Consumer Health Data Privacy Policy

Scope of this health-data policy

Capably Health, LLC, a Georgia company, provides this policy for consumer health data processed in connection with Capably’s website, requested updates, correspondence, software-usability testing, and current local-first consumer preview. It is separate from the Privacy Notice and controls if the two differ about consumer health data.

Consumer health data can include information linked, or reasonably capable of being linked, to a person that identifies health status, abilities, symptoms, or use of health-related products or services. The privacy choices below are available wherever you live. Additional statutory rights depend on the law that applies, including Washington and Nevada consumer-health-data laws.

The current app processes its profile and workout data locally without automatically uploading them to us. Information deliberately sent through a signup, email, form, call, or shared file is different: Capably and the relevant service providers receive that information.

Categories of consumer health data

Conditions and related details

Self-reported conditions and disability information, including details entered where supported, such as spinal-cord injury level, affected joints, or limb difference and laterality. These stay local in the app unless you choose to share them; we also receive details you deliberately provide for testing or support.

Physical abilities and exercise context

Answers about movement, grip, reaching, balance, positioning, transfers, and related abilities; equipment, support, and accommodation needs; and preferences that reveal health-related information.

Exercise activity and feedback

Generated plans; dated workout and set records; repetitions, resistance, duration or distance; swaps, skips, pauses, and completion records; fatigue or symptom-related feedback, safety concerns, and notes. These are local app records unless deliberately shared.

Derived planning information

Movement-screening results, cautions, held movements, explanations, and plan/report summaries produced from entered information. The local program derives these outputs to provide its features; they are not a medical diagnosis.

Testing and correspondence

Health-related statements, requests, attachments, observations, consent records, and accommodation information. Optional audio, screen, or video recordings can contain a face, voice, surroundings, and disclosed health details.

Linked contact and interaction records

An email address, name if provided, subscriber or testing status, and associated website/email technical or engagement records when linked to health-related interest or use. An early-access signup is not proof of a diagnosis, and we do not use engagement to infer one.

We do not automatically obtain electronic medical records, prescription histories, genetic test data, or wearable-sensor data. We do not use precise device-location tracking or health-facility geofencing. This does not mean we can prevent someone from including sensitive information in a message or screen share; please provide only what is needed.

Where the information comes from

Sources are information you enter into the app; information you submit through website signup, recruitment forms, email, attachments, or other deliberate correspondence; your participation in a testing session; and technical or subscription records generated by the services used for those interactions. Local program calculations produce the derived planning information described above.

We do not buy consumer health data from data brokers or automatically retrieve it from healthcare providers. A report or medical detail you choose to send is information supplied by you, not a connected medical-record feed.

Why and how it is processed

Local app features

On your device, use the entered profile, abilities, equipment, preferences, and records to screen movements, generate and display a plan, record activity, explain results, and create reports or backups you request. The software can flag or withhold movements; this is programmed processing, not clinician review.

Requested communication

Manage early-access updates and subscription choices; respond to a message or shared report; troubleshoot a specific issue; and process privacy requests. We do not require health details for the email list.

Software usability and accessibility

Arrange an appropriate mix of testers, provide requested accommodations, document consent, observe use of fictional profiles, and identify product or wording problems. The current testing scope is software-only and no-exercise, not automatic clinical-research enrollment.

Optional recordings

Review the session for the testing purposes specifically explained in the consent materials. Recording is optional. The existing 12-month deletion commitment remains; recording consent is not permission for public promotion, indefinite retention, or a new purpose.

We collect or share consumer health data with the consent required by applicable law, or to the extent necessary to provide a product or service you requested where the law allows that basis. When separate consent to sharing is required, we obtain it separately from consent to collection. Reading this policy, joining the email list, or participating in a test is not blanket consent to unrelated health-data processing.

We do not sell consumer health data or share it for targeted advertising. We do not use it to build advertising audiences or infer diagnoses from browsing or email engagement. The current consumer app has no research/study mode or automatic transmission of health records to a generative-AI service. A new study, public use of identifiable material, or external AI-training proposal would require its own explanation and any required separate permission before it begins.

Data shared and recipients

Local app profiles and workout records are not automatically shared with Capably, its providers, a clinician, or an advertising service. Company-held data is handled as follows:

Website and email-list services — Squarespace

Receives website technical data, signup/contact details, subscription status, and email engagement data. These may show health-related interest. The signup does not request diagnoses or workout records, and the app does not upload those records to Squarespace.

