DRAFT 1.0 (beta), written 10 October 2026. Not yet reviewed by a lawyer. Do not publish until approved.
Washington's My Health My Data Act (RCW 19.373) and Nevada's SB 370 (NRS 603A) expect this as a separate page, linked prominently from the website homepage, holding only what those laws require. Connecticut's rules are met by the main policy plus this page. [LEGAL REVIEW: confirm the homepage link wording, e.g. "Consumer Health Data Privacy Policy".]
Effective date: [PLACEHOLDER] · Version: 1.0 (beta)
This policy is from Mind and Physique Lifestyle Coaching (Dubai, UAE), which runs the MiPhy app. It applies to "consumer health data" about people in Washington, Nevada, Connecticut and other US states with similar laws. Our full Privacy Policy applies too.
1. Consumer health data we collect, and why
| Category | Examples | Why we collect it |
|---|---|---|
| Body measurements and stats | Height, weight, body-fat %, muscle mass, body measurements | To show your progress and set targets |
| Health conditions, symptoms and pain | Pain or discomfort areas, conditions you choose to tell us about, a "discomfort" flag on a set | To keep plans safe and show safety notices |
| Health-related tests | The date of your last blood test (not the results) | To suggest checking with a doctor where useful |
| Reproductive health | Menstrual-cycle status in weekly check-ins (optional) | To adjust training suggestions for that week |
| Food, diet and allergies | Meals, calories and nutrients, diet type, allergies | To track nutrition and avoid foods you can't eat |
| Fitness and activity | Workouts, sets, effort, steps, activity, water | To build and adjust plans and show progress |
| Wellbeing | Mood, sleep, energy, stress-related goals, mindfulness sessions | To suggest relaxation and adapt the day's plan |
| Images | Posture photos and exercise form videos (private, not analysed) | So you can compare your posture and form over time |
| Inferences | Personal bests, estimated targets, AI coaching suggestions | To give you feedback and suggestions |
| Messages | What you tell the AI coach, which may include health details | To answer you (only with AI help turned on) |
We use consumer health data only to provide the MiPhy features you ask for, keep them safe and secure, meet legal duties, and, during the beta, to let authorised MiPhy team members review individual accounts (view-only, every view recorded, never photos or videos) to check and improve the app and the AI. This review is covered by the health-information consent you give at sign-up. We do not use it for advertising.
2. Where it comes from
- You, when you answer setup questions, log, check in, take photos or chat.
- The app itself, which calculates things like personal bests and estimated targets from what you log.
- We do not get consumer health data from other companies, wearables or data brokers.
3. Consumer health data we share, and with whom
We share consumer health data only with service providers (processors) that store or process it for us under contract, and only with your consent:
| Who | What | Why |
|---|---|---|
| Supabase Inc. (database and storage, Mumbai, India) | All categories above | To store your account securely |
| [DECISION: AI provider name] (AI processing) | Only what an AI request needs: messages, profile summary, plan, recent logs; never photos or videos | To create AI replies and plans, only if you turn on AI help (separate consent) |
We have no affiliates. We do not sell consumer health data and do not share it with advertisers, data brokers, insurers or employers. We do not use geofencing around health-care facilities.
4. Your rights
You can:
- Confirm and access: ask whether we hold your consumer health data and get a copy, including a list of every third party and affiliate we shared it with and their contact details;
- Withdraw consent to collection or sharing at any time (Profile → Privacy, or by email);
- Delete it: in the app (Profile → Delete account) or by email. We also tell our processors to delete it, including from backups (backups are overwritten within the periods in our Privacy Policy, section A12).
How: email support@miphyfitness.com with "Health data request" in the subject, from your sign-in address. We may send a code to confirm it is you. We reply within 45 days (we may extend by another 45 days where needed, and will tell you why). Requests are free, up to twice a year.
Appeals: if we refuse your request, reply with "Appeal" in the subject. We decide within 45 days and explain our decision. If you are not satisfied, you can complain to the Washington State Attorney General (https://www.atg.wa.gov/file-complaint) or the Nevada Attorney General, or the Connecticut Attorney General, as applies.
5. Contact
Mind and Physique Lifestyle Coaching, [PLACEHOLDER: address], Dubai, UAE · support@miphyfitness.com