1. Scope and responsible entity ISI Alberta Inc, trading as Iron Sharpens Iron (ISI), based in Alberta, Canada, determines the purposes and means of handling the app's consumer health data. Contact: legal@isi.fitness. This notice explains the additional handling and rights for consumers protected by Washington's My Health My Data Act, Nevada's consumer health-data provisions and Connecticut's applicable privacy/health-data rules. Those laws differ in scope, definitions and exceptions. Washington coverage can include persons whose health data is collected in Washington, not only residents. Connecticut does not impose the usual revenue/volume thresholds on a covered consumer health-data controller. This notice controls any conflict with the general Privacy Policy to the extent the applicable law requires.
2. Categories and sources From you: screening answers; medications, injuries, conditions and pregnancy/postpartum information supplied; eating-related screens; measurements/body-fat estimates; weight/goals; workouts and loads; meals, allergies and meal photos; supplement use; readiness, sleep, mood and energy; and journal/faith/custom-task entries that reveal health status. Photos may reveal physical characteristics or conditions even when posted as community content. From app processing: flags, accommodations, calorie/macronutrient targets, progress/weight percentages, health-related scores and other inferences from those inputs. Technical/account identifiers can connect this information to you. A derived rule is not automatically anonymous. Sources are your inputs/uploads and the app's calculations/inferences; any new connected-device or external health-data source requires updated disclosure before use.
3. Purposes We use the relevant information to provide the personalized fitness/nutrition service you request; screen for a need for professional advice; assemble and adjust plans and estimates; show logs/progress; perform permitted coach/support review; and operate requested community sharing. Necessary security/legal handling is subject to applicable exceptions and does not create a general exemption from deletion rights. We do not sell consumer health data or use it for targeted advertising, and do not use geofencing to identify persons seeking health services.
4. Recipients and community disclosure Processing-provider categories: app hosting/database, media storage, email delivery, infrastructure/security logging, platform analytics and AI processing. Base44's published subprocessors include MongoDB, Supabase, Render, SendGrid, DataDog, Google Cloud, OpenAI, Anthropic and Wix. Request-specific routing/configuration determines which provider receives which data. Providers must be engaged under appropriate binding processing terms. Provider processing must be assessed under each law rather than presumed exempt sharing. Other recipients: team members and an accepted partner when you choose those features, and lawful authorities where disclosure is legally authorized or required. Teams can receive workout/sleep/nutrition/category scores, activity/task names, personal-record loads and stories. Weight display and weight-goal category progress are suppressed when weight sharing is Off. Progress display adds pounds lost and percentage to goal; Everything adds starting/current/goal weights. Partners receive the limited activity/count/streak fields in the Privacy Policy. These fields can constitute health data; community disclosure is not limited to photos or raw medical records. The responsible ISI entity is ISI Alberta Inc. Vendor corporate affiliates are not automatically ISI affiliates. Contact us for the recipient/affiliate list relevant to your records. We provide the actual recipient/affiliate list and required contact mechanisms through a verified request.
5. Consent and withdrawal We obtain the consent required by the applicable law before the collection or sharing concerned. The request identifies categories, specific purposes, recipient categories and how to withdraw. Necessary requested-service or other statutory exceptions are assessed narrowly, not assumed for every use. Where sharing consent is required, it is separate from collection consent. General Terms acceptance and the injury release are not substitutes. Optional community, weight display, faith/reflection and marketing permissions are separate. Submitting a photo for analysis sends it to the disclosed AI processing providers for the requested estimate. You may withdraw collection/sharing consent by email to legal@isi.fitness. We stop the affected optional processing and explain any core feature that cannot continue. Withdrawal does not automatically close your account for unrelated optional choices. ISI does not sell health data; any future sale would require separate legal review and any mandated written authorization, not reliance on these consents.
6. Access, deletion and other rights As applicable, you may confirm collection/sharing/sale, access your data and recipient/affiliate information, withdraw consent and request deletion. Connecticut rights can also include correction, portability and relevant opt-outs. We will not retaliate for exercising a protected right. Request by emailing legal@isi.fitness, preferably from the account email. We verify identity with proportionate steps, provide a secure channel where needed and do not ask for unnecessary medical documents. An authorized agent may act where the law permits upon appropriate proof of authority. Washington: respond without undue delay and within 45 days of receipt, with one permitted 45-day extension on timely notice. Upon a valid deletion request, delete covered data across relevant systems and notify covered recipients. For archived/backups, any delay must meet the statutory limit of six months after authentication, not an indefinite vendor cycle. An appeal is handled within 45 days, with the reason and attorney-general complaint mechanism if denied. Nevada: respond without undue delay and within 45 days after authentication, with one permitted 45-day extension on notice. Covered deletion from active records/networks and notice to recipients must occur within 30 days after authentication; notified recipients have their own 30-day obligation. A backup/archive delay is permitted only as authorized by the statute, with its maximum two-year limit. The longest allowed delay is not our target. Nevada's health-data provisions do not create the same mandatory appeal mechanism as Washington; we nevertheless offer an internal review by replying to our decision. Connecticut: respond without undue delay and within the applicable 45-day period, with a permitted 45-day extension on notice. Provide the appeal route; respond to an appeal within 60 days and provide the attorney-general complaint mechanism when required. If a request is refused in whole or part, we explain the lawful reason and available review/complaint route. Records are not automatically exempt merely because ISI may want them for a future claim. An injury waiver does not override statutory health-data deletion. Provider backups must meet the law that applies to the particular request.
7. Contact and updates Email: legal@isi.fitness. Postal address: Alberta, Canada; contact legal@isi.fitness. Washington Attorney General: atg.wa.gov; Nevada Attorney General: ag.nv.gov; Connecticut Attorney General: portal.ct.gov/ag. New categories/purposes or sharing require updated disclosures and affirmative consent where required before implementation.