Consumer Health Data Privacy Policy

Last updated: October 12, 2026

This notice explains how YoForte Inc. (“we”, “us”) handles consumer health data — information linked to you that identifies your past, present, or future physical or mental health. It applies to everyone, and it is written to meet Washington's My Health My Data Act, Nevada's consumer health data law, and the sensitive-data rules in other US states. Our Privacy Policy covers the rest of how YoForte works.

The consumer health data we collect

• Body measurements: weight and weight trend, height, body-fat % and body circumferences, and the calorie and protein targets our engine computes from them.
• Medication: whether you take a GLP-1 medication, your usual injection day, and injections you report.
• Eating, sleep, and training: food and drink you describe, sleep check-ins, workouts, cardio-fitness (VO₂max) results, hydration details, dietary preferences and supplements.
• Health status: marking yourself sick, injured, or on a medical hold, and anything about your health you tell the coach.
• Lab values you choose to share, typed or photographed.
• Reproductive health: cycle days, only if you turn cycle tracking on.
• Inferences: the coaching profile the system writes about your habits and patterns. It records behavior, never diagnoses.

Where it comes from

From you — your onboarding answers, what you tell or show the coach, and what you enter in the app — and from our own calculations on that data. We don't buy health data or collect it from other companies. We don't use your location to collect or infer health data. The only location we use is the country your connection comes from, which our hosting provider determines from your IP address; we use it only to check whether YoForte is available where you are, and we don't store it for that purpose.

Why we collect and use it

Only to provide the coaching you asked for: computing your numbers, writing your coaching reads, sending the reminders you opted into, keeping the service secure, and meeting our legal obligations. If you turn on the optional research setting, your de-identified data may also be used to study and improve the coaching. We never sell consumer health data, never use it for advertising, and never use it to build profiles for anyone but you.

Your consent

We collect consumer health data only with your consent. Before you answer the first setup question, we show you a short summary of what we collect, why, and who processes it, and ask you to tick a separate consent box. That consent is its own step, apart from agreeing to our Terms of Use and Privacy Policy, and we record when you gave it. If we change what that consent covers, we ask again.

We will ask for your separate consent before we use consumer health data for any other purpose or share it with anyone other than the service providers below. You can withdraw consent at any time by deleting your record from your profile, which stops all collection and deletes your data as described under Your rights. You can also turn off any optional use (reminders, texts, research) from your profile.

Who receives it

We don't sell or share consumer health data with third parties, and we have no affiliates that receive it. These service providers process it on our behalf, under written agreements that limit them to providing their service to us:

• AI model provider — generates the coach's replies and coaching profile from your messages, record, and photos.
• Database and sign-in provider — stores your record.
• Hosting provider — serves the app.
• Messaging providers (email and text messages) — deliver the emails and texts you opted into, which can include coaching content.

If you turn on notifications, your phone or browser's own push service delivers them. Their contents are encrypted on our server before they leave it, so the push service can't read them.

We disclose consumer health data to a government agency, court, or other party only when the law compels us to (for example a valid subpoena, court order, or warrant), never voluntarily. We review every request and challenge requests we believe are overbroad or unlawful. We disclose only what the request legally requires, and we tell you first unless the law or a court order prohibits it. This applies with particular care to reproductive-health data; turning cycle tracking off deletes the days you marked from our live systems, and they age out of backups within 30 days.

Your rights

• Confirm and access — ask whether we hold your consumer health data and get a copy, plus the list of every provider and third party that has received it. Your record is readable and exportable in the app at any time.
• Delete — delete your record and sign-in account with one action from your profile, or ask us. Your record and sign-in account are removed from our database right away, and your text-message history is deleted from our text-message provider at the same time. We instruct our other service providers to delete what they hold. Database backups and the short-term logs those providers keep to run and secure their service (such as our AI provider's abuse monitoring) age out within 30 days.
• Withdraw consent — at any time, as described above.
• Appeal — if we decline a request, reply to that decision to appeal. We'll answer within 45 days. If you're not satisfied, you can contact your state attorney general — in Washington, at atg.wa.gov/file-complaint.

Email requests to matt@yoforte.com. We'll confirm it's you, usually by replying to your account email, and respond within 45 days, extending once by up to 45 more only if a request is unusually complex — and if so, we'll tell you why. Requests are free, and exercising your rights never changes your service.