Consumer Health Data Privacy Policy

Last updated: October 6, 2026

This Consumer Health Data Privacy Policy supplements our general Privacy Policy and applies specifically to "consumer health data" as defined by Washington's My Health My Data Act (MHMDA), Nevada SB 370, the Connecticut Data Privacy Act, and similar U.S. state laws. We publish it as a separate, distinct policy because MHMDA requires one. Snap My Gym is a direct-to-consumer fitness app; we are not a HIPAA covered entity or business associate, and the data covered here is data you choose to give us — not data we receive from a healthcare provider on your behalf.

1. What consumer health data we collect

• Health documents you upload — medical records, lab / blood-work results, and visit notes, which can contain diagnoses, medications, vitals, and biomarker values.
• Health summaries we derive — the structured summary and trend metrics extracted from those documents.
• Biometric & wearable data — sleep, HRV, resting heart rate, recovery / readiness, strain, steps, active calories, and workout summaries from Apple Health or a wearable you connect.
• Body-composition data — measurements you enter or upload.

2. How and why we collect it

We collect consumer health data only when you actively provide it (upload a document, connect a wearable, or enter a measurement), and only to deliver the feature you asked for — turning a document into a structured summary, plotting trends, or generating a fitness insight. We do not collect it passively or from third-party data brokers.

3. How we use it

To extract structured summaries from documents you upload, compute health trends, and generate the fitness/educational insights you request. We do not use consumer health data for advertising, and we do not use it to train any AI model.

4. Who we share it with

We use processors to deliver these features. Their handling depends on applicable service terms, processing agreements and account configuration; we do not claim universal zero retention:

• Anthropic — uploaded health-document extraction after separate consent. Document extraction remains Anthropic-only. Other AI text features may retry through OpenAI if Anthropic fails, including the relevant fitness context supplied to those features. Provider retention depends on the applicable terms and settings.
• Google Cloud Storage and our hosting / database provider — encrypted storage of uploaded files and derived summaries.

We do not sell consumer health data, and we do not share it for cross-context behavioral advertising. We will not share it with any new category of third party without first obtaining your consent.

5. Consent

Before any health document is sent to an AI subprocessor, we display a dedicated warning and record your versioned, timestamped consent. This consent is separate from your general acceptance of our Privacy Policy and Terms. You may withdraw consent at any time by emailing us; withdrawal stops future processing (it does not affect processing already completed).

6. Your rights

• Right to access the consumer health data we hold about you.
• Right to delete it. We honor deletion requests and instruct our processors to delete it as well.
• Right to withdraw consent to collection and sharing at any time.
• Right to a list of the third parties and affiliates with whom we have shared your consumer health data.
• Right to non-discrimination for exercising any of these rights.

To exercise any right, email privacy@snapmygym.com. We respond within the timeframe the applicable law requires (generally 45 days, extendable once where permitted). You may appeal a denied request by replying to our decision; if we deny the appeal you may contact your state Attorney General.

7. How we protect it

Uploaded health summaries and the AI memory derived from them are envelope-encrypted at rest with AES-256-GCM; all traffic is served over TLS 1.2+. Access is limited to the operators and processors who need it. See the Privacy Policy for our breach-notification commitments (FTC Health Breach Notification Rule, state breach laws, and GDPR where applicable).

8. Retention

We retain consumer health data until deletion of the relevant record or account, subject to applicable legal requirements. Successful account deletion removes live application records. Cleanup failures can require a retry; see data requests. Backups and legally required records have separate retention requirements, and AI-provider retention depends on provider terms and configuration. We do not promise an unverified universal backup-erasure deadline or universal zero retention.

9. Children

Snap My Gym is for adults aged 18 and over worldwide. Do not upload a minor's health data. We do not offer parental consent as an alternative to this age requirement. Contact us if a minor has provided health data so we can restrict access and arrange deletion.

10. Contact

Questions or requests regarding consumer health data: privacy@snapmygym.com.