PrivaFit Consumer Health Data Privacy Policy

Last updated: 2026-06-29

This Consumer Health Data Privacy Policy applies to "consumer health data" as defined by the Washington My Health My Data Act (MHMDA) and comparable U.S. state laws (e.g. Nevada SB 370). It supplements, and is provided separately from, our general Privacy Policy. If you are a Washington resident (or a resident of another state with consumer-health-data protections), this policy describes your rights and how we handle your consumer health data.

1. Categories of consumer health data we collect

• Body metrics you enter: age, gender, height, weight, body-fat percentage, waist measurement, and weight goals.
• Activity data: step counts read from Health Connect (with your permission), and calories estimated on-device from steps.
• App-generated health data: AI-generated meal/exercise plans derived from your body metrics.

We do not collect heart rate, sleep, precise location, or biometric identifiers. We do not collect data through geofencing.

2. Sources of consumer health data

• Directly from you (profile entries, daily measurements, content reports).
• From your device's Health Connect, only after you grant the READ_STEPS permission.

3. Purpose of collection and use

To provide the app's core features: generating AI meal/exercise plans, showing your personal activity and progress reports, and — only if you link an organization account — calculating organization walking-event scores. We do not use consumer health data for advertising or marketing.

4. Categories of consumer health data we share

Most consumer health data stays on your device. We share the following only as needed to operate the app:

• Body metrics (excluding your name) — sent to AI providers to generate your plans.
• Step counts, points, date, and organization email — sent to our server only when you have linked an organization account and an organization walking event is active.

We do not sell consumer health data, and we do not share it with advertising networks or data brokers.

5. Categories of third parties and affiliates with whom we share consumer health data

• AI service providers (OpenAI, Google Gemini) — process body metrics to generate plans. We have no corporate affiliates.
• Google — Health Connect (on-device permission framework) and Google Play billing. Step/health data is not shared with Google AdMob.
• Cloud hosting provider — stores organization walking-event scores when applicable.

These providers act as our processors/service providers and are not permitted to use your consumer health data for their own purposes.

6. Your rights

Subject to applicable law, you have the right to:

• Confirm and access the consumer health data we hold about you.
• Obtain a list of the third parties and affiliates with whom we have shared your consumer health data.
• Withdraw consent to our collection and sharing of your consumer health data.
• Delete your consumer health data.

Most data is on your device: open Settings → Delete app data to erase it immediately, and revoke the Health Connect permission to stop step collection. To exercise any of the rights above with respect to server-held data, submit a request through our contact form and state "Consumer Health Data request." We verify and respond within 45 days (extendable once by an additional 45 days where permitted, with notice).

7. How to appeal

If we deny your request, you may appeal by replying to our decision or submitting a new contact form request marked "Appeal." If your appeal is denied, Washington residents may file a complaint with the Washington State Attorney General.

8. Consent

We collect and share consumer health data only as necessary to provide features you request, or with your consent. We do not sell consumer health data; any sale would require your separate written authorization, which we do not seek.

9. Contact

Questions about this policy or your consumer health data: contact form (PrivaFit, the developer listed on Google Play).