Consumer Health Data Privacy Policy

1. Who this applies to

This policy covers consumer health data as Washington's My Health My Data Act and Nevada's SB 370 define it. It applies to everyone who uses RETAIN, not only to residents of those two states — we would rather hold one high standard for everybody than sort people by postcode.

RETAIN is run from the United States, your data is processed there, and it is offered to United States residents only.

Our general Privacy Policy covers everything else, including data that is not health data. Where the two documents overlap they are meant to say the same thing. If they ever disagree about health data, this one governs.

2. What we collect, and why

Every item below is something you type into the app yourself. None of it is bought, inherited from a broker, or guessed at from your browsing.

Your medication

• Whether you take a GLP-1, which one, your dose, and when you started. Used to set your protein target and to tune how gentle the food guidance is.
• Any other medications you choose to enter, and a free-text note for your care team. Optional — you can leave both empty and finish intake. Stored as context you can read back later. We do no drug-interaction checking of any kind. See section 12.

How you feel

• How often nausea shows up, asked once during intake. Decides how cautious the food suggestions should be.
• Daily stomach check-ins — queasy, rough, meh or fine, plus an optional note. One entry per day. Used to adjust what the app suggests you eat that day and to show you your own pattern over time.

Your body

• Current weight, goal weight, height, age and biological sex. Your protein target is calculated from your goal weight; your calorie floor is estimated from the rest.
• Weight entries over time, and body-fat percentage if you enter one, so you can see the trend.
• Activity level and strength-training experience. Moves your protein target up or down.

What you eat

• Meals you log — the food, the protein and calories, an optional note, and the time.
• Dietary preferences, restrictions and allergies, so meal ideas and grocery lists respect them.

Everything else on the intake form

• Your name and email, to make the account and to contact you about it.
• Your goal and your “why” — free text you write yourself, shown back to you on hard days.
• How you found us, including whether a clinic or prescriber referred you. We record that a referral happened so the partnership can be counted. Nothing about your health goes back to that clinic — see section 7.

3. Where it comes from

From you, directly, and only from you. We do not buy health data, take it from data brokers, get it from your pharmacy or prescriber, or infer it from your browsing. If it is in your account, you typed it in.

We do not collect your location. Not roughly, not precisely, not at all — there is no location code in this app. More on why that matters in section 5.

We do not store photos. The photo features are unfinished: the camera screens do not upload anything, and a picture you take of a meal is never sent off your device. If that changes, this page changes first, and the storage it would go to is already private and locked to your own account.

One clarification about food lookups. When you search for a food or scan a barcode, the search text or the barcode number goes to USDA FoodData Central or Open Food Facts to fetch the protein and calorie figures. That request is made by our server, not by your phone, so those databases receive the food you looked up and nothing at all that identifies you — not your name, not your account, not your IP address, and nothing else in your log.

4. What we use it for

These are the only purposes. If we add one, this page changes first.

• Working out your daily protein target and your calorie floor.
• Choosing which foods to suggest, and how gentle those suggestions should be on a bad stomach day.
• Showing you your own history — your weight trend, your protein streak, your symptom pattern.
• Answering you when you write to us about your own account.
• Keeping the service secure and spotting fraud or abuse.
• Complying with the law.

We do not use consumer health data for advertising. Not to target you, not to build audiences, not to measure campaigns, not to find people who look like you.

5. The promises we are prepared to be held to

These are architectural commitments — enforced by how the software is built, not merely asserted on a page.

• We never sell your consumer health data. Not for money, not for anything else of value. The Act defines “sell” very broadly, and this sentence is written to that broad definition.
• Health data never reaches an advertising platform. Your medication, dose, symptoms and weight are never sent to an ad network and are never used to build custom or lookalike audiences.
• There are no advertising trackers in this app. Not on the intake screens, not on the account screen, not anywhere — there is no third-party advertising or tracking script loaded on any page.
• No geofencing, because there is no location data at all. We operate no geofence around any healthcare facility and we cannot infer anything about your health from where you are, because we never learn where you are. The Act specifically prohibits geofencing health facilities; we are not in a position to do it even by accident.
• Health data is not the price of anything. Agreeing to our Terms subscribes you to no marketing. The marketing checkbox is separate and starts unticked.
• Row-level database security. Every health record is locked to your own account inside the database itself, not merely by app code. A stolen copy of our public key still cannot read your row.

6. Your consent

We ask before we collect, and “no” is a real answer. If you are setting up an account, that question is the first screen you see — before we ask anything about your medication, your weight or your stomach. If you joined before we started asking, the app puts the same question to you on the screens where it would otherwise take something new: your account details, your daily stomach check-in and your food log. Those stay switched off until you answer.

The box starts empty and nothing ticks it for you. You can leave it empty for as long as you like, and saying nothing costs you nothing else — your account, your subscription, the way to cancel it and every way of reaching us all carry on working exactly as normal. We keep a record of your answer, the moment you gave it, and which version of this policy you were shown, so that we can always say what you actually agreed to rather than what we assume you did.

