Washington Consumer Health Data Privacy Policy

Scope

This Washington Consumer Health Data Privacy Policy supplements the FitPulse Privacy Policy and applies to consumer health data protected by the Washington My Health My Data Act. “Consumer health data” means personal information that is linked or reasonably linkable to a consumer and identifies or permits an inference about that consumer’s past, present or future physical or mental health status.

Consumer Health Data We Collect and Why

• Profile, goals and health constraints. Height, body weight, sex, date of birth, training and weight goals, experience, equipment, injuries and other constraints are used to personalise training, nutrition, recovery and safety guidance requested by the user.
• Training and activity. Workouts, exercises, sets, repetitions, load, effort, duration, distance, pace, steps, active energy, personal records, training schedules and programme adherence are used to keep the training log and compute progress, strength and training recommendations.
• Nutrition and hydration. Meals, foods, meal photographs, voice-log transcripts, search terms, scanned barcodes, calories, macronutrients, water, targets and corrections are used to maintain the nutrition diary and provide estimates and suggestions.
• Sleep, recovery and vital signs. Bedtime and wake windows, sleep duration, heart rate, resting heart rate, heart-rate variability, body weight and related samples are used to calculate recovery, readiness, activity and nutrition figures.
• Photographs and derived observations. Meal photographs and front and side progress photographs, together with non-medical physique observations and trends derived from them, are used only to provide the logging, progress and physique-review features requested by the user.
• Coaching and other inferences. Coach messages, coaching memories, habits, estimated one-repetition maximums, strength ratings, readiness and recovery scores, weight trends, calorie and macronutrient targets, meal estimates and similar inferences are used to provide the requested training, nutrition, recovery and coaching features.

Sources of Consumer Health Data

• The consumer. Information entered, photographed, recorded, selected or corrected in FitPulse, including information imported at the consumer’s direction.
• The consumer’s device and connected health service. Activity measurements computed during an activity and, only after operating-system permission, measurements read from Apple Health or Health Connect.
• FitPulse calculations. Scores, estimates, trends and recommendations derived from the consumer’s own entries and connected measurements.
• Service providers acting for FitPulse. Results returned for an artificial-intelligence feature after the consumer has consented to that processing, and subscription status used only to determine feature access.

How We Collect and Use Consumer Health Data

FitPulse collects consumer health data when the consumer chooses to enter or upload it, starts an activity, connects a health service, asks FitPulse to calculate a result, or requests an artificial-intelligence feature. FitPulse uses that data only to provide and secure the features requested by the consumer, maintain the consumer’s records, honour settings and consent choices, prevent abuse, comply with law, and support deletion or access requests. FitPulse does not collect or use an additional category of consumer health data, or use existing consumer health data for a materially different purpose, without first updating this policy and obtaining affirmative consent where Washington law requires it.

Consumer Health Data We Share

• Private application data. Account-linked training, nutrition, sleep, recovery, profile, coaching and photograph data is processed by database and private-file-storage providers in the United States solely to operate FitPulse.
• Artificial-intelligence requests. After the consumer gives explicit consent, the minimum meal photograph and correction instruction, voice transcript, progress photographs, profile photograph for screening, coach message, relevant account summary, or recap information needed for the requested feature is processed by OpenAI as described in the general Privacy Policy. Consent can be withdrawn under Settings → AI data sharing.
• Notifications. When notifications are enabled, the device push token and notification text are processed by a push-delivery provider. Notification previews may contain fitness or habit information selected for that notification.
• Food lookups. Typed food-search text and scanned barcodes are sent directly from the device to Open Food Facts to return food matches. FitPulse does not attach a FitPulse account identifier, although that independent service necessarily receives ordinary network information such as the request IP address.
• Other users at the consumer’s direction. Group members may receive workouts, exercise details, personal records and group messages. Photographs published to a group or profile through earlier versions may remain visible to their prior audience until removed. New profile photographs are screened by OpenAI with consent before publication. Approved profile photographs are visible to other users and accessible to anyone with their public image link. New uploaded group-logo and group-chat image publication remain disabled. Accepted friends may receive the profile and strength information described in the general Privacy Policy. These disclosures are controlled through group membership, group sharing and account privacy controls.
• Legal and safety recipients. Consumer health data may be disclosed where required by law or where necessary to protect a person’s rights or safety or the integrity of FitPulse.

Categories of Recipients

The categories of recipients are database and file-storage processors, OpenAI, a push-notification delivery processor, Open Food Facts as an independent food-database service, other users when the consumer uses community features, and legal or safety recipients where disclosure is required or necessary. FitPulse has no affiliates with which it shares consumer health data. FitPulse requires processors acting on its behalf to process consumer health data only under instructions consistent with this policy and to protect it appropriately.

No Sale of Consumer Health Data

FitPulse does not sell consumer health data and does not use it for advertising, cross-context behavioural advertising, data brokerage or marketing profiling. FitPulse does not use a geofence around a health-care facility to identify or track a person, collect consumer health data, or send health-related messages.

Washington Consumer Rights

A Washington consumer may ask whether FitPulse is collecting, sharing or selling consumer health data concerning that consumer; access that data; receive a list of third parties and affiliates with which it has been shared or sold and an available way to contact them; withdraw consent from future collection or sharing; and request deletion of consumer health data. FitPulse does not discriminate against a consumer for exercising these rights. Requests are provided free of charge up to twice each year, subject to the exceptions allowed by Washington law.

How to Exercise Rights or Appeal a Decision

A signed-in consumer may delete individual entries and photographs in FitPulse or delete the account under Settings → Delete account. A consumer may also send an access, withdrawal or deletion request to [email protected] with the subject “Washington health data request.” FitPulse may request information reasonably necessary to authenticate the request and will not require a person without an account to create one. FitPulse responds without undue delay and within 45 days, subject to the single 45-day extension permitted by Washington law. A consumer may appeal a refusal by emailing the same address with the subject “Washington health data appeal.” FitPulse will answer the appeal in writing within 45 days and, if the appeal is denied, provide a way to submit a complaint to the Washington Attorney General.

Deletion

When a verified deletion request is granted, FitPulse deletes the covered consumer health data from its active systems and directs relevant processors and other recipients to honour the request where required by law. Deletion from archived or backup systems may be delayed only as permitted by Washington law and will be completed within six months of authentication of the request. Information may be retained only where an exception under applicable law permits it.

Security

FitPulse restricts access to consumer health data to the people and processors that need it for the purposes described in this policy and maintains administrative, technical and organisational safeguards appropriate to the sensitivity of that data. No method of transmission or storage is completely secure, and absolute security cannot be guaranteed.

Changes and Contact

FitPulse is operated by Jackson Baker in the United States. FitPulse will update this policy before collecting, using or sharing an additional category of consumer health data or using consumer health data for a materially different purpose, and will request affirmative consent where required. Questions and requests may be sent to [email protected].