Consumer Health Data Privacy Policy

Who this policy covers

Ironclad Enterprises LTD, 1 Beckwith Head Road, Cardale Park, Harrogate, HG3 1RY, United Kingdom operates Keep. This policy describes consumer health data processing, including for consumers protected by Washington’s My Health My Data Act and other applicable US state health privacy laws.

Categories, sources and purposes

We collect information you enter: body measurements, age, fitness goals and experience, equipment, schedule, joint limitations, nutrition safety answers, workouts, sets, meals, recipes, food photos and check-ins. We derive workout plans, nutrition targets, food estimates and progress summaries from these records. Account identifiers associate records with your account. Support messages may also reveal health information you choose to include.

Sources are you, your use of Keep, calculations made from your records, food-analysis/database providers, and Apple Health or Health Connect if you authorize them. Health connections can provide steps, weight, body fat, energy and workouts. We use this information to provide the fitness, nutrition, tracking, synchronization and support features you request, and to secure those services. We do not collect precise location to infer visits to healthcare facilities.

Categories shared and recipients

Account-linked setup, saved records and derived outputs are processed by Google Firebase to provide cloud features. Submitted meal photos and descriptions go to OpenAI for analysis; food names go to USDA FoodData Central and barcode values to Open Food Facts. Health information you include in a support message is processed by our support team, Resend and the support email service. Selected fitness-app usage events may be processed by PostHog when configured; these can reveal fitness interests, but exclude raw questionnaire answers, photos and explicit weight or nutrition values.

Imported Apple Health and Health Connect samples remain local in the current integration; permitted workout exports go to your chosen health service. Subscription service providers receive entitlement/transaction information, not your workout or meal records. We do not share health records with affiliates for their independent use, sell consumer health data, or use imported health samples for advertising. Disclosures necessary to comply with law or protect security may also occur.

Consent and choices

Use optional health and photo features only if you want the described processing. You may stop using these features and revoke device permissions. Where consent is required for collection or sharing beyond the service you request, it must be obtained separately; this policy does not itself grant consent. Contact us to withdraw consent or request deletion of records already collected.

Access, withdrawal, deletion and appeals

Email rebecca.hayes@aformely.com with “Health privacy request”, or use the account export/deletion controls. You may ask whether we collect, share or sell your consumer health data; request access and a list of third parties/affiliates that received it with contact information; withdraw consent; and request deletion. You do not need to create a new account to email us. We may verify an existing account or request proportionate information to protect your records.

For requests covered by Washington law, the response period is 45 days, with a further 45 days where legally permitted and explained. Deletion requests extend to relevant recipients, subject to applicable law. Washington permits delayed deletion from archived or backup systems for no more than six months after authenticating the request. Other applicable state rights and time limits also apply.

To appeal a refusal, reply to our response or email rebecca.hayes@aformely.com with “Health privacy appeal”. We will give a written decision within the applicable deadline (45 days under Washington law). If the appeal is denied, you may submit a complaint to the Washington Attorney General or your applicable state regulator.