1. Scope
This policy explains how HEATCOACH (operated by [PLACEHOLDER: legal name], Greece) collects, uses, and shares consumer health data — and the rights you have over it. It supplements our Privacy Policy and is provided as a separate document as required by Washington’s My Health My Data Act and similar laws.
2. Health Data We Collect
- Body measurements: weight, height, and other measurements you or your coach record
- Biometric-adjacent details you provide: birthday, gender, activity level
- Progress photos you upload
- Workout history and exercise performance
- Nutrition plans, meal logs, and nutrition goals
- Habit tracking and check-in responses, including any health notes you share with your coach
Source: this data comes only from you (or your coach entering it as part of your coaching relationship). We do not buy health data, infer it from other sources, or collect it from third parties.
3. Why We Collect It
- To provide the coaching features you request: plans, tracking, progress review, coach–client collaboration
- To display your own history and progress back to you
- We do NOT use your health data for advertising, and we NEVER sell it
4. Consent
We collect and process health data only with your separate, explicit consent, requested the first time you add health details — never bundled into accepting the Terms of Service. Health data beyond what is necessary to provide the features you request is not collected. Sharing beyond what is described here would require your separate consent, and any “sale” of health data (which we do not do and do not plan to do) would require your signed authorization.
5. Who Can See or Process It
- Your connected coach (or clients, if you are a coach) — only the data shared within your coaching relationship
- Our service providers, bound by data processing agreements and acting only on our instructions: Supabase (storage/database), Vercel (hosting) — full current list at /subprocessors
- Analytics providers do NOT receive your health data: session recordings mask all text and input values, and we do not send health fields to analytics events
- Authorities, only if legally compelled
6. Your Rights
- Access your health data and get a copy
- Withdraw consent at any time: Settings → Privacy (stops new collection/processing)
- Delete your health data or your entire account (Settings → Danger Zone) — deletion is immediate, with residual encrypted backups expiring within our provider’s limited backup window
- No discrimination for exercising any of these rights
- Appeal: if we decline a request, reply to our decision email and we will review it; Washington residents may also contact the Washington Attorney General
To exercise any right, email [email protected]. We respond within the timelines required by your local law (at most one month).
7. Changes
Material changes to this policy will be notified by email or in-app at least 30 days in advance.