Consumer Health Data Privacy Policy
Effective date: 25 September 2026 Last updated: 30 September 2026
1. Purpose of This Policy
Kounisou LLC ("Kounisou," "we") processes consumer health data as part of delivering our fitness coaching platform. This policy describes what consumer health data we process, why, who we share it with, and how you can exercise your rights.
This policy applies to all Kounisou users and specifically addresses the requirements of:
- Washington My Health My Data Act, RCW Chapter 70.372 ("MHMD"), effective March 31, 2024 for small businesses
- Nevada SB 370 (2023), codified at NRS Chapter 629C, effective October 1, 2023
- Connecticut SB 3 / Public Act 23-16 ("CTHIPA"), effective October 1, 2023
2. What Is Consumer Health Data?
Consumer health data means personal information that is linked or reasonably linkable to an individual and that identifies the individual's physical or mental health condition or status. Under MHMD and similar laws, this includes but is not limited to:
- Biometrics and vitals: Heart rate, heart rate variability (HRV), blood oxygen saturation (SpO2), resting heart rate, blood pressure (if logged)
- Sleep data: Sleep duration, sleep stages (REM, deep, light), sleep quality scores
- Physical activity: Steps, active minutes, workout sessions, exercise type, GPS routes and location data from workouts
- Body measurements: Weight, body fat percentage, height, waist/chest/hip measurements, body composition data
- Stress and recovery: Stress scores, readiness scores, recovery metrics from wearable devices
- Nutrition: Food logs, caloric intake, macronutrient data, food photos submitted for AI analysis
- Progress photos: Body photographs submitted for coaching progress tracking
- Injury and health notes: Injuries, medical conditions, physical limitations, health history as entered by a client or their coach
- Reproductive and hormonal health: Any such data a user voluntarily logs (the platform does not specifically solicit this)
- Precise geolocation: GPS routes from Strava, Garmin, and other connected activity trackers constitute consumer health data under MHMD because they can reveal exercise patterns and potentially health conditions
3. Categories of Consumer Health Data We Collect and Their Sources
| Category | How Collected | Source |
|---|---|---|
| Heart rate, HRV, SpO2, sleep, stress | API sync (with consent) | Fitbit, Oura, WHOOP, Garmin, Apple Health, Google Health Connect |
| Activity data, GPS routes | API sync (with consent) | Strava, Garmin, Fitbit, Apple Health, Google Health Connect |
| Body weight, measurements | Entered by client or coach | User input in the Kounisou app |
| Progress photos | Uploaded by client | User upload |
| Nutrition logs, food photos | Entered by client, or synced (with consent) | User input; food photos also sent to AI for analysis. Food the client logs in other apps (e.g. MyFitnessPal, Cronometer) and shares with Apple Health or Google Health Connect, when they connect them |
| Injury and health notes | Entered by coach or client | User input |
| Check-in responses | Entered by client | Structured check-in forms |
4. Purposes for Which We Process Consumer Health Data
We process consumer health data only for the following purposes:
- Delivering coaching services: Providing coaches and their clients with the core platform functionality — progress tracking, workout assignment, nutrition logging, AI-assisted plan generation, and reporting.
- AI-assisted feature delivery: Sending relevant health data to AI model providers to generate workout plans, meal plans, food-photo nutritional estimates, and client progress reports at the Coach's or client's request.
- Wearable integration: Retrieving and displaying health metrics from connected devices and platforms.
- Security and platform integrity: Detecting fraud, abuse, and unauthorised access.
- Legal compliance: Responding to lawful requests, exercising legal rights, and satisfying regulatory obligations.
We do not process consumer health data for:
- Advertising or marketing purposes
- Sale, rental, or licensing to third parties
- Employment-related decisions
- Insurance underwriting
- Building consumer profiles for purposes unrelated to the coaching service
- Location geofencing or proximity-based tracking
5. Who We Share Consumer Health Data With
We do not sell consumer health data. We do not share consumer health data with data brokers.
We share consumer health data only with:
| Recipient | Purpose | Basis |
|---|---|---|
| The user's assigned Coach | Core platform functionality — coach must see client health data | User consent at platform sign-up; coach is data controller |
| Supabase | Database storage and authentication | Data processing agreement; processor role |
| Vercel | Hosting and serverless function execution | Data processing agreement; processor role |
| OpenRouter / Anthropic | AI feature delivery (workout plans, meal plans, analysis) | User consent; data processing agreement |
| Sentry | Error monitoring — technical error reports, without session recordings | Data processing terms |
| PostHog | Product analytics — only with your consent; receives no consumer health data | Data processing terms |
| Resend | Email delivery — may carry coaching content your coach sends you, such as reports | Data processing terms |
| Daily.co | Live video calls with your coach (not recorded) | Data processing terms |
| Wearable vendors (on import only) | OAuth callback handling for data retrieval | User-initiated OAuth consent |
| Law enforcement or courts | Legal obligation | Lawful order or legal requirement |
We do not use consumer health data to train AI models. Under Anthropic's commercial terms, API inputs and outputs are not used to train its models by default.
