Consumer Health Data Privacy Policy
Last updated:
About this policy
This policy is for people in the United States, and it is written to meet Washington’s My Health My Data Act (RCW 19.373), Nevada SB 370 (NRS 603A) and similar state consumer health data laws, such as Connecticut’s. It sits alongside our main Privacy Policy, which covers everything else.
Holimo is published by To fill in company legal name, To fill in registered address. “Consumer health data” means personal information that is linked or reasonably linkable to you and that identifies your past, present or future physical or mental health.
Consumer health data we collect
Depending on the features you turn on, Holimo may collect:
| Category | Examples |
|---|---|
| Body measurements | Height, weight, weigh-ins, waist and other measurements you enter |
| Food and nutrition | Meals logged, meal plans, calories, protein and other nutrients, diets and allergies you choose |
| Medication and GLP-1 | Medication names, doses and schedules exactly as you enter them from your prescription, doses taken or skipped, injection sites, side effects, appetite, supply |
| Movement | Workouts, sets and reps, steps and active energy you allow us to read from Apple Health or Health Connect |
| Sleep | Bed and wake times, duration, wake-ups, the sleep score and how rested you feel |
| Mind | Mood check-ins and tags, breathing and focus sessions, journal entries (encrypted on your phone) |
| Hydration and habits | Water and caffeine logs, habits and streaks |
| Reproductive health | Period dates, flow, symptoms, cycle predictions, and a pregnancy or breastfeeding pause (all encrypted on your phone; can be kept on your phone only) |
| Inferences | Calorie and protein targets, the Today ring, trends and insights calculated from the data above |
We do not collect precise location, and we do not use geofencing around any health care facility.
Where it comes from
- From you, when you enter it in the app.
- From Apple Health or Health Connect, only for the data types you allow, and only if you turn sync on.
- From Holimo itself, when the app calculates targets, scores and trends from what you logged.
Why we collect and use it
- To provide the features you ask for: targets, meal plans, reminders, the Today view, trends, the GLP-1 doctor-visit report and exports.
- To keep your data in sync between your phone and your account, so it survives a new phone.
- For Holimo Pro AI features, only if you use them, and only with the minimal context described in our AI Disclosure.
- To keep you safe: for example, red-flag side effects show an urgent-care screen.
- To protect the service and meet legal duties.
We never use consumer health data for advertising, and we never use it to decide which affiliate shop buttons you see.
Your consent
We ask for your consent in the app before we collect consumer health data, with separate consents for health logs, GLP-1 and medication, cycle data, and AI processing. Each consent is recorded with its version and time. You can withdraw consent in the app at any time; this stops new collection for that area.
We would ask for separate consent before sharing consumer health data with anyone other than a service provider processing it for us. Today we do not share it with anyone else.
Who we share it with
We share consumer health data only with processors that help us run Holimo under contract and only on our instructions:
- Supabase (database, sign-in and server functions; EU region, Frankfurt).
- Google Gemini API (paid tier), only for Holimo Pro AI features you use, with minimal context. Journal text is never sent. Cycle data is sent only if you turn on “Let the AI coach see cycle data”.
The full list is on our Sub-processors page. We have no affiliates that receive consumer health data. To fill in counsel to confirm whether any corporate affiliates exist and must be listed
We do not sell consumer health data, and we do not share it for targeted advertising.
Your rights
- Access: confirm whether we hold your consumer health data, see it, and get a list of all third parties and affiliates we shared it with, with their contact details.
- Delete: delete your consumer health data, including from our processors and backups. In the app: Settings → Account → Delete account. See Account and data deletion.
- Withdraw consent: at any time, in the app or by email.
- Export: Settings → Your data → Export everything (JSON) or Export logs (CSV).
Email privacy@getholimo.com with the subject “Consumer health data request”. We will verify your request using the account you signed in with, and reply within 45 days, extendable once by 45 days when reasonably necessary, in which case we will tell you why. We do not charge for requests, and we will not treat you differently for using your rights.
Appeals
If we decline your request, you can appeal by replying to our decision or emailing privacy@getholimo.com with the subject “Appeal”. We will answer in writing within 45 days and explain our reasons. If you are still unhappy, you can contact the Washington State Attorney General (atg.wa.gov (opens in a new tab)) or the attorney general of your state.
How we protect it
Access is limited to you through row-level security on every table, tested automatically. Data travels encrypted (TLS). Journal text and cycle data are also encrypted on your phone before they sync. More on our Security page.
Contact and changes
Questions: privacy@getholimo.com. If we change this policy in a way that affects how we collect or share consumer health data, we will tell you in the app and ask for consent again where the law requires it.