Consumer Health Data Privacy Policy

About This Policy

This Consumer Health Data Privacy Policy is a standalone disclosure required by the Washington My Health My Data Act (RCW 19.373), Nevada Senate Bill 370, and the Connecticut Data Privacy Act. It describes how StepSavvy LLC ("StepSavvy," "we," "us," or "our") collects, uses, shares, and protects consumer health data.

This policy is separate from and supplements our general Privacy Policy. Where this policy addresses consumer health data specifically, its terms govern.

This policy applies to all consumers whose health data we collect, regardless of residency, and provides the rights and disclosures required under applicable state consumer health data laws.

This policy addresses data privacy only. StepSavvy is not a medical device and has not been evaluated by the U.S. Food and Drug Administration; for the full medical and regulatory disclaimers, see Sections 3 and 4 of our Terms of Service.

Categories of Consumer Health Data We Collect

We collect the following categories of consumer health data, as defined under RCW 19.373.010:

Purposes for Collection and Use

We collect and use consumer health data for the following purposes:

• Generating personalized physical therapy recovery plans based on your surgery type and health conditions
• Providing AI-powered Gait Analysis and biomechanical feedback
• Providing AI Form Check — squat, bench press, and deadlift video analysis with form score, per-rep observations, and coaching cues
• Providing Foot Photo Analysis — descriptive foot type and arch classification from a back-of-foot photo
• Tracking pain patterns and monitoring recovery progress over time
• Generating recovery reports that you may choose to share with your healthcare providers. These reports are assembled on your device from data already stored in StepSavvy; their contents are not sent to our AI analysis provider
• Maintaining app functionality, security, and technical diagnostics
• Sending recovery-related communications, including welcome emails and weekly activity summaries

Categories of Sources

We collect consumer health data from the following categories of sources:

• Directly from you: Information you provide during onboarding (surgery type, conditions) and daily app use (pain logs, exercise completion)
• From your device — Gait Analysis: Short walking videos you record in-app. The video is uploaded to our secure cloud storage so the app can replay your results with a skeleton overlay. Individual still frames and pose landmarks extracted from the video are separately transmitted to our AI analysis provider for interpretation.
• From your device — Form Check: Short side-view videos of squats, bench press, or deadlifts. The video plus on-device biomechanics measurements are transmitted to our AI analysis provider for one-shot analysis; the cloud copy is discarded after the result returns. A local copy is cached on your device for replay only.
• From your device — Foot Photo Analysis: A back-of-foot photo you take in-app. The photo is transmitted to our AI analysis provider for one-shot classification; the cloud copy is discarded after the result returns.
• From your device — Heel Angle Measurement (manual): Heel (rearfoot) angle values, the derived foot-type category, and an optional arch-height self-report, computed on your device from markers you place on a photo that never leaves your device.
• From Apple Health (optional, with your permission): If you tap “Connect Apple Health” in the Closet, we read your walking and running distance (read-only) to attribute mileage to a shoe you choose for wear tracking. We only read this single distance metric and never write to Apple Health. We never sell it, share it with data brokers, or use it for advertising. The mileage total we attribute to a shoe is stored in your private account and, if you request AI shoe recommendations, that per-shoe total is included in the context sent to our AI analysis provider; we do not send your raw Apple Health records.
• Automated collection: Crash and error logs from error monitoring services, which may incidentally include app state information

Categories of Consumer Health Data Shared

We share the following categories of consumer health data with third parties:

• Gait analysis still frames and pose landmarks shared with our AI analysis provider (Google, via the Gemini API) for the purpose of generating biomechanical feedback
• Form Check videos and on-device biomechanics measurements shared with our AI analysis provider (Google, via the Gemini API) for the purpose of generating a form score and coaching cues. Google discards the video after the analysis is complete.
• Foot photos shared with our AI analysis provider (Google, via the Gemini API) for the purpose of generating descriptive foot type and arch classification. Google discards the photo after the analysis is complete.
• Surgery type, health conditions, recovery phase and time since surgery, and pain tracking data (including the body regions you marked and their intensities) shared with our AI analysis provider to personalize exercise recommendations and shoe compatibility scoring
• Your saved shoe list — brand and model, the comfort rating you gave each pair, and accumulated mileage (including mileage attributed from Apple Health) — shared with our AI analysis provider when you request AI shoe recommendations
• Raw walking videos stored with our cloud infrastructure provider (Supabase) to enable playback of your gait analysis results with a skeleton overlay. These videos remain within your private account storage and are not shared with any AI provider in raw form
• Technical error data (which may incidentally include app state) shared with our error monitoring service for crash diagnostics

Third Parties and Affiliates

The following third parties receive consumer health data from StepSavvy:

StepSavvy has no corporate affiliates. We are an independently operated company with no parent company, subsidiaries, or affiliated entities that receive consumer health data.

