Consumer Health Data Privacy Policy

This Consumer Health Data Privacy Policy describes how BP Movement Medicine ("Knozela," "we," "us") collects, uses, shares, and protects consumer health data under applicable U.S. consumer health privacy laws. It is designed to address, where applicable, Washington’s My Health My Data Act, Nevada’s consumer health data law (NRS Chapter 603A), Connecticut’s consumer health data requirements, and other applicable state privacy laws. It supplements our general Privacy Policy and controls for matters specific to consumer health data.

1. What Is "Consumer Health Data"

Consumer health data may include information that identifies or is reasonably linkable to a consumer and relates to past, present, or future physical or mental health status, including certain inferences derived from other data. For Knozela, this may include:

• Self-reported symptoms and body-system information.
• Medical conditions, medications, and allergies you tell us about.
• Biomarker or laboratory values you choose to enter.
• Biomarker or laboratory values captured from a document or photo (such as a lab report) that you choose to upload — the uploaded file itself is used only to extract the values shown to you and is not retained after that extraction.
• Lifestyle, sleep, stress, exercise, and nutrition information you provide.
• Wearable or fitness information you choose to enter manually. Knozela does not currently connect directly to wearable devices.
• Health, wellness, nutrition, or related recommendations, inferences, or scores generated from the information above.

Uploading a document, such as a lab report, shares with us only what you choose to submit. It does not create, and should not be understood to create, any relationship, connection, data-sharing arrangement, or integration between Knozela and the laboratory, clinic, hospital, or healthcare provider that issued the document. We have no access to, and no relationship with, the systems of the laboratory or provider that produced it.

2. Why We Collect This Data

We collect consumer health data to provide the Service you request, including personalized wellness recommendations, safety screening, relevant educational information, and saved results.

Biomarkers, medications, medical conditions, allergies, symptoms, and health-history information do not positively trigger or independently generate wellness recommendations. They may be used to exclude potentially inappropriate recommendations and to provide relevant educational information. A biomarker value may lead to educational information about that biomarker, but the value itself does not cause Knozela to recommend an intervention intended to change it.

3. How We Use Consumer Health Data

• Generate and display personalized wellness recommendations from Knozela’s pre-developed databases and rules.
• Apply safety exclusions based on information you provide.
• Provide educational information about user-entered health and wellness data.
• Save and display past results.
• Operate, test, debug, evaluate, and improve the performance and reliability of the recommendation system, including identifying errors and correcting recommendation rules.
• Allow a movement specialist to access only the limited exercise- and lifestyle-relevant information described below if you schedule a consult.

We do not use consumer health data to train artificial intelligence models. We do not use consumer health data for targeted advertising, and we do not use geofencing around healthcare facilities to identify or track consumers seeking health services.

4. Categories of Sources

We collect consumer health data directly from you through the information you enter into the Service, or upload as a document or photo (such as a lab report). Knozela does not currently connect directly to wearable devices, laboratories, healthcare providers, or electronic health record systems; any wearable information is manually entered by you, and any lab or biomarker information comes only from what you type in or choose to upload yourself.

5. Service Providers and Other Recipients

We do not sell consumer health data. We disclose it only as reasonably necessary to provide, host, secure, or support the Service, or as otherwise permitted or required by applicable law. Current service providers include:

• Supabase — authentication and database hosting, including stored assessment data and results. Our relationship with Supabase is governed by a signed Data Processing Addendum that restricts its use of this data to providing the Service.
• Anthropic — Claude API processing used to assist in applying Knozela’s pre-developed recommendation logic, presenting personalized results, and extracting biomarker values from lab-report documents or photos you choose to upload. Uploaded documents and photos are transmitted only for this extraction and are not stored by Knozela after the values are extracted. Our relationship with Anthropic is governed by Anthropic’s Data Processing Addendum, which is incorporated into the commercial terms governing Knozela’s use of the Claude API.
• Vercel — website/application hosting, infrastructure, delivery, and related technical operations. Knozela configures logs and technical telemetry so consumer health content is not intentionally included beyond what is necessary to operate and secure the Service.
• Stripe — payment processing. Stripe does not receive health-assessment content as part of payment processing.
• hCaptcha — bot and abuse protection on account creation and login only. hCaptcha operates before any health-assessment data is collected and does not receive consumer health data.

We do not disclose consumer health data to data brokers or advertisers for their independent use.

6. Limited Coach Access

If you schedule a consult, our movement specialist may access only exercise- and lifestyle-relevant portions of your information, such as activity level, goals, and exercise/lifestyle recommendations, solely to prepare for or support the consult. The movement specialist is a Certified Strength and Conditioning Specialist with a B.S. in Exercise Science and is not acting as a physician, dietitian, or other licensed healthcare provider.

