Consumer Health Data Privacy Policy

Effective Date: April 6, 2026

This Consumer Health Data Privacy Policy ("Health Data Policy") is provided in accordance with the Washington My Health My Data Act, RCW 19.373 et seq. ("MHMDA"), and applicable consumer health data privacy laws in other states, including Nevada SB 370. This Health Data Policy describes how Resilio Health LLC ("Company," "we," "us," or "our") collects, uses, shares, and retains consumer health data in connection with the Resilio Health application and related services (collectively, the "Service").

This Health Data Policy is a standalone document provided as a separate and distinct policy as required by the MHMDA. It supplements our general Privacy Policy, available at https://resiliohealth.com/privacy. If there is a conflict between this Health Data Policy and our general Privacy Policy with respect to consumer health data, this Health Data Policy shall control.

This Health Data Policy applies to all users of the Service.

1. Definitions

• "Consumer health data" means personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status. Under the MHMDA (RCW 19.373.010(8)), this includes but is not limited to: bodily functions, vital signs, symptoms, or measurements thereof; individual health conditions; exercise or fitness data; data that identifies a consumer seeking health care services; and data that is derived, extrapolated, or inferred from nonhealth information and used to associate or identify a consumer with health-related data, including inferences generated by AI systems from non-health inputs.
• "Consumer" means (a) a natural person who is a Washington state resident, or (b) a natural person whose consumer health data is collected in Washington.
• "Processor" means a person that processes consumer health data on behalf of the Company.
• "Sell" means the sharing of consumer health data for monetary or other valuable consideration. We do not sell consumer health data.

2. Consumer Health Data We Collect

In the course of providing the Service, we collect the following categories of consumer health data:

2.1 Body Region Status Data

When you use the body map feature, you designate specific body regions as "focus" zones (areas you want to strengthen) or "avoid" zones (areas where you are managing discomfort or want to avoid heavy loading). These selections reflect your self-reported physical status and constitute consumer health data. We collect:

• Body regions designated as focus or avoid (from the set of selectable body regions displayed in the app);
• Changes to body region status over time (tracked for resilience analysis); and
• Temporary daily avoid overrides (a focus zone that you want to avoid loading for one day).

2.2 Exercise and Physical Activity Data

We collect data about your exercise activity as reported through the Service:

• Self-reported training status (whether you trained today, have not yet trained, or are taking a rest day);
• Self-reported workout intensity (easy, moderate, or hard);
• Sport type for each session;
• AI-generated exercise routines assigned to you, including exercise names, sets, repetitions, and duration;
• Routine completion data, including actual duration, whether you completed all exercises, and which exercises you skipped; and
• Debrief responses reflecting your subjective assessment of routine difficulty.

2.3 Safety and Symptom Data

If you report symptoms during a check-in or chat with the AI Coach, or if the AI Coach determines that a safety escalation is warranted, we collect:

• The content of your symptom description or pain report;
• The AI Coach's safety recommendation (caution or stop) and the associated message;
• Whether you acknowledged the safety recommendation and whether you continued using the Service afterward; and
• The context that triggered the safety event (check-in, debrief, or chat).

2.4 AI Coaching Conversation Data

When you interact with the AI Coach, we collect the messages you send, which may include descriptions of physical symptoms, pain, injuries, medical history, or other health-related information you voluntarily disclose.

2.5 AI-Derived Health Inferences

Our AI systems generate inferences from your data that may constitute consumer health data, including: exercise preferences, progression levels, body region resilience trends, and engagement patterns. Even where these inferences are derived from non-health inputs (such as session timing or app usage patterns), they may qualify as consumer health data under the MHMDA to the extent they are used to associate you with health-related information.

2.6 Sources of Consumer Health Data

We collect consumer health data from the following sources: directly from you, through the app interface (body map selections, check-in responses, debrief responses, chat messages); from Apple Health, with your explicit permission via the HealthKit API (workout type, duration, and distance); from Strava, with your explicit permission via OAuth and webhook (activity type, duration, and distance); and generated by our AI systems (exercise routine selections, safety recommendations, progression decisions, and health-related inferences).