Your Rights

Under applicable consumer health data privacy laws, you have the following rights:

• Right to Confirm: You may request confirmation of whether we collect, share, or sell your consumer health data.
• Right to Access: You may request a copy of the consumer health data we have collected about you.
• Right to a Third-Party List: You may request a list of all third parties and affiliates, including contact information, with whom we have shared your consumer health data during the prior 12 months.
• Right to Withdraw Consent: You may withdraw your consent to the collection and sharing of your consumer health data at any time.
• Right to Delete: You may request that we delete your consumer health data. Upon receiving a verified deletion request, we will delete your data from active systems within 30 days and from backup systems within an additional 6 months. We will direct all third parties who received your data to delete it as well. One narrow record falls outside this schedule and is described in Section 8 (Data Retention) of our Privacy Policy: an anti-abuse record noting that the free plan’s single AI Gait Analysis was claimed on a given device. It is unlinked from your account on deletion and contains no consumer health data — only a random device install identifier, which feature was claimed, the app build, and dates.

Right to Appeal: If we deny your request, you may appeal by contacting us at stepsavvy.app@gmail.com. If you are unsatisfied with the outcome of an appeal, you may file a complaint with the Washington State Attorney General, the Connecticut Attorney General, or the Nevada Attorney General, as applicable.

Consent

We obtain your consent to collect, use, and share consumer health data as follows:

• Collection consent: Obtained when you voluntarily enter health information into the app (such as surgery type, conditions, and pain data); your act of entering this information to set up and use the recovery features is your affirmative consent to our collection and use of it for those features.
• Sharing consent: Obtained separately, before any health data is shared with our AI analysis provider, through an in-app consent modal presented the first time you use any AI feature that uploads health data — Gait Analysis, AI Form Check, or Foot Photo Analysis.

We do not sell consumer health data and therefore do not require sale authorization.

Your consent must be freely given, specific, informed, and unambiguous. We will never collect consumer health data without valid consent or a permissible legal basis.

Children and Minors. StepSavvy requires all users to be at least 16 years old. We do not knowingly collect consumer health data from anyone under 16, and, consistent with the U.S. Children’s Online Privacy Protection Act (COPPA), we do not knowingly collect personal information from children under 13. If we learn that we have collected consumer health data from someone under 16, we delete it promptly. If you believe a minor has provided us data, contact us at stepsavvy.app@gmail.com.

Geofencing

StepSavvy does not use geofencing technology in any form. We do not use GPS, cell tower data, Wi-Fi signals, Bluetooth beacons, or any other location technology to establish virtual boundaries around health care facilities, mental health facilities, reproductive health clinics, or any other physical locations.

This disclosure is made in compliance with RCW 19.373.080, which prohibits the use of geofencing around health care facilities for the purpose of collecting consumer health data.

Data Security

We implement administrative, technical, and physical security measures appropriate to the sensitivity of consumer health data, including:

• Encryption of data in transit using TLS 1.2 or higher
• Encryption of data at rest on our infrastructure provider's servers
• Access controls and authentication mechanisms to limit data access to authorized personnel
• Regular security reviews of our systems and practices

All third-party processors who receive consumer health data are contractually required to maintain appropriate security measures consistent with industry standards.

Data Retention

We retain your consumer health data only for as long as your account is active or as needed to provide you with our services.

Upon account deletion or a verified deletion request, your consumer health data is removed from active systems within 30 days and from backup systems within 6 months.

The single exception to that schedule is the anti-abuse free-analysis device record described in Section 8 (Data Retention) of our Privacy Policy. It survives account deletion with your user ID removed, and it contains no consumer health data — no gait, pain, exercise, photo or pose data of any kind — only a random device install identifier, the feature claimed, the app build, and dates.

Biometric-Style Data Retention Schedule. Pose landmarks extracted from walking videos (which some jurisdictions may classify as biometric identifiers under laws such as Illinois’ Biometric Information Privacy Act) are retained for the duration of your active account so you can view your gait history. Upon account deletion, a verified deletion request, or the date on which the purpose for collection has been satisfied — whichever occurs first — pose landmarks are permanently deleted from active systems within 30 days and from backup systems within 6 months, but in no event later than 3 years following your last interaction with StepSavvy. This schedule, and the same consent, limited-purpose, and no-sale protections, also apply to any other data that may be construed as a biometric identifier — including the gait or pronation pattern inferred from your walking videos and the back-of-foot photographs used for foot-type classification — which are sent to Google’s Gemini API only to generate your result and whose cloud copy is discarded after processing.

You may request deletion of your consumer health data at any time by contacting us at stepsavvy.app@gmail.com, or through the in-app privacy settings.

Changes to This Policy

If we make material changes to this Consumer Health Data Privacy Policy, we will notify you before those changes take effect. Material changes include, but are not limited to, new categories of consumer health data collected, new purposes for collection, or new third parties with whom data is shared.

If we collect new categories of consumer health data or use existing data for materially different purposes, we will update this policy and obtain your affirmative consent before proceeding.

Contact Us

If you have questions about this Consumer Health Data Privacy Policy or wish to exercise your rights, please contact us: