Ryvion Consumer Health Data Privacy Policy

For Consumers in Washington State and Nevada (USA)

Effective date: 11 September 2026 · Version 1.2

Material changes compared to version 1.1: the optional Apple Health integration has been added, both as a source of consumer health data and as a destination the App writes to at your direction (Sections 1, 2 and 4); the processing location of certain server functions is now described in full (Section 5).

This Consumer Health Data Privacy Policy supplements our Privacy Policy (https://ryvion.de/legal/app-datenschutz) and applies to "consumer health data" of consumers in Washington State (Washington My Health My Data Act, RCW 19.373) and Nevada (Senate Bill 370). If there is a conflict between this Policy and our Privacy Policy with respect to consumer health data of Washington or Nevada consumers, this Policy controls.

Entity responsible: Tove Rehag, c/o IP-Management #11010, Ludwig-Erhard-Strasse 18, 20459 Hamburg, Germany — Email: contact@ryvion.de ("Ryvion," "we," "us").

1. Categories of Consumer Health Data We Collect

The Ryvion app is a fitness and nutrition app. To provide it, we collect and process the following categories of consumer health data, always with your consent:

Health and fitness profile information you provide: age, gender, height, weight, target weight, and optionally body fat and muscle percentage, activity level, and training goals;
Exercise and physical activity data: training plans, completed workouts, exercises, sets, repetitions, weights, effort ratings, readiness inputs, personal records you enter yourself (PR logbook), and activities you record (type, date, duration, and the energy expenditure estimated from your body data);
Nutrition data: logged meals and foods, nutritional values and macronutrients, foods you create yourself, your own recipes including any photos you add to a recipe, and your supplement intake log, including any entries you create yourself;
Well-being journal and hydration data: mood ratings, mood and influence keywords, journal notes, any photos or audio recordings you add to your journal, and fluid-intake (hydration) tracking;
Data synchronized from Apple Health, where you have enabled the connection: step count, distance traveled, active energy burned, flights climbed, workouts recorded by other applications, water intake, weight, height, body fat percentage, and body mass index. This data originates from your device or from third-party devices and applications you have connected to Apple Health — for example, a smartwatch or a body scale.
Goals, streaks, and achievements: the daily goals you set and whether you met them, the resulting streaks, and the achievements you unlock;
Derived health information (inferences): calculated values such as basal metabolic rate, energy expenditure, calorie and macro targets, performance metrics and trends, and progress statistics;
Transient AI input: photos of meals or groceries and free-text messages you submit to the AI features. These are processed solely to generate the response and are not stored by us (journal photos/audio, by contrast, are stored as described above and are not sent to the AI provider);
Consent records documenting your health-data consent (timestamp and version).

The calculators included in the App (1RM, training zones, pace, FFMI, body fat and muscle percentage, among others) run entirely on your device; your input and the results are neither transmitted to us nor stored unless you save them yourself. Your shopping list is not stored on our servers.

We do not collect precise geolocation data, biometric identifiers, or genetic data, and we do not use tracking technologies for advertising.

2. Sources of Consumer Health Data

We collect consumer health data (a) directly from you, when you enter information or use App features, (b) by deriving it within the App from the data you provide (e.g., calculated calorie targets), and (c) from Apple Health, if and to the extent you have enabled that connection and allowed the respective data types in Apple's own permission dialog.

3. Purposes of Collection and Use

We collect and use consumer health data exclusively to provide the services you request:

creating and adapting your training plans and workout recommendations (including AI-based generation);
tracking your workouts, nutrition, supplements, and progress, and displaying statistics;
calculating personalized values such as calorie and macro targets;
operating the AI features you actively use (e.g., analyzing a meal photo you submit);
maintaining the security, stability, and integrity of the App;
complying with legal obligations.

We do not use consumer health data for advertising of any kind.

We do not sell consumer health data, and we will not sell it without the separate, valid authorization required by law. We do not share consumer health data with third parties for their own purposes, for marketing, or for advertising.

Writing to Apple Health (at your direction). If you enable it, the App writes the following to Apple Health on your device: your completed workouts, your logged meals as a daily total with the associated nutritional values, your fluid intake, and weight, height, body fat percentage, and basal metabolic rate.

This is not a sale or a sharing of Consumer Health Data with a third party. Apple Health is an application on your own device, under your own control. The data does not leave your device in this process, we receive nothing in return, and no third party gains access through us. You enable each data type individually in Apple’s own permission dialog, and you can revoke it at any time in your iOS settings.

Once written, the data is subject to Apple's handling of Apple Health data and to whatever access you grant other applications on your device. Deleting your Ryvion account does not remove data previously written to Apple Health; you can delete it in the Health app.

5. Categories of Recipients (Processors)

Consumer health data is disclosed only to service providers that process it on our behalf, under contracts that restrict processing to our instructions:

Google (Firebase): authentication, database hosting (data centers within the European Union), server logic, crash reporting, usage analytics (data-minimizing configuration), and push delivery. Some server functions — in particular those that calculate your monthly and lifetime statistics — currently run in the Google Cloud region us-central1 (Iowa, USA). In that process, consumer health data is briefly processed in the United States and then stored again in the European Union. These transfers are covered by the EU-U.S. Data Privacy Framework, under which Google LLC is certified;
Google (Gemini API, paid tier): processing of AI requests to generate plans, analyses, and answers; under the applicable paid-tier terms, content is not used to train Google's models.

The Apple App Store processes your payments as an independent entity; we do not disclose consumer health data to them. We may disclose data if required by law (e.g., a lawful order by authorities).

A list of the specific third parties (processors) with whom consumer health data has been shared is available upon request (Section 7).

We collect consumer health data only after obtaining your consent through a separate consent screen before first collection. You may withdraw your consent at any time in the App settings with effect for the future. Because the App's core features cannot function without this data, withdrawal means those features can no longer be used; you may delete your account at any time.

7. Your Rights

If you are a Washington or Nevada consumer, you have the right to:

Know and access: confirm whether we collect, share, or sell your consumer health data, access that data, and obtain a list of all third parties with whom we have shared it (including contact information where required);
Withdraw consent: withdraw your consent to the collection and processing of your consumer health data (Section 6);
Delete: request deletion of your consumer health data. The fastest way is the in-app account deletion (Settings), which permanently deletes all your data. Upon a deletion request, we delete the data from our systems without undue delay and from backups within a maximum of 30 days (rolling backup cycle) — well within the statutory backup window.

How to exercise your rights: Use the in-app functions (account deletion, consent withdrawal) or email us at contact@ryvion.de. To protect your data, we verify requests, for example by requiring the request to come from your registered email address. We will respond within 45 days; where reasonably necessary, we may extend this period once by an additional 45 days and will inform you of the extension.

We will not discriminate against you for exercising any of these rights.

8. Appeals

If we decline to take action on your request, you may appeal our decision within a reasonable period by replying to our response or emailing contact@ryvion.de with the subject "Appeal — Consumer Health Data." We will respond to your appeal within 45 days with a written explanation. If your appeal is unsuccessful, you may contact your state Attorney General: Washington: www.atg.wa.gov — Nevada: ag.nv.gov.

9. Changes to this Policy

We will update this Policy when our practices or legal requirements change and will post the current version at this address. Material changes will be announced in the App.

10. Contact

For questions about this Policy or your consumer health data: contact@ryvion.de.