Consumer Health Data Privacy Policy

1Who this policy is for

This Consumer Health Data Privacy Policy is provided by Metricsnumero Technology Solutions Ltd. ("we", "us"), 850-36 Toronto St, Toronto, Ontario M5C 2C5, Canada, which operates the iThriive app, its AI assistant Thriive and the website www.ithriive.com. It applies to "consumer health data", as defined in Washington's My Health My Data Act (RCW 19.373), Nevada's consumer health data law (Senate Bill 370, 2023, NRS Chapter 603A) and the Connecticut Data Privacy Act, about residents of those states, anyone whose consumer health data is collected in Washington, and residents of any other state with a similar law. Consumer health data means personal information that is linked or reasonably linkable to you and that identifies your past, present or future physical or mental health status.

It supplements our Privacy Policy, which describes all the personal information we handle; where this policy is more protective, it governs.

2Health data we collect and why

Categories of consumer health data, and how we use them
Category	How we use it
Bodily measurements and vital signs: height, weight, body fat, lean mass, body mass index, waist circumference, resting, average and maximum heart rate, heart rate variability, VO₂ max, respiratory rate and blood oxygen saturation	To show your trends, estimate readiness and training load, calculate targets, plan training around your recovery, and, with your AI consent, personalise Thriive's replies.
Activity and exercise: steps, distance, flights or floors climbed, active and resting energy, exercise minutes, workouts and activities, including the exercises, sets, repetitions, weights and effort you record and activities imported from Strava	To track your activity and progress, plan workouts and recovery, and, with your AI consent, personalise Thriive's replies. Data imported from Strava is only shown to you and is not used by any AI feature.
Sleep: sleep sessions, duration, stages and efficiency, and bedtime consistency	To estimate readiness, plan your schedule around your sleep and, with your AI consent, personalise Thriive's replies and briefings.
Nutrition and hydration: meals and the foods in them, calories, protein, carbohydrates, fat, water, foods you look up by barcode or name, nutrition plans and targets	To track intake against your targets, look up foods and, with your AI consent, estimate a meal from a description and personalise Thriive's replies.
Mental and emotional wellbeing: mood, energy and stress ratings, check-in tags (such as anxious, tired, sick, hungover or period), journal entries, and mindful-session minutes	To show your own trends and patterns, estimate readiness (energy), and, with your AI consent, personalise Thriive's replies and briefings.
Anything else you choose to track, such as symptoms, and its values and notes	To show your trends, run the experiments you choose, and, with your AI consent, personalise Thriive's replies.
Health conditions, treatments and reproductive or sexual health information you choose to save: conditions (such as diabetes, hypertension, heart, kidney or eating-disorder history), classes of medication, pregnancy due date, a baby's birth date and breastfeeding status, and a "period" check-in tag	To make the app's figures and, with your AI consent, Thriive's advice safer and more appropriate for you, for example by avoiding calorie targets that are unsuitable during pregnancy.
Health information you write in messages, notes, tasks, goals or memories, or say in voice recordings, and health-related feedback and reports	To answer you and carry out what you ask; to keep you safe, including by recognising possible risks of self-harm or disordered eating and showing crisis resources; and, for feedback and reports, to improve the quality and safety of Thriive.
Information derived from the above: readiness scores, patterns in your data, experiment results, recovery and training-load assessments, calculated targets, progress, briefings and evening reviews	To provide the features above and send the notifications you allow, such as a low-recovery alert or a briefing.
Inferences about your physical or mental health: automated assessments that a message may indicate a risk of self-harm, an eating disorder or a medical emergency; conditions, pregnancy or medicines detected in your messages; your choice not to see calorie or weight numbers	To show crisis resources, keep the app's figures and Thriive's advice safe for you, decide whether a briefing is written by AI, and review the quality and safety of Thriive.
Health information in the titles or notes of calendar events you import	To plan your schedule around your commitments and, with your AI consent, give Thriive the titles and times it needs to help you (event notes are not sent to our AI provider).
Age and gender, where you provide them	To calculate targets with appropriate formulas and apply appropriate safety limits.

We also use consumer health data, where necessary, to secure and maintain the Service, to prevent and investigate fraud and abuse, and to comply with the law. We do not sell consumer health data, do not use it for advertising, and do not use geofencing around any health-care location.

