Consumer Health Data Privacy Policy

1. About this policy

This Consumer Health Data Privacy Policy explains how Pushi collects, uses, shares, and protects "consumer health data" as defined by Washington State's My Health My Data Act (MHMDA). It supplements our main Privacy Policy and applies to residents of Washington and other US states with comparable consumer health data laws. Where this policy and the main Privacy Policy differ in respect of consumer health data, this policy applies.

Pushi is operated from Austria. For any question about this policy or your consumer health data, contact us at hello@pushi.fitness.

2. What consumer health data we collect

We treat the following as consumer health data:

• Your activity and exercise data — exercise minutes, intensity minutes, active hours, move calories, stand hours, steps, and distance;
• Workout metadata — workout type and duration;
• Your challenge score derived from the above; and
• Your Basal Metabolic Rate (BMR) and Move goal.

We do not collect precise location data and we do not use geofencing around any health facility.

3. Where this data comes from

Consumer health data is read, with your permission, from Apple HealthKit (iOS) or Google Health Connect (Android), and from your activity within Pushi challenges. Some figures are derived on your device before they reach our servers:

• Heart rate is read on your device only to compute intensity zones. Your raw heart rate is never uploaded — only the derived intensity-minutes figure is stored.
• Height, weight, age, and biological sex are read on your device only to compute your BMR. Only the derived BMR figure is uploaded.

4. How we use consumer health data

We use consumer health data only to operate the features you use: running activity-based challenges, calculating scores, displaying leaderboards to challenge participants, showing a summary of your daily progress to friends you have connected with and agreed to share with, and — if you separately opt in — generating AI Activity Suggestions. We do not use consumer health data for advertising or to infer characteristics about you beyond the challenge features.

5. Consent

We collect consumer health data only with your consent, which you give when you grant Pushi permission to access your health data on your device. Consent to collect is not consent to share: any sharing beyond the features you are using requires a further, separate consent, asked for at the point it becomes relevant and never bundled into these terms or into account creation. Optional processing — such as AI Activity Suggestions — and sharing your daily progress with a connected friend each require your separate, explicit consent before any data is shared. You may withdraw consent at any time (see "Your rights" below), and you can revoke health data access through Apple Health settings (iOS) or Google Health Connect settings (Android).

6. Who we share consumer health data with

We do not sell consumer health data, and we do not share it with advertising networks or data brokers. We use the following processors, which handle data only as needed to operate the app:

• Supabase — database and backend hosting, in the European Union (EU) region.
• Apple HealthKit / Google Health Connect — read access to your activity data on your device.
• Anthropic — only if you opt in to AI Activity Suggestions. Activity data with no name, email, or account identifier attached is sent to Anthropic in the United States under the EU–US Data Privacy Framework. Anthropic does not train on these inputs and retains them for up to 30 days for trust and safety purposes.

Friends you connect with

If you connect with another Pushi user and you both agree to share, that person can see a summary of your progress against your own daily activity goal: how many days you have reached this week, whether you have reached today's goal, how far through it you are as a proportion, and your current streak. No underlying health figures are shared — not step counts, calories, exercise minutes, distances, heart rate, or workout details.

This sharing happens only with your consent. Before you connect, you are shown a notice setting out exactly what is and is not shared, and you confirm it as part of connecting. You can withdraw at any time by hiding that person from your board, by turning off Share my daily results on the Friends & Ladder screen, or by disconnecting. We receive nothing in exchange for this sharing and it is not a sale.

If you were already connected with someone before 5 August 2026, that connection was made before this notice existed. Those connections appear on your board when the feature launches, and you can turn Share my daily results off at any time — including before you first open the board.

Other than as described here, we do not share consumer health data, and we do not collect, use, or share it under any "valid authorization" to sell it, because we do not sell it.

7. Data retention

We retain consumer health data for as long as your account is active. To delete your data, request deletion by contacting us at hello@pushi.fitness; we will delete it within 30 days, except where we are required to retain it for legal or compliance purposes. Activity data associated with completed challenges may be retained in aggregated form, with no personally identifying information attached, which cannot be linked back to you.

8. Your rights

Under the MHMDA and comparable laws, you have the right to:

• Access — confirm whether we are collecting, sharing, or selling your consumer health data, and access that data;
• Withdraw consent — you can stop further collection at any time by revoking Pushi's access in Apple Health (iOS) or Google Health Connect (Android) settings, stop sharing with our AI provider by turning off "AI Activity Suggestions" in Settings, and stop sharing your daily progress with friends by turning off "Share my daily results" on the Friends & Ladder screen. To withdraw consent for any other processing, contact us at hello@pushi.fitness;
• Delete — request deletion of your consumer health data, including from our processors.

To exercise any of these rights, contact us at hello@pushi.fitness. We will respond within 30 days. We will not discriminate against you for exercising these rights.

9. Complaints

If you believe we have not complied with the MHMDA, you may file a complaint with the Washington State Attorney General at atg.wa.gov. EU residents may also lodge a complaint with the Austrian Datenschutzbehörde (DSB) at www.dsb.gv.at.

10. Contact

For any question about this Consumer Health Data Privacy Policy, contact us at hello@pushi.fitness.