Consumer Health Data Privacy Policy (US)

For people in the United States, including Washington, Nevada and Connecticut: what health data PersonalLedger collects, why, where it comes from, who handles it and how to use your rights.

Version 1.0-draft · Not yet in effect

Draft — prepared before launch, not yet in effect, pending legal review. Highlighted text marks facts that still have to be decided.

Who this policy is for

This policy applies to consumer health data about people in the United States, including residents of Washington, Nevada and Connecticut and anyone whose data is collected while in those states. We apply the same protections to everyone. It adds to our general Privacy Policy; where they differ for US consumer health data, this policy applies.

Responsible for your data: [LEGAL ENTITY NAME REQUIRED]. Contact: [PRIVACY CONTACT REQUIRED].

Consumer health data we collect, and why

Category	Examples	Why we use it
Reproductive and sexual health	Period days, flow, symptoms, pain, notes, your situation (e.g. hormonal contraception, postpartum), cycle estimates	To show your cycle and find patterns in your own data, for you
Body	Weight, measurements, body composition (including values read from body-composition printouts you scan), progress photos you take	To show your progress over time
Sleep	Sleep sessions, naps, morning check-ins	To show your sleep and patterns with other areas
Mental health and wellbeing	Mood, energy, stress, check-ins, journal, reflections, dreams, gratitude	To show your own entries and patterns
Nutrition	Meals, foods, recipes, meal photos you choose to scan, vitamins and minerals computed from foods you link, and the fasts you time (start, end, goal, plan)	To show what you ate against your own goals and reference values, and to time your fasts and remind you on your phone if you turn that on
Physical activity	Workouts, sets, cardio, steps, GPS routes you record, and the routes of outdoor workouts you import from Apple Health	To show your training; a route is drawn on your device
Data from Apple Health	Only the types you connect (e.g. steps, sleep, cycle, body measurements, workouts, recovery, State of Mind, activity totals)	To bring that data into your ledger
Age	Your date of birth and the country you live in	To confirm you are old enough (18 or over in the United States); never shown to anyone
Inferences	Patterns and trends worked out from the data above (fixed rules, not AI)	To show you what your own data suggests; never used for ads or decisions about you

We never use consumer health data for advertising, and we never sell it.

Where it comes from

From you: what you log, write or photograph in the app.
From Apple Health on your iPhone, only for the data types you choose to connect.
From PersonalLedger itself: patterns, averages and estimates worked out from the two sources above.

Who it is shared with

We do not share consumer health data with third parties or affiliates. Service providers (processors) handle it only on our instructions to run the app:

Processor	What for	What it can receive
Supabase	Database, sign-in, photo storage (EU region)	Everything you store, including health data
Vercel	Hosting the app (EU functions)	Requests to the app, including the data you enter, in transit
Anthropic	Estimating the food in a meal photo, and reading the numbers on a body-composition printout you photograph — each only if you turn it on	Only that photo, without location or camera details

What you choose to show other members (for example your training level, a shared workout or favourite Library items) is shared by you, at your request, and you can turn it off at any time in Settings.

We do not use geofencing around health care facilities.

Your rights and how to use them

Confirm and access: see whether we hold your consumer health data and get a copy. Download it at any time under Privacy & data, or ask us.
Know who received it: Privacy & data lists every service that has handled your data. No third party or affiliate has received it.
Withdraw consent: you can withdraw consent to collection at any time by deleting your account; the AI meal-photo permission can be turned off on its own in Privacy & data.
Delete: delete your account and all its data in Privacy & data. We also delete it from our processors' active systems; provider backups expire after [BACKUP RETENTION PERIOD REQUIRED], and AI inputs are deleted by Anthropic within 30 days under its terms.
No discrimination: using these rights never changes how the app works for you.

To make a request we can't handle in the app, contact [PRIVACY CONTACT REQUIRED]. We answer within 45 days, which may be extended once by 45 days if necessary; we will tell you why. We may need to confirm the request comes from the account holder.

Appeal: if we decline your request, you can appeal by replying to our answer or writing to [PRIVACY CONTACT REQUIRED] with the subject "Appeal". We answer appeals within 45 days. If you are not satisfied, Washington residents can contact the Washington State Attorney General, Nevada residents the Nevada Attorney General, and Connecticut residents the Connecticut Attorney General. [LEGAL REVIEW REQUIRED]

Changes

If we ever want to collect or share consumer health data in a new way, we will ask for your consent first. This policy is a draft and has not yet had legal review.

Change history

1.0-draft — First draft (US consumer health data).