Consumer Health Data Privacy Policy

This Consumer Health Data Privacy Policy supplements our general Privacy Policy and provides additional information about how SynthVitals collects, uses, and protects your consumer health data, including information required by state health privacy laws such as Washington's My Health My Data Act.

1. What is Consumer Health Data?

Consumer health data includes personal information that identifies or is linked to a consumer and relates to:

• Past, present, or future physical or mental health status
• Provision of health care services
• Health conditions, diseases, or diagnoses
• Biometric data (heart rate, HRV, sleep patterns, activity metrics)
• Genetic data
• Lab results and biomarker values
• Data from wearable devices and health apps

2. Categories of Health Data We Collect

• Lab Results: Blood work, biomarker values, test dates, reference ranges
• Biometric Data: Heart rate, HRV, blood glucose, weight, body composition
• Activity Data: Steps, calories burned, exercise, active minutes
• Sleep Data: Duration, quality, stages, patterns
• Nutrition Data: Food logs, macros, calorie intake (from connected apps)
• Self-Reported Data: Symptoms, mood, check-ins, goals

3. Sources of Health Data

• Directly from you (uploads, manual entries, check-ins)
• Connected wearable devices (Fitbit, Garmin, Oura, Whoop, etc.)
• Connected health apps (Dexcom, Cronometer, Eight Sleep, etc.)
• AI analysis of uploaded documents

4. Purposes for Collecting Health Data

• To provide the SynthVitals service and display your health metrics
• To analyze trends and generate personalized insights
• To power AI-driven recommendations and the chat assistant
• To calculate wellness scores and track goals
• To improve our algorithms using anonymized, aggregated data

5. How We Share Health Data

We may share health data with:

• Service providers who help operate our platform (bound by confidentiality)
• Third-party services you explicitly connect (e.g., syncing back to Fitbit)
• As required by law or legal process
• In anonymized, aggregated form for research and improvement

6. Your Rights

You have the right to:

• Access: Request a copy of your consumer health data
• Deletion: Request deletion of your consumer health data
• Withdraw Consent: Withdraw your consent for collection and use of health data
• Know: Understand what health data we collect and how we use it
• Portability: Export your health data in a portable format

To exercise these rights, email privacy@synthvitals.com or use the settings in your account.

7. Washington Residents

Under Washington's My Health My Data Act, you have specific rights including:

• Right to know what health data is collected and shared
• Right to access your health data
• Right to delete your health data
• Right to withdraw consent
• Right to be free from discrimination for exercising your rights

We will respond to verified requests within 45 days.

8. Data Security

We protect your consumer health data using:

• Encryption in transit and at rest
• Access controls and authentication
• Regular security audits
• Employee training on health data handling

9. Data Retention

We retain your health data for as long as your account is active. Upon account deletion or consent withdrawal, we will delete your health data within 30 days, except as required for legal compliance.

10. Contact Us

For questions about this policy or to exercise your rights:

Last Updated: December 1, 2025