Consumer Health Data Privacy Policy

1. What this document is

This is Heala's consumer health data privacy policy. It is a separate document because Washington's My Health My Data Act requires one: consumer health data has to be described in its own policy, with its own link, and not as a paragraph inside a longer one. Nevada's consumer health data law asks for the same disclosures, and this document answers both.

It applies if you live in Washington or Nevada, or if you are in one of those states while you use Heala. If you live somewhere else, the Heala Privacy Policy is the document that sets out your rights — but everything described here is true of your information too, wherever you are.

Heala is operated by Heala Limited, company number 17430512, a company registered in England and Wales with its registered office at Apartment 1219 Nobel Way, Uhaus Vita Living East, Manchester, England, M1 7FY. Heala Limited decides what consumer health data is collected and why. Privacy contact: hello@heala.fit.

Consumer health data means information that identifies your past, present or future physical or mental health. In Heala that is most of what the app holds, so this document describes it in the words the app uses rather than in categories.

Heala is a fitness and general-wellness service, not medical care. You must be at least 18 years old to have an account.

2. The consumer health data we collect

Heala collects consumer health data for the features you choose to use. Nothing below arrives on its own.

• Body and measurements. Weight; height; body-fat estimates; waist, chest, hip, arm and leg measurements; body-scan photographs; estimated body shape and skin tone; generated 3D body-twin files; and your scan history.
• Heart, breath and temperature. Heart rate; resting heart rate; heart-rate variability; blood oxygen; respiratory rate; blood pressure where a cuff writes it into your phone's health store; body and skin temperature; and VO2 max.
• Sleep. Bedtime; wake time; how long you slept; sleep stages; and the sleep score Heala calculates from them.
• Training and movement. Workouts; exercises, sets, repetitions and weight; how hard a set felt; personal records; steps; active and resting energy; cardio sessions with their duration, distance, pace and heart-rate trace; and the GPS route of an outdoor session you record.
• Food and water. Meals and foods; calories; protein, carbohydrate and fat; up to 32 further nutrients — vitamins, minerals, fibre, sugars, sodium, cholesterol and caffeine among them — when they are imported from your phone's health store; water; food photographs; nutrition-label photographs; barcode scans; and the food searches you type.
• Medication and habits. Medication names, doses, schedules and reminders; whether you marked a dose taken; habits and habit check-offs.
• Cycle and reproductive information. Period dates; cycle length; flow; symptoms; basal body temperature; ovulation-test results; cervical mucus; whether you logged intercourse; birth-control method and pill adherence; pregnancy context and kick counts; notes; and the cycle day, phase, predicted period and fertile window Heala estimates from them.
• How you feel. Your morning check-in answers on soreness, stress, energy and mood, and the mood and energy you log against a cycle day.
• What Heala works out. Recovery, sleep, strain and readiness scores; training load and trends; calorie and macro targets; and the training programmes generated for you.
• What you send to the AI coach. The question you type or dictate, the health context sent with it, and the answer.

Some ordinary account information is collected alongside all of this because the arithmetic depends on it: your date of birth or age, and your sex or gender where you give it.

3. Where it comes from

• You. Everything you type, photograph, dictate or answer in the app.
• Your phone and your watch. Apple Health on iOS and Health Connect on Android, after you grant the operating system's own permission, and only for the data types you authorise. Your watch and other devices write into those stores; Heala reads what is there. Basal body temperature is a fertility indicator and is asked for only if you use the cycle feature, never as part of a general health permission.
• Other applications, through your phone's health store. When you import your food and water log, the entries come from whatever app wrote them — MyFitnessPal, Cronometer, Lifesum and the like — and the name of that application is imported with them.
• Services you connect. Oura, WHOOP, Fitbit and supported Google health services, once you authorise them. For a connected Fitbit account this is not only on demand: Heala's servers collect an hourly heart-rate summary whether or not the app is open, and keep it for 90 days. Disconnecting stops it.
• A Bluetooth heart-rate strap you pair. It is read directly over Bluetooth while a session runs and not afterwards.
• Heala itself. Every score, trend, prediction and target in the previous section is calculated by Heala from the rest.
• The website. If you fill in the questionnaire at heala.fit/start or ask for a free programme at heala.fit/program, the answers are recorded against a random session identifier before any account exists — including your sex, age, height, weight, target weight, activity level, training experience, goal and usual sleep — together with your browser's language, time zone and screen size, and the country, city, region, postal area, approximate coordinates and network provider Cloudflare reports for the visit.

4. Why we collect it

We collect consumer health data to do the things you opened the app for.

• To show you your own information: the dashboard, the history, the charts and the trends.
• To calculate what you asked Heala to calculate: recovery, sleep, strain and readiness scores, calorie and macro targets, cycle phase and predictions, and generated training programmes.
• To run the features you turn on: the workout logger, the food log, the cycle tracker, medication reminders, body scans, the lab-result reader and the AI coach.
• To keep your history in one place across your phone, your watch and a reinstall.
• To send the reminders and notifications you asked for.
• To keep the service working and honest: fixing faults, preventing fraud and abuse, enforcing usage limits, and keeping accounts secure.
• To answer you when you write to support.
• To meet a legal obligation, or to establish, exercise or defend a legal claim.

