Consumer Health Data Privacy Policy

This policy is provided in addition to our Privacy Policy. It describes how Kreev Informatics Inc. ("Kreev", "we", "us") handles consumer health data, and the specific rights available to residents of Washington State under the My Health My Data Act (MHMDA) and to residents of Nevada under SB 370.

Where this policy and our general Privacy Policy differ in describing consumer health data, this policy governs.

1. Plain-Language Summary

• Kreev reads health data only from Apple Health, only with your explicit permission, and only on your own iPhone.
• It is analysed on your device and stored on your device. It is never transmitted to Kreev. We do not receive it, hold it, or have any means of accessing it.
• We do not share your consumer health data with anyone, because we never have it. No cloud provider, no analytics provider, no artificial-intelligence provider, and no advertiser receives it.
• We do not sell your consumer health data. There is no price at which we would.
• We never collect location data, and we do not use your health data to infer where you are.
• You can erase all of it, permanently, from inside the App, at any time — without asking us, and without an account.

2. Who This Policy Covers

This policy describes how Kreev handles consumer health data for all users in the United States. Sections 3 through 7 and Section 11 apply to every US user.

The statutory rights in Section 8 are those created by Washington's My Health My Data Act and are available to Washington residents. The statutory rights in Section 9 are created by Nevada SB 370 and are available to Nevada residents. We scope those two sections to the laws that create them rather than asserting statutory entitlements in states that have not enacted them.

This scoping does not reduce what you can actually do. Every practical capability in this policy is available to every Kreev user, wherever you live — and, because Kreev has no accounts and holds no copy of your data, each is exercised by you directly rather than by request to us:

• Erase everything — Settings → Reset This Device, or delete the App
• Export your data — Settings → Export My Data
• Revoke health data access — iPhone Settings → Privacy & Security → Health → Kreev

Baseline rights for all users are set out in our Privacy Policy, Sections 9 and 10. What Sections 8 and 9 below add for Washington and Nevada residents are the statutory procedures those laws require — a formal response deadline and a right of appeal to a state Attorney General.

Kreev is offered to residents of the United States and of Canada excluding Quebec. Canadian users' rights are described in our Privacy Policy (Section 11).

3. What Consumer Health Data Is Involved

"Consumer health data" means personal information linked or reasonably linkable to a consumer that identifies past, present, or future physical or mental health status. The categories below meet that definition. All of it is read, computed, and stored on your device only.

We do not collect: precise or approximate location data, information about your seeking of health care services, gender-affirming care information, reproductive or sexual health information, biometric identifiers used for identification (such as fingerprints or facial geometry), genetic data, or diagnoses.

Derived scores are listed above deliberately: although they are computed rather than collected, they describe your physical health status, and we treat them as consumer health data with the same protections.

4. Why It Is Processed

Consumer health data is processed for these purposes only:

1. To provide the service you asked for — computing your Recovery Score, Strain score, VO2 Max estimate, wellness metrics, and, on the Sentinel tier, the Healthspan Index and VO2 Max ranking.
2. To generate your wellness narratives, by a rule-based engine on your device. No artificial-intelligence service is involved and no narrative data is transmitted.
3. To show Guardian Alerts — a local iOS notification when your recovery state deviates significantly from your baseline, evaluated on your device.

All three happen on your iPhone, and the results are shown only to you.

We do not use consumer health data for advertising, for marketing to you, for building profiles about you, for improving our algorithms, for any purpose unrelated to health and fitness, or for training artificial-intelligence models. We could not do any of those things: the data never reaches us.

5. How It Is Collected

All health measurements are read from Apple Health, on your device, and only after you grant Apple Health permission. Kreev reads health data from no other source, and does not write to Apple Health.

Self-reported data (sport profile, subjective check-in, and age and biological sex if you enter them yourself) is collected only when you type it into the App. None of it is requested during onboarding, and every field is optional.

You may revoke Apple Health access at any time in iPhone Settings → Privacy & Security → Health → Kreev.

6. Who It Is Shared With

No one.

Kreev does not share consumer health data with any third party — not with cloud providers, analytics providers, artificial-intelligence providers, advertisers, data brokers, insurers, employers, or anyone else — because consumer health data never leaves your device and is never received by us.

Two providers receive information from the App, and neither receives any health data:

The App contains no advertising SDKs, no advertising identifiers, and no cross-app tracking.

Should we ever receive a government demand for a user's consumer health data, we would be unable to satisfy it: that data exists only on that person's own device. We will disclose whatever information we do hold only in response to a valid, legally binding request, and where permitted by law we will notify you first.