Correspondence and document services — Google Workspace

Receives submitted forms, emails, attachments, health-related support or testing details, and associated consent/administrative records that are handled in our business account.

Testing-call services — Google Meet when used

Receives information shared during the invited call and any specifically agreed recording. The session materials identify the actual platform and recording scope before participation.

A recipient you choose

Receives the report or file you deliberately send outside the app. Creating or downloading it does not send it automatically. Copies a clinician or other recipient receives are also subject to that recipient’s privacy practices.

Website security or font integrations, where active, may send technical page/device information to Google or Adobe. This can be health-related where it reveals an interaction with our services, but is not an upload of an app health profile. The general notice describes these platform features. We do not enable third-party advertising trackers to collect consumer health data over time and across websites. Standard hosting, security, and email measurement are not a promise that no third-party technical data processing occurs.

Specific corporate affiliates receiving consumer health data: none. We do not share identifiable testing or app data with clinical reviewers, advisors, or investors under this policy. We may provide genuinely non-identifying summaries; a rare detail or attributable quotation is not treated as anonymous merely because a name is removed. Tell us if you do not want to be quoted at all, and we will not use direct quotations from you.

Apart from the providers and authorized uses identified here, we disclose identifying health information only with your permission or when legally required, limited to what is required. Providers handling consumer health data on our behalf are limited to the applicable service purpose and processing arrangements.

Your rights, consent, and deletion

You may ask us to confirm whether we collect, share, or sell consumer health data about you; access company-held data and information about recipients, including contact details required by law; correct inaccurate information; withdraw consent and ask us to stop collection or sharing; or delete data we hold.

Email hello@capably.health. Describe the request and, where possible, use the address used with us. We may seek the minimum information needed to authenticate it. Do not send a full medical record, ID document, or app backup in the initial request. We will arrange a suitable method if more information is actually needed.

We will respond within 30 days and explain the action taken or any limitation in writing. We honor applicable legal deadlines, including Nevada’s deadline for deleting covered data within 30 days after authenticating a deletion request, subject to applicable statutory limitations. These requests are free, do not reduce agreed tester compensation, and are not a reason to penalize you in future testing invitations.

Information we hold or have shared

A valid deletion request covers the relevant records we hold and the notifications to service providers and other recipients that applicable law requires. We do not treat a retention schedule as overriding a deletion right. We will explain any limited records legally required to remain and any permitted delay affecting archived or backup copies, rather than claiming every copy disappeared instantly.

Testing signup responses are deleted on request or 12 months after the relevant testing round, whichever is earlier. Recordings are deleted after 12 months, or earlier when required by a valid request or shorter consent commitment. Health-related email correspondence follows the 24-month schedule in the general notice, subject to earlier deletion rights. Identifiable testing notes follow the testing-record schedule. Truly non-identifying summaries may no longer be traceable to an individual; a coded record that remains linkable is still covered.

Information only on your device

We cannot access local app data remotely. The current preview’s Settings → Start over → Delete local preview data control removes its local profile and workout records. You can also use browser site-data controls. Delete downloaded reports and backups separately and address other browsers, devices, or recipients holding copies. A user-created export may contain conditions or notes even without a name.

Withdrawing consent

You can unsubscribe from updates, decline or stop recording, stop participating in optional testing, and ask us to stop optional processing. We explain any information genuinely necessary to provide a requested feature or arrange a session. Withdrawal does not make earlier lawful processing unlawful, but it does stop future processing based on that consent; ask for deletion as well when that is what you want.

Appeals and complaints

If we refuse a request, we explain why in writing within 30 days. You can appeal by replying to that message or emailing hello@capably.health with “Privacy appeal” in the subject. We will review the decision and respond in writing within 45 days, explaining the result and reasons.

If we deny the appeal, we will provide the relevant Attorney General’s contact or complaint information. You can also contact the Washington Attorney General, the Nevada Attorney General, or the appropriate authority where you live.

Changes and notice

We will update the effective/last-updated date when this policy changes. Before a material change to company-held health-data practices, we will directly notify the people whose health information and contact details we hold. For a future change affecting only local app users, notice must also be provided in the applicable app release before new processing begins.

New categories, recipients, or purposes will be explained before use and require consent where applicable. Publishing a broader policy does not retroactively authorize new uses, extend a recording deadline, create a clinician connection, or enroll anyone in research or AI training.