For solo founders & indie hackers · Updated 2026

WMHMDA for Solo Founders

Q: Is there a small-business or solo-founder exemption in WMHMDA?

No. Unlike many U.S. state privacy laws that exempt small businesses below a revenue or user-count threshold, WMHMDA has no small-business exemption. A solo founder with a health-adjacent app and a handful of users can be covered the same way a large company is.

Q: Can a solo founder realistically afford WMHMDA compliance?

A full custom legal engagement can run into the thousands of dollars. A generator that produces a first draft of the core required documents for under $100 is built specifically for this budget gap — with the understanding that a quick attorney review is still recommended before launch.

Q: What's the minimum a solo founder should do before launching?

At minimum: a compliant privacy policy disclosing health data collection, an opt-in consent mechanism before that data is collected, a documented process for consumer deletion and access requests, and a decision about whether any SDK or analytics tool you use could count as a 'sale' of data requiring separate authorization.

"I'm just one person building this" doesn't change what the statute requires

Most U.S. state privacy laws exempt small businesses under a revenue or user threshold. WMHMDA does not. If you're a solo founder shipping a health, fitness, sleep, or wellness app — even a side project with a few hundred users — you're covered on the same terms as a funded startup or a public company. That's a real risk for indie builders who assumed "I'm too small to matter" was a valid legal position. It isn't.

In short: There's no solo-founder or small-team exemption — revenue, funding, and team size don't matter. Watch for third-party SDKs that trigger obligations by default, and budget for a first draft now plus a light attorney review before launch. Generate your first draft below.

Read the full guide for solo founders

Where solo founders get caught off guard

No small-business carve-out — revenue, funding stage, and team size are irrelevant to WMHMDA's applicability test.
Third-party SDKs count as your obligation — bolting on a free analytics or crash-reporting SDK can trigger "sale" or "sharing" obligations even if you never look at the data yourself.
Generic privacy-policy generators don't cover this law — most free templates are built for CCPA/GDPR, not for WMHMDA's specific consent and data-category requirements.
Time-to-launch pressure — solo founders often ship first and plan to "add a privacy policy later," which is exactly backward under WMHMDA's opt-in-before-collection model.

Example: a one-person habit and mood-tracking app

A solo developer ships a habit tracker that also logs a daily mood score, distributed through the App Store with a Stripe subscription and a free-tier analytics SDK. Before the first real user signs up, this founder needs: a privacy policy naming mood data as a collected health category; an in-app consent step before that data is first recorded; a review of whether the analytics SDK's default configuration counts as "sharing" consumer health data with a third party (many do, by default); and a simple way for a user to request their data be deleted. None of this requires a law firm retainer to get a solid first draft in place.

A realistic, budget-aware compliance path

Step 1: run the free scope check to confirm WMHMDA applies to your specific product. Step 2: generate a first-draft privacy policy, consent form, and rights-request process. Step 3: have a lawyer do a lightweight review pass before or shortly after launch — many will do a fixed-fee review of an already-drafted set of documents for far less than drafting from scratch.

Built for founders without a legal budget

The WMHMDA Compliance Pack generates a privacy policy, consent form, sale authorization, retention schedule, and rights form — a real first draft, not a generic template. Read everything free before you pay — $99.99 one-time.

Generate My Compliance Pack — $99.99

Legal limitations

This tool produces draft documents based on the answers you provide — it is not a substitute for legal advice and does not account for every possible fact pattern. Solo founders in particular should budget for at least a brief attorney review before launch, especially if the product touches reproductive, mental health, or other sensitive data categories.

FAQ

Is there a small-business or solo-founder exemption in WMHMDA?

No — there is no small-business exemption; applicability depends on the data collected, not company size.

Can a solo founder realistically afford WMHMDA compliance?

A generator that drafts the core documents for under $100 is built for exactly this gap, alongside a recommended quick attorney review.

What's the minimum a solo founder should do before launching?

A compliant privacy policy, opt-in consent before collection, a documented deletion/access process, and a review of any third-party SDKs.

Does wmhmda or mhmda apply to a side-project app with only a few hundred users?

Yes — user count and revenue are not part of the applicability test.