Consumer Health Data Privacy Policy

1. What this notice covers

Washington's My Health My Data Act defines consumer health data as personal information linked to a consumer that identifies past, present or future physical health status. The Act is explicit that data derived or extrapolated from non-health information counts as consumer health data. That is the provision that makes this page necessary rather than decorative for BodyTrajectory.

2. What we collect, and how it is derived

What you type in is a set of measurements: height, weight, age, gender, activity level and a goal timeline. On its own that is body data. What we compute from it, and what we deliver back to you, is health-related:

• body mass index, now and projected
• estimated body fat percentage and lean body mass
• projected circumference measurements (waist, chest, hips, arm, thigh and similar)
• a projection of how those numbers change over your chosen timeline, scenario by scenario

We collect these only when you ask us to compute a projection or a free score. We do not collect photographs, we do not perform facial recognition or any other biometric analysis, and we do not infer health data from any source other than the measurements you enter.

3. Why we collect it

Solely to provide the projection you asked for and to deliver it to you. We do not use consumer health data for advertising, we do not use it to train third-party models, and we do not use it to make decisions about you beyond producing the report you requested.

4. We do not sell your consumer health data

We do not sell consumer health data, and we never have. There is no mechanism in the product to do so, and no third party receives it for advertising or profiling. We do not share it except with the processors named in the next section, who handle it on our instructions to run the service.

5. Who processes it

Vercel (hosting), Supabase (database and storage) and Resend (email delivery) process the data needed to store your order and send your report. If you ask for a personalised action plan, the measurements needed to tailor it (age, gender, height, weight, activity level, BMI, estimated body fat, lean mass and goal timeline) are sent to DeepSeek in China for that single generation; no email address or account identifier is included, and you can ask us to skip this step so that your report is produced from our built-in template instead. See our Privacy Policy for the transfer safeguards we rely on.

6. How long we keep it

Order records, including the measurements and the projection, are kept for 24 months for refund, tax and accounting purposes, then deleted or anonymised. Free score records follow the same period. Nothing is kept indefinitely by default.

7. Your rights under MHMDA

You have the right to:

• confirm whether we are collecting, sharing or selling your consumer health data
• access your consumer health data, and receive a list of the third parties it has been shared with
• withdraw consent to our collection and sharing of it
• have your consumer health data deleted
• appeal a refusal, by replying to our decision and asking for a review

To exercise any of these, email us at morphme2026@outlook.comCopy. We will respond within 45 days, and we will not discriminate against you for making a request. You can also withdraw the Article 9 consent that covers health-data processing at any time; see section 4 of our Privacy Policy.

8. Security

Consumer health data is held in our database and reachable only with server-side credentials that never reach the browser. Not every field is encrypted at the application layer; access control, transport encryption and a private network boundary are the controls that protect it. We do not claim more than that.