Email updates
Signup forms ask for an email address and sometimes an optional name. They record the update request, consent choice, time, and limited security information needed to protect the form.
The simple version
Your choices
Health privacy
Collect less. Explain why. Prove the choice.
Accounts and membership
The account system can hold identity, verification, session, membership, provider-standing, course, community, and entitlement state. Payment-card details are intended to stay with the payment provider, not this site.
Wellness and Signal.OS
The Signal Integrity Map and Signal.OS can involve wellness answers, derived results, profile context, and lab-like information. That deserves a separate, specific consent and retention boundary. Do not put personal health details in a public signup or community post.
Providers and community
Provider applications can include professional identity and standing information. Community use can include posts, votes, moderation, and course activity. Role, audience, access, removal, appeal, and retention must remain visible.
Anonymous site analytics
Anonymous site analytics run on thewayin.me unless you decline. A notice appears when you first arrive; if you decline there, or if your browser sends Do Not Track or Global Privacy Control, collection stops and stays stopped. You can change your mind at any time from Privacy choices in the footer.
AI-assisted features
Some Signal.OS features send specific content you provide, such as a question you ask or a document a coach is working with, to an outside AI processor to generate a response. That processor is contractually required not to retain the content or use it to train its models. It does not receive your name, email, or account identity along with that content. Nothing else on this site sends data to an AI processor.
What each lane is for
| Lane | Why it exists | How it works |
|---|---|---|
| Email request | Send the doctrine, reading updates, or private-prelaunch news the person asked for. | Your request and consent choice are recorded, and the form tells you whether it was received. We send one email asking you to confirm your request, and it includes a working unsubscribe link, unless this address already has confirmed status. Regular update emails have not started yet. |
| Anonymous site analytics | Measure page use and browser performance so the site can be improved. | On unless you decline. Analytics may send page paths without query strings, referrer origin and path, a short-lived random identifier, device class, screen size, browser language, time, performance measurements, and allowlisted event labels to the SNRG-operated command service. Form values, account identity, email, wellness answers, and free-form text are excluded. |
| Account and security | Sign in, verify control of an email, manage sessions, protect private areas, and respond to abuse. | Used to verify your email, keep private areas private, manage sessions, sign out devices, and respond to abuse. |
| Courses and commerce | Show access, record progress, fulfill purchases, handle refunds and disputes, and preserve provider economics. | Order, webhook, entitlement, reversal, and course-progress controls are still being completed and tested. |
| Signal.OS | Provide personalized research and education with source, uncertainty, safety, and next-actor context. | Signal.OS is live at signal.thewayin.me. A verified thewayin.me account holder can open it through a signed, session-bound handoff. Member features and personal data need a verified account; the public landing, walkthrough, and sample report read no personal data. |
| Community and providers | Support role-labeled discussion, moderation, professional standing, course authorship, enforcement, and appeal. | The forum is live at thewayin.me/forum, with boards, threads, posting, and voting. Real staffing, operating rules, and provider relationships are not yet proven live. |
| AI-assisted features | Generate a response to a specific question or document, such as the Signal.OS guide or a coach's document-reading tools. | The specific content involved is sent to an outside AI processor under a contract that bars retaining it or training on it. Your name, email, and account identity are not included in that request. This lane covers only features that explicitly say they use AI; nothing else on this site works this way. |
The controls this system must make real
Say yes clearly
Email updates require a separate checkbox. The form returns a receipt showing whether your request was recorded. An email address without that choice is not a marketing subscription.
Change your mind
The one-time email-updates confirmation email includes a working unsubscribe link, valid for 48 hours. Using it stops future marketing email to that address without deleting the security records needed to honor the choice. Account and security email, such as sign-in verification or a password reset, is not marketing and does not carry an unsubscribe link. Regular, recurring update emails have not started sending yet; when they do, the same unsubscribe path applies.
See, correct, export, or delete
Signed-in requests to see, correct, export, or delete your data return a status receipt, and an explanation of anything that must be retained. This is still being tested and is not yet claimed to work end to end.
Know who receives data
The final notice will name the current service categories, purposes, locations, contracts, and retention. Connecting a service behind the scenes is not the same as that notice being accurate yet, so we keep the two separate until it is.
Anonymous analytics, and how to decline
Analytics is on unless you decline it. Choosing no, using Do Not Track or Global Privacy Control, visiting from a preview or local address, or using a noncanonical hostname stops collection. Declining later works the same way: reopen Privacy choices in the footer and choose no. That removes the local analytics session identifier and blocks later sends from the page. Declining is honoured for as long as the choice is stored on this device.
HIPAA is not a slogan.
Whether HIPAA applies depends on the actual relationship among the platform, a provider, and the service being performed. A health app outside HIPAA may still face Federal Trade Commission privacy, security, and breach-notification duties. The final operating model needs qualified legal review of the exact data flows and provider relationships, not a badge placed on the site.
Sources we reviewed for this page: HHS covered entities and business associates, FTC Health Breach Notification Rule guidance, and FTC email opt-out guidance.