Consumer Health Data Policy

This policy supplements the Privacy Notice and applies to consumer health data processed by Good Decades. We publish it separately because health information deserves a direct answer, not a paragraph hidden in a general notice.

Our core rule

Good Decades uses health information to provide health features you request, not to sell products or advertising. We do not sell consumer health data. We do not use it for targeted advertising. We do not provide it to data brokers. We keep identifiable health records separated from commerce systems and do not use symptoms, conditions, reproductive-health information, measurements, or health notes to select affiliate products.

Health data we may collect

Depending on the features you choose, the app may collect:

• profile information such as age or birth date, sex at birth, gender identity, height, activity level, focus area, and exercise-clearance status;
• conditions, injuries, limitations, accommodations, medications if a future feature clearly requests them, and supplements;
• mood, energy, stress, soreness, symptoms, severity, duration, and notes;
• sleep timing, duration, quality, stages, and related summaries;
• activity, walking, workouts, exercises, sets, performance, recovery, and fitness assessments;
• body measurements and vital signs, including weight, body composition, heart rate, blood pressure, oxygen saturation, glucose, and cardio-fitness estimates when those features are available and used;
• meals, food entries, hydration, supplements, and nutrition goals or summaries;
• menstrual, menopause, pelvic, sexual, and men’s or women’s health information when you choose those features; and
• goals, habits, Check-In answers, annotations, reports, trends, and inferences generated to provide requested health features.

The presence of a category in this policy does not mean we collect it from everyone. We collect a category only when you enter it, enable the relevant feature, or authorize a connected source.

Sources

Health data can come from:

• you, through app forms, uploads, Check-Ins, goals, and settings;
• a device, app, or service you deliberately connect and authorize;
• calculations and inferences Good Decades generates from the information above to provide a result, trend, report, plan, or accommodation; and
• a person you expressly authorize through a future sharing feature.

The public website Check-In is different: its answers stay in your browser and are not collected by Good Decades unless a future save flow clearly asks and you choose to upload them.

Why we collect and use it

We use health data to provide the feature you requested: store and display records, calculate summaries, identify patterns, personalize educational content, suggest goals or habits, adapt an exercise or plan to an accommodation, prepare an export or report, sync an authorized source, and protect the integrity and security of the service.

We may use deidentified or aggregate statistics to measure reliability and improve the product only when they are not reasonably linkable to a person. Research use that involves identifiable or linkable health data requires the permission shown in the service and any additional consent required by law.

We will not collect a new category or use health data for a materially new purpose without first updating this policy and obtaining consent when required.

Sharing and recipients

We share health data only as necessary for a requested feature or another purpose permitted by law:

• Supabase, which provides authentication and data infrastructure;
• infrastructure and security providers acting for Good Decades under confidentiality and use restrictions;
• a connected provider when you direct a sync or revoke, manage, or use the connection;
• a person you direct us to share with, if a report-sharing feature is offered and you use it; and
• authorities or professional advisers when legally required or reasonably necessary to protect rights, safety, and the service.

Good Decades currently has no corporate affiliates with which it shares consumer health data. We do not share health data with retailers, affiliate networks, advertisers, or data brokers. A vendor that processes health data for us may use it only to provide the contracted service, not for its own advertising.

Consent and connected data

Where consent is required, the request identifies the categories, purpose, and recipient types before collection or sharing. Permission to collect is not permission to share for an unrelated purpose. Connected-service permissions are category-specific where the provider supports that control.

You may withdraw consent or disconnect a source at any time. Withdrawal stops future collection or sharing based on that consent. To delete information already collected, make a deletion request as well.

Your rights

You may ask whether we collect, use, or disclose health data about you and may request access, a copy, correction, or deletion. You may also ask for a list of third parties and affiliates that received your health data, withdraw consent, or appeal a refusal.

Use the signed-in app’s Privacy screen, visit Privacy Choices, or email [email protected]. You do not need to create a new account. We respond without undue delay and within the period required by applicable law. Where Washington’s My Health My Data Act applies, that is generally 45 days, subject to a permitted extension. Requests are free unless the law permits a charge for manifestly unfounded, excessive, or repetitive requests.

Deletion applies to active systems and recipients we control or can direct, subject to lawful exceptions. Backup deletion may take longer where permitted. We explain any refusal and how to appeal.

Security and health-data breaches

We apply safeguards appropriate to sensitive health data, including access controls, encryption in transit, limited administrative access, and logging. We maintain an incident-response process and will notify affected people and regulators when required. An unauthorized disclosure can be a breach even when no system was hacked.

Changes and contact

The date above shows the latest revision. Materially broader collection, sharing, or use will receive notice and consent where required before it begins. Questions, rights requests, or complaints: [email protected].