Consumer Health Data Privacy Policy

1. Who this policy covers

This policy explains how SoMa Inc. ("we", "us") handles consumer health data in the Upstanding app and website. It is written to meet Washington's My Health My Data Act (RCW 19.373) and similar state laws, such as Nevada's consumer health data law (SB 370) and Connecticut's consumer health data rules. We give the protections in this policy to every user, wherever you live.

It adds to our Privacy Policy. If the two differ on consumer health data, this policy controls.

2. Health data we collect

Category	Examples
Body photos	The four photos in a body scan (front, both sides, back). Your face is blurred on your phone by default.
Exercise videos	Form check clips (muted on your phone before upload and deleted automatically 90 days after upload), reps and weight you enter.
Body measurements	Height, weight, posture angles and body points worked out on your phone (for example shoulder and hip tilt, head position, where your ear, shoulder and hip are in each photo), and an estimated body-fat range if you turn that on.
Physical condition	Whether you have pain right now; your answers to the safety questions (pregnancy, surgery in the last 6 months, osteoporosis, a heart condition or high blood pressure, a fall in the last year, dizziness or fainting); self-check results you record; training experience; and notes you write about how you feel.
Diet and nutrition	Meal photos, notes and times; estimated daily calories and protein.
Goals and activity	Your goal, where you work out, equipment, your Fix Plan, and sessions you complete.
Inferences	Scores, findings (for example "your head sits forward"), wins, priorities, and before-and-after comparisons that the Service creates from the data above.
Service use	That you use a fitness coaching service, and your subscription status.

Pregnancy. One safety question asks whether you're pregnant. It's the only reproductive health information we collect, and we use it only to keep your plan safe.

What we don't collect: precise location, biometric identifiers (we don't use face recognition or build face templates; to blur your face, the app only finds the face area on your phone), genetic data, or sexual health data.

3. Why we collect it and how we use it

We collect consumer health data only to provide the Service you ask for:

to run each check you start (Body Scan, Form Check, Meal Review, Progress Check) and create your report and score;
to build and schedule your Fix Plan and show your progress over time;
to keep your plan safe: if you answer yes to a safety question, we leave harder and balance-heavy moves out and remind you to check with your doctor;
to send reminders you turn on;
to keep your account secure, prevent abuse, and fix problems;
to meet legal obligations.

We don't use it for advertising, and we don't use it to train AI models. We won't use it for any other purpose without asking for your consent first.

4. Where it comes from

You: photos, clips, meals, notes and answers you give us.
Your device: posture measurements the app works out on your phone.
The Service: scores, findings and plans we create, using our analysis provider (Google's Gemini API).

5. Who receives it

We disclose consumer health data only to processors that work for us under a written contract and may use it only to provide their service to us:

Category	Who	What they receive
Cloud hosting and storage	Supabase, Inc. (United States) · privacy policy	All categories above, stored in our private database and file storage.
Analysis service	Google LLC, Gemini API · privacy policy	Only the content of the check you start: the photos, clips or meal photos, plus the profile details and measurements that check needs. Never your safety answers: if any was yes, it only learns that one was.

Affiliates: We have no affiliates that receive your consumer health data.

We may also disclose consumer health data when the law requires it (for example, a valid court order) or with your consent. We don't share it with advertisers, data brokers or social networks.

7. Your rights

You have the right to:

Confirm whether we collect, share or sell your consumer health data. (We never sell it.)
Access your consumer health data, including a list of every third party and affiliate we've shared it with and how to contact them.
Withdraw consent to our collecting and sharing it.
Delete it. We'll delete it from our systems and tell our processors to delete it too. If some of it sits in backups, it will be deleted when those backups are restored or overwritten, and no later than six months after we confirm your request.
Be treated fairly. We will never charge you more or give you a worse service for using these rights.

8. How to use your rights

Ask. In the app, go to You → Privacy. Or email support@getupstanding.com from the email on your account and tell us what you'd like.
We confirm it's you. We'll check the request comes from the account owner, for example by sending a code to your account email.
We answer within 45 days. If we need more time, we'll tell you why within those 45 days and may take up to 45 more. Requests are free, at least twice in any 12 months.

Appeals

If we turn down your request, in whole or in part, you can appeal. Reply to our decision or email support@getupstanding.com with the subject "Appeal". We'll respond in writing within 45 days and explain our decision. If we deny your appeal, you can contact your state attorney general. Washington residents can file a complaint at atg.wa.gov/file-complaint.

9. What we never do

We never sell consumer health data.
We never use it for targeted advertising or send it to advertising platforms.
We never set up geofences around health care facilities. We don't collect your location at all.
We never treat you differently for using your rights.

10. How we protect it

Only staff and processors who need consumer health data to provide the Service can access it, and only as much as they need. We use encryption in transit and at rest, private storage opened only through short-lived links, and access rules that keep each account to its own data. Our processors are bound by contracts to protect it and use it only for us.

11. Changes

We'll post any change here with a new date. Before we collect, use or share consumer health data in a new way that this policy doesn't cover, we'll ask for your consent.

12. Contact us

SoMa Inc.
Yiseong Bldg., 298, Dongho-ro, Jung-gu, Seoul 04617, Republic of Korea
Health data and privacy requests: support@getupstanding.com