Consumer Health Data Privacy Policy

This policy applies to consumers in Washington State and Nevada, under Washington's My Health My Data Act and Nevada's SB 370. It describes consumer health data that [company name: to be added] collects through Complete Athlete. It adds to our general Privacy Policy.

1. Consumer health data we collect

• Injuries, health notes, supplements and allergens from questionnaires.
• Sex, birth year, height, weight, weigh-ins, body measurements, progress photos and your own metrics.
• Workouts, cardio and muscle recovery.
• Meal logs and meal photos, and diet preferences.
• Health-related services you search for or book, such as pregnancy or rehabilitation training, and your intake answers.
• Your approximate location, to the extent it reveals an attempt to get a health-related service.

2. Why we collect and use it

To provide the features you ask for: logging, training and nutrition plans, recovery estimates, AI meal reading and food swaps, booking, and sharing with businesses you choose. We also use it to keep the service secure and to meet legal duties.

3. Where it comes from

From you, from your device, from businesses you are a client of (such as notes and plans), and from assistants you connect.

4. What we share

We share consumer health data with:

• Businesses you are a client of, as you direct. Your recovery estimate is shared by default once you are a client, and you can turn it off. Other shares are off until you turn them on.
• Assistants you connect with an API key.

Service providers (processors) that handle it for us: Railway (hosting and storage), Anthropic (AI features), Stripe (payments, where a purchase reveals it), Resend (email), SMSAPI (text messages) and Sentry (error reports).

Third parties: the businesses you choose are listed to you in the app under Settings, Sharing. Affiliates: we have none that receive this data. We do not sell consumer health data.

5. Your rights

You can:

• confirm whether we collect, share or sell your consumer health data, and access it;
• get a list of the third parties and affiliates we shared it with;
• withdraw consent;
• have it deleted, including from our service providers and from third parties we shared it with.

You can withdraw consent in your settings, under Health data, and we then delete this data as our Privacy Policy describes. For anything else, write to legal@complete-athlete.co. We respond within 45 days. If we refuse, you can appeal by replying to our answer, and we will answer your appeal within 45 days. If your appeal is denied, you can complain to the Washington State Attorney General or the Nevada Attorney General. We will not treat you differently for using these rights.