Consumer Health Data Privacy Policy

This policy supplements our Privacy Policy. It is for residents of Washington State, Nevada, California and other places with consumer health data laws, and it describes how Directive handles consumer health data.

Notice at Collection

The app processes consumer health data to provide fitness and nutrition services. We obtain your express, affirmative consent before any such processing begins. This policy serves as our Notice at Collection, detailing that we process health-related sensitive personal information solely for the purpose of providing the app's features. We do not sell or share this data. Your health data stays on your phone and is not sent to our servers. It is kept until you delete it in the app or delete the app.

The health data we collect, and where it comes from

We collect the following categories of consumer health data: body weight and target weight, body measurements (waist, neck, hip) and a body-fat estimate calculated from them, height, date of birth and sex, the food and drink you log (calories, protein, carbohydrate, fat, alcohol and fluids), workouts (type, duration and intensity), steps, resting heart rate and sleep data, and, only if you choose to enter them, menstrual cycle dates, cycle length and period length, menopause status, and GLP-1 or other appetite-modulating medication use.

This data is sourced directly from you (what you type into the app) and, if you choose to connect it, from your device's health service (Apple Health on iPhone, Health Connect on Android), from which the app reads only body weight, step count, sleep, resting heart rate and workouts. The app never reads body fat, lean body mass or body mass index from your device's health service.

Local processing only

All of this information is collected and stored only on your own phone. It is not transmitted to Directive, and Directive has no access to it. We do not store or maintain consumer health data from the app on any external systems or cloud infrastructure under our control.

Your consent

Before you can enter any health information, the app shows a separate consent screen. It lists the information above and what it is used for, and nothing is entered, imported or started until you tap "I CONSENT". This consent is separate from any permission your phone itself asks for. The app records the date of your consent and the version of this policy. If you do not consent, the app cannot be used.

If we make a material change to this policy, we will notify you in the app and ask for your consent again before the change applies to you. The app shows the consent screen again whenever the version of this policy changes.

You can withdraw your consent at any time with "Withdraw health data consent" in the app's Settings. The app asks whether you also want to delete your data, and you can do both in one step. The app then stops until you consent again. If you choose to keep your data, it stays on your phone until you delete it with "Delete all my data" in the app's Settings.

How it is used

We process the Consumer Health Data categories listed above for the following purposes: to provide and maintain the app's functionality on your device; to calculate and display your personal fitness and nutrition metrics, such as weight trends and daily calorie and macronutrient targets; to produce your weekly review; to import data from your device's health service (Apple Health on iPhone, Health Connect on Android) at your direction; and to create the backup, report, and spreadsheet files you request. We do not use Consumer Health Data to improve our products, for advertising, or for any other purpose.

Data retention criteria

We retain Consumer Health Data only for as long as the App remains installed on your device, or until you erase it with "Delete all my data" in the App's Settings. Because data is stored locally on your phone, deleting the App deletes all Consumer Health Data stored within it. We do not maintain copies of your health data on our own servers. Copies in your phone's own cloud or computer backup, and any backup file, report or spreadsheet you saved or sent, are under your control and are not deleted by deleting the App.

Sharing, and categories of third parties and affiliates

We do not share Consumer Health Data with any third party or any affiliate, so there are no categories to list. We do not sell Consumer Health Data, and we will not do so.

Health data leaves your phone only at your direction: in a file the app creates for you, or through your phone's own device backup if you have it turned on. The backup file the app creates is encrypted with a password you choose. The report, the spreadsheet and the calendar file are not encrypted, and the app warns you and asks you to confirm before it creates any of them.

Our subscription provider, RevenueCat, and the app store's purchase system (Apple's App Store or Google Play) do not receive Consumer Health Data. The companies that run our website do not receive Consumer Health Data from the app.

The website

The website at directivefitness.com does not ask for health data. If you choose to include health information in a Charter application or a support message, we use it only to respond to you, and you can ask us to delete it.

Your rights

You have the right to confirm whether we collect, share, or sell your consumer health data and to access such data, including a list of all third parties and affiliates with whom we have shared or sold the data and an email address or other online mechanism to contact them. You also have the right to withdraw consent, to have your data deleted, to correct any inaccurate health data, and to limit our use and disclosure of your sensitive personal information. We have not shared or sold your consumer health data with any third party or affiliate, so there is no such list to provide.

• In the app, you control your data. You can view and edit it within the app, switch cycle tracking off, withdraw your consent in the app's Settings, and withdraw the health service's permission in your phone's settings. To delete the data stored in the app, use "Delete all my data" in the app's Settings, or delete the app. Three things are not removed by either, and are under your control: (1) your phone's own cloud or computer backup, which may include the app's data until that backup is replaced or deleted; (2) any backup file, report or spreadsheet you created and saved or sent; and (3) data held in your device's health service (Apple Health on iPhone, Health Connect on Android). Directive only reads from that service and never writes to it, so nothing of ours is stored there. We do not store your health data on our servers and there are no accounts, so there is nothing for us to delete on our side.
• For anything you sent us through the website, email privacy@directivefitness.com. We will acknowledge your request within 10 business days and respond within 30 days. If we decline your request, you may appeal by replying to our response, and we will answer within 45 days. If your appeal is declined, you may contact your state's attorney general. Washington residents: www.atg.wa.gov/file-complaint.

California Confidentiality of Medical Information Act (CMIA)

To the extent the California Confidentiality of Medical Information Act (Cal. Civ. Code Section 56 et seq.) applies to the app, we comply with it. We do not disclose your medical information, including reproductive health information such as menstrual cycle details, to any third party: it is stored only on your device and we have no access to it. If that ever changed, we would first obtain your authorization as Section 56.11 requires, unless the disclosure is otherwise required by law. The app contains no advertising or tracking technology, and it does not send your information to any artificial intelligence service or other outside service. Cycle information is left out of the reports you create unless you choose to include it.

Contact

Directive LLC952 Winchester Rd, Unit #308, Lexington, KY 40505privacy@directivefitness.com