Privacy posture and regulatory scope

Operating profile

Everything in this section is fact about how the business runs, not analysis. Items marked confirm are ones we have not independently verified and are flagged again under facts to confirm.

The business

Practitioners and staff

The business positions itself publicly as wellness coaching. Internal editorial policy already distinguishes between general wellness-coach language for the app and marketing, and Jes's broader NTP scope for her own course and clinical content. Neither lane diagnoses, prescribes, or claims to treat disease.

Services and how money moves

All payment is direct from the client by card or buy-now-pay-later. No third-party payer is ever involved.

What the 1:1 program includes

This is the offering with the most clinical texture, and the one most likely to shape counsel's view:

• Five one-to-one video sessions over 90 days, plus daily messaging on weekdays.
• Facilitated laboratory testing. Clients choose a pathway among blood, DUTCH hormone, or stool testing, plus hair tissue mineral analysis. HMM arranges the testing and reviews results. The ordering mechanics and the contracting party with the lab are confirm.
• A recorded video review of lab results with a written protocol and dietary recommendations.
• A personalized nutrition protocol, plus food and mood analysis.
• Referral links to a practitioner supplement dispensary (Fullscript) and a supplement brand (Marea). Confirmed 2026-08-11: these are affiliate links only. The client shops with those companies directly and HMM transmits no client data to either. Note for counsel as an adjacent matter: affiliate compensation on recommended products raises an endorsement disclosure question under the FTC endorsement guides, which is separate from privacy and is not analyzed in this brief.
• Lifetime access to the PMDD Rehab course and the app.

What data is collected

Where data lives today

The change under consideration

HMM intends to retire Practice Better and build a client portal on its own infrastructure: Supabase for accounts and data, Cloudflare for hosting and video delivery. That portal would hold signed agreements, intake questionnaires, protocol documents, and recorded videos. This brief is being prepared because that decision should not be made before the regulatory position is settled.

HIPAA covered entity analysis

Our confidence: high, subject to one fact

The test

Under 45 CFR 160.103, a covered entity is a health plan, a health care clearinghouse, or a health care provider who transmits health information in electronic form in connection with a transaction covered by the HIPAA rules. The covered transactions are enumerated at 45 CFR Part 162 and are administrative and financial in nature: claims, eligibility inquiries, prior authorization, claim status, enrollment, premium payment, referral certification, remittance advice, and coordination of benefits.

The trigger is the electronic transaction, not the clinical service. A practice that provides health services but never transmits a covered transaction is not a covered entity.

Applying it

Her Mood Mentor accepts no insurance. It submits no claims, checks no eligibility, and receives no electronic remittance. Every dollar arrives directly from the client through Stripe or Kajabi. On those facts, no covered transaction is ever transmitted, and HMM is not a covered entity.

A nuance worth stating plainly so it does not surprise anyone: Jes may well satisfy HIPAA's separate and quite broad definition of health care provider, which reaches any person who furnishes, bills, or is paid for health care in the normal course of business. That definition alone does not create covered entity status. Provider status plus a covered transaction does. We believe the second element is absent.

The one adjacent fact, disclosed for completeness

One client has asked HMM for a paid receipt so that she could seek reimbursement from her own health savings account. We do not believe this affects the analysis, for two independent reasons. First, the client is the party submitting, not HMM, so HMM transmits nothing. Second, an HSA is a custodial account holding the client's own funds rather than a health plan adjudicating a claim, so reimbursement from it is not among the transactions enumerated at 45 CFR Part 162 in the first place. We raise it only so that counsel is not surprised by it later.

Superbills

HMM does not issue superbills. For the record, had it done so, our reading is that a superbill handed to a client who submits it herself leaves the client as the transmitting party and does not trigger coverage. Only HMM transmitting on a client's behalf would change the analysis.

Business associate status

Separately from covered entity status, an organization can be pulled into HIPAA as a business associate when it performs functions on behalf of a covered entity involving protected health information. The relevant relationship here is laboratory testing. Our reading is that HMM acts as a customer and ordering party rather than performing a service on the laboratory's behalf, which would not create business associate status. We flag it because the lab relationship is the only place HMM touches an entity that is itself likely covered, and because the contracting mechanics are not fully documented on our side.

