Consumer Health Data Privacy Policy

1. Scope

This policy describes how Wellness Project collects, uses, shares, and protects consumer health data as that term is defined under the Washington My Health My Data Act (RCW 19.373, “WMHMDA”), the Nevada Consumer Health Data Privacy Law (SB 370), and the Connecticut, Colorado, and other state laws that regulate consumer health data. It is a supplement to, and read together with, our general Privacy Policy.

If a term is used here without definition, it has the meaning given in WMHMDA RCW 19.373.010.

2. What “Consumer Health Data” Means Here

For the purposes of this policy, “consumer health data” includes personal information that identifies or is reasonably capable of being associated or linked with a consumer and identifies past, present, or future physical or mental health status. Depending on the current or future features, devices, services, and integrations you use, the Service may collect consumer health data within the following broad categories:

• Activity, exercise, mobility, fitness, and energy: steps, distance, workouts, exercise sessions, movement, training, recovery activity, cardio fitness, active or basal energy, performance information, and related activity or fitness data.
• Vitals, cardiovascular, rhythm, respiratory, metabolic, and other physiological measurements: heart rate, resting heart rate, heart rate variability, ECG and rhythm information, irregular-rhythm notifications, blood pressure, blood glucose, oxygen saturation, respiratory measurements, body or skin temperature, and other supported physiological or sensor-derived measurements.
• Body measurements, composition, profile characteristics, and health-related settings: weight, height, body fat or other body-composition information, body measurements, biological sex, age or date-of-birth-related information, measurement-unit preferences, locale or similar settings associated with health features, and related profile or measurement information.
• Sleep and recovery: sleep duration, timing, stages, quality, recovery information, readiness or recovery-related measurements, and related data.
• Diet, nutrition, hydration, alcohol, and supplements: foods, meals, nutrients, calories, macros, hydration, alcohol-related information, supplements, and related dietary or nutrition information.
• Health history, conditions, symptoms, injuries, care, medications, labs, and biomarkers: information you enter, upload, connect, or authorize regarding symptoms, injuries, health conditions, treatment or care, medications or supplements, lab results, biomarkers, notes, records, and related health information.
• Mental health and wellbeing: wellbeing, mood, stress, mindfulness, mental or emotional wellness information, and related data you choose to provide or authorize.
• Reproductive and sexual health: menstrual-cycle, reproductive-health, sexual-health, fertility-related, and other information you choose to provide or authorize where supported by the Service.
• Biometric, genetic, genomic, and other health-related identifiers or measurements: biometric, genetic, genomic, sensor, image, voice, or similar information where a supported feature collects or derives it and applicable law treats it as consumer health data.
• Health-related location, route, environmental, and contextual information: location, route, environmental, device, contextual, or related information where a supported feature collects it and applicable law treats it as consumer health data.
• Inferences and derived data: scores, metrics, trends, classifications, summaries, recommendations, predictions, reports, charts, visualizations, plans, analyses, AI-generated outputs, and other information or formats derived or inferred from consumer health data by us or our service providers.
• Health-related service, device, integration, and account activity: interactions with health features, connected-device or integration information, permissions, settings, service activity, and other activity to the extent applicable law treats it as consumer health data.
• Other supported health and wellness information: other information you choose to enter, upload, connect, generate, or authorize through current or future Service features, to the extent it falls within the categories above or otherwise qualifies as consumer health data under applicable law.

3. Sources

We collect consumer health data from the following sources:

• Directly from you, when you enter, upload, submit, photograph, record, or otherwise provide health, fitness, wellness, or related information through the Service.
• From wearables, devices, health platforms, and other integrations you choose to connect, including Apple Health, Health Connect, Fitbit, Oura, Withings, Google Health API, and other supported sources we may make available. Each integration is off by default, requires the applicable authorization or permission, and can be disconnected through the Service or relevant platform controls.
• As inferences and derived data we or our service providers generate from information described above, including scores, metrics, trends, classifications, summaries, recommendations, predictions, reports, charts, visualizations, plans, analyses, AI-generated outputs, and other derived or inferred information or formats we make available or generate at your request.
• From the Service and our service providers, including information generated through your use of health features, devices, integrations, AI features, and related Service functionality.

4. Purpose of Collection and Use

We collect and use consumer health data only for the following purposes:

• To provide, operate, personalize, maintain, and improve the health, fitness, nutrition, recovery, wellness, logging, analysis, and related features of the Service.
• To display, organize, sync, analyze, summarize, visualize, or otherwise present your health and fitness information back to you.
• To generate scores, insights, recommendations, predictions, plans, reports, charts, summaries, celebrations, goal progress, AI-generated outputs, and other current or future derived features or formats.
• To power AI features, including chat, summaries, image or photo analysis, recommendations, plans, and other AI-enabled functionality you request.
• To send service-related notifications or communications connected to health or wellness features you use or enable.
• To create and use aggregated or de-identified information for population-level statistical analysis, benchmarking, internal reporting, research, product and service improvement, reliability, and other internal analysis, where permitted by applicable law and platform rules.
• To respond to your requests under this policy, protect the Service and its users, and comply with applicable law.

We may use non-health personal, technical, service, or marketing data for analytics, attribution, advertising measurement, and marketing as described in our Privacy Policy, but we do not use consumer health data for advertising or marketing measurement.

Aggregated and de-identified information. When we treat information as de-identified, we take reasonable measures designed to ensure it cannot reasonably be associated or linked with an individual, publicly commit not to attempt to re-identify it except as permitted by law to test or maintain de-identification safeguards, and require recipients to comply with applicable restrictions when we disclose de-identified information.

