Consumer health data privacy policy (Washington)

Last updated: October 25, 2026.

This Consumer Health Data Privacy Policy explains how Gymyos collects, uses and shares consumer health data, as required by the Washington My Health My Data Act and similar state laws. It applies to anyone in the United States and complements the Privacy notice.

1. What consumer health data we collect

Only what you choose to log or give us. None of it is required to use Gymyos.

• Body data: weight, body measurements, height, goals for a measurement and the photos of your progress.
• Health-related profile data: sex, injuries and notes about them, date of birth, and whether you track your menstrual cycle.
• Daily log: sleep, energy, stress, mood, food, calories and macros, alcohol, caffeine, steps, resting heart rate, menstrual period and its symptoms.
• Workouts and discomfort: the exercises you do and any pain or discomfort you mark when you finish a workout.
• Gym presence: which gym you entered and when, if you use GymyosPass or «Did you get to the gym?».

2. Where it comes from

Directly from you, when you log it in the app. We don't buy health data or get it from other companies.

3. How we use it

• To show you your progress, charts and goals.
• To let Gymy adjust its comments to your workouts, for example not suggesting more weight where you logged discomfort. Gymy runs inside Gymyos and doesn't send your data to another company.
• To protect your account and comply with the law.

We don't use your health data for advertising, we don't sell it and we don't use it to make decisions about insurance, credit, housing or employment.

4. Your consent

We collect body data, progress photos and discomfort only after you accept their own notice in the app. The rest of your daily log and health profile data is covered by the consent you give when you accept your account notice, which names it expressly. You can withdraw any consent at any time.

5. Who we share it with

We don't sell consumer health data. It is only shared:

• With your trainer, only the categories you tick when you link with them (body data and discomfort start turned off).
• With the AI app you connect (for example, Claude or ChatGPT), only if you connect it, after accepting its notice.
• With the companies that host, protect and back up the service on our behalf, which can't use it for anything else.
• With authorities, only when a law or a court order requires it.

Your gym and the gyms you enter with GymyosPass never see your health data.

6. Location

«Did you get to the gym?» uses your location only when you open the app near a gym in the network, and never stores your coordinates. Gymyos does not set up virtual boundaries around health care facilities.

7. Your rights

You have the right to:

• Confirm whether we collect, share or sell your consumer health data, and access it, including the list of everyone it was shared with. «Download my data» gives you a copy, including who looked at your record.
• Withdraw your consent to collecting and sharing it.
• Have it deleted. You can delete individual entries, all your body data or your whole account from the app; we also delete it from our backups as they rotate (7 days).

To exercise any right, use the app or write to [email protected] with the subject «Health data». We answer within 45 days; if we need more time (up to 45 more days), we tell you why. There's no charge.

8. Appeals

If we deny your request, you can appeal by replying to our answer or writing to [email protected] with the subject «Health data appeal». We answer the appeal within 45 days and explain our decision. If you're not satisfied, you can contact the Washington State Attorney General at atg.wa.gov.

9. Changes

If we change this policy we'll publish the new version here with its date, and ask for your consent again before using health data in a new way.