We do not use consumer health data to advertise to you, to build advertising audiences, or to train AI models.

5. What we share, and who with

Sharing means letting somebody outside Heala have it. The list below is the complete list as far as consumer health data is concerned, and each entry says what that company actually receives.

• Supabase — the database, authentication, file storage and server functions Heala runs on. It holds everything in section 2, because it is where your account lives.
• OpenAI — the AI features. It receives what a request needs: your question and the health context sent with it; a meal or nutrition-label photograph you scan; body photographs for supported analysis; the medication, habit and adherence records the assistant reads when you ask it about them; and, only where you turn on that specific switch, a cycle summary — the phase, the cycle day, days to your next period, whether a period is open, the predicted date, the fertile window and up to six recent symptoms. It also receives the foods you type in by hand: twice a day the ones waiting for review are sent in one batch — the name, the brand, the serving and the calories, protein, carbohydrate and fat — and scored for whether they belong in the shared food catalogue, with nothing identifying you attached. If you request a programme on heala.fit without an account, the goal, experience, equipment and available days you gave are sent too.
• Tripo / VAST AI Research — the body photographs you submit for a 3D body twin, to build it.
• Clad — numeric body parameters for measurement-based body generation. No photographs.
• Apple — Apple Health holds this data on your device before Heala reads it, and Heala writes the weight, meals and water you log back into it where you allow that, while the Apple Watch app saves a finished workout, its energy and its distance there; speech you dictate may be sent to Apple's speech service to be turned into text, because Heala does not restrict recognition to the device; notifications reach an Apple device through Apple's push service; App Store purchases are Apple's.
• Google — the same on Android: Health Connect on the device, where only your weight is written back; Google's speech service for dictation on the same terms; and Firebase Cloud Messaging for notifications. If you connect Fitbit or another Google health service, Google is also where that data comes from.
• Expo — delivers push notifications. The text of a notification passes through Expo's service on its way to Apple or Google, and for a direct message that text is the first 80 characters of what your friend wrote.
• Resend — delivers our email. Where an email carries health content it carries it to Resend as well: the free training programme emailed from heala.fit is exercises, sets and repetitions.
• Mapbox and Esri — draw the map tiles underneath a route, and receive the map area being requested, which is where you were. The map view those tiles sit on is Apple's on iOS and Google's on Android, and each draws its own base map for the same area.
• USDA FoodData Central, FatSecret and OpenFoodFacts — receive the food name or the barcode you search for, and nothing else about you.
• Cloudflare — serves heala.fit and carries what you type into it, including the questionnaire answers, on its way to us.
• Stripe, RevenueCat, Apple and Google Play — purchases and subscription state. They receive no health data. RevenueCat holds your account identifier, email address, display name, app language and how you signed up, alongside product, offer, receipt and entitlement information.
• Other Heala users, where you choose it. Joining a challenge publishes your progress on the metric that challenge is built on to every member of it, and those metrics include workouts, workout minutes, training volume, cardio sessions, distance, cardio minutes, cardio calories, pace, a lift's weight, protein, sleep hours, water, calorie-goal days, habit days, active days and weigh-ins. Publishing a program to the community library publishes its exercises, sets, repetitions and weights under your name to every signed-in Heala user. Sending a workout, a route card or a body-twin link to somebody sends what is on it. Turning on the friend map shows your latest position and recent trace to friends you have accepted.
• A court, a regulator or law enforcement, where a valid legal request or a legal obligation requires it.

Affiliates. Heala Limited has no parent company, no subsidiary and no affiliate. Nothing is shared inside a corporate group because there is no group. If that changes, this document will name the affiliate before anything is shared with it.

Every company above receives it to perform a service for Heala or because you asked for the feature that involves them. None of them is permitted to use your consumer health data for their own advertising.

6. What we never do with it

We do not sell consumer health data. Washington law allows a sale only under a signed authorisation on a prescribed form that you could later revoke. Heala does not sell it, has never sold it, and so has never asked anyone to sign one. If that ever changed it could only happen through that form and with your signature.

We do not give consumer health data to advertising partners. Heala uses the Meta Pixel and the TikTok Pixel on heala.fit, Meta's own toolkit inside the app where you allow advertising measurement, and Apple's attribution service to learn which advertisement an install came from. What they receive is fixed by a closed list: which page was viewed, and whether an install, first open, registration, onboarding completion, paywall view, trial start, subscription purchase, other purchase, renewal or cancellation happened, with only the product identifier and category, billing interval, store, platform, app version, currency and amount attached. None of section 2 is in any of them — no measurement, no meal, no workout, no route, no cycle entry, no medication, no body scan, no lab value, no assistant conversation. Allowing advertising measurement does not change that, and neither does opting in to marketing email.

We do not give consumer health data to data brokers.

We do not use it to train AI models.

