content moderation providers | Community Content you post publicly | To keep community spaces safe | Service provider contract |
| Security and monitoring providers | Access and system logs that may reference health-data records | To detect intrusions and abuse | Service provider contract |
| Professional advisors (legal, audit) | Only as strictly needed | Legal compliance | Duty of confidentiality |
| Law enforcement or regulators | Only when compelled by valid legal process, or to prevent imminent harm | Legal obligation, safety | We review every demand and notify you where legally permitted |
Not on this list, deliberately: advertising networks, data brokers, analytics providers, course teachers, employers, insurers, commercial or affiliate partners, and other members. Course teachers receive enrollment information only. They never see your Coach conversations, Coach Memory, journal entries, or health data.
No advertising or analytics tags run inside Commune Coach.
Everyone who touches it is under contract
Every third party listed above processes health data as our processor or service provider under a written contract that: limits them to the purposes we specify, prohibits them from selling or sharing it, prohibits their own independent use of it, requires appropriate security, requires them to bind their own subcontractors to the same terms, and requires deletion or return when the relationship ends.
AI providers do not train on your health data
Our AI model providers are contractually prohibited from using your information to train, fine-tune, develop, or improve their own general-purpose or foundation models. They generate a response and send it back. That is all.
Some providers retain a short-term copy of inputs and outputs for their own abuse monitoring, typically about 30 days and in some configurations up to approximately 55 days, then delete it on their own schedule. Commune cannot delete those copies on demand. They are not used for training and Commune cannot access them for any other purpose.