Consumer Health Data Privacy Notice

Effective September 9, 2026

This notice applies to the invite-only, unpaid U.S. adult wellness pilot operated by [email protected]. The dashboard is not medical care, diagnosis, treatment, disease monitoring, injury clearance, or an emergency service. Do not use it if you are under 18 or need medical advice.

Privacy and rights contact: [email protected]

Who this notice covers

Named adults who receive a personal invitation and sign in with Google. The dashboard is not offered through doctors, insurers, employers, or public signup. It is not intended for EEA or UK residents.

Consumer health data we collect

• WHOOP records you authorize: recovery and strain scores; sleep timing, stages, need, efficiency, consistency, and disturbances; workouts, activity timing, distance, and energy expenditure; heart rate, heart-rate variability, respiratory rate, blood-oxygen percentage, skin temperature, VO2 max, and associated timestamps and source metadata.
• Information you enter or upload: date of birth, height, sex used for estimates, timezone, units, state of residence, goals, journal and check-in answers, nutrition, weight and body composition, symptoms, training, Strong workout exports, Omron exports, custom metrics, and—only when you separately enable Coach Kaiya—messages, conversation titles, meal descriptions, food or nutrition-label photos, qualitative progress or exercise photos you submit to that feature, Memory notes, and optional progress photos you ask Coach Kaiya to remember.
• Coach Kaiya records: saved user messages, Coach Kaiya replies and their compact decision, evidence, and limitation metadata, conversation titles and summaries, structured meal, goal, workout, rest-day, or Memory proposals, confirmation or cancellation status, Memory notes and optional progress photos that survive daily chat reset, and the ordinary health-log records created after you confirm a proposal. Conversations and memories can reveal or allow inferences about your health, habits, fitness, and goals even when you do not enter a measurement directly.
• Derived information: correlations, baselines, ranges, trends, targets, energy estimates, training guidance, and other recommendations calculated from your records.
• Account and security information: Google account identifier, email, display name, invitations, essential session-cookie data, consent and terms records, WHOOP OAuth credentials, IP address and request metadata in host security logs, and account-audit events.

We collect this information directly from you, from files you choose to upload, from Google for identity, from WHOOP after authorization, and from calculations performed by the dashboard.

Why and how we process it

We use the data only to authenticate you, operate and secure your private account, import records you request, display your history, calculate personal wellness insights, provide export/deletion controls, troubleshoot support requests, and comply with law. You may choose which nutrition measurements to track—including calories, macros, hydration, micronutrients, or custom numeric nutrients—and may change those choices later without deleting prior records. Most insights are generated by deterministic application code from the records in your account. If you separately enable Coach Kaiya, we also use relevant account data to answer wellness questions, maintain conversation continuity, prepare nutrition estimates, keep Memory notes you asked Coach Kaiya to remember, learn limited account-specific patterns from repeated confirmed corrections, and propose editable meal, goal, workout-plan, rest-day, or Memory changes. Those learned patterns stay in your tenant, are not used to train a global model, and can be reset in Coach Kaiya settings.

Coach Kaiya is off by default and the former nutrition-only preference does not enable it. After you opt in, the app may send OpenAI the current message, a bounded set of recent messages, a compact conversation summary, active Memory titles and text (not stored Memory photos unless you attach a photo to the current request), the selected date and page, and the minimum relevant profile, goal, nutrition, body-composition, recovery, sleep, check-in or symptom, WHOOP-derived, and training data needed for the request. The app selects at most the relevant health domains rather than sending the complete account or lifetime conversation. Requests for diagnosis, treatment, disease management, medication interactions, pregnancy, allergies, eating-disorder guidance, injury clearance, or emergency help are not permitted. USDA receives only short candidate-food lookup phrases derived from a meal description, not the original question, photo, or account record.

Before upload, the browser resizes photos and re-encodes them, removing filenames and embedded metadata such as camera and location fields. Do not submit photos showing people, identifying surroundings, account information, or receipts and labels containing names, addresses, order numbers, or other identifiers. Visual food and portion estimates can be wrong, particularly when ingredients are hidden or scale is unclear.

We do not sell consumer health data, use it for targeted advertising, provide it to data brokers, or use it to train public models. We do not use precise location or geofencing.

Who processes or receives data

• Railway processes account, health, security-log, database, volume, and backup data to host the service.
• Google receives sign-in requests and provides identity information. Health records are not sent to Google by this dashboard.
• WHOOP receives OAuth and API requests when you connect, synchronize, disconnect, or revoke access. The dashboard imports records read-only and does not post health records to WHOOP.
• OpenAI processes Coach Kaiya messages, bounded conversation context and summaries, active Memory titles and text, food, nutrition-label, progress, or exercise photos, relevant health context, structured proposals, and generated responses only after you enable Coach Kaiya and submit a request. Requests use the API with response storage disabled and a one-way hashed tenant identifier rather than your name or email. The operator keeps optional provider data sharing disabled. OpenAI states that API data is not used to train its models unless the account holder opts in; default abuse-monitoring logs may retain customer content for up to 30 days, subject to OpenAI's terms and legal or safety exceptions.
• USDA FoodData Central may receive short food lookup terms after the AI identifies candidate foods. The app's USDA API key stays on the server. FoodData Central data is public-domain reference data; matching and portion calculations may still be incomplete or wrong.
• The operator may access the minimum account or health information necessary to respond to support requests, investigate security incidents, maintain the service, or comply with law.
• Government or legal recipients may receive information only when disclosure is legally required. The operator will evaluate and narrow such requests where legally permitted.

