Consumer Health Data Privacy Policy
This policy explains how JRS Content Solutions UG (haftungsbeschränkt) (“we”), the maker of bunlo, handles consumer health data as defined by Washington's My Health My Data Act, Nevada's consumer health data law (SB 370) and Connecticut's Data Privacy Act. It supplements our Privacy Policy, which describes all processing in detail.
1. Consumer health data we collect
- Health and fitness data you allow from Apple Health: sleep, activity and workouts, heart rate, resting heart rate, heart rate variability, breathing rate, blood oxygen, wrist temperature, body measurements and cycle tracking. It is processed on your iPhone.
- Health data you enter: journal entries, mood, training sessions, body measurements, blood test values, cycle logs, and a status such as sick, injured or on a break.
- Scores bunlo derives: recovery, sleep, strain, stress and biological age estimates.
- Data from a wearable account you connect: sleep, heart rate, heart rate variability, breathing rate, blood oxygen, skin temperature, steps, energy, workouts, weight and the device's own scores.
- What you send to health explanations: the categories you allow, your questions, notes and photos, and the AI's answers.
- Account and usage data that could indicate you use a health app: your account, subscription status and, only if you agree, app usage events and crash reports. These never contain health values.
Cycle data is reproductive health data. It is sent to health explanations only under its own separate switch. We do not collect precise location or biometric identifiers, and we do not use geofencing.
2. Sources
You, directly in the app; Apple Health on your iPhone, with your permission; and the wearable provider you choose to connect (Google, Oura, WHOOP, Polar, Withings or Garmin), with your permission.
3. Why we collect and use it
- To show you your own health data, scores, trends and garden (on your iPhone).
- To write health explanations and answer your questions, if you consent.
- To back up your journal and scores and to sync data from a connected device, if you consent.
- To run your account and subscription, keep the service secure and fix crashes.
We never use consumer health data for advertising, never sell it, and never use it to build profiles for anyone else.
4. Your consent
Health data stays on your iPhone unless you give a separate, explicit consent in the app: one for health explanations, and one for keeping health data on our server (cloud backup and device connections). You can withdraw each in the app at any time.
5. Who we share it with
We share consumer health data only with processors that act on our instructions and under contract, and only for the purposes above:
- Supabase, Inc.: hosts our server and database (EU).
- OpenRouter, Inc. and Anthropic, PBC on Amazon Web Services: write health explanations, keeping nothing once an answer is written.
- RevenueCat, Inc. and Superwall, Inc.: subscription status and the paywall. They receive no health values.
- PostHog Inc. and Functional Software, Inc. (Sentry): usage statistics and crash reports, only if you agree. They receive no health values.
- Resend, Inc., Google and Vercel Inc.: account emails, our email and our website. They receive no health values.
We have no affiliates that receive consumer health data. We may disclose data if the law requires it, for example under a valid court order. We do not sell consumer health data.
6. Your rights
Depending on your state, you have the right to:
- confirm whether we collect, share or sell your consumer health data, and access it, including a list of the third parties and affiliates it was shared with;
- withdraw your consent to its collection and sharing;
- have it deleted, including by our processors;
- not be discriminated against for using these rights.
How to use them: in the app, stop sharing data with the AI chat, turn off cloud backup, disconnect a device and delete its data, or delete your account in Settings → Account → Delete account. Or email robin.faraj@11x.agency from the address of your account. We may need to confirm the request comes from you. We answer within 45 days; if we need up to 45 more, we tell you why.
Appeals: if we decline your request, reply to our answer with the subject “Appeal”. We decide within 45 days and explain the result. If you disagree, you can contact your state's attorney general, such as the Washington Attorney General.
7. How long we keep it
Data on your iPhone stays until you delete it or the app. On our server, saved questions and answers are deleted 90 days after each was created, data from a connected device 400 days after the moment it describes, cloud backup copies when you turn backup off, a device's data when you disconnect it and choose delete, and everything when you delete your account, as described in the Privacy Policy.
8. Contact
JRS Content Solutions UG (haftungsbeschränkt), Berlin, Germany. Email robin.faraj@11x.agency.
Questions about any of this?
Write to robin.faraj@11x.agency.