3. Purposes for Collecting Consumer Health Data

We collect each category of consumer health data identified above for the following specific purposes:

• Routine Generation: Your body region selections, training status, workout intensity, and exercise history are transmitted to our AI provider to generate a personalized strength and stability routine tailored to your current physical status.
• Progression Management: Your debrief responses and completion data are used to adjust exercise difficulty over time, ensuring routines remain appropriately challenging.
• Safety Monitoring: Your symptom reports and safety event records are used to trigger appropriate safety recommendations (e.g., advising you to stop and consult a healthcare provider) and to maintain an audit trail of safety escalations.
• Resilience Tracking: Your body region status history is used to show you trends in your body's resilience over time.
• Service Improvement: Aggregated, de-identified health data may be used to improve our exercise library, AI prompt quality, and safety detection. De-identification is performed by removing all direct identifiers (name, email, device identifiers, account ID) and aggregating data across multiple users, consistent with the MHMDA definition of "deidentified data" (RCW 19.373.010(9)). We do not use identifiable consumer health data to train third-party AI models.

4. How We Share Consumer Health Data

We do not sell consumer health data. We share consumer health data only with the following categories of processors, solely for the purposes described in Section 3:

4.1 AI Processing (Anthropic, PBC)

To generate personalized routines and coaching responses, we transmit your check-in data, body region selections, exercise history, safety event context, and chat messages to Anthropic, PBC, which provides the Claude large language model. Anthropic acts as a processor on our behalf pursuant to a data processing agreement (incorporated into Anthropic's Commercial Terms of Service). Under the terms of our agreement, Anthropic is contractually prohibited from using data submitted through the API to train its models. Anthropic retains API inputs and outputs for a maximum of thirty (30) days for safety and abuse monitoring purposes, after which they are automatically deleted. Anthropic does not store your data beyond this period.

4.2 Cloud Infrastructure (Supabase / Amazon Web Services)

Your consumer health data is stored in a PostgreSQL database hosted by Supabase on Amazon Web Services infrastructure in the United States. Supabase acts as a processor on our behalf pursuant to a data processing agreement. All data is encrypted at rest and in transit. Row-level security policies ensure that only your authenticated session can access your data.

4.3 Activity Data Integrations (Apple Health / Strava)

If you connect Apple Health or Strava, workout activity data (type, duration, distance) from these platforms is stored in our database and used as context for AI-generated routine recommendations. When this context is included in a routine generation request, it is transmitted to Anthropic as part of the check-in data described in Section 4.1. Apple Health data is accessed via the HealthKit API on your device. When you complete a routine, we write a summary workout record (activity type and duration) back to Apple Health so your training log stays complete. Strava data is received via Strava's webhook system. Neither Apple nor Strava receives your consumer health data from Resilio. HealthKit data is not used for advertising, marketing, or data mining purposes. We do not sell HealthKit data to data brokers or any third parties. HealthKit data is not stored in iCloud.

4.4 Push Notification Delivery

Push notifications are delivered through Apple Push Notification service (APNs), Google Firebase Cloud Messaging (FCM), and Expo's push notification service. These services receive only your device push token and notification content. No consumer health data is transmitted through push notification channels.

4.5 Processor Agreements

We maintain contractual agreements with each processor identified above that include data processing provisions, as required by the MHMDA (RCW 19.373.060). For Anthropic and Supabase, these take the form of data processing agreements incorporated into their commercial terms of service. For Apple APNs, Google FCM, and Expo, processing is governed by their standard terms of service, which include data handling obligations. Payment processors (Stripe, RevenueCat, Apple, and Google billing) do not receive consumer health data. These agreements contractually require each processor to:

• Process consumer health data only as instructed by the Company and for the purposes specified in this Health Data Policy;
• Implement appropriate security measures;
• Not sell or otherwise make available consumer health data for purposes outside the scope of the processing agreement; and
• Assist the Company in meeting its obligations under applicable law, including responding to consumer requests and honoring deletion requests.

4.6 No Other Sharing

We do not share consumer health data with any other third parties, including advertisers, data brokers, analytics providers, or social media platforms. We do not use consumer health data for advertising purposes. Resilio Health LLC has no subsidiaries or affiliated entities. If this changes, we will update this Health Data Policy and name all affiliates by name as required by the MHMDA.