3Where it comes from

Directly from you, when you complete your profile, log information, track something, do a check-in, save health details, scan or search for a food, or write or speak to Thriive.
From services you choose to connect: Apple Health, Health Connect and Strava.
From your calendars, where an event's title or notes describe something about your health.
Derived by the Service from the information above.

5Health data we share and with whom

We share the categories of consumer health data listed in section 2 only with the following categories of third parties. Each processor acts on our behalf under a contract that restricts its use of the data to providing services to us.

Categories of recipients
Category of third party	Who	Consumer health data shared
Cloud hosting provider (processor)	Amazon Web Services	All categories in section 2, stored on our behalf.
Artificial-intelligence model provider (processor), only with your optional AI consent	OpenAI	When relevant to a conversation, a briefing, a meal estimate or a transcription: health and fitness summaries, readiness and training-load figures, tracker values and today's check-in (not your journal, except up to 280 characters of the previous evening's journal in a morning briefing), health details, nutrition plan, recent workouts, sleep and nutrition (never data imported from Strava), the inferences described in section 2, voice recordings, and any health information in your messages, memories, notes or calendar event titles.
Push-notification delivery providers (processors)	Expo; Apple Push Notification service; Google Firebase Cloud Messaging	The content of notifications you allow, which may include your readiness or recovery, a briefing, or a tracker or check-in reminder.
Error-reporting provider (processor), when crash reporting is enabled	Sentry	Technical error reports with request contents and health fields removed; an error message could still, rarely, contain a fragment of health information.
Email service providers (processors)	Microsoft 365 (provided through GoDaddy); Proofpoint	Any consumer health data you include when you email us, for example in a support or privacy request.
Public food database, at your request	Open Food Facts (association, France)	The barcode you scan or the food you search for online, sent from your phone with your IP address but no account information, which may indicate what you eat.

We have no affiliates with whom we share consumer health data. We may also disclose consumer health data where required by law, or with your separate consent if a merger, acquisition or sale of our business occurs. Apple and Google, which sell our plans, do not receive consumer health data from us.

6Your rights and how to use them

You have the right to:

confirm whether we collect, share or sell your consumer health data;
access your consumer health data, including a list of all third parties and affiliates with whom we have shared or sold it, with an active email address or other online way to contact each of them;
withdraw your consent to our collection and sharing of your consumer health data; and
have your consumer health data deleted. When you ask, we delete it from our systems and notify our processors of your request. Copies in our backups are removed within 30 days, and information already sent to OpenAI is deleted by OpenAI within 30 days.

How to make a request:

In the app, you can export your data (Profile, Export my data); withdraw your consent to sharing with our AI provider (Profile); delete individual health details or withdraw your consent to them; delete trackers, check-in entries, experiments and memories; clear your chat history; disconnect Apple Health, Health Connect or Strava (which deletes the data imported from them); or delete your account and all its data from your Profile settings. Because the Service cannot operate without processing consumer health data, withdrawing your consent to its collection entirely means deleting your account.
For any request, including deletion if you cannot use the app (see www.ithriive.com/delete-account), email aisolutions@metricsnumero.com with the subject line "Consumer health data request", from the email address on your account.

We will verify your request using commercially reasonable means, usually by confirming you control the email address on your account. We will respond within 45 days of receiving your request; if reasonably necessary, we may extend this once by a further 45 days and will tell you why within the first 45 days. Requests are free of charge up to twice in any 12-month period. We will not discriminate against you for exercising these rights.

When we answer an access request, we give you the list of third parties described above with an active email address or other online contact for each.

7Appeals

If we decline to act on your request, you can appeal by replying to our decision, or by emailing aisolutions@metricsnumero.com with the subject line "Consumer health data appeal", within a reasonable time after our decision. We will respond in writing within 45 days, explaining any action taken or not taken and why. If your appeal is denied, you may contact your state's attorney general, for example the Washington State Office of the Attorney General at atg.wa.gov/file-complaint, the Nevada Attorney General at ag.nv.gov, or the Connecticut Attorney General at portal.ct.gov/ag.

8Changes to this policy

The effective date of this policy is shown at the top. If we make a material change, we will notify you in the app and by email at least 30 days before it takes effect and, where required, ask for your consent again. You can review and request changes to your consumer health data as described in section 6. We do not allow third parties to collect information about your online activities over time and across different websites or online services through the Service.