Consumer Health Data Privacy Policy

This policy covers consumer health data: personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status. It applies to everyone who uses Squatly, and it provides the disclosures required by the Washington My Health My Data Act (MHMDA) and Nevada's consumer health data law (SB 370) for residents of those states.

Our Privacy Policy describes how we handle all other personal data. Where the two overlap, this policy controls for consumer health data.

Apple Health Data

If you grant the iOS Health permission and separately consent in the app, we collect the following from Apple Health:

• Sleep
• Heart rate variability and resting heart rate
• Steps and active energy
• Body weight
• Workouts recorded by other apps or devices

These values are combined on your device into one normalized summary per day. Only the daily summaries are uploaded; we never receive your raw Apple Health database.

Fitness Data You Enter in Squatly

The training data you log in Squatly — workouts, sets, body weight and measurements, and progress photos — may also be consumer health data. It receives the same protections described in this policy: we do not sell it, do not share it with third parties for their own use, and do not use it for advertising. Our Privacy Policy describes its handling in full.

Consumer health data comes from exactly two sources:

• Apple HealthKit on your device, read only after you grant the iOS Health permission and separately consent in the app
• You, when you log training data in the app

We do not buy, license, or otherwise obtain consumer health data from any other source, and we do not infer health data from your browsing or from other apps.

We collect Apple Health data for one purpose: to compute your training load and recovery, so the app can reflect how training and daily life affect your readiness.

We do not use it for anything else. Specifically:

• It is never used for advertising or marketing
• It is never sent to analytics or advertising partners
• It is not included in AI coaching context and is not sent to our AI providers
• It is never used to train machine-learning models

If we ever want to collect additional categories of consumer health data or use it for a new purpose, we will ask for your consent first.

• Daily health summaries are stored on Squatly's servers in the United States, encrypted in transit and at rest, with access restricted to your own account
• Your device keeps no health values on disk — only sync bookkeeping (a backfill flag and a last-sync timestamp), so health data never enters your device or iCloud backups via Squatly
• Each daily record is automatically deleted 24 months after collection
• Deleting your account deletes all of your health records immediately

We do not sell consumer health data, and we do not share it with third parties or affiliates for their own use. There are no categories of third parties, and no affiliates, with whom we share consumer health data.

One service provider processes it on our behalf: our cloud hosting provider (Amazon Web Services), which stores the data under contract, acts only on our instructions, and may not use it for any other purpose. We would disclose consumer health data to authorities only if legally compelled.

Selling consumer health data would require your separate, signed authorization under Washington law. We do not seek that authorization, because we do not sell it.

We collect Apple Health data only after two separate affirmative steps: the iOS Health permission, and an explicit consent inside the app. Declining either means nothing is read. If you decline, the app does not ask again, and you can change your mind later in the app's Settings.

The date and version of your consent are recorded so we can prove what you agreed to and when.

Access

You can ask us to confirm whether we collect consumer health data about you, to receive a copy of it, and to receive a list of the third parties with whom we have shared it (that list is empty). Email support@squatly.app.

Withdraw Consent

Disconnect Apple Health in the app's Settings at any time. Collection stops immediately. Records collected before you withdrew remain stored until they expire (24 months), until you delete your account, or until you ask us to delete them — whichever comes first.

Delete

Deleting your account in the app's Settings permanently deletes all of your consumer health data immediately. If you want your health data deleted without deleting your account, email support@squatly.app and we will delete it, including from our service provider's systems.

How and When We Respond

We respond to rights requests within 45 days of receipt. If a request is unusually complex, we may extend once by a further 45 days and will tell you why within the first 45. Exercising these rights is free, and we will never discriminate against you for doing so.

If we decline to act on a request, you may appeal by replying to our decision (or emailing support@squatly.app with "Appeal" in the subject line). We will respond to your appeal in writing within 45 days of receiving it, with an explanation of our decision.

If your appeal is unsuccessful and you are a Washington resident, you may contact the Washington State Attorney General at atg.wa.gov/file-complaint to submit a complaint.

If we change what consumer health data we collect, why we collect it, or how it is shared, we will update this policy and obtain your consent before collecting or using your data in the new way. The "Last updated" date at the top reflects the current version.

Questions about this policy or your consumer health data: support@squatly.app

Osgiliath Labs, LLC, 7901 4th St N, STE 300, St. Petersburg, FL 33702, United States.