Consumer Health Data Privacy Policy

Effective date: July 5, 2026

1. Scope

This Consumer Health Data Privacy Policy explains how Aiden August Lindan Buck, developer of the Byrna iOS application (“Byrna,” “we,” “us”), collects, uses, shares, and protects “consumer health data” as defined by applicable state health-data privacy laws, including Washington’s My Health My Data Act. It is separate from, and supplements, our general Privacy Policy. Where the two differ regarding consumer health data, this policy controls.

2. Consumer health data we collect

“Consumer health data” is personal information linked to you that identifies your past, present, or future physical or mental health. In Byrna, this may include:

• Fitness activity: workouts, exercises, sets, repetitions, weights, and training programs
• Body measurements: bodyweight
• Sleep data, including data imported from Apple Health with your permission
• Nutrition data: food and supplement logs, and nutrition or macro targets
• Health-related profile information: stated injuries, fitness goals, and physical attributes such as sex and age
• Metrics derived from the above, such as your Byrna Score, training volume, and streaks

Most of this data is stored on your device and synced only to your own private Apple iCloud account. We do not store it on our servers or access it, except in the two situations described in Section 4.

3. Sources of consumer health data

We collect consumer health data:

• Directly from you, when you enter it in the app
• From Apple Health (HealthKit) on your device, with your permission, for data such as sleep
• By deriving or calculating it from the data above (for example, your Byrna Score)

4. How we use consumer health data, and our basis

We process your consumer health data only to provide the features you request. Because most of it stays on your device, we process it off your device in only two situations, each initiated by you:

• AI features. When you use an AI feature (for example, plan generation, the AI Coach, or meal analysis), the inputs that feature needs are transmitted to our AI provider to generate your response. This processing is necessary to provide the feature you requested.
• Sharing with friends. If you choose to share an activity summary (such as your Byrna Score, streak, or training volume) with a specific friend, we store and share that summary as you direct.

We process consumer health data that is necessary to provide a product or service you have requested without separate consent, as permitted by law. For any processing that is not necessary to provide a requested product or service, we obtain your consent first, and you may withdraw it at any time. We do not use consumer health data for advertising.

5. How we share consumer health data

We share consumer health data only as follows:

• Apple — stores your on-device health data in your own private iCloud (CloudKit) account.
• Anthropic — our artificial-intelligence provider; receives the inputs you submit to an AI feature in order to generate your response. Under our commercial terms, Anthropic does not use these inputs to train its models, and retains them only for a limited period.
• Supabase — provides the database that stores server-side data, including any activity summary you choose to share.
• Railway — hosts the server that transmits your AI-feature inputs to our AI provider.
• Other users — the specific friends you choose to share an activity summary with.

The categories of third parties that receive consumer health data are cloud storage and database providers and an artificial-intelligence provider. We have no affiliates that receive consumer health data.

We do not sell your consumer health data, and we will not do so without your separate, valid, written authorization.

6. Your rights

You have the right to:

• Confirm whether we collect, share, or sell your consumer health data, and access that data
• Obtain a list of the third parties and affiliates with which we have shared your consumer health data, along with a way to contact them
• Have your consumer health data deleted
• Withdraw consent to our collection or sharing of your consumer health data

To exercise any of these rights, contact us at buckaiden40@gmail.com. You can also delete your account and data from within the app at any time. We will respond within 45 days; if we need more time, we may extend once by an additional 45 days and will tell you. We will not require you to create a new account to exercise your rights, and we will not deny you services or charge you differently for exercising them.

7. Withdrawing consent and deletion

If you withdraw consent or request deletion, we will stop the relevant collection or sharing and delete your consumer health data, except where we are permitted or required to retain limited records (for example, to comply with law). Deleting your account also removes the server-side data associated with it.

8. Security

We protect consumer health data using encryption in transit and access controls, and by keeping most of it on your device rather than on our servers.

9. Contact

Aiden August Lindan Buck — buckaiden40@gmail.com

Effective date: July 5, 2026