Washington Consumer Health Data Privacy Supplement

1. Scope and Applicability

This Supplement is provided by QG Labs LLC ("Company," "we," "us," or "our"), operator of the GymAmigo mobile application (the "App"), pursuant to the Washington My Health My Data Act, RCW 70.372 (the "MHMD Act"). The MHMD Act provides Washington state residents with specific rights regarding their consumer health data and imposes obligations on regulated entities that collect or share such data.

This Supplement applies to all Washington state residents who use the App. Capitalized terms not defined in this Supplement have the meanings given in the GymAmigo Mobile Application Privacy Policy.

The MHMD Act defines "consumer health data" broadly to include personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status, including but not limited to health conditions, precise location data that could reasonably indicate an attempt to acquire health-related services or supplies, body weight and measurements, wellness information, and health-related fitness metrics. GymAmigo collects several categories of data that fall within this definition, as described in Section 2 below.

2. Consumer Health Data We Collect

Based on GymAmigo's features and the MHMD Act's broad definition of consumer health data, we may collect the following categories of consumer health data from Washington residents:

2.1 Health and Fitness Metrics

• Heart rate data (collected via Apple Watch and Apple HealthKit, if authorized by you)
• Active and basal calories burned (collected via Apple Watch and Apple HealthKit, if authorized by you)
• Workout activity, session duration, sets, reps, and performance metrics
• Personal records and strength metrics (including estimated one-rep-max calculations)
• Training load, recovery indicators, rate of perceived exertion (RPE), and reps in reserve (RIR)
• Step count and distance data (from your device's pedometer and, if authorized, Apple HealthKit)

2.2 Body and Wellness Data

• Body weight entries and trend history
• Body measurements (waist circumference and any custom fields you enter)
• Wellness ratings submitted through the coach check-in system (energy, mood, soreness, sleep quality, and stress levels, each rated 0–10), and daily readiness check-ins (sleep, soreness, and stress)
• Injury log entries (such as body region, side, pain level, date of onset, status, and notes)
• Body map variant (male/female, used for muscle group visualization and injury diagrams)

2.3 Nutrition and Hydration Data

• Daily calorie intake and macronutrient entries (protein, carbohydrates, and fat)
• Meal logs and food entries, including barcode-scanned foods and meal photo entries
• Daily hydration intake logs

2.4 Precise Location Data

• GPS coordinates (latitude, longitude, altitude, speed, and accuracy) collected during active outdoor workout sessions (run, walk, hike, cycle) through your device's location services
• GPS route data derived from outdoor workout sessions, which may indicate locations visited during workout activity

Note: The MHMD Act specifically identifies precise location data that could reasonably indicate a consumer's attempt to acquire health-related services or supplies as consumer health data. GymAmigo treats all GPS workout route data collected from Washington residents as consumer health data subject to this Supplement.

2.5 Progress and Visual Data

• Progress photos you capture and store within the App
• Progress photos submitted as part of coach check-in submissions

3. How We Collect Consumer Health Data

We collect consumer health data through the following methods:

Directly from you: When you manually log workouts, nutrition entries, hydration, body weight, body measurements, wellness ratings, injury information, and progress photos through the App's features.

Automatically: When you conduct an active workout session, including GPS data collected during outdoor workouts, and health metrics read from Apple HealthKit with your authorization. During active outdoor workout sessions, GPS tracking continues even when your device screen is locked or you switch to another application, until you end the workout session.

Through the coaching check-in system: When you respond to your coach's check-in requests and submit wellness ratings, body measurements, and progress photos, subject to the separate consent process described in Section 8.2.

4. Purposes for Which We Use Consumer Health Data

We collect and use consumer health data solely for the following purposes directly related to providing GymAmigo's fitness and coaching features to you:

• To provide and operate the App's core fitness tracking, workout logging, nutrition tracking, hydration tracking, goal management, and progress monitoring features;
• To facilitate the coaching relationship between you and your coach, including check-in submissions, coach feedback, and coach-assigned workouts, where you have chosen to enable Client Mode and connect with a coach;
• To power Apple Watch integration, iOS Widgets, Live Activities, and the Android workout notification during active workout sessions;
• To perform GPS route snapping via Geoapify to display accurate workout route maps (see Section 6);
• To sync your data across your devices via cloud synchronization (Supabase);
• To moderate profile photos and coach-submitted exercise videos for appropriate content (OpenAI Moderation API — profile photos only; health data is not shared for this purpose); and
• To provide customer support and respond to your requests.

We do not use consumer health data for advertising, marketing, sale to third parties, training of artificial intelligence or machine learning models, or any purpose unrelated to providing GymAmigo's fitness and coaching features to you.

