Consumer Health Data Privacy Policy

Last updated: October 1, 2026

This is a standalone policy, separate from our general Privacy Policy. It describes the consumer health data that Speed Macros collects, why we collect it, where it comes from, who we share it with, and how you can use your rights. It is written to meet Washington's My Health My Data Act (RCW 19.373), Nevada's consumer health data law (NRS Chapter 603A, as amended by SB 370), and the consumer health data provisions of the Connecticut Data Privacy Act. We apply the same safeguards, consent requirements, and no-sale commitment to every user, wherever they live.

Speed Macros is operated by Aariz Noorani, an individual doing business as Speed Macros. Contact: nooraniaaariz@gmail.com.

1. Consumer Health Data We Collect

"Consumer health data" means personal information that identifies, or could reasonably be linked to, your past, present, or future physical or mental health status, including information inferred from other data. At Speed Macros it includes:

• Body data: sex, birth date and age, height, current and target weight, current and target body-fat percentage and how you measured it, weigh-ins, waist, neck, and hip measurements, sleep hours, and notes you add to those entries.
• Nutrition data: food and drink logs (descriptions, portions, nutrients, water intake), saved recipes, remembered ingredients, allergens and intolerances, supplements you are open to, dietary preferences you choose (some of which may also reveal religious beliefs), and your optional typical daily outdoor-time range.
• Fitness data: activity level, training frequency and cardio type, goals, workout sessions, exercises, sets, and effort ratings.
• Bloodwork data: lab values and notes you save.
• Photos and videos: progress check-in photos and videos you upload, and food, label, or lab-report photos you submit for an AI estimate. Speed Macros does not store food, label, or lab-report photos. They are used only for the requested AI estimate.
• Inferences: nutrition targets, daily summaries, nutrient and biomarker ratings, and AI-generated estimates derived from the data above.
• Health information in messages: anything health-related you put in feedback or AI Nutrition Chat messages (where chat is offered).
• Consent records: when you gave or withdrew health-data and AI-sharing consent and acknowledged the health disclaimer.

We do not collect precise location, biometric identifiers, genetic data, or data about reproductive or sexual health, gender-affirming care, or healthcare-facility visits. We do not import data from Health Connect or wearables. If you turn on the optional Apple Health link in our iPhone app, we import the weight and body-fat measurements you allow from Apple Health and save each day's nutrition totals and water to Apple Health; see Section 2.

2. Where It Comes From

• From you: what you enter, photograph, upload, or type.
• Generated by the Service from your data: calculated targets, summaries, ratings, and AI estimates, which you review before saving.
• From our AI processor: the estimate Anthropic returns for a submission, only when AI sharing is on and you request an AI feature.

We do not buy consumer health data or obtain it from data brokers or other third parties.

Apple Health (optional, iPhone app only): if you connect Apple Health in Settings and allow it in Apple's permission screen, we read weight and body-fat percentage to fill in days without a weigh-in (your own entries always win) and write each day's calories, protein, carbohydrate, fat, fiber, and water to Apple Health. Apple Health data is used only for your tracking in Speed Macros. It is never used for advertising, sold, used for data mining, sent to our AI provider, or stored in iCloud by us. You can turn the link off in Settings or remove our access in the Health app at any time.

3. Why We Collect and Use It

• To provide the features you request: calculating nutrition, macro, and micronutrient targets, logging food, workouts, weight, and bloodwork, storing progress media, and showing your trends and ratings.
• To produce AI estimates from what you submit, only if AI sharing is on.
• To read and respond to feedback you send.
• To keep the Service secure and operating, including backups and troubleshooting.
• To comply with the law and respond to your rights requests.

We do not use consumer health data for advertising, marketing, or profiling, to decide eligibility for credit, insurance, housing, or employment, or to train AI models. We collect and use consumer health data only as reasonably necessary to provide the Service you asked for. We will not collect, use, or share additional categories of consumer health data, or use it for additional purposes, without first getting your consent.

4. Your Consent

• Collection and use: during setup, you give a separate, affirmative consent to Speed Macros collecting and using your health information to provide the Service. This consent is separate from accepting the Terms and the Privacy Policy. We do not collect consumer health data before you give it.
• Sharing with our AI processor: a second, optional consent. You can leave it off and use manual entry.
• Withdrawing consent: you can turn off AI sharing at any time in Settings, under Legal & Privacy. To withdraw consent to all collection and use, delete your account in Settings or email us. Tracking health information is the Service itself, so we cannot keep an account open without it. Withdrawal stops future processing. It does not undo processing already done.

