Consumer Health Data Privacy Policy

This policy applies to Washington State residents. If you are not a Washington State resident, please refer to our Privacy Policy.

Washington State's My Health My Data Act (MHMDA), effective March 31, 2024, gives Washington residents specific rights over their consumer health data. This page explains exactly what health information ZuraLog collects from Washington residents, why we collect it, who receives it, and how you can access, delete, or withdraw consent for that information at any time.

ZuraLog ("we," "us," or "our") takes this law seriously. We have designed our data practices to be straightforward and transparent. If you have questions, email us at privacy@zuralog.com.

1. What Consumer Health Data We Collect

With your explicit permission, ZuraLog may collect the following categories of consumer health data from Washington residents:

• Activity and fitness data: steps taken, workouts, exercise sessions, exercise type, calories burned, distance, and active minutes
• Sleep data: sleep duration, sleep stages (REM, deep, light), sleep quality scores, and sleep efficiency
• Heart health data: heart rate, heart rate variability (HRV), and resting heart rate
• Nutrition data: meals logged, calorie counts, macronutrients (protein, carbohydrates, fat), and food items
• Body measurements: weight
• Symptom and wellness notes: subjective notes about how you feel — mood, energy, stress, pain levels, and any free-text notes you enter manually
• AI coach conversation content: the questions you ask your AI health coach and the responses you receive
• Device and platform metadata: your device type (iOS or Android), app version, and operating system version

We collect only the data categories you explicitly authorize. You can review and manage which categories are active at any time from Settings in the ZuraLog app.

2. Why We Collect This Data

We collect consumer health data for the following purposes only:

• Powering your personal AI health coach: your health data gives Zura (your AI coach) the context it needs to answer your questions accurately and give you relevant guidance
• Generating personalized health insights and trends: we analyze your data to surface patterns, progress, and anomalies you might not otherwise notice
• Enabling health integrations: when you connect Apple Health, Google Fit / Health Connect, Strava, or other platforms, we read the data you authorize so everything shows up in one place
• Improving the accuracy and relevance of health recommendations: we use aggregated, de-identified patterns to make ZuraLog's coaching more useful over time

We do not use your consumer health data for advertising, marketing, employee evaluations, credit scoring, or any purpose beyond those listed above.

3. We Do Not Sell Consumer Health Data

ZuraLog does not sell consumer health data. ZuraLog does not share consumer health data with third parties for advertising, marketing, or any monetary or other valuable consideration.

This applies to all forms of sharing that the MHMDA defines as a "sale," including sharing data in exchange for non-monetary value. We do not engage in this practice — full stop.

4. Who Receives Your Data

ZuraLog shares consumer health data only with the sub-processors necessary to operate the service. These are technology vendors we contract with who handle data on our behalf and are contractually bound to use it only as directed by ZuraLog. They are not permitted to use your data for their own purposes.

Our current sub-processors that may process consumer health data are listed in our main Privacy Policy under "Limited Data Sharing." They include our cloud infrastructure provider, AI inference provider, and vector search provider — all operating under strict data processing agreements.

No third party receives your consumer health data for advertising, research unrelated to operating the service, or any other purpose beyond what is described here.

5. Your Rights as a Washington State Resident

Under the Washington My Health My Data Act, you have the following rights with respect to your consumer health data:

• Right to access: you can request a copy of the consumer health data we hold about you. Email privacy@zuralog.com with the subject line "WA Data Access Request."
• Right to deletion: you can request deletion of your consumer health data. Use Settings → Delete Account in the ZuraLog app, or email privacy@zuralog.com with the subject line "WA Data Deletion Request."
• Right to withdraw consent: you can withdraw your consent for us to collect or use your health data at any time. Use Settings → Privacy → Revoke Health Data Consent in the app. Withdrawing consent stops future collection but does not erase data already collected. To erase all data, delete your account.
• Right to submit a request form: you can also submit a formal request through our Washington Health Data Rights page.

We will respond to your request within 45 days as required by Washington State law. If we need more time, we will notify you before the 45-day period ends.

6. How to Withdraw Consent

To withdraw your consent for health data collection at any time, open the ZuraLog app and go to Settings → Privacy → Revoke Health Data Consent.

You can also email privacy@zuralog.com to request that we stop processing your health data. We will process your request within 45 days.

Withdrawing consent means ZuraLog will stop reading or processing your health data going forward. Health features in the app (AI coaching, insights, integrations) will become unavailable until you grant consent again. Data already collected is retained until you delete your account or submit a deletion request.

7. Effective Date

This Consumer Health Data Privacy Policy is effective as of March 31, 2024, the date the Washington My Health My Data Act took effect. It was last updated on May 9, 2026.

We may update this policy from time to time to reflect changes in our data practices or the law. Material changes will be communicated by email and through an in-app notice at least 30 days before they take effect.

8. Contact

Questions or privacy requests? Reach us at privacy@zuralog.com. We take every inquiry seriously and will respond within 5 business days for general questions, and within 45 days for formal rights requests as required by law.

For your full privacy rights under US law, see our Privacy Policy.