Consumer Health Data Privacy Policy
Effective: October 13, 2026
This Consumer Health Data Privacy Policy supplements the SwipeHealth Privacy Policy and applies to "consumer health data" as defined by the Washington My Health My Data Act, Nevada SB 370, the Connecticut Data Privacy Act's consumer health data provisions, and similar state laws. It applies to you if you are a resident of one of those states or if your consumer health data is collected in one of them. If anything in this policy conflicts with the Privacy Policy, this policy controls for consumer health data.
What consumer health data we collect
Consumer health data is personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status. In SwipeHealth this means:
- Body measurements: weight, height, and other body measurements you enter, and body-composition results you or a trainer records.
- Fitness and activity information: your fitness goals, experience level, the workouts you complete, sets, reps, weights, and duration, and how you rate a session.
- Apple Health and Health Connect data, if you connect them: workouts and other activities you record outside SwipeHealth (with heart rate, energy burned and distance during them), steps, sleep, resting heart rate, heart rate while you sleep and heart rate variability, and height, weight, body fat percentage, date of birth and sex, plus the readiness and recovery levels we calculate from them.
- Connected device data, if you connect a device account directly where that option is available, such as Garmin, WHOOP or Oura: the workouts you approve, with activity type, times, duration, distance, heart rate, energy burned and the device name.
- Check-ins and sports: how you tell us you feel before a workout (such as fresh, a bit tired or sore, and where), and which sports or activities you do and when.
- Injury and limitation information: injuries, pain, or physical limitations you tell us about so we can adapt your program.
- Coaching conversations: what you write to the AI coach, which may include information about your health, and the coach's replies.
- Inferences: program adjustments and readiness or progression suggestions we derive from the above.
We do not collect biometric identifiers (such as facial geometry, fingerprints, or iris scans), precise geolocation, genetic data, reproductive or sexual health information, or gender-affirming care information, and we do not use geofencing around any facility.
Where it comes from
Directly from you, through the app and the AI coach, and, if you choose to connect them, from Apple Health on iPhone, Health Connect on Android, and device accounts such as Garmin, WHOOP or Oura where that option is available. If a partner organization sponsors your access, it provides only your name, your email address and a reference it uses to check your eligibility, so we can link your account to its program; it does not provide health data about you.
Why we collect it
- To build your workout program and adapt it to what you complete and how you recover.
- To show you your activity, sleep and recovery trends in the app.
- To share the information you choose with a trainer or other practitioner, if you approve that person in the app.
- To generate AI coaching responses to your questions.
- To keep your account secure and the Service working.
- To produce aggregate, de-identified reporting for a sponsoring organization, in groups of ten or more members, that cannot identify you. This reporting never uses data from Apple Health, Health Connect or any wearable or connected device, or anything we calculate from it.
We do not sell consumer health data. We do not use it for advertising. We do not use it to train, fine-tune, or improve artificial-intelligence models, ours or anyone else's.
Who we share it with
Apart from a practitioner you approve (described below) and disclosures the law requires, we share consumer health data only with service providers that process it on our behalf under a written contract, for the purposes above, and only the minimum needed:
| Provider | Purpose | What it receives |
|---|---|---|
| Amazon Web Services (including Amazon Bedrock) | Hosting, storage, backups, and AI coaching inference inside our own AWS account | All service data, including coaching conversations |
| OpenAI (API) | Workout-program generation | De-identified inputs only: age, weight, goals, experience level, equipment, and injury or limitation flags; no name, email address, or account identifier |
| Zendesk | Member support | Health information only if you include it in a support message |
Mixpanel | Product analytics | Account identifier, email address and phone number (if you gave one), and in-app events (for example, workouts completed) with profile attributes such as fitness goal and experience level; no coaching conversations or injury details |
Customer.io | Account and lifecycle email and in-app messages | Account identifier, email address, fitness goal and workout-completed events used to trigger messages; no coaching conversations or injury details |
The full list of our service providers, including those that do not receive health data, is at swipehealth.ai/subprocessors. A sponsoring organization receives only aggregate reporting as described above. A trainer, dietitian, clinician or other practitioner receives consumer health data only if you approve that person in the app, and only the data you choose to share with them, including your history of that data. We may also disclose consumer health data if required by law, such as in response to a valid legal process, and we will tell you unless the law prohibits it.
Your rights
- Know whether we collect, share, or sell your consumer health data, and receive a list of the third parties and affiliates with which we have shared it, with an email address or other online way to contact each of them.
- Access the consumer health data we hold about you.
- Withdraw consent to our collection or sharing of your consumer health data.
- Delete your consumer health data. Deleting your account in the app (Account, then Delete my account) deletes it from our production systems within 30 days and from encrypted backups within 30 days after that; we also instruct our service providers to delete it. You can also delete health data without deleting your account. Disconnecting Apple Health or Health Connect in the app (Account, then General, then Connected data) deletes the readings we received from it, and using Delete health data in the app where that option is available, or emailing us, deletes the rest, as described in the Privacy Policy section "Apple Health and Health Connect".
- Not be discriminated against for exercising any of these rights.
To exercise a right, use the in-app controls, email support@swipehealth.ai with the subject "Consumer health data request", or write to us at the mailing address in the "Changes and contact" section below, marked "Consumer health data request". If you write to us, include the email address on your account. We will verify the request using that email address and respond within 45 days (extendable once by 45 days where permitted, and we will tell you if so). If we deny a request in whole or in part, you may appeal by replying to our response with "Appeal" in the subject, or by writing to us at the mailing address below marked "Appeal". We will answer your appeal in writing within 45 days, explain the reasons for our decision and, if we still deny it, tell you how to contact your state attorney general to submit a complaint.
Consent
We collect consumer health data only when you give it to us or choose to connect a source of it, such as Apple Health or Health Connect, and only as needed to provide the Service you requested and for the other purposes above. Sharing with the service providers listed here is necessary to provide the Service you requested. We share consumer health data with a practitioner only with your consent, which you give by approving that person and choosing what to share in the app; you can withdraw it at any time by removing their access. We will ask for separate, specific consent before collecting, using or sharing your consumer health data for any other purpose.
Security and retention
Consumer health data is encrypted in transit and at rest, stored in the United States, and accessible only to the SwipeHealth staff who need it to operate the Service, under individual credentials. We keep it for as long as your account is active and delete it as described above. If your paid or sponsored access ends and you do not start a paid plan or a new sponsored membership within 12 months, we may delete your consumer health data. We will email you at least 30 days before we do. We do not delete your account because a payment or sponsorship stopped. We may keep a record of a request you made, or a consent you gave, for as long as we need it to show that we complied with the law.
Changes and contact
We will update the effective date above when this policy changes and, for material changes, notify you in the app or by email. Questions, requests and appeals: email support@swipehealth.ai or write to us at:
Swipe Health, Inc.
5900 Balcones Drive #33470
Austin, TX 78731
USA
SwipeHealth is operated by Swipe Health, Inc., a Delaware corporation registered to do business in Texas. To send us a formal legal notice, email support@swipehealth.ai with "Attn: Legal" in the subject line, or mail it to the address above marked "Attn: Legal". A notice to us is effective when we receive it. We send notices to you by email to the address on your account or in the app. Full notice terms are in Section 42 of our Terms and Conditions. You do not need to send a legal notice to exercise your rights under this policy.