Consumer Health Data Privacy Policy

Last updated & effective: July 7, 2026

This policy supplements our Privacy Policy and describes how Whetstone ("we", "us") handles "consumer health data" as defined by the Washington My Health My Data Act, Nevada SB 370, and similar consumer health data laws. It applies to residents of those states and to anyone whose consumer health data is collected there — and we apply these practices to all users.

1. Categories of consumer health data we collect

Body measurements and characteristics you provide: age, sex, height, weight, activity level, fitness goals.
Fitness and exercise data: workouts you log (exercises, sets, weights), training preferences, streaks, and — with your permission — step count and walking/running distance read from Apple Health.
Nutrition data: foods and meals you log, meal photos you submit for identification, calorie and macronutrient information, dietary preferences, restrictions, and allergies.
Wellness data: sleep schedule preferences, mood-adjacent entries such as reflections, gratitude journaling, and mindfulness/breathing activity.
Health-related information you volunteer in free-text messages to the AI coach.
Inferences derived from the above to provide the Services (e.g., calorie targets, plans, recommendations).

We do not collect biometric identifiers, genetic data, precise location, reproductive or sexual health data as service categories, and we do not use geofencing of any kind (including around health care facilities).

2. Why we collect it (purposes)

To provide the features you request: food and workout logging, movement rings, calorie/macro targets, day planning, streaks, and AI coaching.
To sync your data across your devices.
For security, debugging, and legal compliance.

We collect and use consumer health data with your consent and only as necessary to provide the features you use. We do not use it for advertising or marketing, and we will ask for separate consent before any new use.

3. Sources

Directly from you (what you enter, log, photograph, or type).
From Apple HealthKit, only with your permission (steps, walking/running distance; read-only).

4. Who receives consumer health data

We do not sell consumer health data and have no plans to; a sale would require your separate, signed authorization under Washington law, which we will never request. We do not share it for advertising. It is disclosed only to the processors that operate the Services, bound by contracts limiting their use of it:

Google LLC (Firebase / Google Cloud) — data storage, authentication, and cloud functions.
Anthropic PBC — AI processing to generate coaching responses and plans (no model training on your data under our API configuration).
OpenAI, L.L.C. — AI processing, including meal-photo identification (no model training on your data under our API configuration).

Affiliates: Whetstone has no affiliated companies with which consumer health data is shared. If that changes, we will list them here before sharing.

We may also disclose consumer health data where required by law or legal process, or to protect safety, as described in our Privacy Policy.

5. Your rights

Right to know / access — confirm whether we collect, share, or (never) sell your consumer health data, and receive a list of third parties with whom it has been shared.
Right to withdraw consent — stop future collection or sharing (e.g., revoke Apple Health access in iOS Settings, stop using a feature, or contact us).
Right to delete — delete your consumer health data, including from backups per backup cycles: use Settings → Delete Account in the App, delete individual entries in-app, or email us.
Right to appeal — if we decline a request, you may appeal by replying to our decision. If your appeal is unsuccessful, you may contact the Washington State Attorney General at atg.wa.gov/file-complaint (or your state's Attorney General).
Non-discrimination — we will not discriminate against you for exercising any right.

To exercise rights: email dillonkeating20@gmail.com with the subject "Health Data Request". We will verify the request using your account email and respond within 45 days (extendable once by 45 days with notice, where permitted).

6. Changes

We will post updates to this policy here with a new "last updated" date and, for material changes, provide additional notice as required by law.

7. Contact

dillonkeating20@gmail.com