5. We Do Not Sell Consumer Health Data

QG Labs LLC does not sell consumer health data. We do not exchange consumer health data for monetary or other valuable consideration with any third party. We do not share consumer health data with data brokers, advertising networks, or any third party for their own commercial purposes.

6. Sharing of Consumer Health Data

We share consumer health data only in the following limited circumstances:

6.1 Service Providers

We share consumer health data with the following service providers that process data solely on our behalf and only as necessary to provide the App's features. Each service provider is bound by contractual obligations limiting their use of consumer health data to the stated purpose and prohibiting use for their own commercial purposes.

6.2 Geoapify and GPS Route Data

During active outdoor workout sessions, GPS coordinates (with timestamps) collected during the workout are transmitted to Geoapify, a third-party mapping service, for the sole purpose of snapping your workout route to actual roads and trails for display within the App. This transmission constitutes sharing of precise location data that qualifies as consumer health data under the MHMD Act.

Geoapify is contractually prohibited from using your location data for any purpose other than route snapping, including advertising, profiling, analytics for their own benefit, or sale to third parties.

If you do not wish to have your GPS route data transmitted to Geoapify, do not use the outdoor workout tracking features of the App.

6.3 Coaches

If you activate Client Mode and connect with a coach, you separately authorize us to make certain consumer health data accessible to your coach through the GymAmigo platform, as described in Section 8.2. This sharing occurs only with your affirmative prior consent and is limited to the data you choose to include in each check-in submission. Your coach is an independent contractor and is not an employee or agent of QG Labs LLC.

6.4 Legal Requirements and Business Transfers

We may disclose consumer health data if required by applicable law, court order, or government request, or if we believe disclosure is necessary to protect the rights, property, or safety of QG Labs LLC, our users, or others. In the event of a merger, acquisition, reorganization, bankruptcy, or other transfer of some or all of our assets, consumer health data may be transferred to a successor entity subject to the same protections described in this Supplement.

7. Your Rights as a Washington Resident

The MHMD Act provides Washington residents with the following rights regarding their consumer health data:

7.1 Right to Confirm and Access

You have the right to confirm whether QG Labs LLC collects, shares, or sells your consumer health data, and to access the following:

• A list of the categories of consumer health data we have collected about you;
• The categories of sources from which that data was collected;
• The purposes for which that data was collected and used; and
• The categories of third parties, including service providers, with whom we have shared your consumer health data.

7.2 Right to Withdraw Consent

Where our collection or sharing of your consumer health data is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent prior to withdrawal. To withdraw consent for specific data types:

• HealthKit data (iOS only): Revoke authorization through iOS Settings → Privacy & Security → Health → GymAmigo
• GPS / location data: Revoke location access through your device settings (on iPhone: Settings → Privacy & Security → Location Services → GymAmigo; on Apple Watch: its Location Services settings; on Android: Settings → Apps → GymAmigo → Permissions)
• Coach check-in data: Use Leave Coach in the coach section of your Profile
• Camera access (progress photos, meal photos, check-in photos): Revoke through your device settings (on iOS: Settings → Privacy & Security → Camera → GymAmigo; on Android: Settings → Apps → GymAmigo → Permissions)
• Push notifications: Revoke through your device settings (on iOS: Settings → Notifications → GymAmigo; on Android: Settings → Apps → GymAmigo → Notifications)

7.3 Right to Delete

You have the right to request deletion of your consumer health data. To exercise this right:

• Delete your account through Settings → Delete Account within the App, which removes your profile, coaching relationships, check-in submissions, and associated cloud data; or
• Submit a deletion request to us at support@gymamigo.app specifying the categories of consumer health data you wish to delete.

Please note the following limitations on deletion:

• Deletion of your account does not delete data you have written to Apple HealthKit through the App. You must remove that data manually through the iOS Health app.
• Deletion of check-in data already submitted to a coach is subject to the retention period you selected at the time of submission (3, 7, 14, or 30 days, or until manually removed). Data already purged pursuant to your selected retention period will have been deleted automatically.
• We may retain certain consumer health data as required by applicable law or as necessary to resolve disputes, enforce our agreements, or comply with legal obligations.

7.4 Right to Non-Discrimination

QG Labs LLC will not discriminate against you for exercising any of your rights under the MHMD Act. We will not deny you access to the App, charge you different prices, or provide a different quality of service because you exercised your rights under this Supplement.

8. Consent to Collection and Sharing of Consumer Health Data

The MHMD Act requires that QG Labs LLC obtain your valid authorization before collecting consumer health data and before sharing it with third parties other than service providers operating under contract as described in Section 6.1.

