Consumer Health Data Privacy Policy

Scope

This Consumer Health Data Privacy Policy explains how Nuko Nova Dynamics LLC ("DropPace," "we," "us," or "our") collects, uses, shares, and protects "consumer health data" as defined by the Washington My Health My Data Act, the Nevada consumer health data law (NRS 603A.400–603A.550), and similar U.S. state laws. It applies to the DropPace mobile app and our websites. For everything else we process, see our Privacy Policy. This policy is effective as of the "Last updated" date above.

1. Consumer health data we collect, and why

DropPace collects the following categories of consumer health data, only with your permission and only when you ask us to turn a workout into a share image:

• Workout and exercise records you authorize from Apple HealthKit or Google Health Connect — workout type, start and end time, duration, distance, pace, calories, and heart rate.
• Workout route location data — the GPS route (polyline) of a workout you choose to render, which is precise location information associated with exercise.
• Derived health information — stats computed from the above (for example, average pace) so they can be drawn on your image, and validation results confirming the image matches your workout.
• A random device-scoped identifier — used to attach your entitlements and usage limits to your installation; it is linkable to the data above only while we process your render.

We collect and use this data for one purpose: to create the share image you request, validate that its stats match your workout, and deliver it to you. We do not use consumer health data for advertising or marketing, we do not sell it, and we do not use it to determine eligibility for anything.

2. Sources of consumer health data

• Apple HealthKit or Google Health Connect on your device, read only with the permission you grant in your device settings; and
• you, through the workout, stats, and options you select in the app.

We do not buy consumer health data, collect it from data brokers, or collect it from other apps or websites.

3. How consumer health data is processed

Your workout data is read on your device and transmitted over encrypted connections to our backend, which sends the selected stats and route (and, for photo modes, your photo) to our image-generation processor to render and validate your image. The workout and route data are processed only for the duration of the render and then discarded; the finished image is cached for up to 30 days so you can re-download it, then deleted automatically. Processing happens in the United States and in the countries where our processors operate.

4. Sharing, and the third parties that process this data

We do not sell consumer health data, and we do not "share" it as state health-data laws define that term. We disclose it only to service providers (processors) that handle it on our documented instructions, under binding contracts, solely to provide the service you request:

• OpenAI (OpenAI, L.L.C.) — receives the selected workout stats and route shape (and, for photo modes, your photo) to generate your image and validate its stats. It does not use this data to train its models.
• Convex (Convex, Inc.) — hosts our backend and the temporary storage for generated images.

No other vendor receives your consumer health data — our analytics and crash-reporting events do not contain workout, route, or health information. We have no affiliates with whom we share consumer health data. On request, we will provide the list of third parties with whom consumer health data has been shared and an email contact for each.

5. Your rights

You have the right to:

• Know and access — confirm whether we collect, share, or sell your consumer health data and access it, including the third parties it has been shared with and how to contact them;
• Withdraw consent — stop our collection at any time by revoking HealthKit or Health Connect access in your device settings;
• Delete — have your consumer health data deleted, including from archived and backup systems, with deletion requests passed on to our processors; and
• Not be discriminated against for exercising any of these rights.

How to exercise them

Use Settings → Privacy → "Delete my data" in the app to delete the data tied to your device, or email [email protected]from the device in question (or include your Support ID from Settings → About) so we can verify the request. We respond within the time your state's law requires. If we decline a request, you may appeal by replying to our decision; we will review the appeal and respond with the outcome and, if we still decline, you may contact your state attorney general.

6. Cross-site collection

We do not allow third parties to collect your consumer health data across different websites or online services over time, and we do not track you across other apps or websites.

7. Changes to this policy

If we make material changes, we will update the "Last updated" date above and notify you in the app or on this site before the changes take effect. Past versions are available on request.

8. Contact

Questions or requests about consumer health data? Email [email protected].