5. Data Retention and Deletion

5.1 Retention Period

We retain your consumer health data for as long as your account is active and you maintain an active subscription. If you cancel your subscription but do not delete your account, your data is retained in read-only form to allow you to access your history.

Per-category retention periods:

• Body region status data: duration of account.
• Exercise and physical activity data: duration of account.
• Safety and symptom data: duration of account plus up to 3 years post-deletion for legal defense purposes.
• AI coaching conversation data: duration of account (stored for session continuity; deleted upon account deletion).
• AI-derived health inferences: duration of account.
• Apple Health and Strava data: duration of account or until integration is disconnected.
• Anthropic API logs: maximum of 30 days (controlled by Anthropic per our data processing agreement).

5.2 Right to Deletion

You have the right to request deletion of all consumer health data we have collected from you. You may exercise this right by:

• Using the account deletion feature in the Service's settings; or
• Contacting us at privacy@resiliohealth.com.

5.3 Deletion Process

Upon receiving a valid deletion request:

• We will acknowledge receipt of your request promptly, and in no event later than five (5) business days;
• A twenty-four (24) hour grace period begins, during which you may cancel the deletion request through the Service;
• After the grace period expires, we will remove all consumer health data associated with your account from our active production systems within twenty-four (24) hours, including all records across all database tables. This deletion is effectuated by removing your authentication record, which triggers cascading deletion of all associated records;
• Processor cascade deletion: We will notify each processor identified in Section 4 (Anthropic, Supabase) to delete any consumer health data they hold on your behalf, in accordance with our data processing agreements. Anthropic's API logs are automatically deleted within thirty (30) days of creation regardless of any deletion request. Supabase will delete your data as part of the cascading database deletion; and
• Data in automated backups and disaster recovery systems will be purged in the normal backup rotation cycle, which does not exceed thirty (30) days. During this period, backup data is encrypted, access-controlled, and not used for any purpose other than disaster recovery.

We will complete the deletion process and respond to your request within forty-five (45) days. If we require additional time, we will notify you of the extension (not to exceed an additional forty-five (45) days) and the reason for the delay.

5.4 Security and Legal Retention

We may retain limited data beyond the periods described above where necessary to comply with legal obligations, resolve disputes, enforce our agreements, or protect against fraud. In particular, safety event records (which document instances where the Service recommended that you stop an exercise or consult a healthcare provider) may be retained for up to three (3) years after account deletion to defend against potential claims. Any such retention will be limited to the minimum data necessary. After the three-year period, all retained safety event records will be permanently deleted.

5.5 Effect of Deletion

Once deletion from active production systems is executed, it cannot be reversed. All exercise history, body region data, progression data, safety event records (except as noted in Section 5.4), chat history, streak data, and notification records will be permanently removed. We are unable to recover this data after deletion.

6. Consent

6.1 Initial Consent

During account creation, we present a dedicated, unbundled consent screen. This screen is separate from and independent of the general Terms of Service acceptance. It:

• Identifies the specific categories of consumer health data we collect (as described in Section 2);
• Identifies the specific purposes for which we collect this data (as described in Section 3);
• Identifies the specific categories of third parties and named processors with whom we share this data (as described in Section 4);
• Describes how you may withdraw your consent (as described in Section 6.3); and
• Requires your affirmative consent (via a clearly labeled checkbox that is separate from the general Terms of Service checkbox and separate from the exercise risk acknowledgment checkbox) before we collect or process any consumer health data.

Your consent to the collection and processing of consumer health data is separate and distinct from your acceptance of the Terms of Service. Neither consent mechanism is pre-checked. You may not use the health-data features of the Service without providing this consent.

Additionally, connection to Apple Health or Strava requires separate, explicit authorization through each platform's own permission flow before any data is accessed.

6.2 Changes Requiring New Consent

We will obtain your affirmative consent before:

• Collecting any new categories of consumer health data not described in this Health Data Policy;
• Using your consumer health data for any purpose not described in this Health Data Policy; or
• Sharing your consumer health data with any new categories of third parties not described in this Health Data Policy.

