Consumer Health Data Notice

5. Consumer Health Data Notice (Washington MHMDA, Nevada SB 370, and Similar State Health Laws)

This Section constitutes our Consumer Health Data Notice under the Washington My Health My Data Act (RCW Chapter 19.373), Nevada Senate Bill 370 (NRS Chapter 603A), and comparable state health-data statutes. It applies to personal information that identifies or is used to identify your physical or mental health status. A standalone copy of this Notice is also published for homepage and in-App linking as required by those statutes.

5.1 Categories of Consumer Health Data Collected

  • Bodily Function Telemetry: Real-time, resting, and historical heart-rate readings; heart-rate variability.
  • Sleep Telemetry: Sleep duration, awakenings, and sleep-stage estimations (light, deep, REM).
  • Physical Activity Records: Exercise type, workout cadence, active minutes, and calculated metabolic energy expenditure.
  • Physiological Metrics: Self-reported height, weight, age, and sex/gender to calibrate calorie estimates.
  • Precise Workout Geolocation: Outdoor workout routes combined with heart-rate and cadence metrics.

5.2 Sources of Consumer Health Data

  • You, when you enter profile metrics, start a workout, or submit a support ticket that includes telemetry.
  • Your paired WITHit Device sensors and firmware, when you enable the relevant feature.
  • The companion App and your mobile operating system, when you grant the permissions required for a feature you enable.
  • Sign-in providers, only to the extent a linked account identifier is needed to associate health data with your account.

5.3 Specific Purposes of Health Data Processing

We collect and process Consumer Health Data exclusively to operate the wellness tracking, algorithmic summary, and history features you affirmatively choose to use within the App, to secure those features, and to comply with law. We do not collect, process, or disclose Consumer Health Data for marketing, contextual tracking, or advertising. We do not sell Consumer Health Data.

Where a feature you request cannot function without Consumer Health Data (for example, heart-rate tracking you enable), we collect and process that data as necessary to provide that feature. We still present an unbundled in-App opt-in before first collection from a paired Device. Separate consent is required before we export Consumer Health Data to a third-party platform that is not our processor.

5.4 Processors, Third Parties, and Affiliates

We disclose Consumer Health Data to bound processors providing operational infrastructure. That disclosure is processing on our behalf, not a "share" or "sale" to a third party. We do not share or sell Consumer Health Data to third parties except at your direction. We do not disclose Consumer Health Data to affiliates for the affiliates' own purposes. Sol-Light, LLC dba WITHit does not currently share Consumer Health Data with any affiliate for that affiliate's independent commercial use.

Categories of processors that receive Consumer Health Data:

  • Cloud infrastructure and database hosting vendors (encrypted data storage and compute execution in the United States);
  • Customer-support and diagnostic systems (accessible only if you submit tickets containing telemetry or grant a support specialist access);
  • Security, logging, and crash-analysis vendors, limited to the telemetry needed to investigate an incident you or the system reports;
  • Professional legal or accounting advisors when reasonably necessary to establish, exercise, or defend legal claims or to satisfy an audit or tax obligation.

Mapping tile providers may receive transient coordinates solely to render a route map you requested; they are not authorized to retain Consumer Health Data for their own purposes.

Each processor is bound by written contract to process Consumer Health Data only on our documented instructions and is barred from retaining, using, or disclosing the data for any secondary purpose. If a processor uses Consumer Health Data for its own purposes, that party is no longer acting as our processor for that use.

If you choose to connect third-party platforms (such as Apple Health or Google Health Connect), that transmission occurs solely at your direction (Section 6.3) and is a disclosure to a third party, not a processor, after you give separate consent.

We do not authorize third parties to collect Consumer Health Data over time and across different websites or online services when you use our website or App for those third parties' own purposes.

5.5 Separate, Standalone Opt-In Consent

We do not bundle consent for collecting Consumer Health Data into our Terms of Use or general account creation.

  • Collection: We require an explicit, unbundled affirmative opt-in screen in the App prior to collecting or processing any Consumer Health Data from your paired Device, except to the limited extent collection is necessary to provide a feature you have already requested and enabled.
  • Sharing: We require separate, express consent prior to exporting your data to third-party ecosystems that are not our processors (for example, Apple Health).
  • Withdrawal: You may withdraw consent at any time without fee or penalty via App Settings > Health Data Permissions or by contacting support@withitgear.com. Upon withdrawal, new collection and new sharing for the withdrawn feature cease. Withdrawal does not by itself delete data we already stored; that data remains until you request deletion under Section 5.7 and Section 10, subject to the exceptions in those sections. You may continue to use non-health functions of your Device (clock, alarms, stopwatch).

5.6 Geofencing Ban

We do not implement or use a geofence around any facility that provides in-person healthcare services (including clinics, hospitals, pharmacies, or counseling centers) to identify, track, collect health data from, or target consumers.

5.7 Consumer Health Data Rights

Subject to identity verification and statutory exceptions, you have the right to:

  • Confirm whether we collect, share, or sell your Consumer Health Data;
  • Access a portable copy of that data;
  • Obtain a list of third parties and affiliates with whom we have shared or to whom we have sold your Consumer Health Data, together with an email address or other online mechanism you may use to contact those parties where we have such a mechanism;
  • Withdraw consent for collection or sharing;
  • Request that we stop collecting or sharing your Consumer Health Data; and
  • Request deletion of your Consumer Health Data from our records, including production systems and, on the timeline in Section 5.8, archived or backup systems, and that we notify processors and other recipients to delete it as required by law.

To exercise these rights, email support@withitgear.com with the subject line "Consumer Health Data Request." You may appeal any denial by following the process in Section 14.6.

5.8 Deletion Timing for Consumer Health Data

After we authenticate a Consumer Health Data deletion request, we will delete that data from active production systems and instruct our processors to do the same without undue delay, and in any event within 45 days. Data residing solely on inactive archived or backup systems will be overwritten or otherwise put beyond use in the ordinary backup cycle, not to exceed six months after authentication, except where a longer period is required by law or a documented legal hold. Data you already exported to Apple Health, Google Health Connect, or another platform you control is outside our deletion scope. We will also notify processors, contractors, and other recipients as required by applicable health-data law.

5.9 Material Changes to This Health Data Notice

If we collect new categories of Consumer Health Data, use it for new purposes, or disclose it to new categories of third parties or affiliates not described here, we will update this Notice, provide prominent notice, and obtain any additional consent required by law before applying those changes to historical Consumer Health Data.