Consumer health data privacy policy

Summary

This policy is for people in the US. It adds what Washington’s My Health My Data Act, Nevada’s consumer health data law and the Connecticut Data Privacy Act require to our privacy policy, which describes everything else. We don’t sell consumer health data, and we share it only with the AI apps you choose to connect.

Who we are

Sascha Schwabbauer, trading as Bodylake, c/o POSTFLEX PFX-318-277, Emsdettener Straße 10, 48268 Greven, Germany. Write to privacy@bodylake.com for anything in this policy.

What consumer health data we collect

With your permission, the Bodylake app copies the data in your Apple Health app to a private store in Germany. Depending on what you allow, this includes:

• activity, workouts and workout routes with precise locations;
• heart rate, blood pressure, ECG recordings and other vital signs;
• sleep, body measurements, nutrition, hearing and mindfulness data, including State of Mind entries;
• cycle tracking and other reproductive health data;
• profile details such as your date of birth and biological sex;
• medications, only if you approve them in their separate prompt;
• information that other apps add to your Health records.

We also keep a log of each time an AI app read your data (when, which app, how much), and a record of your consents.

Why we collect it

To keep a private copy of your health history that the AI apps you connect can read for you, to show you what they read, and to keep the service and your data secure.

Where it comes from

From the Health app on your iPhone, with your permission, and from the AI apps you connect, which ask Bodylake for your data when you ask them a question.

Who we share it with

• The AI apps you connect, such as Claude (Anthropic) or ChatGPT (OpenAI). An app receives whatever its queries return, and only after you allow that app on its own consent screen, separate from your consent to the copy.
• Amazon Web Services, which hosts Bodylake in Germany as our processor.

We have no affiliates, sell no consumer health data and show no ads. No third party collects consumer health data over time and across websites or online services through Bodylake.

Your rights and how to use them

• Access. You can ask whether we collect, share or sell your consumer health data, get a copy, and get a list of every third party we shared it with, with an email address or web page for contacting each one. In the app, Connected AIs lists the apps you allowed and the Access Log shows what each one read.
• Deletion. You can have your consumer health data deleted. Delete Account in the app starts this at once: the health data in our live storage can no longer be read straight away, the rest is deleted within hours, records of past sign-ins and requests, which can no longer be used, expire within 90 days, and backup copies are gone within 35 days. We can’t delete what an AI app already received: delete it in each AI app you connected, too.
• Correction. Health values are corrected in the Health app; Bodylake then copies the change. For anything else, write to us.
• Portability. Export in the app gives you all your data as Parquet files.
• Withdrawing consent. You can disconnect an AI app under Connected AIs, or delete your account.

You can also use these rights by writing to privacy@bodylake.com. We answer within 45 days. If we turn down your request, you can appeal by replying to our answer, and we decide on the appeal within 45 days. If you disagree with that decision, you can complain to the attorney general of your state; in Washington at atg.wa.gov/file-complaint. We never treat you differently for using your rights.

Notes for some states

• Washington: this policy is our consumer health data privacy policy under the My Health My Data Act (RCW 19.373).
• Nevada: this policy is our consumer health data privacy policy under NRS 603A.400 to 603A.550. Your consent to the copy and your consent to share with an AI app are separate. When we change this policy in a way that matters, we tell you in the app before the change takes effect.
• Connecticut: the Connecticut Data Privacy Act applies to us, and you have the rights above. We don’t sell personal data, don’t use it for targeted advertising, don’t profile you and don’t use it to train large language models or any other AI models, so there is nothing to opt out of. We process consumer health data only with your consent, everyone who has access to it is bound to confidentiality, and we use no geofencing.

Changes

The version and the date it took effect are at the top of this page. When we change this policy, we publish the new version here.