Empire of Light

Empire of Light — Consumer Health Data Privacy Policy

Last updated: June 23, 2026

This Consumer Health Data Privacy Policy explains how Empire of Light — the operating name of Media Marketing Resource LLC, a California limited liability company — collects, uses, and shares consumer health data. It is required by Washington's My Health My Data Act (MHMDA) and similar laws (including Nevada SB 370 and Connecticut's health-data provisions), and it supplements our main Privacy Policy.

We provide this policy because the Empire of Light experience — the Know Yourself Quiz and our deeper assessment — may infer aspects of your mental or emotional state in order to teach you in the way you learn best. Information that reflects or infers your mental or emotional condition can qualify as "consumer health data" under these laws, so we hold it to the higher standard those laws require.


1. What we mean by "consumer health data"

Under MHMDA, "consumer health data" is personal information that identifies your past, present, or future physical or mental health status — including information that is derived or inferred about your mental or emotional state. For Empire of Light, this means:

  • your responses to the Know Yourself Quiz and any deeper assessment; and
  • the results, archetypes, "house" readings, and learning-style or emotional-orientation inferences we generate from those responses.

We treat all of this as consumer health data, whether or not it would qualify in every jurisdiction.


2. What we collect and why

We collect consumer health data only when you choose to provide it by taking an assessment, and only to provide the educational Service to you — specifically, to generate your reading and to personalize how we teach you. We do not collect it for any other purpose. We collect the minimum necessary to deliver the experience you asked for.

We do not use consumer health data for advertising, we do not sell it, and we do not use it to train third-party models.


3. Your consent

Before we collect consumer health data, we ask for your clear, separate, affirmative consent, given through an action you take on purpose (such as starting the assessment after reviewing this notice). Your consent to this kind of data is requested separately from any general acceptance of our Terms or Privacy Policy.

We will obtain a separate consent before we would ever share consumer health data with anyone for any purpose beyond the service providers strictly necessary to deliver the Service to you (see Section 5). You may withdraw your consent at any time by emailing email us; withdrawal stops future processing, though it does not undo processing already completed.

We will never collect or share your consumer health data on the basis of consent obtained through deceptive design or pre-checked boxes.


4. How we protect it

We restrict access to consumer health data to the people and systems that need it to provide the Service, and we protect it with encryption in transit and at rest and with administrative and technical safeguards appropriate to its sensitivity.


5. Who can access it

We share consumer health data only with the service providers that are strictly necessary to operate the Service, under contracts that bind them to protect it and to use it only on our instructions. The current categories are:

  • GoHighLevel — secure storage of your account and assessment data.
  • Google Cloud (Firestore / Cloud Run) — secure storage and serving of your learner record.
  • Google Cloud (Vertex AI) — generates your reading and your teacher's responses, and scores your assessment (model: Gemini 2.5 Flash). This runs inside our own Google Cloud project, in the United States, authenticated without a shared API key. Under Google Cloud's processor terms your content is not used to train Google's models, and it may not be retained or reused for their own purposes. We send no more than is needed.

Corrected 2026-08-15. An earlier version of this policy named "AI model providers (via OpenRouter)" here. That was inaccurate: a code-level trace confirmed OpenRouter is not in the path of any learner data — it generates our marketing imagery and website copy only. Naming the wrong processor is a defect we would rather correct loudly than quietly.

We do not sell consumer health data, and we do not share it for advertising or with data brokers. We will not provide it to law enforcement except as required by valid legal process, and we will tell you where we are legally permitted to do so.


6. Your rights

With respect to your consumer health data, you have the right to:

  • confirm whether we are collecting, sharing, or selling it (we do not sell or share it);
  • access it, including a list of who has received it;
  • export it — take a readable copy with you (see below; this goes beyond what the statute requires);
  • withdraw consent to its collection and sharing; and
  • delete it.

To exercise any of these rights, email email us. We will verify your request and respond within the timeframe the law requires (generally 45 days, extendable once where permitted). We will not charge you, deny you the Service, or otherwise penalize you for exercising these rights. If we deny a request, you may appeal by replying to our response.

We aim to beat the statutory clock, and we extend these rights to everyone. The 45-day timeline above is the legal floor. Under the Learner Covenant — which is binding on us — we commit to 30 days and aim for 48 hours, and we honor these rights for every learner regardless of where they live, not only those the statute covers. Where the two differ, the Covenant governs.

How it works today, plainly: for deletion, you can start the request yourself from your Personal Data & Rights page — we verify it with a single-use link to your registered address, and a person completes it. For everything else, email us from your registered address; we verify it is you; a person fulfils it. There is not yet a self-serve export button — and we will not claim one before it exists. Erasure is a real deletion, not a hidden flag.

Retention

We keep your consumer health data only while your account is active, or until you delete it — whichever comes first. There is no separate retention clock for this category: when you delete, it is erased, not deactivated and not merely de-identified. The only thing that may persist is anonymous, de-identified aggregate learning statistics that can no longer be traced to you. If your account becomes inactive, we apply the retention schedule in the Privacy Policy Section 6, and this category is erased at that point rather than retained for analysis.


7. No discrimination

We will not unlawfully discriminate against you for exercising any right under this policy, and we will not deny you goods or services, charge a different price, or provide a different level of quality because you exercised a right.


8. Geofencing

We do not use geofencing around any health-care facility, and we do not use location data to identify, track, or send messages to consumers based on proximity to any such facility.


9. How to reach us

For any question or request about your consumer health data:

  • Email: email us
  • Phone: (916) 675-9975
  • Mail: full mailing address available on written request.

10. Changes to this policy

If we make a material change to how we handle consumer health data, we will update this page, update the "Last updated" date, and — where the change is material — obtain your renewed consent before applying it to data we have already collected.


Empire of Light is a registered fictitious business name of Media Marketing Resource LLC, Citrus Heights, California. This document is provided for transparency and is not legal advice. Washington residents: this policy is provided under RCW 19.373.

Questions? Reach us at email us. Empire of Light is a registered fictitious business name of Media Marketing Resource LLC, Citrus Heights, California.