FitnessSyncer Consumer Health Data Privacy Policy

Effective on October 29, 2026

This policy describes how FX Development, Inc. (“we”) collects, uses, and shares consumer health data through FitnessSyncer, and the rights you have over it under the Washington My Health My Data Act and similar laws in other states. It supplements our Privacy Policy, which covers all of the personal information we handle.

Consumer Health Data We Collect

Depending on the services you connect and the data types you choose, we collect:

• Activity data, such as workouts, steps, distance, floors, active minutes, heart rate, and calories burned
• Body measurements, such as weight, body fat, lean and bone mass, body water, and height
• Vital signs and test results, such as blood pressure and pulse, blood glucose, cholesterol, blood oxygen saturation, and body and skin temperature
• Electrocardiogram (ECG) recordings and their classification, only if you enable ECG
• Reproductive health data, such as menstrual flow, basal body temperature, cervical mucus, and ovulation test results, only if you enable Cycle Tracking
• Sleep sessions, stages, and related measurements
• Nutrition and hydration logs
• Medications, conditions, and allergies that you record or import
• Notes, comments, and annotations you attach to any of the above

Where It Comes From

We collect consumer health data from you, when you enter or upload it, and from the health and fitness services and devices you connect, such as Google Health, Garmin Connect, Strava, Samsung Health, Apple Health, Withings, and Polar. We collect data from a connected service only after you connect it and grant it permission, and only for the data types you choose.

How We Use It

We use consumer health data only to provide the services you request: to show it to you in your Dashboard, Stream, Notebook, and reports; to synchronize it to the services you choose; to send you the reports and notifications you set up; and to provide customer support when you ask for it. We do not use it for advertising and we do not sell it.

Who We Share It With

We share consumer health data with the following categories of third parties:

• Service providers that process it on our behalf and only as needed to provide FitnessSyncer: hosting (Amazon Web Services and Linode (Akamai)), system monitoring (Grafana), e-mail delivery of the reports and notifications you request (Mailgun), and customer support, when you include health data in a support request (Atlassian and DocsBot).
• Anthropic, and only for the laboratory PDF reports you ask us to read: if you upload a laboratory report as a PDF and tick the box asking us to read the results out of it, that document is sent to Anthropic, which returns the results it read for you to check. Where the PDF has text in it, we send that text as the report lays it out. Where it has none, such as a scan or a photograph of a printout, we send an image of each page instead, because there is nothing else to read. In both cases it is the whole page that is sent, and the page carries whatever your laboratory printed on it, which usually includes your name, your date of birth, and a medical record number. You are asked for each document, every time, and nothing is sent unless you ask for it. Our copy of the document is deleted as soon as it has been read, and the results are stored only once you keep them. Anthropic does not train on it, and it is retained by Anthropic for up to 30 days under its standard API terms or as required by applicable law. A FHIR, C-CDA, or CSV file from your patient portal or your laboratory is read by us and is never sent to anyone.
• Recipients you choose: the services you add as Destinations; the applications and AI assistants you authorize; the people you share with by link, from the Sharing tab, or by E-mail Destination; leaderboard organizers and participants; researchers running a study you join; and an organization, such as your employer, whose program you join.

We do not share consumer health data with any affiliate. For a list of the specific third parties we have shared your consumer health data with, contact us as described below.

Your Consent

We collect and share consumer health data only with your consent or as necessary to provide a service you have requested. Connecting a service, choosing its data types, and creating a Destination, share, leaderboard membership, or study enrollment are each a request you make; you can undo any of them at any time. We will ask for your separate consent before we collect or share consumer health data for any other purpose.

Your Rights

You have the right to:

• confirm whether we collect, share, or sell your consumer health data, and access it, including a list of the third parties and affiliates we have shared it with and a way to contact them
• withdraw your consent to our collection and sharing of your consumer health data
• have your consumer health data deleted

You can do much of this yourself: export your data to CSV, disconnect services, delete Destinations and shares, or delete your account from your Profile. When you delete your data, we delete it from our systems and ask our service providers to do the same. Copies in our encrypted backups are removed as those backups expire, within 30 days.

To make any other request, e-mail support@fitnesssyncer.com from the e-mail address on your account. We will respond within 45 days. If we need more time, we will tell you why, and we may take up to 45 more days. Requests are free of charge up to twice a year.

Appealing Our Decision

If we decline to act on your request, you may appeal by replying to our response or e-mailing support@fitnesssyncer.com with “Consumer Health Data Appeal” in the subject. We will respond to your appeal in writing within 45 days and explain our decision. If your appeal is denied, you may contact the Washington State Attorney General.

Contact Information