Consumer Health Data Privacy Policy

• Sleep data: duration, stages, efficiency, time to fall asleep and time awake. Used to calculate your sleep baselines and show changes against them.
• Heart and recovery data: heart rate variability, resting heart rate, recovery and readiness scores, stress. Used for your baselines, suggestions, and prompts to talk to a clinician when readings stay outside safe ranges.
• Breathing data: blood oxygen (SpO₂), respiratory rate and breathing disturbances. Used for your baselines and for clinician prompts.
• Activity and fitness data: steps, active minutes and calories, strain, workouts and VO₂max. Used for your baselines and to measure experiments.
• Body measurements: weight, body fat, muscle mass and skin temperature deviation. Used for your baselines and to measure experiments.
• Reproductive health data: menstrual cycle day, only if a connected source provides it. Used to interpret temperature and recovery changes in context.
• Supplement use: the supplement experiments you plan, start and stop, and your daily taken/skipped log. Used to run your experiments and show what changed.
• Inferences: your personal baselines and ranges, the supplement suggestions and clinician prompts generated from your data, and experiment results. Used to show you how your body is trending and what may be worth trying or checking with a clinician.

We use this data to provide, maintain, secure and fix Umbral. We do not use it for advertising or marketing.

• You, through what you enter in Umbral.
• Wearables and health apps you connect: WHOOP, Oura, the devices available through our connection partner Junction, and Apple Health through the Health Auto Export app or Junction.
• Umbral itself, which derives inferences from the data above.

We share all of the categories above, but only with the service providers (processors) listed in the next section, only so they can run Umbral for us, and under contracts that bar them from using it for anything else.

• Cloud hosting provider (Vercel): runs the website and app.
• Cloud database provider (Supabase): stores your data in the United States.
• Device connection provider (Junction): retrieves data from the devices it supports and passes it to us.

We have no affiliates that receive consumer health data.

No third party collects consumer health data about your online activity over time and across websites through Umbral. Pages load fonts from Google and supplement pages show product images from Amazon, so those companies receive your IP address and the file requested. If you follow a product link to Amazon, Amazon learns which product you clicked. We never send them an identifier for you or any of your health data.

You have the right to:

• Confirm and access: learn whether we collect, share or sell your consumer health data, get a copy of it, and receive a list of every third party and affiliate we have shared it with, with their contact information.
• Withdraw consent: stop our collection and sharing of your consumer health data.
• Delete: have your consumer health data deleted, including from our backups and from our service providers.
• Appeal if we decline a request.

To exercise any of these rights, email info@umbral.health from the email address on your Umbral account. We may ask you to confirm the request from that address to verify it is you. You can also stop new data from reaching us by revoking Umbral's access in your device's app.

We respond within 45 days. If we need more time, we will tell you why within that period and may extend it once by another 45 days. We delete data from our active systems within 30 days of confirming a deletion request and from backups no later than 90 days after it, and we tell our service providers to delete it too. We will not charge you or treat you differently for exercising these rights.

Appeals. If we decline your request, reply with "Appeal" in the subject line within 60 days. We will answer within 45 days and explain our decision. If your appeal is denied, you can contact the Washington State Attorney General, the Nevada Attorney General, or the attorney general of your state.

We post any change on this page and update the effective date above. If we change it in a way that affects how we collect, use or share consumer health data, we will tell you by email or in Umbral before the change takes effect and ask for your consent again where the law requires it.