Consumer Health Data Privacy Policy

These changes take effect on November 16, 2026.

This policy supplements our Privacy Policy. It is for residents of Washington State, Nevada, California and other places with consumer health data laws, and it describes how Directive handles consumer health data.

Notice at Collection

The app processes consumer health data to provide fitness and nutrition services. We obtain your express, affirmative consent before any such processing begins. This policy serves as our Notice at Collection, detailing that we process health-related sensitive personal information solely for the purpose of providing the app's features. We do not sell this data. We do not share it, with two exceptions that happen only with your separate consent: if you scan the barcode on a packaged food, the app sends that barcode number to the Open Food Facts database to look the product up; and if you play a video briefing, the app asks our video host, Bunny, for that video. Both are described below. Your health data stays on your phone and is not sent to our servers. It is kept until you delete it in the app or delete the app.

The health data we collect, and where it comes from

We collect the following categories of consumer health data: body weight and target weight, body measurements (waist, neck, hip) and a body-fat estimate calculated from them, height, date of birth and sex, the food and drink you log (calories, protein, carbohydrate, fat, alcohol and fluids), including packaged foods you look up by scanning a barcode (the product's barcode number, name and nutrition facts), workouts (type, duration and intensity), steps, resting heart rate and sleep data, and, only if you choose to enter them, menstrual cycle dates, cycle length and period length, menopause status, and GLP-1 or other appetite-modulating medication use. If you choose to watch the app's video briefings, which briefing you play is also treated as consumer health data, because it may suggest a health interest.

This data is sourced directly from you (what you type into the app) and, if you choose to connect it, from your device's health service (Apple Health on iPhone, Health Connect on Android), from which the app reads only body weight, step count, sleep, resting heart rate and workouts; and, if you choose to scan a barcode, from the Open Food Facts database, which supplies the product's name and nutrition facts. The app never reads body fat, lean body mass or body mass index from your device's health service.

Local processing only

All of this information is collected and stored only on your own phone. It is not transmitted to Directive, and Directive has no access to it. We do not store or maintain consumer health data from the app on any external systems or cloud infrastructure under our control. The only things that leave your phone, other than at your direction in a file or a backup, are described under "Sharing" below: the barcode number of a product you choose to scan, and the request for a video briefing you choose to play.

Your consent

Before you can enter any health information, the app shows a separate consent screen. It lists the information above and what it is used for, and nothing is entered, imported or started until you tap "I CONSENT". This consent is separate from any permission your phone itself asks for. The app records the date of your consent and the version of this policy. If you do not consent, the app cannot be used.

Scanning a barcode has its own, separate consent. The first time you choose to scan, the app explains that the barcode number will be sent to Open Food Facts and asks you to agree. If you do not agree, nothing is sent and you can still enter the food yourself.

Playing a video briefing has its own, separate consent too. Before the first briefing plays, the app explains that videos stream from our video host, Bunny, which receives your device's internet address and which video you are watching, and asks you to agree. If you do not agree, no video is requested.

You can change your mind about either at any time in the app's Settings.

If we make a material change to this policy, we will notify you in the app and ask for your consent again before the change applies to you. The app shows the consent screen again whenever the version of this policy changes.

You can withdraw your consent at any time with "Withdraw health data consent" in the app's Settings. The app asks whether you also want to delete your data, and you can do both in one step. The app then stops until you consent again. If you choose to keep your data, it stays on your phone until you delete it with "Delete all my data" in the app's Settings.

How it is used

We process the Consumer Health Data categories listed above for the following purposes: to provide and maintain the app's functionality on your device; to calculate and display your personal fitness and nutrition metrics, such as weight trends and daily calorie and macronutrient targets; to produce your weekly review; to import data from your device's health service (Apple Health on iPhone, Health Connect on Android) at your direction; to look up the nutrition facts of a packaged food when you scan its barcode; to play the video briefings you choose to watch; and to create the backup, report, and spreadsheet files you request. We do not use Consumer Health Data to improve our products, for advertising, or for any other purpose.