5. Who We Share It With

We share consumer health data only with the processors below. Each processes it on our behalf, under a contract that limits its use to providing services to us. Speed Macros has no affiliates that receive consumer health data.

• Supabase, Inc. (database, authentication, and private file storage): receives all consumer health data listed in Section 1, except food, label, and lab-report photos, which are not stored. Privacy contact: supabase.com/privacy.
• Vercel Inc. (hosting and delivery): processes consumer health data as it passes between your device and our database. Privacy contact: vercel.com/legal/privacy-policy.
• Anthropic, PBC (AI processing, only with your AI-sharing consent): receives the specific submission and context an AI request needs, such as a food description or photo with your allergens, dietary preferences, and remembered ingredients, a label photo, a lab-report photo, or, if you choose, a chat context summary. Anthropic does not train on this data and deletes it within 30 days, except as its terms allow for safety enforcement or legal compliance. Privacy contact: anthropic.com/legal/privacy.

Our email delivery provider, Brevo (Sendinblue SAS, France), receives only your email address and sign-in emails. It receives no consumer health data.

Referrals: if you sign up with someone's referral link, that person may be able to see that their code was used when you complete setup, and they receive a reward when you make your first purchase. No health activity triggers a referral reward, and they never see your meals, measurements, or any other health records.

We may also disclose consumer health data when the law requires it, for example in response to a valid court order. We will tell you about such a request unless the law forbids it.

We do not sell consumer health data and will not do so without your separate, signed authorization as the law requires. We do not use consumer health data for targeted advertising, and no third party collects data about your activity across other apps or websites through Speed Macros. We do not use geofencing around healthcare facilities.

6. How We Protect It

Consumer health data is protected by HTTPS encryption in transit, database row-level security tied to your own sign-in session, private account-scoped storage with short-lived signed links for media, and encryption of the offline queue in the mobile apps. Access is limited to people who need it to operate the Service, and they are bound by a duty of confidentiality.

7. Your Rights

Wherever you live, you can:

• Confirm and access: confirm whether we collect, share, or sell your consumer health data, and get a copy of it, together with the list of processors we share it with (Section 5) and their contact information. Plan, then Export gives you your main records immediately. Email us for anything the export does not include, such as progress media files, custom exercises, or feedback messages.
• Correct: edit your entries and profile in the app, or ask us to correct them.
• Withdraw consent: as described in Section 4.
• Delete: delete your account in Settings, or ask us to delete it. Deletion removes your consumer health data from our active database and private storage, which Supabase holds on our behalf. Anthropic deletes AI submissions on its own schedule, within 30 days (Section 5). Copies in backups are deleted as those backups expire, within 7 days and in no case later than six months. We do not use backup copies for any other purpose.
• Appeal: appeal our decision on any request (Section 8).

We will not discriminate against you for exercising these rights.

8. How to Exercise These Rights

• In the app: Settings (AI-sharing consent, Delete Account) and Plan, then Export.
• By email: nooraniaaariz@gmail.com. Send it from the email address on your account, or tell us which one it is, so we can verify the request. If we cannot verify you, we will explain why and what we need. An authorized agent may submit a request where the law allows.
• Timing: we respond within 45 days of receiving a verified request. If a request is complex, we may extend that once by up to 45 more days, and we will tell you within the first 45 days. Requests are free up to twice a year.
• Appeals: if we decline a request, you can appeal by replying to our decision or emailing nooraniaaariz@gmail.com with the subject "Health data appeal". We will respond within 45 days (60 days for Connecticut residents), explain our reasoning, and tell you how to contact your Attorney General if you disagree: Washington (atg.wa.gov), Nevada (ag.nv.gov), or Connecticut (portal.ct.gov/ag).

9. Changes to This Policy

We will update the "Last updated" date whenever this policy changes. Before we collect, use, or share consumer health data in a way this policy does not describe, we will notify you and ask for your consent.

10. Contact

nooraniaaariz@gmail.com. We do not currently publish a postal address; please contact us, including for legal notices, at nooraniaaariz@gmail.com, and we will provide a postal address if the law requires one for your request.