One thing we would rather say plainly than leave you to work out. If you joined earlier and had already told us your weight, your dose or what you ate, we still have it — asking you now does not undo that. It stays exactly as it is, we take nothing further until you answer, and if you would rather we deleted it, say so and we will.

You can take that consent back at any time. Email support@retainmuscle.app and say so. You do not have to explain, and we will not try to talk you out of it.

Being honest about the consequence: withdrawing consent or deleting your data will stop the app working for you, because the app is the data — there is no protein target without a goal weight. That is a consequence, not a punishment. We will not charge you, quietly worsen anything unrelated, or treat you differently for asking.

7. Who else sees it

A very short list. Each is a service provider that handles data on our instructions, under contract, and may not use it for its own purposes.

• Supabase — our database, sign-in and file storage. Holds all of the health data described in section 2, encrypted at rest. This is where your data lives.
• Vercel — hosting. Receives technical request logs including your IP address. No health data.
• Stripe — payments. Receives your name, email and card details, which go to Stripe directly and never touch our servers. No health data.
• USDA FoodData Central and Open Food Facts — nutrition lookups. They receive the food you searched for or the barcode you scanned, and nothing that identifies you. See section 3.
• Klaviyo — our email platform, for opt-in email only, and it receives nothing today. The integration is unfinished: it writes to a developer log and sends no data anywhere. When it is switched on it is built to receive your email address, your first name, app milestones such as “completed intake”, and — being precise rather than reassuring — which GLP-1 you take, so that an email about nausea goes to people it might help. It is built never to receive your dose, your other medications, your care-team notes, your nausea reports, your weight or your food log. We will say so here before it is switched on, not after.
• Analytics providers — none. The analytics layer in the app writes nothing and sends nothing anywhere. If we ever connect one, it will be named here before it is switched on.

Not on this list: your clinic. If a healthcare provider referred you, they do not get access to your account, your food log, your weight or your symptoms. Nothing in this app sends anything to anybody's clinic. If we ever build something that shares a summary with your care team, it will need your explicit, separate, revocable consent at that time.

Not on this list: anyone who wants to advertise to you.

We may disclose data if the law genuinely requires it — a valid subpoena or court order. If that ever happens and we are allowed to tell you, we will.

8. Your rights

Wherever you live, you can ask us to:

• Tell you what we have. A list of the consumer health data we hold about you, and a list of every third party we have shared it with.
• Give you a copy you can take somewhere else.
• Correct it if we have something wrong.
• Stop. Withdraw your consent to us collecting or sharing it, at any time.
• Delete it. Erase your consumer health data from our systems — and we will pass that deletion request on to the service providers in section 7.

How to ask

Email support@retainmuscle.app from the address on your account and say what you want. That is the whole process — no form, no phone tree, no justification required. A person reads it.

We will confirm we got your request and act on it within 30 days. That is our own promise and it is tighter than the 45 days Washington law allows. If something is genuinely complicated we may need longer — in which case we will tell you why before the 30 days are up, and we will still finish inside 45.

If we say no

You can appeal, by replying to our decision or writing to the same address. We will answer an appeal within 45 days with a written explanation. If we still decline, you can complain to the Washington State Attorney General at atg.wa.gov/file-complaint, or to the attorney general of your own state.

9. How long we keep it

• While your account is active, and then deleted within 30 days of a deletion request.
• Backups: deleted data survives in encrypted backups for up to 30 days before it is overwritten.
• Billing records are kept as long as tax law requires, typically seven years — but billing records contain no health data.

10. Security

Health data is encrypted in transit and at rest, and access is restricted to your own account inside the database itself. The administrative key that could bypass those restrictions exists only on our server and is never sent to a browser.

No system is perfectly secure and we will not pretend otherwise. If a breach affects your data we will tell you and the relevant regulators, as the law requires.

11. Children

RETAIN is for adults. It is not aimed at anyone under 18, and we do not knowingly collect health data from anyone under 18. If we find out we have, we delete it.

12. RETAIN is not medical care

Worth repeating on the page about your health data. RETAIN is a nutrition tracking tool. It is not a medical device, it does not diagnose or treat anything, and it does not give medical advice. It does no drug-interaction checking whatsoever. Never change your medication, your dose or your treatment because of something the app said. Talk to your prescriber. The full statement is in Terms of Service section 1.

Because we are not your healthcare provider, the health data you give us is not protected by HIPAA. That is precisely why laws like My Health My Data exist, and why this page does.

13. Changes to this policy

If we change what we collect, what we use it for, or who we share it with, we will update this page and tell you before the change takes effect. Where the law requires fresh consent, we will ask for it rather than assume it.

14. Contact

Registered company name — to be confirmed
Registered address — to be confirmed
Privacy requests: support@retainmuscle.app
Anything else: support@retainmuscle.app

The state whose law governs the agreement between us is set out in our Terms of Service: Governing state — to be confirmed. Whatever that turns out to be, it does not take away rights that Washington or Nevada law gives you. Those rights follow you, not our paperwork.