Consumer health data privacy
This is a draft. It is not yet in force.
It still needs who operates the service, a postal address, a contact address for requests, an effective date. Until those are filled in and a lawyer has read it, treat what follows as a description of how the app works rather than as a policy you can hold anyone to. Accounts are not open to the public while this is the case.
This policy is required by the Washington My Health My Data Act, chapter 19.373 RCW. It covers consumer health data only.
Who we are
Overhaul is operated by one person. Their legal name and address will appear here before accounts open. There are no affiliates, as that term is defined in RCW 19.373.010.
Overhaul is a food and training record for adults aged 18 and over. It is not a medical device and not a clinical tool, and using it does not create a treatment relationship with anyone.
What we collect
Your account is identified by your email address. That is what links everything below to you.
Food
- Every entry: date, description, grams, calories, protein, carbohydrate, fat, fibre, and an optional note
- Foods you create yourself, and meals you save
Targets
- Your calorie and macronutrient targets, and your activity level
- Your goal weight, if you set one
Training
- Sessions by date, and any notes on them
- Per-set weight, reps, and reps in reserve
- Cardio: what you did, for how long, how far, and how hard
- Routines you build
Body measurements
- Weight, fat mass, muscle mass, bone mass, water percent, waist, hip
- When each was recorded, and whether you entered it or a scale did
Details used to work out your targets
- Date of birth, which also proves you are 18 or over
- Biological sex, used for the sex-aware calorie floor
- Height, and whether you read in kilograms or pounds
Technical data attached to the above
- Your time zone, read automatically from your browser and kept in a cookie so the app knows which day you are living in. You do not enter it and there is no setting for it.
- Sign-in session cookies
- A ten-minute cookie used while you connect a device
- Training sets you record offline, held in your browser until they reach us
We do not log IP addresses ourselves. Our hosting and database providers keep their own request logs under their own retention periods.
There are no analytics, no advertising, no tracking scripts, and no third-party code running on these pages.
Where it comes from
- From you. Almost all of it. You type it in.
- From your device. Your time zone. Barcode digits when you scan a product — the scan happens on your device and only the digits leave it, never a picture.
- From a scale you connect. Body measurements from Withings, if you connect one. The connection is limited to body measurements. We do not ask for sleep, activity, or heart data.
- From public food databases. Nutrition figures come from USDA FoodData Central and Open Food Facts, in answer to a search or scan you made.
How we use it
- To show you your food log, your training, and your measurements
- To add up your day against your target
- To work out your calorie and macronutrient targets, including the sex-aware floor
- To show your own history back to you over time
- To bring in measurements from a scale, if you connected one
Nothing here is used for advertising, and nothing is used to build a profile of you for anyone else.
Who it reaches
We do not share your consumer health data, as sharing is defined in RCW 19.373.010. We have no affiliates, and no third party receives it.
Data does reach these companies, in these ways:
- Supabase, Vercel, and Resend process data on our behalf and on our instructions, to run the service. Supabase holds the database and your sign-in. Vercel serves the site. Resend sends confirmation and password-reset email, and receives your email address and nothing else.
- Withings is involved only if you connect a scale. You have your own relationship with them. Data comes from them to us, not from us to them.
- USDA FoodData Central and Open Food Facts receive the words you search for, or the barcode digits you scan. We do not send your name, your email address, or anything else that identifies you.
Selling
We do not sell your consumer health data. We do not offer it for sale and we do not give it to data brokers. There is no sale authorisation for you to sign, and you do not have one on file with us.
What you can require of us
Under RCW 19.373.040 you may confirm what we hold and get a copy of it, find out who we have shared or sold it to, withdraw your consent, and have it deleted. We will not charge you for any of this up to twice a year, and we will not make you create an account to ask.
A copy of everything
From your account page you can download your complete record — food, training, cardio, routines, measurements, targets, and your profile — with no date limit. Your food log is also available as a spreadsheet. Both download straight to your device. We do not put your record behind a link that exists on the internet.
Who we shared or sold it to
Nobody. The list is empty, and this sentence is the answer.
Deletion
You can delete your account yourself, from your account page, without asking anyone. It takes your food log, custom foods, saved meals, targets, training sessions and sets, cardio, routines, measurements, and any connected-device tokens with it. It cannot be undone and we do not keep a copy.
Deletion happens in our database immediately. Copies inside our providers’ backups take longer to age out, and the law gives them at most six months from the point we confirm who you are.
Withdrawing consent, and disconnecting a scale
You can disconnect a connected scale at any time, which deletes the access tokens we hold for it and stops anything further arriving. You can also revoke our access from your Withings account. Everything else we hold is collected only when you enter it, so it stops when you stop. To withdraw consent altogether, delete your account or write to us.
Asking, and appealing
A contact address for requests and appeals will appear here before accounts open. Until then, deletion and your copy are both on the account page.
Where it is kept, and for how long
In the United States. We have not set a retention period: if your account stays open, your record stays until you delete it. Deleting your account deletes it.