Data retention criteria

We retain Consumer Health Data only for as long as the App remains installed on your device, or until you erase it with "Delete all my data" in the App's Settings. Because data is stored locally on your phone, deleting the App deletes all Consumer Health Data stored within it. We do not maintain copies of your health data on our own servers. Copies in your phone's own cloud or computer backup, and any backup file, report or spreadsheet you saved or sent, are under your control and are not deleted by deleting the App.

Sharing, and categories of third parties and affiliates

We do not sell Consumer Health Data, and we will not do so. We do not share it with any affiliate.

We share two kinds of information, each only when you choose it and only with your separate consent.

• Barcode lookups. Category of third party: a public food-product database (Open Food Facts, a non-profit organization based in France). What is shared: the barcode number of a packaged food you scan. Purpose: to return that product's name and nutrition facts to your phone.
• Video briefings. Category of recipient: a video hosting service that acts as our processor (Bunny, BunnyWay d.o.o., a company based in Slovenia). What is shared: which video you ask to play. Purpose: to deliver that video to your phone. The host acts only on our behalf and may not use the information for any other purpose.

Each request also shows the recipient the internet (IP) address of your device, as any internet request does. Nothing else is sent. A food you look up, or a briefing you watch, may reveal something about your diet or your health interests, which is why we treat both as Consumer Health Data and ask for your separate consent first.

Health data otherwise leaves your phone only at your direction: in a file the app creates for you, or through your phone's own device backup if you have it turned on. The backup file the app creates is encrypted with a password you choose. The report, the spreadsheet and the calendar file are not encrypted, and the app warns you and asks you to confirm before it creates any of them.

Our subscription provider, RevenueCat, and the app store's purchase system (Apple's App Store or Google Play) do not receive Consumer Health Data. The companies that run our website do not receive Consumer Health Data from the app.

The website

The website at directivefitness.com does not ask for health data. If you choose to include health information in a Charter application or a support message, we use it only to respond to you, and you can ask us to delete it.

Your rights

You have the right to confirm whether we collect, share, or sell your consumer health data and to access such data, including a list of all third parties and affiliates with whom we have shared or sold the data and an email address or other online mechanism to contact them. You also have the right to withdraw consent, to have your data deleted, to correct any inaccurate health data, and to limit our use and disclosure of your sensitive personal information. We have not sold your consumer health data. The only recipients are the two named under "Sharing" above, and only if you allowed barcode lookups or video briefings: Open Food Facts (openfoodfacts.org) and Bunny (bunny.net). Each can be contacted through the address published on its website.

• In the app, you control your data. You can view and edit it within the app, switch cycle tracking off, withdraw your consent in the app's Settings, and withdraw the health service's permission in your phone's settings. To delete the data stored in the app, use "Delete all my data" in the app's Settings, or delete the app. Three things are not removed by either, and are under your control: (1) your phone's own cloud or computer backup, which may include the app's data until that backup is replaced or deleted; (2) any backup file, report or spreadsheet you created and saved or sent; and (3) data held in your device's health service (Apple Health on iPhone, Health Connect on Android). Directive only reads from that service and never writes to it, so nothing of ours is stored there. We do not store your health data on our servers and there are no accounts, so there is nothing for us to delete on our side.
• For anything you sent us through the website, email privacy@directivefitness.com. We will acknowledge your request within 10 business days and respond within 30 days. If we decline your request, you may appeal by replying to our response, and we will answer within 45 days. If your appeal is declined, you may contact your state's attorney general. Washington residents: www.atg.wa.gov/file-complaint.

California Confidentiality of Medical Information Act (CMIA)

To the extent the California Confidentiality of Medical Information Act (Cal. Civ. Code Section 56 et seq.) applies to the app, we comply with it. We do not disclose your medical information, including reproductive health information such as menstrual cycle details, to any third party: it is stored only on your device and we have no access to it. The barcode lookups and video streams described under "Sharing" above happen only with your separate consent and contain none of the information you have entered. If that ever changed, we would first obtain your authorization as Section 56.11 requires, unless the disclosure is otherwise required by law. The app contains no advertising or tracking technology, and it does not send your information to any artificial intelligence service. It contacts no outside service other than those named in this policy. Cycle information is left out of the reports you create unless you choose to include it.

Contact

Directive LLC952 Winchester Rd, Unit #308, Lexington, KY 40505privacy@directivefitness.com