Consumer Health Data Privacy Policy

Version 1.5 · Effective 2026-09-29

The short version. If you connect your device's health source, Apple Health on iOS or Google Health Connect on Android, the sleep and activity records the app reads qualify as consumer health data under Washington's My Health My Data Act (MHMDA) and Nevada's SB 370. Since version 1.2 that data is processed on your phone only: the app reads it, builds a short reading of your rhythm, and keeps that reading in your device's secure storage. No health record and no reading is ever sent to us, stored by us, shared by us with anyone, or used by the AI analysis. You can share a picture of your reading yourself: the app draws it on your phone and hands it to your phone's share sheet, and it goes only where you send it. We never receive that picture. This policy explains what the app reads, how it is used on your device, the one record our servers keep (your consent), and the rights you have under those laws. It is in addition to our general Privacy Policy, that policy still applies; this one adds the health-data specific commitments those state laws require.

This Consumer Health Data Privacy Policy supplements our general Privacy Policy and is intended for residents of Washington and Nevada. It describes how Eltria UG (haftungsbeschränkt) ("we", "us") collects, uses, shares, and protects consumer health data under:

The Washington My Health My Data Act, RCW 19.373 ("MHMDA")
The Nevada Consumer Health Data Privacy Act, NRS 603A.300–360 ("Nevada CHDPA")
Any other US state consumer-health-data privacy law as it takes effect

For questions or to exercise the rights described below, contact privacy@eltria.de.

1. What is "consumer health data"

We adopt the statutory definition. Under RCW 19.373.010, consumer health data is:

"personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status."

The statute lists thirteen categories that fall under "physical or mental health status," including individual health conditions, treatments, diseases or diagnoses, surgical procedures, medication use, vital signs, diagnostic testing, gender-affirming care, reproductive or sexual health, biometric data, genetic data, precise location indicating health-service access, and data identifying anyone seeking health-care services.

Of those categories, the only one the app touches is vital signs: and then only the subset you choose to allow from your device's health source. We do not collect any of the other twelve categories.

2. What consumer health data the app reads, and where it stays

If you grant the Service access to your device's health source (Apple's HealthKit framework on iOS, or Google's Health Connect on Android), the app running on your phone reads:

Sleep records: total time asleep per night, for a rolling 90-day window. The app does not keep sleep stage detail (REM, deep, core, awake breakdown): where a source records stages, they are used on the device only to total the time asleep, and the breakdown is discarded.
Activity records: daily step count, distance, active energy, exercise minutes, for the same 90-day window

The app does not read heart rate, heart rate variability, mindfulness, blood pressure, glucose, body composition, menstrual or fertility data, mental-health data, or any of the other categories your device's health source may expose. The OS-level permission sheet you see when you first connect, Apple's HealthKit prompt on iOS or Google's Health Connect prompt on Android, lists only the categories above.

Where it stays. Everything happens on your phone. The app folds the records into a short reading, your typical bedtime and wake-up window, how steady your bedtime is night to night, whether weekends run later, your typical daily steps, how many days count as active, and your longest active streak, expressed as a few plain sentences and a handful of numbers. The reading is stored in your device's secure storage (the iOS Keychain, or Android Keystore-backed storage), protected by your device passcode and tied to that device: not synced through iCloud Keychain and not restorable on another device (on Android the app's data is excluded from backups). Neither the records nor the reading is transmitted to our servers, and our servers have no copy. The reading is itself consumer health data because it relates to your physical health status; it is protected by this policy and by the on-device design described here.

The one thing we do keep is a consent record: that you turned the health source on, which of the two categories (sleep, activity) you allowed, when, and which version of our Privacy Policy the consent sheet showed you. That record contains no health data. It exists so the app knows the source is on, so we can prove your consent if asked (GDPR Article 7(1)), and so we can honour your withdrawal. The consent entry in our audit log carries the IP address and user agent of the request that wrote it, as described in the Privacy Policy §4 (Audit logs).

3. Sources

The app reads consumer health data only from your own device's health source: Apple Health (via Apple's HealthKit framework) on iOS, or Google Health Connect on Android, accessed with your explicit permission. We do not receive consumer health data from any third-party data broker, advertising partner, employer, healthcare provider, or insurer, and we do not receive it from your device either.

Our use of data obtained through Google Health Connect is additionally subject to Google's Health Connect Permissions Policy: the app uses Health Connect data solely to show you the rhythm reading described in §2, on your device; it does not transfer the data to us or to any third party, and it is not used for advertising.

4. Purposes for which the app uses consumer health data

The app uses the consumer health data described above for these purposes only, all on your device:

To show you your rhythm reading: the sleep and activity sentences and numbers described in §2, on the Analyze tab, the Connect tab and next to your analysis results
To tell you how much of it there is: the number of nights and days behind the reading, shown in the app's footprint view

Consumer health data is not an input to your personality analysis, is not sent to our AI processor, and is not part of any Compatibility report. We do not use consumer health data for advertising, marketing, profiling for cross-context behavioural advertising, employment decisions, insurance decisions, credit decisions, or any other consequential decision about you.