Why this conclusion is not the end of the analysis

The newer consumer health privacy statutes generally exempt data that is already regulated as protected health information under HIPAA. A business outside HIPAA does not get that exemption. Concluding that HMM is not a covered entity therefore moves the exposure rather than eliminating it, and it moves it toward the regimes described in the next two sections.

Washington My Health My Data Act

Our confidence: high that it applies

Why we think it reaches HMM

The Act applies to any legal entity that either conducts business in Washington or provides products or services targeted to Washington consumers, and that determines the purpose and means of collecting, processing, sharing, or selling consumer health data. There is no revenue threshold and no minimum number of consumers. Practitioner commentary on the Act specifically identifies providers of fitness, wellness, and nutrition products as falling within scope.

HMM markets nationally to an audience of roughly 85,000 followers and 10,000 email subscribers, and sells to consumers in any state. It is not realistic to assume there are no Washington clients.

What counts as consumer health data

The definition is deliberately broad: personal information linked or reasonably linkable to a consumer that identifies the consumer's past, present, or future physical or mental health status, including individual health conditions, treatments, diseases or diagnoses, and any information used to associate a consumer with health status.

Symptom check-ins, cycle tracking, journal entries about mood, intake questionnaires, and lab results all sit comfortably inside that. So, arguably, does the mere fact that someone purchased a PMDD program.

Obligations we understand to attach

• A consumer health data privacy policy published as a separate and distinct link on the homepage, which may not contain any information beyond what the Act requires. A general privacy policy does not satisfy this.
• Consent before collecting consumer health data beyond what is necessary to provide a service the consumer requested.
• Separate and specific written authorization before any sale of consumer health data, where sale is defined broadly.
• Rights of access and deletion, including a duty to pass deletion requests to downstream recipients.
• A prohibition on geofencing around facilities providing health services.

Enforcement

A violation of the Act is a per se violation of the Washington Consumer Protection Act. That means enforcement by the Attorney General with civil penalties reported at up to $7,500 per violation, and, unusually among modern privacy statutes, a private right of action. The private right of action is the reason this deserves attention disproportionate to Washington's share of the client base.

What we propose to do about it

We have written the plan out rather than leaving it open. See the compliance plan for the prioritized version with statutory citations, and the draft consumer health data privacy policy for a complete first draft of the document the statute requires.

The headline from that work: HMM currently publishes no privacy policy at all, on either the main site or the Kajabi properties. That is the first thing to fix and it is not solely a Washington issue.

FTC exposure

Health Breach Notification Rule

Our confidence: high that it applies to the app

The FTC finalized amendments to the Health Breach Notification Rule in April 2024, published them in May 2024, and they took effect on July 29, 2024. The amendments were written specifically to reach direct-to-consumer health applications and connected devices that are not regulated by HIPAA. The HMM mobile app, which collects symptom, mood, and cycle data, appears to be exactly the class of product contemplated.

The change with the sharpest edge is to the definition of a breach of security. It now includes any unauthorized disclosure of identifiable health information, not only disclosure resulting from a cybersecurity intrusion. A voluntary disclosure that the consumer did not authorize can itself be a reportable breach. That converts a marketing tag misconfiguration into a notification event.

Section 5 and the tracker finding

Our confidence: this is the most likely real-world exposure

The FTC has pursued unfair and deceptive practices claims against consumer health companies for disclosing health data to advertising platforms through tracking pixels and software development kits. GoodRx settled for $1.5 million. BetterHelp settled for $7.8 million, and its order bans sharing health information for advertising, requires affirmative express consent before disclosure to certain third parties, requires directing third parties to delete data already shared, and imposes a retention schedule.

We checked HMM's own properties against this pattern:

What remains genuinely worth counsel's view is narrower and unrelated to advertising: the page title and URL themselves disclose that the visitor is purchasing PMDD care, and that string is transmitted to Google Analytics as ordinary page data. Whether that constitutes sharing consumer health data under the Washington statute is a question we would rather ask than assume.

