Ryvion Consumer Health Data Privacy Policy

For Consumers in Washington State and Nevada (USA)

Effective date: July 20, 2026 · Version 1.0

This Consumer Health Data Privacy Policy supplements our Privacy Policy (https://ryvion.de/legal/app-datenschutz) and applies to "consumer health data" of consumers in Washington State (Washington My Health My Data Act, RCW 19.373) and Nevada (Senate Bill 370). If there is a conflict between this Policy and our Privacy Policy with respect to consumer health data of Washington or Nevada consumers, this Policy controls.

Entity responsible: Tove Rehag, c/o IP-Management #11010, Ludwig-Erhard-Strasse 18, 20459 Hamburg, Germany — Email: contact@ryvion.de ("Ryvion," "we," "us").

1. Categories of Consumer Health Data We Collect

The Ryvion app is a fitness and nutrition app. To provide it, we collect and process the following categories of consumer health data, always with your consent:

Health and fitness profile information you provide: age, gender, height, weight, target weight, and optionally body fat and muscle percentage, activity level, and training goals;
Exercise and physical activity data: training plans, completed workouts, exercises, sets, repetitions, weights, effort ratings, and readiness inputs;
Nutrition data: logged meals and foods, nutritional values and macronutrients, your own recipes, and supplement intake;
Well-being journal and hydration data: mood ratings and mood keywords, journal notes, any photos or audio recordings you add to your journal, and fluid-intake (hydration) tracking;
Derived health information (inferences): calculated values such as basal metabolic rate, energy expenditure, calorie and macro targets, performance metrics and trends, and progress statistics;
Transient AI input: photos of meals or groceries and free-text messages you submit to the AI features. These are processed solely to generate the response and are not stored by us (journal photos/audio, by contrast, are stored as described above and are not sent to the AI provider);
Consent records documenting your health-data consent (timestamp and version).

We do not collect precise geolocation data, biometric identifiers, or genetic data, and we do not use tracking technologies for advertising.

2. Sources of Consumer Health Data

We collect consumer health data (a) directly from you, when you enter information or use App features, and (b) by deriving it within the App from the data you provide (e.g., calculated calorie targets).

3. Purposes of Collection and Use

We collect and use consumer health data exclusively to provide the services you request:

creating and adapting your training plans and workout recommendations (including AI-based generation);
tracking your workouts, nutrition, supplements, and progress, and displaying statistics;
calculating personalized values such as calorie and macro targets;
operating the AI features you actively use (e.g., analyzing a meal photo you submit);
maintaining the security, stability, and integrity of the App;
complying with legal obligations.

We do not use consumer health data for advertising of any kind.

We do not sell consumer health data, and we will not sell it without the separate, valid authorization required by law. We do not share consumer health data with third parties for their own purposes, for marketing, or for advertising.

5. Categories of Recipients (Processors)

Consumer health data is disclosed only to service providers that process it on our behalf, under contracts that restrict processing to our instructions:

Google (Firebase): authentication, database hosting (data center in Frankfurt, Germany), server logic, crash reporting, usage analytics (data-minimizing configuration), and push delivery;
Google (Gemini API, paid tier): processing of AI requests to generate plans, analyses, and answers; under the applicable paid-tier terms, content is not used to train Google's models.

The Apple App Store and Google Play process your payments as independent entities; we do not disclose consumer health data to them. We may disclose data if required by law (e.g., a lawful order by authorities).

A list of the specific third parties (processors) with whom consumer health data has been shared is available upon request (Section 7).

We collect consumer health data only after obtaining your consent through a separate consent screen before first collection. You may withdraw your consent at any time in the App settings with effect for the future. Because the App's core features cannot function without this data, withdrawal means those features can no longer be used; you may delete your account at any time.

7. Your Rights

If you are a Washington or Nevada consumer, you have the right to:

Know and access: confirm whether we collect, share, or sell your consumer health data, access that data, and obtain a list of all third parties with whom we have shared it (including contact information where required);
Withdraw consent: withdraw your consent to the collection and processing of your consumer health data (Section 6);
Delete: request deletion of your consumer health data. The fastest way is the in-app account deletion (Settings), which permanently deletes all your data. Upon a deletion request, we delete the data from our systems without undue delay and from backups within a maximum of 30 days (rolling backup cycle) — well within the statutory backup window.

How to exercise your rights: Use the in-app functions (account deletion, consent withdrawal) or email us at contact@ryvion.de. To protect your data, we verify requests, for example by requiring the request to come from your registered email address. We will respond within 45 days; where reasonably necessary, we may extend this period once by an additional 45 days and will inform you of the extension.

We will not discriminate against you for exercising any of these rights.

8. Appeals

If we decline to take action on your request, you may appeal our decision within a reasonable period by replying to our response or emailing contact@ryvion.de with the subject "Appeal — Consumer Health Data." We will respond to your appeal within 45 days with a written explanation. If your appeal is unsuccessful, you may contact your state Attorney General: Washington: www.atg.wa.gov — Nevada: ag.nv.gov.

9. Changes to this Policy

We will update this Policy when our practices or legal requirements change and will post the current version at this address. Material changes will be announced in the App.

10. Contact

For questions about this Policy or your consumer health data: contact@ryvion.de.