Consumer Health Data Privacy Policy

1. Scope and responsible business

This Consumer Health Data Privacy Policy describes how DataWay LLC handles consumer health data for Setfolk, including where Washington’s My Health My Data Act or a similar applicable law protects that information. It is a separate notice focused on health data.

The current app keeps workout, nutrition, and activity records on your iPhone. There is no Setfolk account or cloud synchronization of those records. On-device processing, optional internet requests, and information you choose to send us are described separately below.

2. Categories, sources, and purposes

• Information you enter on your device: fitness goals and relevant profile information, workout plans and exercise logs, sets, reps, weights, personal records, weight entries, food and meal records, calorie and macro information, and water entries. The app uses these to provide the planning, logging, and progress features you request.
• Device information you allow: step and activity information from supported device features when you grant the relevant permission. This supports step tracking and related progress displays.
• Locally calculated information: calorie and macro totals, training summaries, and progress indicators based on your entries and permitted activity information. These remain part of your local app records.
• Optional service requests: exercise-media requests, product barcodes, and associated connection information such as IP address and request time. In context, a request may reveal a fitness or nutrition interest. This information is processed to deliver the requested content, perform a lookup, or protect the service, not to create advertising health profiles.
• Health-related support information: records, descriptions, or screenshots you choose to send in a support message, together with contact details. The source is you; the purpose is handling your request. Please avoid unnecessary health details.

We do not purchase health records from data brokers. Processing is limited to the requested services and purposes described here, with consent where required by applicable law.

3. Disclosures and recipients

Your complete local workout, food, weight, water, and step records are not automatically sent to DataWay or its providers. Limited disclosures can occur as follows:

• Cloudflare, as hosting and delivery provider: receives requested media resources and technical request information to deliver exercise content and secure the service.
• Open Food Facts, as barcode-lookup provider: receives the submitted product barcode and connection information to return product information. The request does not include your full food diary or profile.
• Email-delivery and storage providers: process any health information you choose to include in support correspondence so that it can be delivered and handled.
• Recipients you select: receive the records you choose to export or send using other apps or services.

Apple processes subscriptions, but Setfolk does not send your local fitness or food logs to Apple as part of a purchase. DataWay does not share Setfolk consumer health data with affiliates, sell it, or disclose it for targeted advertising. Disclosures required or permitted by law remain subject to applicable health-data protections. Any future additional category, purpose, or recipient requiring notice or consent will be addressed before that processing begins.

4. Your rights and how to use them

Where applicable, you may confirm and access health-data processing, obtain recipient details, withdraw consent to collection or sharing, and request deletion. Use Settings/Profile for records kept only on your iPhone; manage exports and backups separately. We cannot remotely access those local records.

For information we hold, email [email protected] or [email protected]. Identify Setfolk and your request; an account is not required. We may request limited verification information.

For requests governed by Washington’s Act, we respond within 45 days of receipt, with one additional 45-day period when permitted and explained within the first period. Required deletion includes notifying relevant recipients; permitted deletion from archived or backup systems may take up to six months after authentication.

To appeal a refusal, reply with “Setfolk health privacy appeal”. For Washington appeals, we respond with reasons within 45 days. If denied, you may use the Washington Attorney General’s complaint process. Other applicable laws may provide additional rights.