Consumer Health Data Privacy Policy

1. About this policy

This Consumer Health Data Privacy Policy applies specifically to "consumer health data" as defined by the Washington My Health My Data Act (MHMDA), the Nevada consumer health data law (SB 370), and the Connecticut Data Privacy Act as amended. It supplements, and should be read together with, our general Privacy Policy at scorepad.me/privacy.

It applies to residents of Washington, Nevada, and Connecticut, and we extend the same protections to any user whose health data we process. ScorePad is the entity responsible for this data; contact us at privacy@scorepad.me.

2. What we mean by consumer health data

Consumer health data means personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status. In ScorePad, this can include the biometric and activity data you choose to share for match tracking.

3. Categories of consumer health data we collect

Only if you opt in, we may collect the following categories:

• Cardiovascular metrics: heart rate, resting heart rate, maximum heart rate, and heart-rate variability (HRV).

• Respiratory and blood-oxygen metrics: blood-oxygen saturation (SpO2) and respiration, where your device provides them.

• Exertion and recovery metrics: strain, stress, Body Battery, recovery score, active and total calories/energy, and exercise or workout sessions.

• Body metrics: skin temperature, where your device provides it.

• Activity metrics: steps, distance, exercise time, and hydration.

• Precise location associated with activity: GPS route/location data during a match, if you enable movement tracking.

• Data derived from the above, such as heart-rate-zone and training-load summaries.

4. Where we collect it from

We collect consumer health data only from sources you connect and authorise: Apple Health (iOS), Android Health Connect, Whoop, Garmin, and the GPS sensors of your phone or watch. We do not buy consumer health data, and we do not collect it from data brokers.

5. How and why we use it

We use consumer health data for a single, limited purpose: to show you your own activity, effort, and performance for the matches and sessions you choose to track, and to compute personal summaries of that activity for you.

We do not use consumer health data for advertising, for marketing profiling, to train AI models, or to infer characteristics about you beyond the activity summaries you asked for. We do not sell consumer health data.

6. Consent — collection and sharing

Consent to collect. We do not collect any consumer health data until you give clear, affirmative, opt-in consent by enabling health features and granting the underlying device or wearable permission. This consent is separate from your general acceptance of our Terms, is not bundled with any other permission, and can be withdrawn at any time.

Separate consent to share. Your biometric data is kept private to you and is not shared with other users. The only category that can be shared is GPS movement data: if you enable movement tracking, the resulting track for a match can be shown to other participants of that match. We obtain a separate, distinct authorization from you before enabling this sharing, and you can turn it off at any time.

Withdrawing consent. You can withdraw consent by disconnecting the source in ScorePad or in your device settings. To also delete consumer health data we have already collected, delete your account or email privacy@scorepad.me; we action such requests within 45 days. Withdrawal stops future collection.

7. Who we share it with

We do not sell consumer health data and do not share it for advertising. We share it only with:

• Supabase — our backend and database provider, which stores the data on our behalf under contractual data-protection obligations (a processor). Supabase hosts data on Amazon Web Services infrastructure.

• Other participants of a match — for GPS movement tracks only, and only if you have enabled movement-track sharing.

• Legal or safety recipients — where we are required by law or legal process, or to protect rights and safety.

We do not share consumer health data with Whoop or Garmin beyond retrieving what you authorise from them, and we never send consumer health data to our AI provider.

8. Your rights

If you are a Washington, Nevada, or Connecticut resident (and, as a matter of policy, any ScorePad user), you have the right to:

• Confirm whether we are collecting, sharing, or selling your consumer health data (we do not sell it).

• Access your consumer health data and obtain a list of the third parties and affiliates with which we have shared it.

• Withdraw your consent to our collection and sharing of your consumer health data.

• Have your consumer health data deleted, including a direction to our processors to delete it from their systems.

How to exercise these rights. Email privacy@scorepad.me, or delete your account from within the app. We will verify your request and respond without undue delay and within 45 days, with one 45-day extension where reasonably necessary. If we deny a request, we will explain why and how you can appeal.

9. No geofencing

We do not use geofencing around any location that provides health-care services to identify or track consumers, to send them health-related advertising, or to collect their consumer health data.

10. How we protect it

We protect consumer health data with encryption in transit and at rest, row-level access controls that make each user's biometric data accessible only to that user, isolation of privileged credentials, and contractual data-protection commitments from our processors. We restrict internal access to what is necessary to operate the Services.

11. Changes and contact

We may update this policy; material changes affecting how we handle consumer health data will be notified through the Services and, where required, we will seek renewed consent. We will update the "Effective date" above.

Contact us about consumer health data at privacy@scorepad.me.