The mobile app, audited 2026-08-11

The app sends product analytics to PostHog, a third-party analytics provider, and it calls identify() with the user's account ID. The events are therefore tied to an identified person rather than an anonymous session. Among the events currently sent:

Free-text journal content does not appear to be transmitted, which matters and is to HMM's credit. But severity counts, period events, mood, and a crisis-screen event, all linked to an identified user, sit squarely inside the Washington definition of consumer health data: information linked to a consumer that identifies past, present, or future physical or mental health status.

PostHog is a processor under contract rather than an advertising platform, which is a materially better starting posture than the companies in the FTC enforcement actions. The analytics itself is also worth keeping: retention measurement is load-bearing for HMM's product decisions. The two goals are compatible, because the retention metrics do not require the health-bearing properties.

Our proposed remedy, pending advice: gate all symptom, mood, cycle, and crisis events behind an explicit opt-in; strip health-bearing properties from any event that remains ungated; and confirm PostHog's data processing terms and hosting region.

Practical consequence for the build

Whatever counsel concludes, the design rule we would adopt is that no advertising or third-party analytics tag should load on any page where a client enters health information or purchases care. That is cheap to enforce in a portal we control, and it is one more argument for moving off Kajabi.

Other state and international law

Montana, the home state

Our confidence: likely below threshold

The Montana Consumer Data Privacy Act took effect October 1, 2024, and was substantially amended by SB 297 effective October 1, 2025. The amendments lowered the applicability threshold to controlling or processing the personal data of at least 25,000 Montana consumers per year, raised penalties to $7,500 per violation with no overall cap, and removed the sixty-day cure period. The right to cure sunsets April 1, 2026.

Montana's entire population is roughly 1.1 million. HMM's national email list is about 10,000. It is very unlikely HMM processes the data of 25,000 Montana residents, so our read is that the Act does not currently apply despite Montana being home. Worth confirming because it is the state whose regulator is nearest.

California

Our confidence: moderate, needs counsel

California's Confidentiality of Medical Information Act was extended so that a business offering a personal health record or similar digital tool designed to maintain medical information is subject to it. A symptom and cycle tracking app arguably falls inside that description. CMIA matters more than a general privacy statute because of its damages provisions. California is also likely HMM's largest state market by client count.

The general state privacy regimes

Most comprehensive state privacy laws, including California, Colorado, Connecticut, Virginia, Texas, and Oregon, classify health data as sensitive and require opt-in consent to process it, along with privacy notices and consumer rights. Applicability thresholds vary and HMM may fall below several of them at current scale. Nevada and Connecticut have also enacted consumer health data provisions modeled in part on Washington's.

International clients

Our confidence: low, we lack the facts

HMM sells a distinct international package at $3,200 and hand-delivers that link to clients abroad. We do not know where those clients are located. If any are in the European Union or the United Kingdom, health data is special category data under Article 9 of the GDPR and requires an explicit lawful basis, along with transfer mechanisms for moving data to the United States. This could be nothing, or it could be a separate workstream. The client list will answer it.

Adjacent, and deliberately out of scope here

Scope of practice and state nutrition licensure are separate questions from privacy. We are not raising them in this brief, but counsel should know that an NTP delivering individualized nutrition guidance to clients in all fifty states touches state licensure regimes that vary considerably. If that is worth its own review, we would rather hear so now.

MHMDA compliance plan

Statutory citations are to RCW 19.373. Everything below is our proposed plan, not counsel's advice. The point of writing it is so counsel can correct a plan rather than build one.

We checked. hermoodmentor.com serves a 404 at /privacy, /privacy-policy, /terms, and every other conventional path, and the homepage contains no policy link. The Kajabi checkout page contains no policy link either. Whatever else follows, this is the gap to close first, and it reaches beyond Washington: most state privacy laws require a notice, and Apple will require a privacy policy URL when the app is submitted to the App Store.

Classification

HMM is a small business under RCW 19.373.010, which covers entities handling consumer health data of fewer than 100,000 consumers in a calendar year. HMM is far below that. The classification matters less than it sounds: small businesses carry materially the same obligations, and only the original compliance date differed. That date was June 30, 2024 and has passed.

