HAC Consumer Health Data Privacy Policy

Washington My Health My Data Act — RCW 19.373

Last Updated: October 5, 2026

Table of Contents

This policy describes how Femetic, Inc., doing business as HAC (“we,” “us,” “our”), collects, uses, and shares consumer health data, and the rights you have over it. It applies to residents of Washington State and to consumer health data collected in Washington, and is published to meet the requirements of the Washington My Health My Data Act (RCW 19.373).

This policy sits alongside our general Privacy Notice and Terms of Use, which apply to everyone who uses HAC. Where the two describe the same practice, they are consistent; this policy adds the disclosures the Act requires. Nothing in it limits rights you have under any other law.

HAC is not a HIPAA-covered entity, and the Service is not a HIPAA-regulated healthcare service.

1. What we mean by consumer health data

The Act defines consumer health data broadly: personal information that identifies your past, present, or future physical or mental health status, including information derived or inferred from other data. Most of what HAC collects falls within that definition, and we have treated it that way throughout this policy rather than drawing fine distinctions.

2. Categories of consumer health data we collect

Category	What it includes
Menstrual and reproductive data	Period start and end dates, cycle length, flow and bleeding type, contraception method, and whether you use our no-period tracking mode.
Body metrics	Weight, height, and body temperature, including basal body temperature where you import it.
Mood, energy, sleep, and readiness	Self-reported mood and energy levels, self-reported sleep, and the readiness score we calculate from your data.
Fueling and hydration	What and when you report eating and drinking in relation to training.
Training data	Workouts planned, completed, and skipped, including intensity and duration.
Injury and recovery data	Injuries you record, how the injury started, days out, your recovery check-in scores for pain (0–10), mood and symptoms, and your recovered date.
Imported health-platform data	Health and activity data you authorize us to read from Apple Health, Google Health Connect, or a connected wearable device (Oura, WHOOP, Garmin, Fitbit).
Illness status	Whether you report being unwell, which we use to adjust training recommendations.
Inferences we derive	Readiness scores, cycle predictions, pattern correlations, and the personalized insights we generate from the data above.

3. Sources of consumer health data

Directly from you, when you enter data in the App during onboarding, daily check-ins, or at any other time.
From your device, where you authorize us to read data from Apple Health or Google Health Connect.
From a connected wearable device, where you authorize the connection through our integration partner.
From our own processing, where we derive inferences such as readiness scores and cycle predictions from the data above.

We do not buy consumer health data, and we do not obtain it from data brokers or from other users.

4. Why we collect it, and how we use it

To provide the core Service: generating your personalized training, recovery, and nutrition insights, cycle predictions, and readiness scores.
To operate the pattern-based algorithm that produces those insights over time.
To show a coach you have connected to the information described in section 6, where you have consented to that connection.
To improve the Service, using de-identified data held in a separate internal database.
To carry out scientific research with external partners, using de-identified data, where you have given optional research consent.
To operate, secure, support, and troubleshoot the Service.

We do not use consumer health data for advertising, for building audiences, or for any purpose not described in this policy.

5. The legal basis on which we collect it

We collect the consumer health data described in section 2 to the extent necessary to provide the Service you have requested from us. HAC cannot function without it: the product exists to generate hormone-informed insights from your cycle and health data, and there is no version of the Service that operates without processing it. The Act permits collection on this basis under RCW 19.373.030(1)(a)(ii).

Two uses go beyond what is necessary to provide the Service, and for each of those we ask for your separate, affirmative consent:

Sharing your data with a coach. See section 6.
Sharing de-identified data with external research partners. See section 7.

If you do not want us to process your consumer health data at all, do not create an account, or delete your account. See section 9.

6. Sharing with coaches

You may choose to connect your account to a coach. Connecting is optional, you initiate it, and the Service works fully without it. Because connecting means sharing health information with another person, we ask for your separate, affirmative consent at the point of connection, distinct from any other agreement or consent.

A connected coach can see:

Your readiness score, and the training you completed or skipped;
Your self-reported sleep, and alerts when you report low mood or low energy;
Your hydration and fueling entries;
Your injury details, including how the injury started, days out, your recovery check-in scores for pain, mood and symptoms, and your recovered date;
Your name, age (not your date of birth), and your city and state.

A connected coach cannot see your cycle day, cycle phase, period predictions, cycle start dates, or basal body temperature. This restriction is enforced in our systems, not only by policy. Your email address is not shown to coaches.

You may connect to more than one coach; each connection requires its own consent. You may disconnect at any time in the App, which ends that coach’s access immediately. Coaches are bound by Section 3.4 of our Terms of Use, which restricts what they may do with your data and requires them to keep it confidential.

7. Categories of third parties and affiliates

We share consumer health data with the following categories of third parties. Except where stated, each acts as our processor under a written contract that limits it to processing on our instructions.