Medications, medical conditions, symptoms, biomarker/lab values, and nutrition/dietary recommendations are excluded from the movement specialist’s access, not merely hidden in the interface.

7. Your Consumer Health Data Rights

Depending on where you live or where your data was collected, applicable law may give you rights to confirm whether Knozela is collecting, sharing, or selling consumer health data; access that data; obtain information about third parties or categories of recipients; withdraw consent; request correction where applicable; request deletion; and appeal certain denials. Knozela does not sell consumer health data.

To exercise a right, use your Account’s Privacy & Health Data settings (sign in, then visit /account) for consent withdrawal and health-data deletion, or contact admin@knozela.com for anything else. We will use a secure and reliable process to authenticate and respond to requests. As a general practice, we aim to complete consumer health data deletion requests within 30 days of authenticating the request (the timeframe required under Nevada’s consumer health data law), subject to lawful exceptions and permitted backup/archive delays of up to 2 years for data on backup systems. Other consumer health data requests will be completed within 45 days of receipt, with one additional 45-day extension when reasonably necessary (the timeframe required under Washington and Connecticut law). If an appeal right applies and an appeal is denied, we will provide the information required by applicable law, including relevant attorney-general contact information when required.

8. Consent

Where applicable law requires consent for collection or sharing of consumer health data, Knozela will request affirmative, voluntary consent before the covered processing occurs unless the processing is legally permitted because it is necessary to provide a product or service you specifically requested. When separate consent for sharing is required, it will be separate and distinct from collection consent. Consent requests will identify the relevant categories of health data, purposes, recipients or recipient categories where required, and how consent may be withdrawn.

9. State-Specific Consumer Health Data Disclosures

Washington: Knozela’s health-data practices are intended to comply with the Washington My Health My Data Act where applicable, including its requirements concerning a consumer health data privacy policy, consent or service-request necessity, consumer access/deletion/withdrawal rights, processor access limits, and security. Knozela does not sell consumer health data and does not use geofencing around health-care facilities to identify or track consumers.

Nevada: Knozela’s health-data practices are intended to comply with Nevada’s consumer health data law where applicable. This Policy identifies the categories and sources of consumer health data, purposes and manner of processing, recipient categories, request procedures, and material-change practices. Knozela does not permit third parties to collect consumer health data over time and across unaffiliated websites or online services through Knozela for targeted advertising. Knozela does not sell consumer health data.

Connecticut: Because Knozela processes consumer health data, Connecticut’s consumer-health-data provisions may apply even while Knozela remains below the ordinary consumer-count thresholds applicable to many comprehensive state privacy laws. Knozela therefore applies health-data minimization, consent where required, consumer rights, processor controls, and security practices to Connecticut consumer health data.

Other States: Many comprehensive state privacy laws apply only after a business reaches specified consumer-count, revenue, data-sale, or other thresholds. Based on Knozela’s current small-business scale and stated practice of not selling personal or consumer health data, many of those broader laws may not currently apply. Knozela will reassess applicability as user counts, revenue, data practices, advertising/analytics practices, or state laws change.

10. Data Retention & Security

We retain consumer health data for as long as reasonably necessary to provide the Service and maintain an active account, subject to applicable law and legitimate retention needs. We limit internal access and use administrative, technical, and physical safeguards designed to protect consumer health data from unauthorized access, acquisition, use, or disclosure.

Knozela maintains an internal Health Data Incident & Breach Response Policy to guide investigation, containment, legal assessment, notification, and remediation of suspected health-data incidents.

Because Knozela is not a HIPAA-covered entity and lets consumers directly enter individually identifiable health information, Knozela’s security-incident practices are designed to comply with the FTC Health Breach Notification Rule (16 C.F.R. Part 318) where it applies. Following discovery of a breach of security involving unsecured, individually identifiable health information in Knozela’s control, Knozela will: notify each affected individual without unreasonable delay and no later than 60 calendar days after discovery; notify the Federal Trade Commission as required by the Rule (as soon as possible, and no later than 10 business days after discovery, for a breach involving 500 or more individuals); and, for a breach involving 500 or more residents of a State or jurisdiction, notify prominent media outlets serving that State or jurisdiction — each as and to the extent required by the Rule.

11. Children

The Service is not directed to individuals under 18, and we do not knowingly collect consumer health data from them.

12. Changes to This Policy

We will post changes with an updated Effective Date and obtain new consent when required by applicable law before applying materially changed health-data practices to previously collected data.

13. Contact Us

Questions or requests regarding consumer health data: admin@knozela.com.