Priority 0, close immediately

Priority 1, before the portal launches

Priority 2, ongoing practice

What this costs

Items 1, 2, 8, and 9 are documentation and configuration, achievable in days. Items 3, 4, 6, and 7 are engineering work that should be folded into the portal build rather than bolted on afterwards, which is the strongest practical argument for settling the regulatory position before that build starts. Item 5 is vendor paperwork.

Draft consumer health data privacy policy

Drafted against the five disclosure requirements at RCW 19.373.020 and the rights at RCW 19.373.040. Bracketed items need a decision or a fact from HMM.

Notes on the draft

• On naming versus categorising third parties. RCW 19.373.020 requires the categories of third parties and the specific affiliates. Only affiliates must be named. We have named the software vendors, because that list is short and stable enough to maintain and transparency costs nothing there, but we have kept laboratories at category level since the panel mix changes and a policy that names a lab HMM no longer uses is worse than one that does not. Counsel should tell us if the stricter reading is warranted.
• Naming still matters internally. RCW 19.373.040 entitles a consumer to a list of every third party and affiliate her data was shared with, including contact details for each. HMM therefore needs an internal, current register of laboratories and vendors with contacts, ready to produce on request within 45 days. That register is an operational requirement, not a published one.
• The analytics question is deliberately absent. The draft says HMM does not share consumer health data with advertising platforms. That is true today. It becomes cleaner still once analytics is removed from health pages, which is item 2 of the plan. Publish the policy after that change, not before, so the statement is unambiguous.
• A general privacy policy is still needed separately, covering payment data, marketing email, website analytics, and everything that is not consumer health data.
• Decide on the street address before publishing. The address supplied appears to be residential. Publishing it puts a home address on a public page belonging to a business that serves people in acute mental health distress, some of whom reach a crisis screen inside the product. The statute wants a working contact method, and the email satisfies that. A registered agent address, a PO box, or a commercial mail address would serve the same purpose without the exposure. This is a judgment call for HMM, but it should be a deliberate one rather than a default.

Questions for counsel

Written so that most can be answered yes, no, or yes-with-a-caveat. If our reading is right, this should be a short engagement.

Facts to confirm internally

These are ours to answer, not counsel's. Several of them change the analysis, so they should be settled before the brief goes out.

• Has HMM ever transmitted a HIPAA standard transaction electronically? Answered 2026-08-11: no. Never billed insurance, never inquired with any insurer or payer, directly or through any intermediary. One client requested a paid receipt to submit to her own HSA, which does not disturb the analysis.
• Does HMM issue superbills? Answered 2026-08-11: no.
• Entity structure. Answered 2026-08-11: Her Mood Mentor LLC, 25157 US Highway 93 S, Rollins, MT 59931. State of formation still to confirm.
• Decide whether to publish the Rollins street address. It appears to be a residential address. See the note on the draft policy page before this goes live.
• Laboratory mechanics. Whose account are labs ordered under, who signs the requisition, what agreement exists with each lab, and what client data is transmitted to them.
• Supplement dispensary and brand partnership. Answered 2026-08-11: Fullscript and Marea are affiliate referral links only. No client data is transmitted to either.
• Are the GA4 properties on the Kajabi checkout page linked to Google Ads? Answered 2026-08-11: no. G-3E0XFP3CNB is HMM's property and its Google Ads links list is empty. G-GTBWYV09JY is not in HMM's Analytics account and is presumed to be Kajabi's own.
• What analytics the mobile app sends, what is in each event payload, and whether any of it is health data.
• Where international clients are located. Specifically whether any are in the European Union or United Kingdom.
• Is a privacy policy published? Checked 2026-08-11: no. Neither hermoodmentor.com nor the Kajabi properties publish a privacy policy, terms of service, or any policy link. Conventional paths return 404. What client agreement exists inside Practice Better is still to be established.
• Verify every factual claim in the draft policy, especially the third-party list, before it is published. See the bracketed items at draft CHD policy.
• Practice Better exit. What data comes out, in what format, and what the vendor retains after termination.