Consumer Health Data Privacy Policy

This Consumer Health Data Privacy Policy (“Health Privacy Policy”) supplements, and should be read together with, our main Privacy Policy. It describes how Oneleaf SAS (“Oneleaf”, “we”, “us”) collects, uses, and shares “consumer health data” through the Calorie Tracker by Oneleaf application and related services (the “App”), and the rights you have in that data.

This Health Privacy Policy is provided in particular for individuals in Washington (under the My Health My Data Act), Nevada (under SB 370), and Connecticut (under the Connecticut Data Privacy Act, as amended for health data), and for any other individuals whose consumer health data we process where similar laws apply. Where this Health Privacy Policy and our main Privacy Policy conflict with respect to consumer health data, this Health Privacy Policy controls.

1. What is consumer health data

“Consumer health data” means personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status. This includes information you provide directly, information collected automatically, and information we derive or infer about your health from other data. It does not include data that has been de-identified or aggregated in accordance with applicable law.

Oneleaf is a consumer wellness application. The information you provide is not protected health information under HIPAA, and we are not a HIPAA covered entity or business associate.

2. Categories of consumer health data we collect

We may collect the following categories of consumer health data, depending on the features you use:

• Body and lifestyle metrics: body weight, height, body composition; target weight, target calories and macronutrients; dietary restrictions, food allergies or intolerances; and any medical conditions you choose to declare.
• Nutrition data: the foods and beverages you log, and photographs you upload for food recognition.
• GLP-1 / medication tracking data (only if you enable GLP-1 tracking): whether you currently use a GLP-1 medication; the medication name and type; dose and full dosage history; injection dates, times, frequency and injection site; past or historical injections you log retroactively; side effects and symptoms you log, and their intensity; preferred reminder or injection times; and free-text notes about your treatment or how you feel.
• Derived insights: metrics we generate from the data you log and display back to you — for example a daily quality score calculated from your calorie, water and exercise entries, and the frequency of the symptoms you have logged. These are informational summaries of the data you entered; they are not a medical assessment of your health, and we make no recommendations based on them.
• Connected health data: health data you choose to import from Apple Health, Google Health Connect, or a connected wearable (for example heart rate, sleep, body composition, and weight).

3. Sources of consumer health data

We collect consumer health data: (a) directly from you, when you enter it into the App or upload content; (b) from health integrations you choose to connect (Apple Health, Google Health Connect, wearables); and (c) generated by the App, where we derive or infer health indicators from the data described above.

4. How we use consumer health data

We use your consumer health data only as reasonably necessary to:

• provide the tracking journals and features you have enabled, including the calorie tracker and, where activated, the GLP-1 injection and symptom journal and history;
• generate and display the tracking insights you see in the App;
• send the reminders and notifications you have set up (for example injection or meal reminders);
• maintain, secure, and improve the App; and
• comply with our legal obligations and honor your privacy choices and rights.

We do not use your consumer health data for any purpose that is not disclosed to you, and we do not use it for targeted advertising directed to you based on that data.

5. How we share consumer health data

We share consumer health data only as reasonably necessary and as described below:

• Service providers / processors: with vendors who process data on our behalf and under contract (for example hosting and analytics providers), who are bound to use it only to provide services to us.
• With your consent: with other parties where you have given us your explicit consent to do so.
• Legal and safety: where required to comply with law, legal process, or to protect rights, safety, and security.

We do not sell your consumer health data. We do not share your consumer health data for cross-context behavioral advertising.

6. Your consent

Where required, we obtain your opt-in consent before collecting consumer health data that is not strictly necessary to provide a feature you requested, and we obtain separate opt-in consent before sharing consumer health data for any purpose that is not strictly necessary. For example, GLP-1 tracking is collected only after you actively enable it and accept the health disclaimer presented at that point.

These consent requests are presented clearly and conspicuously in the interface where the collection or sharing occurs and describe the categories of data, the purposes, the recipients, and how to withdraw consent. You may withdraw your consent at any time — for example by disabling GLP-1 tracking in your settings, or by contacting us — and we will stop the collection or sharing covered by the withdrawn consent.

7. Your rights

Depending on your state of residence, you may have the right to:

• confirm whether we process your consumer health data and access that data, including a list of the third parties to whom we have disclosed it;
• withdraw consent to our collection, use, or sharing of your consumer health data;
• delete your consumer health data;
• appeal a decision we make regarding a rights request; and
• not be discriminated against for exercising your rights.

To exercise any of these rights, contact us at [email protected]. We will respond within the timeframe required by applicable law. We may need to verify your identity before acting on your request. You may also use an authorized agent to submit a request on your behalf, subject to verification.

8. Retention and security

We retain consumer health data only for as long as necessary to provide the features you use and to comply with our legal obligations, after which it is deleted or de-identified. You can delete your data at any time from the App or by contacting us. We maintain administrative, technical, and organizational safeguards designed to protect consumer health data, as described in our main Privacy Policy.

9. Location data

We do not use geofencing to identify or track your presence at, or to collect consumer health data in connection with, any health care facility or provider.

10. Children

The App is not intended for individuals under 18, and we do not knowingly collect consumer health data from them. See our main Privacy Policy for details.

11. Changes to this policy

We may update this Health Privacy Policy from time to time, in particular to reflect changes in the App or in applicable law. If we make material changes, we will make reasonable efforts to notify you, for example by email or in-app notification. The “Effective date” above indicates when it was last updated.

12. Contact

If you have any questions about this Health Privacy Policy or wish to exercise your rights, contact us at [email protected].