Consumer Health Data Privacy Policy

1. Scope

This policy describes how Wellness Project collects, uses, shares, and protects consumer health data as that term is defined under the Washington My Health My Data Act (RCW 19.373, “WMHMDA”), the Nevada Consumer Health Data Privacy Law (SB 370), and the Connecticut, Colorado, and other state laws that regulate consumer health data. It is a supplement to, and read together with, our general Privacy Policy.

If a term is used here without definition, it has the meaning given in WMHMDA RCW 19.373.010.

2. What “Consumer Health Data” Means Here

For the purposes of this policy, “consumer health data” includes any personal information you give us, or that we generate or infer, that identifies your past, present, or future physical or mental health status. In practice, that covers the following categories that the Service collects:

• Bodily functions, vital signs, and measurements: steps, distance, heart rate, resting heart rate, heart rate variability, respiratory rate, oxygen saturation, blood pressure, blood glucose, body temperature, sleep duration and stages, weight, body fat, height, basal metabolic rate.
• Physical activity and exercise: workouts, runs, sets and reps, exercise sessions, mindfulness sessions, recovery sessions.
• Diet and nutrition: meals, food items, macros, calories, supplements taken.
• Health conditions and care-seeking: injuries, injury severity history, lab markers and lab results you enter, free-text health notes and descriptions.
• Mental health and wellbeing: wellbeing ratings, mood entries.
• Reproductive health: menstrual cycle data (if enabled).
• Inferences and derived data: Fit Score, training-load metrics, recovery scores, trend lines, AI-generated insights and summaries built on the categories above.

3. Sources

We collect consumer health data from three sources, each under your explicit control:

• Directly from you, when you log workouts, meals, sleep, wellbeing, injuries, supplements, lab results, or other data inside the app.
• From wearables and health platforms you choose to connect, including Apple Health, Health Connect, Fitbit, Oura, Withings, and other supported sources we may make available. Each integration is off by default, requires your explicit consent in the app, with a clear disclosure of what we will read and why, and can be disconnected at any time from Settings > Devices & Integrations.
• As inferences and derived data we generate from the two sources above: Fit Score, training load, recovery, AI summaries, charts.

4. Purpose of Collection and Use

We collect and use consumer health data only for the following purposes, each of which is necessary to provide the Service you are using:

• To display your health and fitness data back to you inside the app.
• To generate insights, Fit Score, recovery and training summaries, charts, celebrations, and goal progress.
• To power AI features (including chat, summaries, and photo scanning) with the minimum subset of your logged data needed to give a useful response.
• To send service-related notifications you have enabled (for example, morning wellbeing prompts).
• To respond to your requests under this policy and to comply with applicable law.

5. Sharing of Consumer Health Data

We do not share consumer health data with any third party for that third party’s own purposes, including advertising, marketing, profiling, or analytics about you.

We do disclose consumer health data only to the following service providers (processors) who act on our behalf under written data-processing terms, and only to the extent necessary to operate the Service:

• Supabase. Database and authentication hosting.
• Vercel. Application hosting and edge delivery.
• Anthropic (Claude), OpenAI, and Google (Gemini). AI model providers, invoked only when you send an in-app chat message or use an AI-powered feature. Each is contractually prohibited from training on your data and receives only the minimum data needed to answer your message.
• Resend. Email delivery for service and (where you have opted in) promotional messages.
• Apple Push Notification service / Firebase Cloud Messaging. Push notification delivery to your device, when you have enabled notifications.

A third-party integration you connect (Apple Health, Fitbit, Oura, Health Connect) is governed by that third party’s own privacy practices for what happens on their side. The Service’s side is described above.

We may also share your consumer health data with other third parties in the following specific circumstances:

• Challenge Participants: If you join a social challenge, the health metrics relevant to that challenge are shared with other participants.
• External AI Services via MCP: If you choose to connect an external AI service (like your own ChatGPT or Claude account) via MCP, your data is processed by that third party under your own agreement with them.

