Consumer Health Data Privacy Notice

Section 01

Scope

This notice supplements the Privacy Policy for information that identifies or can reasonably be linked to a consumer and reveals or could be used to infer health status, fitness, nutrition, bodily functions, symptoms, measurements, treatment, medication, reproductive or sexual health, or efforts to seek health-related services. Whether a particular law applies depends on your location, Revenge Arc’s launch scope, and the facts of the processing.

Revenge Arc is a general-wellness service, not a healthcare provider, and should not be assumed to be covered by HIPAA. Other consumer-health, privacy, and breach-notification laws may still apply.

Section 02

Categories we may collect

• Workout plans, exercises, performance, activity, steps, active energy, recovery, injuries or limitations you choose to disclose, and related goals.
• Foods, meals, recipes, photos, calories, nutrients, dietary preferences, allergies or medical-diet details you choose to disclose, and nutrition goals.
• Weight, measurements, progress records, images, voice, transcripts, and information that may reveal or support an inference about health, fitness, or physical condition.
• AI prompts, outputs, classifications, and recommendations connected to health, nutrition, exercise, body, or wellbeing information.
• Device, feature-use, purchase, support, and security information when it can be linked to a health-related interaction or inference.

Section 03

Sources

• You, when you create a profile, enter information, upload media, speak, message, request support, or use a feature.
• Your device and Apple Health, only for data types and access you authorize.
• Connected services, subscription systems, and food or barcode databases used for a feature you request.
• Other users, if they send, mention, tag, report, or upload information involving you, subject to their obligations and your controls.
• Inferences produced from your activity, entries, media, prompts, and requested AI analysis.

Section 04

Why we collect and use it

• Provide requested workout, nutrition, progress, wellness, reminder, community, support, and account features.
• Generate requested AI-assisted estimates, plans, summaries, classifications, and coaching while clearly communicating their limitations.
• Save, synchronize, display, export, correct, or delete your information according to your choices.
• Secure the Services, prevent abuse, investigate incidents and reports, provide support, comply with law, and defend legal claims.
• Improve reliability and usability using approved, minimized, and appropriately protected information. Separate consent must be obtained where required for a new purpose.

Section 05

Sharing and processors

Consumer health data may be shared with processors only as needed for the requested feature, such as configured cloud hosting and authentication, AI processing, Apple or HealthKit connectivity, subscription entitlement, push delivery, diagnostics, support, and food-data services. It may also be visible to users you choose to share with, or disclosed when required by law or necessary to protect rights and safety.

The production provider list, specific affiliates, contractual roles, regions, subprocessors, retention, and data-use settings must be verified before launch. Planned or evaluated providers may include Apple, RevenueCat, Google or Firebase services, a configured AI provider, FatSecret, and Open Food Facts; a planned name must not be presented as a current recipient until the production data flow confirms it. Supabase is used for the public website and must not be described as an app-health-data recipient unless the app actually sends that data to it.

Section 06

Sale, advertising, and geofencing

Revenge Arc does not currently sell consumer health data and does not use Apple Health data or consumer health data for targeted advertising. We do not use a geofence around a healthcare facility to identify, track, collect data from, or send messages to people about health services. If a material practice changes, required notice and consent must be provided before the new processing begins.

Section 07

Consent and withdrawal

Where consent is required, the request should be specific to the data and purpose and separate from unrelated terms. You may decline an optional permission or AI/media feature, revoke device permissions, stop future collection, or withdraw consent where applicable. Withdrawal does not make earlier lawful processing unlawful and may prevent the affected feature from working.

Section 08

Your consumer health rights

• Confirm whether covered consumer health data is collected, shared, or sold, and access eligible data.
• Request deletion of eligible data, including appropriate notification to processors or other recipients when required.
• Withdraw consent for collection or sharing and receive information about relevant recipients where applicable.
• Correct or export information and appeal a refusal where applicable law provides those rights.
• Submit a request or appeal to revengearchelp@gmail.com. We may verify identity and authority and will not discriminate against you for exercising a protected right.

Section 09

Retention, security, and changes

Consumer health data is retained according to the Data Retention & Deletion Policy and should be protected with safeguards appropriate to its sensitivity. Exact app, backup, provider, media, AI, message, and legal-hold periods must be verified before launch. No security measure eliminates every risk.

The categories, purposes, and recipients in this notice must be updated before collecting, using, or sharing additional consumer health data in a way that requires new notice or consent. Material changes will receive additional notice where required.