Consumer Health Data Privacy Policy

Oneleaf — for Washington and Nevada residents

Effective date: 07th July 2026

This Consumer Health Data Privacy Policy supplements our Privacy Policies and applies to “consumer health data” as defined by the Washington My Health My Data Act (“MHMDA”) and Nevada Senate Bill 370 (together, the “Consumer Health Data Laws”). It applies to residents of Washington and Nevada, and to consumers whose consumer health data is collected in those states, in connection with the “Oneleaf” and “Calorie Tracker by Oneleaf” mobile applications, our websites, our quizzes, and all related services (the “Services”), operated by Oneleaf SAS, 7 place de l'Hôtel de Ville, 93600 Aulnay-sous-Bois, France (“Oneleaf”, “we”, “us”).

To the extent of any conflict between our other privacy notices and this policy with respect to consumer health data, this policy prevails.

1. CONSUMER HEALTH DATA WE COLLECT

We collect the following categories of consumer health data, depending on the Services you use and the information you choose to provide:

• Health-related quiz and onboarding answers: current weight, target weight, height, eating habits and patterns, sleep patterns, stress levels, smoking habits, weight-related goals and barriers;
• Body metrics and measurements: body weight, BMI, body measurements, and their evolution over time;
• Nutritional information: foods and beverages logged, calorie and macronutrient intake, dietary preferences and restrictions, declared allergies or intolerances, fasting windows (Calorie Tracker);
• Photographs: meal photographs and progress photographs you choose to upload (Calorie Tracker);
• Program and usage information that could reveal health status: hypnosis and wellness programs followed, self-reported outcomes and progress;
• Data from health integrations you enable: metrics from Apple Health (for example weight, activity, energy expenditure);
• Inferences we derive from the above to personalize your programs, recommendations, and insights.

2. SOURCES AND PURPOSES

Sources. We collect consumer health data directly from you (quizzes, onboarding, in-app logging, photographs, support communications) and, where you enable an integration, from Apple Health. We do not purchase consumer health data from third parties.

Purposes. We collect and use consumer health data solely: (i) to provide the products and services you request — creating your account, personalizing and delivering your programs, calculating and tracking your nutrition and progress, providing AI-assisted features you enable, and providing customer support; (ii) to maintain the security and integrity of the Services; and (iii) to comply with our legal obligations.

What we do not do. We do not sell consumer health data, and we do not use or disclose consumer health data for advertising or marketing purposes. No consumer health data is transmitted to advertising platforms or attribution partners.

3. CONSENT

We collect consumer health data with your consent, obtained at the time of collection, and only to the extent necessary to provide the Services you request. If we ever intend to collect or share consumer health data for purposes beyond providing the Services you request, we will first obtain your separate, affirmative consent, as required by the Consumer Health Data Laws. We will never sell consumer health data without obtaining your prior written authorization meeting the requirements of those laws — and we have no intention of doing so.

You can withdraw your consent at any time in the App settings (including by disabling AI features or health integrations) or by contacting us; withdrawal takes effect going forward.

4. SHARING OF CONSUMER HEALTH DATA

We share consumer health data only with the following categories of recipients, strictly as necessary to provide the Services, under contracts that bind them to confidentiality and to the purposes described in this policy:

• Our employees and contractors, on a need-to-know basis;
• Our processors and service providers: cloud hosting and infrastructure (Amazon Web Services, on servers located in the European Union), customer support tooling (including AI-assisted support via Tasklet), and, where you enable AI features in the Calorie Tracker, AI service providers (such as OpenAI, Anthropic, or Google Cloud) strictly to provide those features;
• Apple, where you enable the Apple Health integration, according to your device authorizations;
• Administrative, judicial, or law-enforcement authorities where required by law;
• Professional advisors and parties to a corporate transaction, subject to appropriate confidentiality obligations.

A list of the third parties and affiliates with whom we share consumer health data, consistent with the above, is available upon request at [email protected].

5. YOUR RIGHTS

Subject to the conditions of the Consumer Health Data Laws, you have the right to:

• Confirm and access. Confirm whether we are collecting, sharing, or selling consumer health data concerning you, and access that data, including a list of all third parties and affiliates with whom we have shared it and an active email address or other online mechanism to contact them.
• Withdraw consent. Withdraw your consent to our collection and sharing of your consumer health data.
• Delete. Request deletion of your consumer health data. We will delete it from our records, including from archived and backup systems (which may take up to 90 days for backups), and we will notify our processors and any third parties with whom we have shared the data of your deletion request.

How to exercise your rights. Email [email protected] from the address linked to your account, with the subject line “Consumer Health Data Request”. We will verify your identity using information associated with your account and respond within 45 calendar days, extendable once by 45 additional days where reasonably necessary (in which case we will inform you). Exercising your rights is free of charge up to twice per year.

Appeals. If we decline to take action on your request, you may appeal by replying to our response with the subject line “Appeal”. We will respond to your appeal within 45 days (Washington) or 60 days (Nevada). If your appeal is unsuccessful, Washington residents may contact the Washington State Attorney General at atg.wa.gov, and Nevada residents may contact the Nevada Attorney General.

Non-discrimination. We will not discriminate against you for exercising any of these rights.

6. CONTACT

For any question about this policy or our handling of consumer health data: [email protected], or by post: Oneleaf SAS, 7 place de l'Hôtel de Ville, 93600 Aulnay-sous-Bois, France.

‍