We do not run a geofence. Heala places no virtual boundary around a hospital, clinic, pharmacy or any other place, and does not use your location to work out what care you might be seeking. The only location Heala records is the route of a session you start yourself and, if you switch the friend map on, the sampled points it shows to friends you have accepted.

7. Your permission, and taking it back

Washington law says consumer health data may be collected only for what is necessary to provide something you asked for, and that anything beyond that needs your consent, given separately. Heala asks per feature, not once for everything.

Some of those questions are ours. Each is its own screen with its own wording, never pre-ticked and never bundled with another permission: AI processing; body scans; the cycle tracker; sending a cycle summary to the AI coach, which is a different question from the tracker itself; and advertising measurement.

Two of them are the operating system's question rather than ours: connecting Apple Health or Health Connect, and recording a precise route during a session. Apple's rules do not allow a sheet of ours to stand between you and the system prompt, so the disclosure is static content on the screen beside the control — nothing to dismiss, no decline button of ours — and what we record is the answer you gave the operating system.

Each answer is stored with the date, the version of the wording you were shown, the app version and the region you answered in. If we change that wording materially, the question is asked again rather than an old yes being carried forward.

Profile → Account & Privacy → Privacy Choices holds the switches for advertising measurement, marketing email, AI processing, body scans, the cycle tracker and connected health. The cycle-summary switch is in the cycle tracker's own settings, next to the feature it governs. The two operating-system permissions are withdrawn where you granted them, in your device settings. Withdrawal is a switch in the same place as the grant, with no warning screen and no friction on the way out.

What each one does when you turn it off. AI processing and body scans stop the sending: the next request is refused before it leaves the phone. Advertising measurement stops the advertising toolkit and clears it. The cycle tracker closes that feature until you grant it again. Connected health records the withdrawal — to stop Heala reading from Apple Health or Health Connect you also revoke Heala's access inside those applications, which is where you granted it.

Withdrawal applies from the moment you make it. It does not undo processing that already happened lawfully, and it does not delete what was already collected — for that, use the deletion controls in the next section. Nothing you withdraw here removes core Heala functionality.

8. Your rights, and how to use them

You may confirm whether Heala collects, shares or sells your consumer health data, and access it. You may ask for the list of every third party and affiliate it has been shared with — section 5 is that list, and if you would like it confirmed for your own account, together with a way to contact each company on it, ask us. You may withdraw consent to collection or to sharing. And you may have your consumer health data deleted.

Everything is in the app, under Profile → Account & Privacy:

• Export My Data returns the records held against your account as a JSON file. Photographs, body scans, 3D files and attachments are not inside it: they come as download links that work for one hour, so save them when the export finishes.
• Reset Data erases a date range, and you can narrow it to sleep, nutrition, water, workouts, cardio, wearable data, body, habits, medications, cycle, social or app activity rather than deleting all of it.
• Delete account removes the account and the information held against it, including your profile and body photographs and your generated 3D files.
• Privacy Choices holds the consent switches described in section 7.

Or write to hello@heala.fit from the address on your account and tell us what you want. A request made in the app is already signed in; a request by email is answered to the address on the account, which is how we check it is you. We answer within 45 days, and tell you if we need a further 45 days and why. There is no charge, unless a request is manifestly excessive or repetitive, and we would tell you that before doing anything.

When you ask us to delete your consumer health data we also tell the companies in section 5 that you have asked for it, so that a copy held by a processor on our behalf goes with ours rather than outliving it. Washington law requires that notification and we treat it as part of the request rather than a separate favour.

Some things survive a deletion and you should know it. A report another person filed about content is theirs, not yours, and is not ours to delete on their behalf. And the payment records Apple, Google and Stripe hold under their own legal obligations are theirs to keep; they are not health data. The retention section of the Heala Privacy Policy says how long each remaining record is kept. If you want something specific confirmed as gone, ask us and we will check it.

Deleting inside Apple Health or Health Connect is done in those applications and does not require Heala. Deleting in Heala does not reach the entries Heala previously wrote into them.

9. Appeals and complaints

If we refuse a request, we will tell you why, and how to appeal, at the time we refuse it.

To appeal, reply to that answer, or write to hello@heala.fit with "Appeal" in the subject line. We will reconsider the decision and write to you with our reasons within 45 days.

If we refuse again, you can complain to your Attorney General: in Washington through the Attorney General's office at www.atg.wa.gov, and in Nevada at ag.nv.gov. Washington's My Health My Data Act is also enforceable by consumers under that state's Consumer Protection Act, and nothing in this document takes that away.

10. Changes, and how to reach us

We will update this document when features change, when a provider changes, or when the law changes. The version and date at the top change with it. Where a change needs new consent or additional notice, we will ask or tell you before the affected processing begins, not afterwards.

Questions, requests and appeals: hello@heala.fit

Heala Limited

Company number 17430512

Registered in England and Wales

Apartment 1219 Nobel Way, Uhaus Vita Living East, Manchester, England, M1 7FY

The Heala Privacy Policy and Terms of Service sit alongside this document, in the app under Profile → Account & Privacy and at heala.fit.