Washington Consumer Health Data Privacy Policy

This Consumer Health Data Privacy Policy applies to consumer health data subject to the Washington My Health My Data Act ("MHMDA") and supplements the general CholesTrack Privacy Policy.

CholesTrack is operated by Peakline Innovations LLC ("Peakline," "we," "us," or "our").

This Policy describes the consumer health data CholesTrack processes, why we process it, its sources, circumstances in which it may be disclosed, and the rights available to Washington consumers.

1. Consumer Health Data We Collect or Process

Depending on the features you choose to use, CholesTrack may collect or process consumer health data including:

• health-related profile selections, including high cholesterol, high LDL, high blood pressure, familial hypercholesterolemia, post-cardiac-event status, statin use, general-prevention goals, and other health-related selections;
• age, sex, height, weight, and activity-level information when used in connection with health or nutrition functionality;
• foods, meals, serving sizes, eating history, and nutrient-intake information;
• customized nutrient targets and preferences;
• Health Scores;
• nutrition trends and related information generated or derived from information you provide;
• custom foods and recipes associated with your account;
• product scans, searches, or related information when that information is reasonably linkable to you and reveals or is used in connection with your health or nutrition behavior; and
• other information that qualifies as consumer health data because it identifies or is reasonably linkable to your past, present, or future physical or mental health status.

Certain additional health information may be processed locally on your device without being transmitted to Peakline.

For example:

Lipid Journey. Cholesterol laboratory values and related milestones that you enter into Lipid Journey are stored locally on your device. Peakline does not receive or store those values on its servers.

Apple Health. If you grant permission, the App may read step-count and body-weight information from Apple Health for display on your device. Peakline does not receive or store this Apple Health information on its servers.

2. Sources of Consumer Health Data

We obtain consumer health data from:

• you when you provide information to CholesTrack;
• your use of CholesTrack's food, meal, nutrition, profile, and related features;
• Apple Health when you expressly authorize CholesTrack to access supported information locally on your device; and
• information CholesTrack generates or derives from other information you provide, such as nutrient totals, personalized targets, Health Scores, and trends.

3. Why We Collect and Use Consumer Health Data

We collect and use consumer health data to provide functionality that you request, including to:

• create and maintain your health and nutrition profile;
• calculate personalized nutrition targets;
• record and display foods and meals;
• calculate nutrient intake;
• generate and display Health Scores;
• display nutrition trends;
• synchronize applicable account information across supported devices;
• provide custom-food and recipe functionality;
• operate features that you choose to use;
• maintain the security and integrity of the Service;
• troubleshoot the Service; and
• comply with applicable law.

We do not use consumer health data for targeted advertising.

4. Categories of Consumer Health Data We Share

Peakline does not sell consumer health data.

Peakline does not share consumer health data with advertisers or data brokers.

We may use processors to process information on our behalf when reasonably necessary to provide the Service requested by you.

For example, Supabase processes certain account, profile, meal, nutrition, and related information on our behalf to provide authentication and database functionality.

Amazon Web Services provides infrastructure relating to FoodDB, product-search and scanning functionality, nutrition-label image processing, and related security and operational functions. AWS does not receive CholesTrack's server-stored health-condition profile or meal history merely because you use FoodDB unless required by the particular functionality being requested.

Apple provides certain platform functionality, including Apple authentication, App Store subscriptions, optional speech recognition, and Apple Health functionality. Apple Health data described above remains on your device as part of CholesTrack's design and is not transmitted to Peakline.

Google provides authentication when you choose Sign in with Google.

These service providers process information on Peakline's behalf or provide functionality requested by the consumer and are subject to applicable contractual and legal restrictions.

5. Third Parties and Affiliates

Peakline does not currently share consumer health data with third parties or affiliates for independent advertising, data brokerage, or unrelated commercial purposes.

If we begin sharing consumer health data with an additional category of third party or affiliate in circumstances requiring consent under Washington law, we will make the required disclosure and obtain applicable consent before the sharing begins.

6. Sale of Consumer Health Data

Peakline does not sell consumer health data.

We will not sell consumer health data subject to the Washington My Health My Data Act without first obtaining the separate valid authorization required by applicable law.

De-identified factual information in FoodDB that is no longer reasonably linkable to a consumer is not treated by Peakline as identifiable consumer health data.

7. Your Washington Consumer Health Data Rights

Subject to applicable law, you may request:

Confirmation and access. You may ask whether Peakline is collecting, sharing, or selling consumer health data concerning you and request access to applicable consumer health data.

Disclosure information. Where applicable, you may request information about third parties and affiliates with whom your consumer health data has been shared or sold.

Withdrawal of consent. You may withdraw consent to future collection or sharing of consumer health data where the processing depends on your consent.

Withdrawing consent does not necessarily affect processing that occurred lawfully before withdrawal.

A requested feature may stop working if the consumer health data necessary for that feature can no longer be processed.

Deletion. You may request deletion of consumer health data concerning you.

Where required by Washington law, Peakline will also notify applicable processors, contractors, affiliates, and third parties that received the consumer health data of a qualifying deletion request.

If consumer health data subject to deletion exists in archived or backup systems, deletion may be delayed until those systems are restored or accessed, but not beyond the period permitted by Washington law.

8. How to Exercise Your Rights

You may exercise applicable rights by:

• using account or deletion controls available in the CholesTrack App; or
• emailing support@cholestrack.com.

For an email request, please state that you are submitting a Washington Consumer Health Data Request and describe the right you wish to exercise.

You do not need to create a new account solely to exercise your rights.

If you already have a CholesTrack account, we may ask you to authenticate through or using information associated with that account.

We may request additional information when reasonably necessary to authenticate a request.

We will respond without undue delay and, where Washington law applies, generally within 45 days after receiving the request. Where reasonably necessary and permitted by law, that period may be extended once by an additional 45 days, in which case we will notify you of the extension and reason.

Qualifying requests are provided without charge up to the frequency required by applicable law. Manifestly unfounded, excessive, or repetitive requests may be handled as permitted by law.

9. Appeals

If Peakline refuses to take action on a request and you have an applicable right to appeal, you may appeal our decision.

Send your appeal to:

support@cholestrack.com

Use the subject line:

Washington Privacy Appeal

Please identify the request you are appealing and explain why you believe our decision should be reconsidered.

We will provide a written response within the period required by applicable law.

If an appeal is denied, we will provide information about how you may submit a complaint to the Washington Attorney General where required.

10. Security and Access

Peakline restricts access to consumer health data to personnel, contractors, and processors for whom access is reasonably necessary to provide the Service requested by the consumer, administer or secure the Service, or satisfy applicable legal obligations.

We maintain administrative and technical safeguards designed to protect consumer health data appropriate to the nature and sensitivity of the information.

No technical system can guarantee absolute security.

11. Additional Categories or Purposes

Peakline will not collect, use, or share additional categories of consumer health data, or use consumer health data for materially additional purposes requiring consent under Washington law, without first providing the disclosures and obtaining the consent required by applicable law.

12. Contact

Questions or requests concerning this Consumer Health Data Privacy Policy may be directed to:

Peakline Innovations LLC
Attn: Privacy Officer
Email: support@cholestrack.com