5. Sharing of Consumer Health Data

We do not share consumer health data with any third party for that third party’s own purposes, including advertising, marketing, profiling, or analytics about you.

We disclose consumer health data to service providers and processors who act on our behalf under applicable terms, and only to the extent necessary to operate the Service or for another purpose described in this policy. Provider categories and examples may include:

• Supabase. Database and authentication hosting.
• Vercel. Application hosting, edge delivery, infrastructure, and AI gateway or routing services.
• AI model, routing, gateway, and infrastructure providers. We may use AI providers directly or through services such as Vercel AI Gateway. Providers may include Anthropic, OpenAI, Google, and other AI model or infrastructure providers we use from time to time. They receive consumer health data only as appropriate to provide an AI-powered feature you request, under applicable provider terms and restrictions.
• Resend. Email delivery for service and, where you have opted in, promotional messages.
• Apple Push Notification service / Firebase Cloud Messaging. Push notification delivery to your device, when you have enabled notifications.
• Other infrastructure, communications, security, storage, or operational service providers. Providers used as reasonably necessary to operate, secure, support, or improve the Service.

A third-party integration you connect, such as Apple Health, Fitbit, Oura, Health Connect, Google Health API, or another supported integration, is governed by that third party’s own privacy practices for what happens on their side. The Service’s side is described above.

We may also share your consumer health data with other third parties in the following specific circumstances:

• Challenge Participants: If you join a social challenge, the health metrics relevant to that challenge are shared with other participants.
• External AI Services via MCP or similar user-controlled connections: If you choose to connect an external AI service, your data is processed by that third party under your own agreement with it.
• Other parties you direct us to share with: where you request, authorize, or enable a feature that requires disclosure to another person or service.

Advertising and measurement. We may use service providers to measure our own marketing using non-health data. We do not provide them with consumer health data for advertising or marketing measurement.

6. No Sale of Consumer Health Data

We do not sell consumer health data and we do not intend to. “Sale” here has the meaning given in WMHMDA RCW 19.373.010(20), meaning any exchange of consumer health data for monetary or other valuable consideration. If we ever change this practice, we will obtain your separate, affirmative, written authorization in the form WMHMDA requires before any sale occurs. Continued use of the Service is not, and will never be, treated as authorization to sell.

7. Your Rights

Regardless of where you live, you have the following rights with respect to the consumer health data we hold about you. There is no charge to exercise them:

• Right to confirm and access. Confirm whether we are collecting, sharing, or selling your consumer health data, and obtain a list of the third parties, if any, with whom we have shared it.
• Right to access in portable form. Use Export All My Data at the bottom of the Settings page to receive a complete copy of your data in a portable spreadsheet format.
• Right to delete. Use Delete Account at the bottom of the Settings page, submit a request at our public deletion-request form at wellnessproject.ai/delete-account (no sign-in required), or email us. We delete your records from our production systems within 30 days, and deleted data ages out of encrypted backups on a rolling schedule within a few months.
• Right to withdraw consent. Disconnect any wearable or AI integration at any time from Settings > Devices & Integrations. Withdrawal stops further collection or use going forward; data we have already collected can be exported or deleted separately under the rights above.
• Right to not be discriminated against for exercising any of the above rights. We will not deny you access to the Service, change the price you pay, or degrade your experience because you exercised a right under this policy.

8. How to Exercise Your Rights

The fastest path for most rights is in-app: Settings > Export All My Data, Settings > Delete Account, or the disconnect buttons on Settings > Devices & Integrations.

For any other request, including a formal access request, a request for the list of third parties, or a request you cannot complete in-app, email us at support@wellnessproject.ai. We will confirm receipt within 10 business days and respond substantively within 45 days. If we need an extension under the law, we will tell you why and when to expect our response.

We may take reasonable steps to verify your identity before responding to a request, in a way that does not require you to create an additional account.

9. Appeals

If we deny a request you have made under this policy, you may appeal by replying to our response email or sending a new email to support@wellnessproject.ai with the word “Appeal” in the subject. We will review and respond within 45 days. If your appeal is also denied, you may file a complaint with the Washington Attorney General at atg.wa.gov/file-complaint or with the attorney general of your state.

10. Security and Retention

We protect consumer health data with encryption in transit and at rest, strict per-user access controls at the database level, and audited privileged access. We retain consumer health data only as long as your account is active and we need it to provide the Service, subject to the limited backup and legal-retention exceptions described in Section 10 of the Privacy Policy.

11. Changes to This Policy

We may update this Consumer Health Data Privacy Policy from time to time. Changes are effective when posted unless applicable law requires otherwise. Your continued use of the Service after an update is governed by the updated policy. Where applicable law requires disclosure, consent, or another affirmative choice before we collect, use, or share an additional category of consumer health data or use consumer health data for an additional purpose, we will comply with that requirement.

Changelog.

• Version 1.4 (August 2026): broadened consumer-health categories and derived-data formats, clarified that consumer health data is not used for marketing measurement, added aggregated and de-identified analysis, generalized AI-provider disclosures, and aligned policy updates with the general Privacy Policy.
• Version 1.3 (August 2026): broadened consumer-health categories to cover supported data types and future fields within those categories.
• Version 1.2 (August 2026): clarified analytics and marketing measurement.
• Version 1.1 (July 2026): added the “Advertising platforms” disclosure in Section 5, describing the ad-click signup report and how to turn advertising measurement off, and simplified wording throughout with no change to any practice.
• Version 1.0 (May 2026): initial publication.

12. Contact

Questions about this policy, or to exercise a right above, email support@wellnessproject.ai.