Effective Date: September 29, 2026
This Consumer Health Data Privacy Policy applies to “consumer health data” as defined by Washington’s My Health My Data Act, Nevada Senate Bill 370, and Connecticut’s consumer health data provisions. It supplements our Privacy Policy. Bounce Back Smart is a fitness and wellness service, not a healthcare provider, but some of the information you choose to share with us is still consumer health data under these laws, and we treat it that way for everyone, wherever you live.
1. Consumer Health Data We Collect
Depending on the features you use, we may collect:
- Injuries and conditions: body area, pain levels over time, any diagnosis or surgery details you type, how and when the injury occurred, whether you have seen a medical professional, and movement restrictions
- Movement Profile: mobility (for example use of a wheelchair or other aid), limb differences, and range of motion
- Pregnancy and postpartum information: status, due or delivery date, delivery type, pelvic-floor focus, and postpartum symptoms you report
- GLP-1 program information: whether you are on, considering, or have stopped a GLP-1 medication, when you started our GLP-1 program, and your medication phase. We do not collect the medication name or dose.
- Symptoms: daily symptom check-ins (such as low energy, nausea, headache, poor sleep, or dizziness) and any note you add
- Workout responses: pain, fatigue, and difficulty ratings after sessions
- Return to sport: your sport, target level, whether a clinician has cleared you, and confidence check-ins
- Body measurements: body weight, and body composition measurements from a DEXA scan (body fat percentage, lean mass, fat mass, and visceral fat)
- Wearable data, if you connect a source: daily sleep, resting heart rate, heart-rate variability, steps, and recovery or readiness scores from Apple Health, Oura, or WHOOP
- Health information in messages: anything health-related you write to the AI coach or to a trainer or clinic you connect with
We do not collect precise geolocation, and we do not use geofencing.
2. How We Use It
We use consumer health data only to:
- Build and adjust your workouts safely around your injuries, restrictions, symptoms, and life stage
- Power the in-app AI coach (see Section 4)
- Show you your own history, such as weight, body composition, and recovery trends
- Share the information you choose with a trainer or clinic you connect with
- Keep the service safe, secure, and working, and meet legal obligations
We do not use consumer health data for advertising, and we do not sell it.
3. Where It Comes From
- Directly from you, through intake forms, check-ins, logs, and messages
- From a wearable or health source, only if you connect one (Apple Health on your device, or Oura or WHOOP through their own authorization screens)
- From a trainer or clinic you connect with, if they record restrictions or session notes for you
4. Who We Share It With
We share consumer health data only with:
- OpenAI, which provides the AI that personalizes your workouts and coaching, and only after you consent in the app. The categories sent are listed in Section 3.1 of our Privacy Policy. Body composition measurements, wearable data, and daily symptom check-in answers are not sent. OpenAI does not use this data to train its models; like other API customers’ data, it may be kept for up to 30 days for abuse monitoring and then deleted.
- Amazon Web Services (AWS), which hosts our application and database and sends our emails
- Trainers and clinics you choose to connect with, limited to the categories shown to you on the connection screen before you agree. You can disconnect at any time.
- Authorities, only where the law requires it
We have no affiliates that receive consumer health data. We do not sell consumer health data, and we will not do so without a separate, written authorization from you as the law requires.
5. Your Consent
We collect consumer health data only as needed to provide the features you ask for. Sharing it with our AI provider requires your affirmative consent in the app, and sharing it with a trainer or clinic requires your approval on the connection screen. You can withdraw either consent at any time: turning off AI consent disables AI-powered features, and disconnecting a trainer or clinic stops further sharing with them.
6. Your Rights
You have the right to:
- Know and access: confirm whether we collect, share, or sell your consumer health data, get a copy of it, and get a list of all third parties and affiliates we have shared it with, including their contact details. You can download your data yourself from your Profile in the app (“Download my data”).
- Delete: have your consumer health data deleted. You can delete many individual entries in the app, or delete your whole account from your Profile (“Delete my account”). We delete it from our live systems promptly and from backups within six months, and we tell our service providers to delete it too.
- Withdraw consent: as described in Section 5
- Not be discriminated against for exercising any of these rights
To make a request that you cannot complete in the app, email Connect@bouncebacksmart.com from the address on your account, with “Consumer Health Data Request” in the subject. We will verify your identity and respond within 45 days. Where the law allows, we may extend this once by another 45 days and will tell you why.
7. Appeals
If we decline your request, you can appeal by replying to our decision or emailing Connect@bouncebacksmart.com with “Appeal” in the subject. We will respond in writing within 45 days, explaining any action taken or not taken and why. If your appeal is denied, you may contact your state Attorney General, including the Washington State Attorney General.
8. How We Protect It
Consumer health data is encrypted in transit and stored encrypted at rest on AWS. Access is limited to the systems and staff who need it to run the service, and wearable connection tokens are stored separately encrypted.
9. Changes
If we change how we collect, use, or share consumer health data, we will update this policy and its date, and where the law requires, ask for your consent again before the change applies to you.
10. Contact
Questions about this policy: Connect@bouncebacksmart.com