6. How We Obtain Your Consent
6.1 Platform Sign-Up Consent
When a Coach invites a client to the platform, the client must affirmatively consent — via a clear checkbox or button — to the collection and processing of their health data for coaching purposes before the platform becomes functional. This consent is recorded with a timestamp and version number in our consent records table.
6.2 Wearable and Health Platform Connection Consent
Before connecting any wearable device or health platform (Fitbit, Oura, WHOOP, Strava, Garmin, Apple Health, Health Connect), we present a clear disclosure describing:
- The data categories that will be imported
- The purpose of the import
- The option to revoke access at any time
The user must affirmatively confirm this consent. Access tokens are stored securely and revoked promptly upon disconnection.
6.3 Separate Consent for Sensitive Data
Where applicable law requires separate consent for the collection of specific categories of health data (e.g., precise geolocation under MHMD), we obtain that consent at the time of data collection.
6.4 Consent Withdrawal
You may withdraw consent at any time by:
- Disconnecting wearables in Settings → Integrations
- Requesting account deletion in Settings → Privacy & Data
- Emailing admin@kounisou.com
Withdrawal of consent does not affect the lawfulness of prior processing. Withdrawal may prevent delivery of coaching features that depend on the relevant data.
7. Your Rights Regarding Consumer Health Data
7.1 Washington Residents (MHMD)
Under RCW 70.372, Washington residents have the right to:
- Confirm whether we process your consumer health data
- Access a list of third parties with whom we have shared your consumer health data
- Delete your consumer health data (submit a request and we will delete within 45 days of identity verification)
- Withdraw consent for future collection or sharing at any time
Kounisou will not deny services, charge different prices, or otherwise discriminate against you for exercising these rights.
7.2 Nevada Residents (NRS Chapter 629C)
Under Nevada's consumer health data law, Nevada residents have the right to:
- Confirm whether we process your consumer health data
- Access a list of third-party categories with whom we share your data
- Delete your consumer health data upon verified request
- Withdraw consent at any time
7.3 Connecticut Residents (CTHIPA)
Under Connecticut SB 3 / Public Act 23-16, Connecticut residents have the right to:
- Access, correct, and delete consumer health data
- Withdraw consent at any time
- Appeal a denial of a rights request
7.4 All Users
Regardless of your state of residence, you may:
- Export your health data from Settings → Privacy & Data
- Request deletion of your account and health data from Settings → Privacy & Data, or by emailing admin@kounisou.com
- Disconnect any wearable integration at any time
8. How to Submit a Health Data Rights Request
Email: admin@kounisou.com Subject line: "Consumer Health Data Rights Request" Include: Your name, the email address associated with your account, and a description of your request.
We will respond within 45 days of receiving a verified request. We will verify your identity before processing requests that involve disclosure or deletion of your data.
If you are not satisfied with our response, you may appeal by emailing admin@kounisou.com with "Health Data Appeal" in the subject line. We will respond to appeals within 45 days. After exhausting our appeal process, you may contact your state Attorney General.
9. No Sale of Consumer Health Data
Kounisou does not sell consumer health data. We do not receive money, services, or other valuable consideration in exchange for consumer health data. This applies to all user types and data categories listed in this policy.
10. No Geofencing Based on Health Data
Kounisou does not use consumer health data to establish or operate any virtual barrier (geofence) for the purpose of identifying, tracking, profiling, or sending notices to individuals based on their physical proximity to any location that provides health care services or any other health-related location.
11. Data Retention and Deletion
Consumer health data is retained for as long as your account is active. Upon account deletion:
- A 30-day grace period begins during which you may cancel the deletion request
- After 30 days, all consumer health data is permanently deleted from our active systems
- Encrypted backups roll off within 30 days
- Billing records required for legal compliance (not health data) are retained for 7 years
12. Contact
Consumer Health Data Privacy Contact: Email: admin@kounisou.com (subject: "Consumer Health Data") Entity: Kounisou LLC, Denver, Colorado
13. Updates to This Policy
We will provide advance notice of any material changes to this policy by email and in-app notification. Updates will be posted at kounisou.com/consumer-health-data.