Consumer Health Data Privacy Policy

6.Your rights and how to exercise them

You may confirm whether we are collecting, sharing, or selling your consumer health data and access it, including a list of the third parties it has been shared with; withdraw consent; and have it deleted. Because almost all of it lives only on your device, you can access it in the app at any time, export it (Profile → Export Data), withdraw Assistant consent (Profile → Bodydex Assistant → Withdraw consent; Privacy Policy Section 11.7), revoke health-platform access in your device's Settings, and delete it (Profile → Delete All Data).

6.1 How to submit a request

For the limited server-side records, or to obtain the list of recipients, email Click to reveal email (or Click to reveal email) with "health data request" in the subject, and tell us which state you are a resident of and what you are asking for. We may ask you for additional information in order to authenticate the request — we will not ask you to create an account to make one, and if we cannot authenticate a request using commercially reasonable efforts we will tell you so rather than acting on it. Responding is free at least twice a year; we may charge a reasonable fee, or decline, only for a request that is manifestly unfounded, excessive or repetitive, and the burden of showing that is ours. We will not discriminate against you for exercising a right.

Initial deadlines. We respond without undue delay and in any case within 45 days of the request (Nevada: of authenticating it). We may extend that once by 45 further days where the complexity or number of your requests makes it reasonably necessary, and we will tell you of the extension and the reason for it inside the first 45 days. An authenticated Nevada deletion request is completed within 30 days, and we notify the processors and third parties named in Section 4 of deletion requests. If we decline to act on a request, we will tell you within the same 45 days, give our reasons, and explain how to appeal.

6.2 How to appeal, and what happens if we deny it

If we refuse to act on a request, you may appeal. Send your appeal to the same address — Click to reveal email (or Click to reveal email) — with "health data appeal" in the subject, within a reasonable period after you receive our decision. You do not need to fill in any form, use any other channel, or provide anything beyond what the original request needed: the appeal route is deliberately the same route as the request. We will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decision, within the period your law sets:

• Washington — within 45 days of receiving the appeal (RCW 19.373.040).
• Nevada — within 45 days of receiving the appeal (NRS 603A.520).
• Connecticut — within 60 days of receiving the appeal (Conn. Gen. Stat. § 42-518).

These are appeal deadlines. They are separate from, and run after, the 45-day deadline for the original request above.

If we deny your appeal, you may submit a complaint to your state Attorney General. We will repeat these routes in the denial itself, and they are:

• Washington — Office of the Attorney General complaint form: atg.wa.gov/file-complaint.
• Nevada — Office of the Attorney General complaint form: ag.nv.gov/Complaints/File_Complaint.
• Connecticut — Office of the Attorney General, data privacy complaints: portal.ct.gov/ag — Connecticut Data Privacy Act (general consumer complaints: portal.ct.gov/ag/complaint/consumer-complaints).

If you are in the EEA or the UK, the equivalent routes and deadlines are in Privacy Policy Section 11.6, and you may also complain to your own supervisory authority.

6.3 Which of these laws applies to you

Washington (My Health My Data Act) and Nevada (SB 370) apply to us by reference to the consumer health data we handle, not to our size, so we apply them in full. Connecticut reaches us on two independent routes, and we claim no exemption on either. Since July 1, 2026, the Connecticut Data Privacy Act applies to any person that "control[s] or process[es] consumers' sensitive data" — a trigger that carries no volume threshold and sits beside, not behind, the 35,000-consumer one (Conn. Gen. Stat. § 42-516(2), as amended by P.A. 25-113, § 6). The Act defines sensitive data to include consumer health data and data revealing a physical or mental health condition, diagnosis, disability or treatment (§ 42-515). Bodydex offers products and services to Connecticut residents through the app stores and processes exactly that data, so we treat the whole of §§ 42-515 to 42-525 as applying to us — not only the health-data parts — and none of the entity exemptions in § 42-517(a) covers us. Separately and additionally, § 42-526(a)(2) applies the consumer-health-data provisions notwithstanding § 42-516 to any person who conducts business in Connecticut or targets products or services to its residents. For consumer health data, what follows is the rights, the 45-day response deadline and the 60-day appeal deadline set out above. Because the general provisions apply to us too, Connecticut also gives you the right to correct inaccuracies in your personal data, to obtain a portable copy of it, and to opt out of targeted advertising, the sale of your personal data, and profiling in furtherance of automated decisions that produce a legal or similarly significant effect (Conn. Gen. Stat. § 42-518(a)). We do not sell personal data, we display no advertising in the app and do no targeted advertising, and we do not profile you in furtherance of such decisions — so on those three there is nothing to opt out of, and a list of third parties your data was sold to would be empty. Correction, portability and every other right are exercised by the same route as any request above; in the app, correction and export are also direct (Profile → Export Data, and editing the record itself).