Advertising platforms. No consumer health data in any category listed in Section 2 is ever disclosed to an advertising platform. If you arrive at our public website from an ad in ChatGPT and then sign up, we report back to OpenAI that its ad click led to a signup, as described in Section 14 of the Privacy Policy. That report identifies the ad click, not you: it contains no name, no email address, and nothing about your health. You can turn advertising measurement off at any time with the “Cookie settings” link in the page footer, and a Global Privacy Control browser signal turns it off automatically, which we always honor.

6. No Sale of Consumer Health Data

We do not sell consumer health data and we do not intend to. “Sale” here has the meaning given in WMHMDA RCW 19.373.010(20), meaning any exchange of consumer health data for monetary or other valuable consideration. If we ever change this practice, we will obtain your separate, affirmative, written authorization in the form WMHMDA requires before any sale occurs. Continued use of the Service is not, and will never be, treated as authorization to sell.

7. Your Rights

Regardless of where you live, you have the following rights with respect to the consumer health data we hold about you. There is no charge to exercise them:

• Right to confirm and access. Confirm whether we are collecting, sharing, or selling your consumer health data, and obtain a list of the third parties (if any) with whom we have shared it.
• Right to access in portable form. Use Export All My Data at the bottom of the Settings page to receive a complete copy of your data in a portable spreadsheet format.
• Right to delete. Use Delete Account at the bottom of the Settings page, submit a request at our public deletion-request form at wellnessproject.ai/delete-account (no sign-in required), or email us. We delete your records from our production systems within 30 days, and deleted data ages out of encrypted backups on a rolling schedule within a few months.
• Right to withdraw consent. Disconnect any wearable or AI integration at any time from Settings > Devices & Integrations. Withdrawal stops further collection or use going forward; data we have already collected can be exported or deleted separately under the rights above.
• Right to not be discriminated against for exercising any of the above rights. We will not deny you access to the Service, change the price you pay, or degrade your experience because you exercised a right under this policy.

8. How to Exercise Your Rights

The fastest path for most rights is in-app: Settings > Export All My Data, Settings > Delete Account, or the disconnect buttons on Settings > Devices & Integrations.

For any other request, including a formal access request, a request for the list of third parties, or a request you cannot complete in-app, email us at support@wellnessproject.ai. We will confirm receipt within 10 business days and respond substantively within 45 days. If we need an extension under the law, we will tell you why and when to expect our response.

We may take reasonable steps to verify your identity before responding to a request, in a way that does not require you to create an additional account.

9. Appeals

If we deny a request you have made under this policy, you may appeal by replying to our response email or sending a new email to support@wellnessproject.ai with the word “Appeal” in the subject. We will review and respond within 45 days. If your appeal is also denied, you may file a complaint with the Washington Attorney General at atg.wa.gov/file-complaint or with the attorney general of your state.

10. Security and Retention

We protect consumer health data with encryption in transit and at rest, strict per-user access controls at the database level, and audited privileged access. We retain consumer health data only as long as your account is active and we need it to provide the Service, subject to the limited backup and legal-retention exceptions described in Section 12 of the Privacy Policy.

11. Changes to This Policy

If we make a material change to this policy, especially one that introduces a new use, share, or sale of consumer health data, we will provide reasonable advance notice (by email to the address on file, by an in-app notice, or both) before the change takes effect. A change that introduces a new sharing or sale of consumer health data takes effect only on a prospective basis and does not apply to data we collected before the change, unless you separately and affirmatively consent.

Changelog.

• Version 1.1 (July 2026): added the “Advertising platforms” disclosure in Section 5, describing the ad-click signup report and how to turn advertising measurement off, and simplified wording throughout with no change to any practice.
• Version 1.0 (May 2026): initial publication.

12. Contact

Questions about this policy, or to exercise a right above, email support@wellnessproject.ai.