5. Authorization (your affirmative consent)

Before the app reads any consumer health data from your device, two consent moments occur:

Our in-app "Health" consent sheet: shown first, summarising in plain English what the app will read, that it is read and kept on your phone only, that nothing is uploaded or used by the AI, and how to disconnect. Accepting it records the consent described in §2.
The OS-level permission sheet: operated by your device (Apple's HealthKit prompt on iOS, Google's Health Connect prompt on Android). It lists the specific categories requested (the sleep and activity records named in §2). Tapping Allow at this prompt is your affirmative grant under MHMDA RCW 19.373.030.

You may withdraw your authorization at any time by opening the Service, going to the Connect tab, finding the health card (labelled Your sleep and steps), and tapping Disconnect. Disconnecting:

Stops further reads from your device's health source immediately
Deletes the reading from your phone's secure storage as part of the disconnect action
Marks the source off in our consent record

You can also revoke the app's read permission in the Health app (iOS: Sharing → Apps and Services → Vetraya) or in Health Connect (Android: App permissions → Vetraya); the app then reads nothing further. Withdrawing authorization does not affect past personality analyses. Analyses generated since 9 September 2026 never contain health data. Any generated before that date, under an earlier version of this policy, may have drawn on your sleep and activity records; their text is kept as part of your account until you delete the analysis or the account, and they are no longer labelled as having used a health source.

6. Who receives consumer health data

No one. Consumer health data is processed on your device and is not shared with any recipient, processor or third party. In particular:

OpenAI (our AI processor for the personality analysis) does not receive it: health data is not part of any prompt.
Amazon Web Services (our infrastructure host) does not receive it: no health record or reading is stored in our database or anywhere else in our infrastructure. AWS hosts the consent record described in §2, which contains no health data.
Apple and Google are not recipients under this policy. Apple's HealthKit framework (on iOS) and Google's Health Connect (on Android) are the on-device sources from which the app reads; they do not see what the app read.

If you use Share your sleep and steps on the sleep-and-steps card, the app draws an image of your reading on your phone and hands it to the share sheet of your phone. Where it goes is your choice, and the app does not send it to us or record where you sent it. The app removes its own copy of the image once the share sheet closes, and again whenever you turn the source off or sign out.

We do not share consumer health data with: data brokers, advertising or marketing partners, social networks, employers, insurers, healthcare providers, government agencies, or any third party for cross-context behavioural advertising. Because we hold no consumer health data, we could not produce it in response to a legal demand.

6.1 International transfers

None. Consumer health data does not leave your device. The consent record (which contains no health data) is stored in Ireland (AWS eu-west-1).

7. Your rights

Under MHMDA, the Nevada CHDPA, and other applicable US state consumer-health-data laws, you have the rights below. They apply regardless of your state of residence, we do not gate consumer-health-data rights on state-level proof. Because the data lives on your device, most of them are exercised there, instantly.

Right to confirm: confirm whether we are collecting, sharing, or selling your consumer health data (RCW 19.373.040(1)(a)). The answer is in this policy: the app reads it on your device with your permission; we do not receive, share or sell it. The list of third parties with whom we share it is empty (§6).
Right to know / access: see the consumer health data held about you (RCW 19.373.040(1)(a)). The reading is shown in full inside the app (Analyze tab → health row, or Connect tab → health card → Your sleep and steps); the underlying records are in your Health app or Health Connect. Our data export (§7.1) includes the consent record and states that no health data is held server-side.
Right to delete: delete the consumer health data held about you (RCW 19.373.040(1)(c)). Disconnecting the source deletes the reading from your phone; there is nothing on our side to delete beyond the consent record, which is deleted with your account.
Right to withdraw authorization: withdraw your consent to collection at any time (RCW 19.373.040(1)(b)). The "as easy to withdraw as to give" obligation in GDPR Article 7(3) applies as well, see §5 above for the disconnect control.
Right to appeal: appeal any denial of the rights above (RCW 19.373.040(1)(h))

7.1 How to exercise these rights

Withdraw authorization + delete the reading: Connect tab → Your sleep and steps → Disconnect
Access the reading: Analyze tab → health row, or Connect tab → health card → Your sleep and steps
Access (full data export): Profile → Settings → Download My Data; you receive, in the format you choose, either a human-readable PDF report or a structured, machine-readable JSON file. The health section of the export carries your consent record and confirms that no health data is held server-side.
Delete the entire account: Profile → Settings → Delete account (removes the consent record and the reading on that phone)

If you cannot use the in-app controls, email privacy@eltria.de. Include your account email so we can verify the request. We do not require you to create a new account to submit a request.

