● LEGAL · DOC 03

Consumer Health Data Privacy

A standalone policy required by the Washington My Health My Data Act. Separate from our general Privacy Policy, and it controls wherever the two describe the same practice.

EffectiveSep 20, 2026 Versionv 1.0 Applies toWashington residents We extend it toEveryone
SECTION 01 — WHAT

What consumer health data we collect.

  • BodyWeight, body-fat estimate, waist / chest / arm / hip measurements, and anything else you choose to log.
  • PhotosProgress photos, the optional onboarding body scan, and each weekly in-app scan.
  • BloodworkLab panels you upload as PDF or enter by hand, and the marker values parsed from them.
  • NutritionMeals logged by text or photo, the calories and macros derived from them, and supplement intake.
  • ExerciseWorkouts, sets, reps, weights and perceived exertion.
  • WearablesResting heart rate, HRV, sleep, active energy and VO₂ max, from providers you connect.
  • InferencesTrend lines and target macronutrient ranges derived from the above.
SECTION 02 — SOURCES

Where it comes from.

Directly from you. From your device with your permission, via Apple HealthKit. And from wearable providers you explicitly connect and authorise.

SECTION 03 — CONSENT

Why we collect it, and the consent we rely on.

Solely to provide the service you asked for: to render your dashboards and trends, compute nutrition targets, generate AI coaching and bloodwork explanations, and show progress over time.

The measurements, meals, supplements and workouts you enter are collected because they are necessary to provide the service you asked for — you enter them so the app can track them, and we use them for nothing else. Progress photos, body scans and bloodwork are optional features that collect nothing unless you choose to use them. Sending data to our AI provider requires your explicit consent, which you can withdraw any time in Settings › Privacy.

● YOU CAN SAY NO

Declining does not degrade any other part of the app. You can withdraw consent at any time, and withdrawing is as easy as giving it.

SECTION 04 — SHARING

Who receives it.

We do not sell consumer health data, and we never have. Selling would require a signed authorization under RCW 19.373.030, and we do not seek one.

Under the Act, disclosure to a service provider processing on our behalf under contract is not "sharing". Every recipient below is such a processor, under a written data-processing agreement. Named specifically, as the Act requires:

  • SupabaseSupabase, Inc. (United States) — receives all categories above. This is where your data lives: database, authentication and file storage.
  • OpenAIOpenAI OpCo, LLC (United States) — receives bloodwork text, meal descriptions and photos, body-scan photographs and coach messages, for AI coaching, meal parsing, bloodwork explanations and physique scoring.
  • AppleApple Inc. (United States) — brokers HealthKit data between your device and the app, on-device.
● WHO GETS NOTHING

PostHog (product analytics), AppsFlyer (advertising measurement) and RevenueCat (subscriptions) receive no consumer health data. We never use health data for advertising, and never disclose it to data brokers.

Wearable providers you connect — Whoop, Oura, Garmin, Wahoo, Fitbit, Strava — are sources we read from under permissions you grant, not recipients.

SECTION 05 — RETENTION

How long we keep it.

For the life of your account. Records you delete in the app are removed within 30 days. Deleting your account deletes your health data — including bloodwork PDFs and body-scan photographs — within 30 days.

SECTION 06 — RIGHTS

Your rights.

  • ConfirmWhether we collect, share or sell your consumer health data — and access it, including the list of third parties it has been shared with.
  • WithdrawYour consent to collection and sharing, at any time.
  • DeleteYour consumer health data.

In the app: Settings › Privacy › Delete Account removes everything. Individual entries, photos and scans can be deleted on their own.

By email: privacy@trans4m.fit, subject "Consumer Health Data Request". We respond within 45 days, extendable once by a further 45 where reasonably necessary — we'll tell you if we need it. We'll ask you to verify your identity first.

Deletion propagates. We delete from our own systems and direct every processor above to do the same. If any copy must be retained because the law requires it, we'll tell you.

If we refuse, reply to our response to appeal; we answer within 45 days. If we deny the appeal, you may complain to the Washington Attorney General.

SECTION 07 — GEOFENCING

We don't geofence. At all.

We do not, and will not, use geofencing around any health care facility. The app collects no location data whatsoever: location lookup is switched off in our analytics provider, and we declare no location data type in our App Store privacy manifest.

SECTION 08 — CONTACT

Reach a human.

privacy@trans4m.fit

Alwyn Ventures · C-11/254, 2nd Floor, Sector 3, Rohini, Delhi, India – 110085

See also our general Privacy Policy.