Consumer Health Data Privacy Policy

Effective October 28, 2026

This policy is for residents of Washington, under the Washington My Health My Data Act, and of Nevada, under Nevada's consumer health data law (SB 370). It applies to "consumer health data": personal information that is linked or reasonably linkable to you and identifies your past, present or future physical or mental health. It adds to our Privacy Policy, which describes everything else. If the two differ on consumer health data, this policy applies.

Consumer health data we collect

Apex Stacked keeps what you log in a private database on your phone. The categories below are handled by the app; where any of it reaches us, the next section says so.

• Body measurements: body weight, body fat, lean body mass and other body-composition values.
• Vital signs and bodily functions: heart rate variability, resting heart rate, respiratory rate, heart rate during workouts, and sleep.
• Activity and training: workouts, exercises, sets, weights, reps, cardio, steps, recovery sessions and personal records.
• Nutrition: calories, macros, water, meal descriptions you type or dictate, and text read from nutrition labels.
• Wellbeing: energy and mood ratings.
• Hormone and peptide protocols: the protocols you track (such as TRT or peptides), doses, schedules and dose logs.
• Bloodwork: lab panels and marker values you enter, and lab reports you scan or upload.
• What you tell the health AI coach: questions and messages you write, which may describe health conditions, symptoms or goals.
• Inferences: trends, averages, Insights reports and AI responses derived from the data above.

We do not collect precise location, biometric identifiers (such as face or fingerprint templates), or genetic data.

Where it comes from

• You, when you log it, type it, dictate it, or scan a lab report or nutrition label.
• Apple Health or Health Connect, only if you connect them and grant permission for each data type.
• The app itself, which calculates trends, summaries and Insights on your phone.

Why we use it

• To provide the features you use: logging and tracking, trends and charts, training plans, Insights and reminders.
• To provide the AI features, only after you choose "Allow AI features" in the app (see below).
• To run challenges you join, which decide from your daily workout summaries which days qualify.
• To keep the service secure and to prevent abuse.

We do not use consumer health data for advertising, profiling for marketing, or training AI models.

When it leaves your phone

• AI features (with your consent): when you have allowed AI features and use one, the data that feature needs is sent through our server to Anthropic, our AI provider, to produce the response. Apple Health and Health Connect values are included only as summaries, and only if you also turn on health data AI sharing. The Privacy Policy lists exactly what each feature sends. We do not store the content on our servers. Anthropic processes it for us under a data processing agreement, may not use it to train models, and deletes it within 30 days (or up to 2 years if a request is flagged for a possible usage-policy violation).
• Challenges (if you join one): a per-day workout summary (start and finish times, duration, working-set count, strength or cardio, and live or imported), which we store until you delete your account. Your challenge totals appear on the leaderboard to other participants.
• Friends & Competitions (if you turn it on): only aggregate points and completed-day counts, visible to friends you accept within competitions you both join.
• Your private iCloud backup: an encrypted backup in your own iCloud account, which we cannot access. Apple Health data is excluded from it.
• Feedback you send: anything you choose to write in a feedback message.

Who we share it with

We share consumer health data only with service providers that process it on our behalf and under contract, and with other users only where you choose to take part in a social feature:

• Anthropic, PBC (AI processing, only with your consent): anthropic.com/legal/privacy.
• Railway (hosts our server, which relays AI requests and stores challenge summaries): railway.com/legal/privacy.
• GitHub, Inc. (our private issue tracker, only for feedback reports that contain health details you wrote): GitHub Privacy Statement.
• Other Apex Stacked users, at your direction: friends in shared competitions (aggregate points) and other challenge participants (challenge totals).

We have no affiliates that receive consumer health data. We do not sell it, and we would need your separate, signed authorization before we ever could.

Your rights

You have the right to:

• Confirm and access: learn whether we collect, share or sell your consumer health data, get a copy of it, and get a list of every third party and affiliate we have shared it with, with their contact details.
• Delete: have your consumer health data deleted. You can do this yourself in Settings → Profile → Delete account & data, which erases it from your phone, your iCloud backup and our servers. When we delete it, we also tell our service providers to delete it. Copies in our server backups are overwritten within six months.
• Withdraw consent: stop AI processing at any time in Settings → Profile → AI features, and stop health data AI sharing in Settings → Health.
• Not be discriminated against for using any of these rights.

Most of your data is on your phone, where you can see, correct and delete it at any time without asking us.

How to make a request

Email hello@apexstacked.com with the subject "Health data request" and tell us which right you want to use. We may ask for details that let us match your request to the records we hold, such as the email you have given us. You may use an authorized agent; we may ask for proof that they are acting for you.

We will respond within 45 days. If we need more time, we may extend that once by another 45 days and will tell you why. Requests are free, up to twice a year.

Appeals

If we decline your request, you can appeal by replying to our decision with the subject "Health data appeal". We will give you a written decision, with our reasons, within 45 days. If you disagree with the outcome you can contact your state attorney general:

• Washington: Washington State Office of the Attorney General: file a complaint
• Nevada: Nevada Attorney General: file a complaint

Security

Only the people who need consumer health data to run the service can access it on our servers. Everything sent between the app and our server is encrypted in transit (HTTPS). We store only the limited fields listed above, and identifiers and IP addresses in our security logs are stored only in hashed form.

Changes

Every change to this policy gets a new effective date at the top of this page. If we want to collect, use or share consumer health data in a new way, we will ask for your consent in the app first.

Contact

Apex Stacked LLC, Portland, Oregon, USA: hello@apexstacked.com