7. We Do Not Sell Consumer Health Data

Kreev does not sell consumer health data, and has never sold it. "Sell" here has the broad meaning given by the My Health My Data Act: exchanging data for monetary or other valuable consideration.

Because we do not sell it, we maintain no valid authorization mechanism for sale, and you will never be asked to sign one. If this ever changed, we would be required to obtain your separate, specific, written authorization first, and we would publish an updated version of this policy before any such change took effect.

8. Your Rights — Washington Residents (My Health My Data Act)

You have the right to:

• Know and access. Confirm whether we collect, share, or sell your consumer health data, access that data, and receive a list of all third parties with whom we have shared it. We share it with no one (Section 6), and the data itself is on your own device — visible in the App and obtainable in full via Settings → Export My Data, without contacting us.
• Withdraw consent. Withdraw consent to the collection and sharing of your consumer health data at any time, by revoking Apple Health permission in iPhone Settings, or by contacting us.
• Delete. Have your consumer health data deleted. Because it resides only on your device, deletion is immediate and entirely in your hands: Settings → Reset This Device erases all of it permanently, and deleting the App removes it with the App. Kreev holds no copy to delete, and no backup of it exists in any Kreev system. If you have iCloud Backup enabled, a copy may remain in your own Apple backup until that backup is replaced or removed in your iCloud settings — that copy is yours and Apple's, not ours, and we cannot access it. Subscription records held by RevenueCat contain no health data; you may ask us to request their deletion at privacy@kreev.app.
• Appeal. If we decline a request, we will tell you why and how to appeal. If your appeal is denied, you may submit a complaint to the Washington State Attorney General at www.atg.wa.gov/file-complaint.

For any request that does require us, we will respond within 45 days, extendable once by a further 45 days where reasonably necessary; we will tell you before extending.

Exercising any of these rights will never result in a lower quality of service, a different price, or any other discrimination.

9. Your Rights — Nevada Residents (SB 370)

Nevada residents have their own statutory rights regarding consumer health data, similar in substance to Section 8 but established under a separate law. You may:

• Confirm whether we are collecting, sharing, or selling your consumer health data, and access it
• Withdraw consent to collection and sharing
• Request deletion
• Appeal a refused request

As set out above, we collect no consumer health data into our own systems, share none, and sell none; the data is on your device and under your control. Complaints may be directed to the Nevada Attorney General's Bureau of Consumer Protection. Kreev does not sell consumer health data as that term is defined under SB 370.

10. How to Exercise Your Rights

Most rights need no request. Access, export, and deletion are all available immediately in the App, without contacting us and without an account:

• Access / export — Settings → Export My Data
• Delete — Settings → Reset This Device, or delete the App
• Withdraw consent — iPhone Settings → Privacy & Security → Health → Kreev

For anything else, email privacy@kreev.app with the subject line "Consumer Health Data Request" and tell us which right you wish to exercise.

Verification. Because Kreev has no accounts, we hold no identity against which to verify you, and we will not ask you for personal information solely to create one. This is also why we cannot act on your device data on your behalf — we have no access to it. Where a request concerns information held by a provider in Section 6, we will ask only for what is strictly necessary to locate it.

An authorized agent may make a request on your behalf with written permission; we may contact you to confirm.

11. Data Storage, Security, and Retention

Consumer health data is stored on your iPhone, inside the Kreev app's private storage area. It is protected by iOS app sandboxing and by iOS Data Protection, which encrypts device storage when a passcode is set. It is never transmitted, so there is no network path to intercept and no server-side copy to secure.

Kreev operates no database containing consumer health data. There is no retention period on our side because there is nothing retained. Your data remains on your device until you erase it (Section 8) or delete the App.

If you enable iCloud Backup, your device backup includes Kreev's data and is stored encrypted by Apple under Apple's own terms and your iCloud settings. Kreev cannot access it.

Breach notification. A breach of Kreev systems cannot expose consumer health data, as we hold none. In the event of a security incident affecting other personal information we hold, we will notify affected users and the appropriate regulators without unreasonable delay and within the timelines required by applicable law, including the FTC Health Breach Notification Rule and applicable state law.

12. Changes to This Policy

We will not make material changes to this policy, or apply them retroactively, without your consent where consent is required by law. Material changes will be communicated in the App before they take effect, and the updated policy will be posted at this address.

13. Contact

Privacy Officer — Kreev Informatics Inc.

• Email: privacy@kreev.app
• Website: www.kreev.app
• General Privacy Policy: www.kreev.app/privacy