Consumer Health Data Privacy Policy
1. Why this policy exists
Some US state laws — including Washington's My Health My Data Act and Nevada's SB 370 — give consumers specific rights over "consumer health data." WARFORM is available worldwide, so we adopt this policy as a voluntary standard: we extend the protections these laws require to all users, everywhere, not only residents of those states. This policy supplements our main Privacy Policy; defined terms carry their meaning from that document.
2. Consumer health data we collect
| Category | Specific data |
|---|---|
| Body measurements | Height, weight, goal weight, logged body-part measurements |
| Exercise & training data | Workout logs (exercises, sets, reps, loads, duration), PRs, session history |
| Nutrition data | Food and meal logs, calories, macronutrients, water intake |
| Sleep & recovery | Sleep duration and quality; Health Connect data you explicitly grant (steps, heart rate, active calories, distance) |
| Health-derived inferences | BMI, calorie/macro targets, recovery readiness — computed from the above by deterministic server-side formulas |
| Progress photos | Body-progress photos you choose to upload (private bucket; signed URLs only) |
3. Sources
- You — everything you log or grant in the app.
- Google Health Connect — only the data types you explicitly grant; optional; revocable any time from Health Connect settings.
- Computation — targets, BMI and readiness are derived on our servers from your logged data by deterministic formulas. No machine-learning model and no external AI service touches your data.
4. Purposes of collection
- Providing the core service: logging, history, progress, streaks, campaigns.
- Computing your personal targets and honest, rule-based coaching directives.
- Syncing your history across your own devices and restoring it on reinstall.
- Safety and abuse prevention; debugging crashes you choose to report.
- Complying with law. We never sell consumer health data and never use it for targeted advertising. There are no ads in WARFORM — the commitment, and the 30-day-notice process that would govern any change, live in the Advertising clause of our Privacy Policy.
5. Sharing
We share consumer health data only with the processors named in our Privacy Policy, each under contract, each processing only what its function requires: Supabase (database, auth, storage), Google Health Connect (on-device, at your direction), Resend, Brevo, Maileroo and Plunk (transactional email delivery), Google Play Billing (Android payments) and Stripe (web checkout, hosted — DIRECT, entitlement status only, never health data). We may disclose data where required by law or to protect someone's life or safety.
6. Your rights
Subject to legal exceptions, you may:
- Confirm whether we collect your consumer health data and access it (Settings → Data Management export, CSV + JSON, free, always).
- Delete it: Settings → Danger Zone (step-up verified, 7-day cooling-off, then a server-side purge). See the deletion page for the exact mechanics.
- Withdraw consent to future collection by deleting your account; Health Connect grants can be revoked separately and instantly.
- Non-discrimination: exercising these rights never degrades your service.
7. How to exercise rights & response times
Email support@warform.app from your account address. We acknowledge within 5 business days and substantively respond within 45 calendar days (one 45-day extension possible for complex requests, with notice). Self-service export and deletion are instant or near-instant and require no email at all.
8. No sales, no ads, no dark patterns
We do not sell consumer health data. We do not run advertising, and we will not: the Advertising clause in our Privacy Policy states the commitment and the 30-day-notice process that governs any future change. We do not use consent banners that trick, fatigue screens that discourage, or any interface that makes exercising a right harder than not exercising it.