Member health data is not copied to the optional GitHub operator mirror. Strong and Omron files are processed locally after you upload them; the dashboard does not send data to Strong or Omron.

The app stores Coach Kaiya conversation text, titles, compact summaries, answer decision/evidence/limitation metadata, day-scoped resized photo attachments, proposals, and confirmation history in your tenant-isolated account only for the current waking day. Coach Kaiya resets—and those live chat records and photo attachments are deleted—when the dashboard advances to a new waking day at the 4:30 AM Good Morning rollover, or when the first log of a new day after sleep is recorded, whether that is a WHOOP sleep or recovery write or a manual log. You can continue today’s chat and view its photos on another signed-in device until that reset. An authenticated export includes only the current day’s remaining chat and photos, account-specific learned patterns, Memory notes, and any confirmed Memory photos. Clearing the chat does not undo ordinary health-log records, learned patterns, or Memory notes that you previously confirmed. Food photos, progress photos, and exercise photos are resized and re-encoded in the browser, stored with the Coach Kaiya message and selected local day, and may be sent again for same-day Coach Kaiya follow-ups. A photo you ask Coach Kaiya to remember is kept on the pending proposal until you confirm or the chat resets, then stored with that Memory until you delete the Memory or the account. The app stores aggregate daily request counts for abuse and cost controls for up to 90 days. Temporary meal-estimate sessions are deleted after 30 days; confirmed values become ordinary nutrition-log records.

Retention and deletion

• Active account and health data is retained while your account is active.
• Deleting a member account removes its live health data, WHOOP credentials, consent records, invitations, terms records, and profile fields. A minimal suppression record containing a random user ID, email, deleted status, and deletion timestamp remains so the deleted email cannot be re-invited.
• Railway backups may retain deleted data until they expire. Backup deletion will be completed as soon as operationally feasible and no later than six months after an authenticated deletion request; the pilot target is 30 days or less.
• Unused OAuth state records expire after about 10 minutes. Host security logs are retained only according to the configured Railway service retention period.
• Disconnecting WHOOP removes local credentials, attempts token revocation, stops future imports, and withdraws the dashboard's current WHOOP consent. Imported history remains until you use Delete WHOOP history or delete the account.
• Delete WHOOP history removes imported WHOOP records and stored values derived from them while preserving independently entered records.
• Turning off Coach Kaiya stops new external processing. Any remaining current-day chat is still cleared at the next morning reset. It does not undo health values, plans, or Memory notes you already confirmed. Account deletion removes conversations, summaries, proposals, Memory notes and photos, temporary estimates, and aggregate request counts from the active tenant database; processor copies may remain for the limited periods described above.

Your rights and choices

You may ask us to confirm whether we collect, share, or sell your consumer health data; access or export it; correct it; obtain the identity and contact information of recipients; withdraw consent and stop future collection; or delete it. The dashboard provides authenticated export, correction, WHOOP disconnect, WHOOP-history deletion, and member-account deletion controls.

You may also submit a request without creating a new account by emailing [email protected] from the address associated with your invitation. We may request limited additional information to authenticate you. Requests are free up to twice per year and will be handled without undue delay, normally within 45 days. If reasonably necessary, we may extend once for up to 45 additional days and will explain the extension during the initial period.

If we refuse a request, we will explain why. You may appeal by replying with the subject “Privacy appeal.” We will answer the appeal within 45 days and, if denied, provide the applicable state regulator's complaint method.

Withdrawing WHOOP consent or disabling Coach Kaiya stops future collection or external processing for that feature but does not affect processing already completed at your request. Deleting an account triggers deletion from active systems and applicable processors; archived or backup deletion may take the period described above.

Security and breach response

The production service uses HTTPS, access-controlled Google sign-in, tenant-isolated storage, encrypted WHOOP credentials, request-origin protection, and restricted administrator access. No system is risk-free. If we discover unauthorized acquisition of unsecured identifying health information, we will investigate, contain it, and provide notices required by the FTC Health Breach Notification Rule and applicable state law without unreasonable delay.

Cookies and online tracking

An essential session cookie keeps you signed in and protects account actions. The dashboard does not use advertising cookies, analytics pixels, or cross-site behavioral tracking. Because no cross-site tracking occurs, browser Do Not Track and Global Privacy Control signals do not change the dashboard's behavior. No third party collects personally identifiable information over time across unrelated websites through this dashboard. Google and WHOOP process information on their own sites when you intentionally follow their sign-in or authorization links, under their own notices.

Adults only

The pilot is for people 18 or older. Date of birth is required, and accounts for minors are not permitted.

Changes

Material changes will be posted with a new effective date. The Terms and Privacy checkboxes are collected during initial pilot account creation and are not repeated at ordinary sign-in. We will request a separate affirmative authorization before collecting new categories of WHOOP data, enabling Coach Kaiya external processing for an account, or using existing consumer health data for a materially different purpose. WHOOP authorization is versioned separately and is requested again only after withdrawal, reconnection, or a material change to WHOOP scopes or processing purpose.