6.3 Withdrawal of Consent

You may withdraw your consent to the collection and processing of consumer health data at any time by deleting your account through the Service's settings or by contacting us at privacy@resiliohealth.com. Withdrawal of consent will result in the deletion of all consumer health data as described in Section 5. Because consumer health data processing is integral to the Service's core functionality (generating personalized routines based on your physical status), full withdrawal of consent requires account deletion; it is not possible to use the Service without the collection described in this Health Data Policy. However, you may partially withdraw consent by disconnecting Apple Health or Strava integrations at any time through the Service's settings, which will stop the collection of third-party activity data without affecting the rest of your account.

7. Security of Consumer Health Data

We maintain administrative, technical, and physical safeguards designed to protect consumer health data, including:

• Encryption of all data in transit (TLS 1.2+) and at rest (AES-256);
• Row-level security on all database tables, enforcing per-user data isolation;
• Passwordless authentication (magic link) to reduce credential-based attack vectors;
• Server-side processing of all AI requests, ensuring that API credentials and raw health data are never exposed to client devices beyond what is displayed in the user interface;
• Access controls limiting employee and contractor access to consumer health data on a need-to-know basis; and
• Logging and monitoring of access to consumer health data systems.

8. Data Breach Notification

For information about our data breach notification procedures as they apply to consumer health data, please see Section 6 of our general Privacy Policy at https://resiliohealth.com/privacy. In the event of a breach affecting consumer health data, we will notify affected consumers without unreasonable delay and no later than thirty (30) business days after discovering the breach, in compliance with the Washington data breach notification statute (RCW 19.255.010) and, where applicable, the FTC Health Breach Notification Rule (16 CFR Part 318).

9. Geofencing

We do not use geofencing technology to identify or track consumers for the purpose of collecting consumer health data. We do not collect location data in connection with the Service. The Service does not use GPS, Wi-Fi triangulation, Bluetooth beacons, or any other geolocation technology. We do not use geofencing within 2,000 feet of any entity providing in-person health care services, as prohibited by RCW 19.373.080 (and within 1,750 feet as required by Nevada SB 370, where applicable). If we introduce any location-based features in the future, we will update this Health Data Policy and obtain your consent before collecting any location data.

10. Exercising Your Rights

10.1 Your Rights

Under the MHMDA and other applicable laws, you have the right to:

• Access: Confirm whether we are collecting, sharing, or selling your consumer health data, and obtain a list of all third parties and affiliates with whom we have shared your consumer health data;
• Correct: Request correction of inaccurate consumer health data;
• Delete: Request deletion of your consumer health data (as described in Section 5);
• Portability: Request a portable copy of your consumer health data in JSON format through the Service's Settings or by contacting us at privacy@resiliohealth.com;
• Withdraw consent: Withdraw your previously granted consent (as described in Section 6.3); and
• Non-discrimination: Exercise any of these rights without facing discrimination in the provision of the Service.

10.2 How to Exercise Your Rights

To exercise any rights under this Health Data Policy, you may:

• Use the relevant features within the Service (e.g., editing your profile, requesting account deletion); or
• Contact us at privacy@resiliohealth.com.

We will respond to verified requests within forty-five (45) days of receipt. If we require additional time, we will notify you of the extension (not to exceed an additional forty-five (45) days) and the reason for the delay. We will not discriminate against you for exercising your rights under the MHMDA or any other applicable law.

10.3 Appeal Process

If we decline to take action on your request, we will inform you of the reason for our decision. You may appeal our decision by contacting us at privacy@resiliohealth.com with the subject line "Privacy Rights Appeal." We will respond to your appeal within forty-five (45) days. If we deny your appeal, we will provide you with information on how to contact the Washington State Attorney General to submit a complaint: https://www.atg.wa.gov/file-complaint.

11. Changes to This Health Data Policy

We may update this Health Data Policy from time to time. If we make material changes to how we collect, use, or share consumer health data, we will notify you through the Service or by email at least thirty (30) days before the changes take effect and, where required by law, will obtain your consent to the changes.

12. Contact Us

If you have any questions about this Health Data Policy or wish to exercise your rights, please contact us at:

Resilio Health LLC
Email: privacy@resiliohealth.com
Legal inquiries: legal@resiliohealth.com
Support: support@resiliohealth.com
Website: https://resiliohealth.com