7.2 Identity verification

For requests received by email, we verify your identity by matching the request to the email address on your account. For deletion or sensitive-data requests, we additionally require you to authenticate inside the Service before we act. If we cannot verify your identity through commercially reasonable efforts, we may ask for additional information (RCW 19.373.040(1)(e)). We do not collect more identifying information than necessary to verify the request.

7.3 Turnaround

We respond to consumer health data requests within 45 days of receipt (RCW 19.373.040(1)(g)). Where the request is complex or we are dealing with a high volume of requests, we may extend that period by a single further 45 days, and will tell you of the extension and the reasons for it within the original 45-day window.

For users to whom GDPR also applies (residents of the EU/EEA/UK/Switzerland), we apply the shorter one-month response window of GDPR Article 12(3), extendable by up to two further months. The shorter applicable deadline always wins.

7.4 Frequency and fees

We respond to information requests free of charge up to twice in any 12-month period. For requests that are manifestly unfounded, excessive, or repetitive, we may charge a reasonable administrative fee or refuse the request, in which case we will explain why and how to appeal (RCW 19.373.040(1)(f)). We bear the burden of demonstrating the request is excessive.

7.5 Appeals

If we deny a request, you may appeal by emailing privacy@eltria.de with the subject line "MHMDA appeal". We respond to appeals in writing within 45 days, with the decision and the reasons for it.

If your appeal is unsuccessful, you may file a complaint with the Washington Attorney General at atg.wa.gov/file-complaint, or with the Nevada Attorney General at ag.nv.gov/Complaints.

8. We do not sell consumer health data

We do not sell consumer health data. This commitment is unconditional: we do not sell consumer health data for monetary or other valuable consideration, with or without an authorization, and have no intention to do so. We do not hold it, so we could not.

Because we do not sell, we do not request the six-element authorization-to-sell described in RCW 19.373.030 / 19.373.070. If we ever changed this practice, we would update this policy, give prior disclosure, and obtain the explicit six-element authorization required by statute before any sale.

9. We do not use geofences around health-care facilities

RCW 19.373.080 prohibits geofences around entities that provide in-person health-care services where the geofence is used to identify or track consumers seeking health-care services, to collect consumer health data, or to send notifications, messages, or advertisements related to consumer health data or health-care services.

We do not implement geofences of any kind. The Service does not read your device location; your phone never tells us where you are. The app does not read workout routes or any other location-shaped health data.

10. How we secure consumer health data

The strongest protection is that the data never reaches us. On your device:

Secure storage: the reading is kept in the iOS Keychain or Android Keystore-backed storage, protected by your device passcode and tied to that device (not synced through iCloud Keychain, not restorable on another device; on Android the app's data is excluded from backups).
No transmission: the app makes no network request carrying health records or the reading. Our servers expose no endpoint that accepts them.
Deletion: disconnecting the source, signing out on that device, or deleting your account removes the reading. A reading left by a previous account on a shared phone is discarded the moment a different account signs in.

The consent record on our side is protected as described in our general Privacy Policy §6 (encryption in transit and at rest, access limited to our application services and the company's management). If we ever discovered a breach affecting the consent record, we would follow the breach-notification process described there.

11. How long we keep consumer health data

We keep no health records and no reading. The reading on your phone covers a rolling 90-day window of records and is rebuilt from the platform's records when the app opens; it is deleted when you disconnect the source, sign out on that device, or delete your account. The consent record is kept for as long as your account exists and is deleted with it. The full retention table is in our general Privacy Policy §4.

12. Processors

No processor handles consumer health data on our behalf (§6). Should that ever change, the processor would act only on our documented written instructions, under a binding contract as required by RCW 19.373.060, and we would tell you and obtain your affirmative consent before any such processing began.

13. Changes to this policy

We may update this policy to reflect changes in the Service, applicable law, or our practices. When we make material changes, including any new categories of consumer health data we collect, any new use we put the data to, or any change that would move processing off your device, we will notify you in advance and obtain your affirmative consent before the new use begins (RCW 19.373.020). Previous versions are archived and available on request.

What changed in version 1.2: health data moved on-device. Earlier versions described records being uploaded to our database, retained for 90 days, encrypted at rest, and included in the prompt sent to our AI processor. None of that happens any more; any records uploaded under earlier versions have been deleted from our systems.

14. Contact

For any consumer health data question, request, or appeal, contact:

Health-data-specific email: privacy@eltria.de
Privacy escalations: privacy@eltria.de (for appeals and complex matters)
Postal address: Eltria UG (haftungsbeschränkt), Kolonnenstraße 8, 10827 Berlin, Germany

You may also contact us through the channels described in our general Privacy Policy §11.