Consumer Health Data Privacy Policy
Effective September 29, 2026. For residents of Washington, Nevada, Connecticut and other states with consumer health data laws.
In short. Your health and fitness information is saved on your phone and backs up to your account, locked with your password before it leaves your phone. Varyvo can’t read it without your password. Body Scan photos stay on your phone and are never backed up. A Body Scan photo or a Coach question goes only to the service provider that produces your result, only after you agree and tap Send, and isn’t kept on our servers. We don’t sell consumer health data and we never share it with advertisers.
This policy supplements our Privacy Policy. It explains how Varyvo LLC (“Varyvo”, “we”) handles “consumer health data” as defined by Washington’s My Health My Data Act, Nevada’s SB 370 and similar laws: personal information that identifies your past, present or future physical or mental health.
Consumer health data we collect
| Category | Examples | Where it’s kept |
|---|---|---|
| Training and fitness information | Goal, experience, workouts, sets, weights, reps, records, how sessions felt | Your phone and your locked backup (encrypted; Varyvo can’t read it without your password) |
| Limits, pain and injury flags | Exercises you avoid, “Something hurts”, pain notes | Your phone and your locked backup (encrypted; Varyvo can’t read it without your password); goes to OpenAI only in a Coach question you choose to send |
| Body information | Birth date, height and weight you enter | Your phone and your locked backup (encrypted; Varyvo can’t read it without your password) |
| Body Scan photos and notes | The photo you choose to send; the coaching notes you get back | Photos stay on your phone, in the app’s private photo vault, and are never backed up; a photo is processed by OpenAI when you tap Send and isn’t stored on our servers. Notes: your phone and your locked backup (encrypted; Varyvo can’t read it without your password) |
| Varyvo Coach questions | Questions that mention your body, pain or health | Processed by OpenAI when you send them; Varyvo doesn’t store your questions or Coach’s answers, and OpenAI may keep them for up to 30 days for abuse monitoring |
| Daily count of answers about pain | How many answers you got that day to questions about pain, together with other answers that don’t use one of your Coach questions (up to 5 a day); never the questions or answers | Our service provider Supabase, with your account. Only the count for the latest day is kept, and it’s deleted with your account |
| Inferences | Focus areas and plan changes the app suggests | Your phone and your locked backup (encrypted; Varyvo can’t read it without your password) |
Where it comes from
Directly from you, from what you log in the app, from the photos and questions you choose to send, and from the results our service provider returns to you.
Why we collect and use it
Only to provide the features you ask for: building and adjusting your plan, logging and showing your progress, keeping your locked backup so your training comes back when you sign in, producing Body Scan notes and Coach answers, keeping you safe (for example, suggesting a swap when something hurt last time), and applying Free and Pro limits and the daily limit on answers to questions about pain. We ask for your consent in the app before collecting consumer health data that isn’t necessary for a feature you’ve requested, and each time before a Body Scan photo is sent.
Who we share it with
- OpenAI, L.L.C. (service provider): receives Body Scan photos and Coach questions you choose to send, only to produce your result. It may not use them for its own purposes or to train its models.
- Cloudflare, Inc. (service provider): carries requests between the app and OpenAI through our servers and hosts our infrastructure.
- Supabase, Inc. (service provider): runs our accounts and stores your locked backup, which is encrypted on your phone with a key locked by your password before it’s uploaded; Supabase can’t read it without your password. It also stores the daily count of answers to questions about pain.
We share consumer health data with anyone else only with your separate consent, or where the law requires it. We have no affiliates that receive consumer health data. We don’t sell consumer health data, and we don’t share it with advertising platforms. The hashed email addresses we use for ads, only if you allow it (see Advertising), never include workouts, photos, scan notes, pain flags, measurements or Coach questions. We don’t use geofences around health care locations.
Your rights
- Confirm whether we collect, share or sell your consumer health data, and see a copy of it.
- Get a list of every third party and affiliate we’ve shared it with, with their contact information.
- Withdraw your consent at any time.
- Delete your consumer health data. In the app, You › Account › Delete account deletes your account and your locked backup, and deleting the app erases what’s on your phone (see Delete your account). For anything we or our processors hold, we’ll delete it and tell our processors to delete it.
- Appeal our decision on your request.
To use these rights, follow the email instructions on Your Privacy Choices or email [email protected]. We’ll respond within 45 days (we may extend once by 45 days and tell you why). We won’t discriminate against you for using your rights. To appeal, reply to our response with “Appeal” in the subject; we’ll respond within 45 days. If we deny your appeal, you can contact the Washington State Attorney General at atg.wa.gov/file-complaint, or the attorney general of your state.
Contact
Varyvo LLC, New York. Email [email protected].