HeroTracker

Consumer Health Data Privacy Policy

Effective 1 July 2026 · Version 1.0

This policy supplements our Privacy Policy and is the separate consumer-health-data disclosure required by the Washington My Health My Data Act (MHMDA, RCW 19.373). Comparable consumer-health-data laws in other states (such as Nevada's) may also apply; where they do, we honor their requirements, which may differ from those described here. "Consumer health data" means information linkable to you that identifies your past, present, or future physical or mental health status. It governs how HeroTracker ("we," "us") handles that data.

1. Categories of consumer health data we collect, and why

We collect only the health and wellness information you choose to record, which may include:

• Nutrition, diet, and hydration
• Sleep
• Physical activity and fitness
• Body measurements and vitals (e.g., weight, heart rate)
• Mood and energy
• Symptoms and how you feel
• Digestive / gut health
• Mindfulness and time in nature
• The goals and quests you set, and any notes you add

We collect it to provide the app to you: to record, display, organize, and sync your data across your devices, to show your history and trends, and — only when you enable them — to power optional insights and AI features you request. We do not collect or use consumer health data for advertising or profiling, and we will not use or share it for a purpose not disclosed here without first obtaining your affirmative consent.

2. Sources of consumer health data

Consumer health data comes from two sources, both under your control:

• Directly from you — what you enter in the app.
• From your device — if you choose to connect Android Health Connect, the specific categories you authorize there.

3. Categories of consumer health data that are shared

To operate features you use, the categories above may be processed by service providers on our behalf — for the purposes of cloud storage and cross-device sync, and (only when you enable them) the AI and insight features you request. When you connect your own external AI assistant, only the categories you enable are shared with that provider, in a minimized, structured form (no free-text notes, photos, or specific symptom/condition names — only structured category values). We do not otherwise share consumer health data.

4. Categories of third parties and affiliates we share with

We share consumer health data only with the following categories of recipients:

• Cloud infrastructure provider — Supabase (storage, authentication, sync).
• AI/ML service providers — Google (for Gemini AI features; and, separately, Google Cloud, which hosts our first-party machine-learning insights service and receives de-identified metrics), and OpenRouter / Anthropic (alternate AI chat), each engaged as a processor under terms restricting their use of the data. These providers act on our behalf to deliver a feature you requested; this is processor activity, not a sale.
• Device health platform — Google Health Connect (only data you choose to sync).
• An external AI assistant you connect — if you use that optional feature, the specific provider you choose (e.g., Anthropic or OpenAI), at your direction.

We have no corporate affiliates with whom we share consumer health data. For the current list of specific recipients, contact privacy@herotracker.co.

5. We do not sell consumer health data

HeroTracker does not sell consumer health data, does not collect a fee or other valuable consideration in exchange for it, and does not share it for cross-context behavioral advertising.

6. Your rights, and how to exercise them

Under MHMDA (and comparable laws) you have the right to:

• Confirm & access whether we are collecting, sharing, or selling your consumer health data, and to access it — the in-app Export (Settings → Data) provides your data.
• Get a list of the third parties and affiliates with whom we have shared your consumer health data — request it at the email below.
• Withdraw consent to our collection and sharing — turn off any AI feature or the connector in Settings, as easily as you turned it on.
• Delete your consumer health data — permanently, from Settings → Account → Delete Account or the app's /delete-account route. Deletion propagates to our processors, who are required to delete it as well; residual copies in encrypted backups are purged within approximately six months.

To exercise any right, use the in-app controls or email privacy@herotracker.co. We may verify your identity via your account email, and you may use an authorized agent where the law allows. We will not deny you service, charge a different price, or provide a different quality of service for exercising a right. If we decline a request, you may appeal by replying to our response.

7. Contact

Consumer-health-data questions or requests: privacy@herotracker.co.