Consumer Health Data Privacy Policy

This policy explains how Visualize Technologies LLC, a Colorado limited liability company doing business as VZN ("VZN", "we", "us"), collects, uses, shares and protects consumer health data through the VZN app and our website. It is written to meet Washington's My Health My Data Act (RCW 19.373), Nevada's consumer health data law (SB 370, NRS Chapter 603A) and Connecticut's consumer health data law (Conn. Gen. Stat. §42-515 and following), and we apply it to everyone who uses VZN, wherever they live.

It adds to our Privacy Policy. Where the two differ about consumer health data, this policy applies. "You" means the person the data is about, including someone scanned by a trainer, a gym or a family member.

We treat all of the following as consumer health data:

• Body scans: the 3D model, the photos taken during a scan (including photos in which the face is visible), the LiDAR depth data, the pose data and the outline of the person, and, from app version 1.2, close-ups of the head, hands and body and the face data the iPhone records.
• What our servers work out from scans: body measurements, body-fat and other body-composition estimates, and predictions of how the body could change.
• Biometric data: the face photos, the face data and the face on the 3D model. We don't make face templates and never use faces to identify or recognize anyone.
• Body and health profile details: height, weight, sex, age or date of birth, ethnicity (used only to adjust body-composition and calorie estimates) and fitness goals.
• Health & Safety Profile answers: the pre-exercise health questions (based on the PAR-Q+), pregnancy status and due date, whether you take beta-blockers, injuries, and exercises to avoid.
• Apple Health data, only if you connect it: steps, active energy, workouts, sleep, resting heart rate, weight, body fat, height, date of birth and biological sex; and the heart rate and active energy the VZN Apple Watch app reads while you record a workout.
• Nutrition data: the meals and water you log, meal photos, and food allergies and intolerances.

We don't collect your precise location, and we don't collect information about visits to health care providers.

• To provide the service you ask for: to build the 3D model, measurements, body-composition estimates and predictions; to show progress over time; and to set calorie, training and heart-rate targets (for example, Health & Safety answers change heart-rate zones for people who take beta-blockers and hide exercises to avoid).
• To share it where you choose: with a trainer or gym you pair with, and with the people you send a scan or a share link to.
• To keep the service working: we run new versions of our software on earlier scans to check that they still work and compare the results (testing), and we find and fix failed scans and crashes. Health and body values are removed from activity logs on your iPhone before they are written.
• To train our own models, only with your separate consent (see "Your Consent" below). Apple Health data is never used to train models.
• To answer you when you contact support.
• To protect the service and meet the law: to keep the service secure and to comply with legal obligations.

We never use consumer health data for advertising, and we never sell it.

• You: what you scan and enter in the app.
• The iPhone used for the scan: its camera, LiDAR sensor and Apple's built-in Vision software.
• Apple Health and the Apple Watch, if you connect them.
• A trainer, a gym or another account holder (such as a family member) who scans you or enters your details.
• Our servers, which work out measurements, estimates and predictions from scans.

• A trainer or gym you pair with: the scans they take of you with their measurements, your shared profile (name, height, weight, sex and birth date), and the meals, water and workouts you log. Raw Apple Health readings are never shared with them.
• People you choose: a scan you send to another VZN user, or a share link you create, which shows the 3D model and, only if you include them, body dimensions; never weight or body fat.
• Spoonacular, our recipe and food search provider: the food names you log, a meal photo if our own analysis of it fails, and your food allergies only if you allow it.
• Service providers that process it for us under contract and only to provide their service to us: Amazon Web Services (hosting, storage and processing, including the AI models we run through Amazon Bedrock for meal photos and the support chat), Google Workspace (our email, if you write to us about your health data) and Apple (speech recognition when you say a food's name).
• When the law requires it, for example to answer a valid court order.
• A new owner of our business: if VZN is merged, acquired or sold, consumer health data may pass to the new owner, who must keep following this policy.

We have no affiliates. We never sell consumer health data. Selling it would need your signed authorization, and we don't ask for one.

From app version 1.2, before anyone is scanned for the first time, the app shows the person being scanned what we collect and why, and asks for their consent. It asks separately:

1. To collect and process their scan and health data to provide the service. A scan can't be made without this.
2. To use their scans to test and train our own software. This is optional, and saying no doesn't change the service.
3. To share with a trainer or gym, when they pair with one, with a list of what the trainer will see.

When a trainer, a gym or a family member scans someone, the person being scanned gives this consent themselves, on the scanning phone. A parent or legal guardian gives it for a child under 18, and a child aged 13 to 17 is also asked to agree. Nobody can give it on another adult's behalf.

Scans made with earlier versions of the app were made without this screen. Until the person scanned agrees in version 1.2 or later, we use them only to provide the service to them (including fixing problems with their own scans), not to test or train our software.

Withdrawing consent: you can withdraw consent at any time in the app (from version 1.2, in the privacy choices in Settings) or by emailing vtprivacy@visualizetechnologies.com. If you withdraw consent to testing and training, we stop using your scans for them within 15 days and remove them from our test and training sets within 30 days. If you withdraw consent to collection, we stop collecting your consumer health data and, if you ask, delete it (see "Your Rights").

We won't collect a new category of consumer health data, or use or share it for a new purpose, without telling you and getting your consent first.

You can ask us to:

• Confirm whether we collect, share or sell your consumer health data.
• Give you access to it, with a list of every third party and affiliate we have shared it with or sold it to, and a contact email or online contact for each. (We have no affiliates and sell to no one.)
• Correct it, or review and change it.
• Delete it. We delete it within 30 days after confirming your request, from our database backups within 35 days, and from our test and training sets within 30 days. We also tell our service providers, and anyone we shared it with, to delete it.
• Withdraw your consent (see above).

How to ask: email vtprivacy@visualizetechnologies.com, or delete your account in the app (☰ → Account → Delete Account). We check that a request comes from the email address on the account; if it doesn't, we ask for details only the account holder would know. If someone else scanned you and you don't have a VZN account, tell us who scanned you (a trainer, a gym or a person) and roughly when, and we'll find your scans, including in their account.

Someone acting for you: where your state's law allows, a person you authorize can make a request for you. We'll ask for proof of their authority and may ask you to confirm your identity. A parent or legal guardian can make requests for a child.

Cost and timing: requests are free of charge, up to twice in any 12 months; after that we may decline a request that is clearly unfounded or excessive, as the law allows. We respond within 45 days. If we need more time, we may extend this once by up to 45 more days, and we'll tell you why within the first 45 days.

If we decline your request, in whole or in part, you can appeal. Reply to our decision, or email vtprivacy@visualizetechnologies.com with the subject "Privacy Appeal". We'll decide your appeal within 45 days and tell you in writing what we did and why.

If we deny your appeal, you can contact your state Attorney General:

• Washington: atg.wa.gov/file-complaint
• Nevada: ag.nv.gov/Complaints
• Connecticut: portal.ct.gov/ag complaint form

Scans are first processed on the iPhone that makes them, then uploaded over an encrypted connection (TLS) to our servers at Amazon Web Services in the United States, where they are processed and stored encrypted (AES-256). Only people at VZN who need consumer health data for the purposes above can access it, and access to stored scan files on our servers is logged. Our service providers may use it only to provide their service to us.

No third party collects consumer health data about your activity over time and across other websites or online services when you use VZN.

We post changes on this page with a new date. For a material change, we tell you in the app or by email before it takes effect, and we ask for your consent before we collect a new category of consumer health data or use or share it for a new purpose.

Visualize Technologies LLC, Colorado. Email vtprivacy@visualizetechnologies.com.