8.1 Authorization for Core App Features

By creating a GymAmigo account and using the App's fitness tracking features, you authorize QG Labs LLC to collect and use the consumer health data described in Section 2 for the purposes described in Section 4. You may withdraw this authorization by deleting your account as described in Section 7.3.

8.2 Separate Authorization for Coach Check-In Data Sharing

Before you connect with a coach and enable the check-in system, GymAmigo will present you with a separate in-app consent screen describing specifically what consumer health data will be shared with your coach, how it will be used, what retention controls you have, and how to withdraw consent. The following categories of consumer health data will not be shared with your coach until you provide affirmative consent through that screen:

• Wellness ratings (energy, mood, soreness, sleep quality, and stress levels)
• Body weight and body measurements
• Progress photos submitted as check-in attachments
• Responses to coach-authored check-in questions

QG Labs LLC will maintain a timestamped record of your consent, including the version of the consent language presented to you at the time you consented.

8.3 Separate Authorization for HealthKit

Apple HealthKit data (such as heart rate, calories, distance, steps, and workouts) is collected only after you grant explicit permission through Apple's standard HealthKit authorization prompt, which is presented within the App. This authorization is separate from and in addition to your consent under Section 8.1. You may revoke HealthKit authorization at any time through iOS Settings → Privacy & Security → Health → GymAmigo.

8.4 Separate Authorization for GPS Tracking

Location data for outdoor workouts is collected only after you grant location permission through your device's standard location permission prompt (on iPhone, Apple Watch, or Android). GPS tracking occurs only during active outdoor workout sessions that you initiate and continues until you end the session, including during periods when your device screen is locked. You may revoke location access at any time through your device settings (on iPhone: Settings → Privacy & Security → Location Services → GymAmigo; on Apple Watch: its Location Services settings; on Android: Settings → Apps → GymAmigo → Permissions).

9. Data Retention

We retain consumer health data only as long as necessary for the disclosed purposes or as required by applicable law. Specific retention periods are set out below and in Section 10 (Data Retention) of the Privacy Policy.

Consumer health data is retained as described in Section 10 (Data Retention) of the GymAmigo Mobile Application Privacy Policy. In general, it is kept until you delete it or delete your account. After deletion, copies may remain in our encrypted backups for up to 7 days, after which they are permanently overwritten.

Check-in photos shared with coaches are subject to the client-selected retention period chosen at the time of submission (3, 7, 14, or 30 days, or until manually removed by the coach). This retention period is enforced at the platform level.

10. Security of Consumer Health Data

QG Labs LLC implements and maintains reasonable security measures to protect consumer health data against unauthorized access, acquisition, use, disclosure, or destruction, including:

• All data in transit is encrypted via HTTPS/TLS;
• Backend storage (Supabase) uses row-level security (RLS) policies so each user can only access their own data;
• Authentication sessions are stored locally on your device within the App's private storage;
• Email addresses are separated from public usernames; no user can look up another user by email address;
• User data is logically isolated per account; and
• Stripe handles all financial and KYC data under PCI-compliant infrastructure; QG Labs LLC never receives or stores raw financial account numbers.

11. How to Submit a Rights Request

To exercise any of your rights under this Supplement, you may contact us through any of the following methods:

• Email: support@gymamigo.app
• Mail: QG Labs LLC, 56 Andrew St, Manchester, NH 03104

We will respond to your verified request within 45 days as required by the MHMD Act. We may extend the response period by an additional 45 days if reasonably necessary, in which case we will notify you of the extension within the initial 45-day period and explain the reason for the delay.

We may request information reasonably necessary to verify your identity before processing your request. We will not require you to create an account solely for the purpose of submitting a rights request, and we will not charge a fee to process your request unless it is manifestly unfounded, excessive, or repetitive.

12. Appeals

If we decline to act on your rights request in whole or in part, we will inform you of our decision, the reasons for the decision, and your right to appeal. To appeal our decision, please contact us at:

QG Labs LLC — Privacy Appeals

56 Andrew St, Manchester, NH 03104

Email: support@gymamigo.app

We will respond to your appeal within 45 days of receipt. If your appeal is denied, you may contact the Washington State Attorney General's Office to submit a complaint at https://www.atg.wa.gov.

13. Changes to This Supplement

We may update this Supplement from time to time to reflect changes in the MHMD Act, our data practices, or other legal or operational developments. If we make material changes to how we collect, use, or share consumer health data, we will notify you by email to the address associated with your account and/or through a notice in the App before the changes take effect. Where required by the MHMD Act, we will obtain your renewed consent before implementing material changes to our data practices.

The effective date of this Supplement is identified at the top of this page. We recommend that Washington residents review this Supplement periodically for updates.