Category	Who and what they receive
Cloud infrastructure	Amazon Web Services (AWS). Hosting and storage of all Service data, encrypted in transit and at rest.
Health data integration	Junction (formerly Vital). The health platform and wearable data you authorize, together with your HAC user identifier.
Product analytics	PostHog. Events describing how you use the App and dashboard, under a pseudonymous identifier. Some events include limited health-related context, such as the range of cycle days an insight related to. No name or email address.
Error monitoring	Sentry. Diagnostic data from crashes and errors. Personal and health values are automatically removed before transmission.
Authentication and push notifications	Firebase (Google). Your email address, name, sign-in identifier, and device push token. Some notification text is health-related and may appear on your lock screen.
Internal data analysis	Anthropic. Query results from our production data, pseudonymized by default, used for our own internal analysis.
Email delivery	Our email delivery provider. Sign-in codes, password resets, invitations, and data-export links.
Internal collaboration tools	Slack and Trello. Feedback you submit in the App, including your comment text as written, and screenshots if you submit feedback through TestFlight.
Coaches	A coach you have connected to. See section 6. Coaches are not processors; they receive your data with your separate consent and are bound by our Terms of Use.
Research partners	Approved external research projects, which receive de-identified data only, with your research consent, and only where the output describes at least ten people. Partners are contractually barred from attempting re-identification.

Affiliates. HAC has no affiliates with whom consumer health data is shared.

We do not share consumer health data with advertising networks, and we do not use geofencing technology around healthcare facilities or any other location.

8. We do not sell consumer health data

We do not sell consumer health data, and we have never done so. We do not receive payment from research partners for access to it. If that were ever to change, we would obtain your valid written authorization first, separately from any other consent, as the Act requires.

9. Your rights

Right to know and to access

You can ask us to confirm whether we are collecting, sharing, or selling your consumer health data, and to give you a list of the third parties with whom we have shared it, together with contact details for each. You can also request a copy of your data. We provide it as a JSON file through a time-limited download link sent to the email address on your account.

Right to withdraw consent

You can withdraw consent to the collection and sharing of your consumer health data:

Coach sharing: disconnect the coach in the App at any time. Access ends immediately.
External research: use the “request to withdraw” option in your account settings. We action withdrawal requests within thirty (30) days, and your consent remains in effect until we do. Data already shared with a research partner cannot be recalled.
Core processing: because it is necessary to provide the Service, you end it by deleting your account. You can do this in the App at any time, and it takes effect immediately.

Right to delete

You can delete your account in the App, or ask us to delete it. Deletion is immediate and permanent. We will ask you to confirm your identity first, and we offer to email you a copy of your data before anything is deleted.

Deleting your account removes your account, your health logs, your insights, your devices and sessions, your imported wearable data, and the key that links you to any de-identified research data. We also pass deletion instructions to our wearable integration, authentication, error-monitoring, and product analytics providers.

A limited set of records is retained afterwards: consent records for five (5) years including your account identifier, retained to establish, exercise or defend legal claims; your answer to our pre-deletion offer to email you a copy of your data, for five (5) years; a record that a deletion occurred, which does not contain your account identifier; de-identified research data, with the key linking it to you destroyed; records of actions taken by HAC staff, with the link to you removed; and financial records reassigned to an anonymous placeholder. Backup copies age out on their normal cycle.

Right to appeal

If we refuse a request, we will tell you why and how to appeal. Appeals go to emily@teamhac.com and we respond within sixty (60) days. If we deny your appeal, you may contact the Washington State Attorney General at atg.wa.gov/file-complaint.

Non-discrimination

We will not discriminate against you for exercising any of these rights.

10. How to exercise your rights

Email emily@teamhac.com, or write to us at the address in section 14. Several of these rights can be exercised directly in the App, as described in section 9.

We respond to verified requests within thirty (30) days. If we need more time, we will tell you within that period and explain why. We may ask you to confirm your identity before we act on a request, and if you use an authorized agent we may ask for proof of written authorization.

11. How long we keep it

Your health data is kept until you delete your account, and is then deleted immediately.
Consent records are kept for five (5) years after account deletion.
Product analytics data collected on or after October 5, 2026 is kept for no more than 24 months. Analytics data collected before that date is kept while it remains necessary for security, integrity, and legal purposes.
Health data access logs are kept for 365 days. Server logs are kept for 14 days.
De-identified data is kept for as long as it remains useful for the purposes described in section 4, subject to periodic review.
Backup copies age out on their normal cycle.

12. How we protect it

All Service data is encrypted in transit and at rest. Sensitive health fields are additionally encrypted individually, with keys held in a managed key service. We log application reads and writes of our principal health data tables, require re-authentication before an account can be deleted, and maintain defense-in-depth controls combining encryption with access restrictions. Our full description of security measures is in Section 6 of our Privacy Notice.

13. Changes to this policy

We will not collect, use, or share categories of consumer health data, or use it for purposes, that are not described in this policy without first updating this policy and obtaining your affirmative consent. For material changes we give at least thirty (30) days’ notice by email to the address on your account.

14. Contact us

Femetic, Inc. (d/b/a HAC)
Attn: Privacy Officer
70 SW Century Drive, Ste. 100, PMB 185
Bend, OR 97702
Email: emily@teamhac.com
Phone: (480) 993-8186