Legal
VEXO Consumer Health Data Privacy Policy
Version: 1.0 · Effective date: August 1, 2026
This Consumer Health Data Privacy Policy supplements the VEXO Privacy Policy and describes how SummitSync LLC (“SummitSync,” “VEXO,” “we,” “us,” or “our”) handles “consumer health data” as that term is used under Washington’s My Health My Data Act.
This policy applies to VEXO users and other consumers whose information is subject to that law. It is intended to be a separate and distinct consumer health data notice.
VEXO does not sell consumer health data.
1. Categories of Consumer Health Data We Collect
Depending on the features you use, VEXO may collect or process the following categories:
A. Body and profile information
- age;
- biological sex selection;
- height;
- current weight;
- target weight;
- activity level;
- goals and goal timeline;
- recovery equipment; and
- related profile settings.
B. Nutrition and dietary information
- dietary-restriction selections;
- preferred proteins;
- carbohydrate and cooking preferences;
- free-text excluded foods;
- food logs;
- calorie and macronutrient information;
- recipe-search terms;
- dietary labels; and
- related meal preferences.
C. Fitness and activity information
- manually logged workouts;
- workout type, duration, and related details;
- activity level;
- recovery activities;
- fitness goals; and
- exercise plans or recommendations.
D. Sleep, recovery, hydration, alcohol, and wellness information
- sleep logs;
- recovery logs;
- hydration logs;
- alcohol logs;
- free-text notes; and
- wellness scores, targets, or inferences generated from information you provide.
E. Apple Health information
If you grant Apple Health permission, VEXO may access selected weight, sleep, steps, active energy, and workout information for on-device functionality.
At launch:
- Apple Health workout and activity records remain on-device and are not sent to SummitSync’s servers or Anthropic;
- Apple Health information may inform calculations on your device;
- Apple Health may suggest a current weight on your device;
- only a current weight you review and confirm as your VEXO profile weight may be sent to Anthropic for a requested plan; and
- the underlying Apple Health record, weight history, source, sample identifier, and timestamp are not sent to Anthropic.
F. Health and wellness inferences
VEXO may generate or display:
- calorie and macronutrient targets;
- goal projections;
- workout or training plans;
- recovery guidance;
- meal or recipe suggestions;
- VEXO scores;
- optimization suggestions; and
- other personalized wellness inferences.
These are general-wellness estimates and are not medical diagnoses.
G. Information identifying you as a VEXO user
Consumer health data may be associated with:
- account email;
- display name;
- VEXO/Supabase user identifier;
- account settings; and
- subscription tier.
We do not intentionally include your name, email, avatar, or VEXO account identifier in Anthropic AI-plan requests.
2. Purposes for Collecting and Using Consumer Health Data
We collect and use consumer health data to:
- create and maintain your VEXO profile;
- calculate calorie, macro, activity, recovery, and other wellness targets;
- allow you to record and review nutrition, fitness, sleep, hydration, alcohol, weight, and recovery information;
- synchronize user-entered and confirmed information across authorized devices;
- generate a personalized AI plan when you affirmatively request and permit it;
- provide recipe-search and meal-related features;
- tailor features to your goals and preferences;
- maintain service security and integrity;
- respond to support, privacy, and deletion requests;
- comply with applicable law; and
- establish, exercise, or defend legal claims where permitted.
VEXO does not collect or use consumer health data for targeted advertising.
3. Sources of Consumer Health Data
We collect consumer health data from:
- you, when you enter, log, upload, select, review, or confirm information;
- your use of the VEXO Services;
- Apple Health, when you choose to connect it and grant permission;
- calculations and inferences generated by VEXO from information you provide or confirm;
- Anthropic, when it returns a plan generated from information you authorized VEXO to send; and
- Edamam, when it returns recipe or nutrition information in response to your request.
4. Categories of Consumer Health Data We Share
Depending on the feature requested, VEXO may share or disclose the following categories to processors or service providers:
Supabase
Categories:
- account and identity information;
- confirmed profile and body information;
- dietary preferences and excluded foods;
- user-entered logs and notes;
- manual weight records;
- subscription tier; and
- private avatar files.
Purpose:
- authentication, database hosting, storage, account synchronization, and operation of the Services.
Anthropic
Categories, only after explicit permission:
- age, biological sex, height, confirmed current weight, target weight, activity level, goals, goal timeline, and recovery equipment;
- dietary preferences and free-text excluded foods; and
- approximately seven days of food, manually logged workout, sleep, recovery, and alcohol information.
Purpose:
- generating the personalized AI plan you request.
VEXO does not intentionally send Anthropic your name, email address, avatar photo, VEXO user identifier, Apple Health workout or activity records, or Apple Health measurement history.
Anthropic generally deletes standard commercial API inputs and outputs within 30 days, subject to limited usage-policy and legal exceptions. Anthropic does not use VEXO’s commercial API inputs or outputs to train its general-purpose models by default, and SummitSync has not opted into a training or feedback program for production VEXO data.
Edamam
Categories:
- recipe search terms;
- macro ranges;
- dietary labels; and
- recipe-filter information.
Purpose:
- providing recipe and nutrition search results you request.
VEXO does not intentionally send your VEXO user identifier to Edamam with the request.
PostHog
If you opt in to optional analytics, PostHog receives limited usage events and account properties.
VEXO configures PostHog not to receive health values, health-related free text, Apple Health data, automatic screen capture, or session replay. Based on the verified launch configuration, VEXO does not treat PostHog analytics as a recipient of consumer health data.
RevenueCat
RevenueCat receives account-linked subscription, product, purchase-status, and entitlement information. VEXO does not intentionally send RevenueCat health values or health logs.
Apple
Apple processes information through Sign in with Apple, the App Store, StoreKit, and Apple Health according to Apple’s terms and your device permissions.
5. Categories of Third Parties and Specific Affiliates
Categories of third parties and processors that may receive information include:
- cloud authentication, database, and storage providers;
- artificial-intelligence processing providers;
- recipe and nutrition-information providers;
- subscription and entitlement providers;
- optional analytics providers;
- operating-system and App Store providers;
- security, legal, and professional advisers where necessary; and
- governmental or legal recipients when required by law.
Current named providers include Supabase, Anthropic, Edamam, PostHog, RevenueCat, and Apple.
Specific SummitSync affiliates receiving consumer health data: None as of the effective date of this policy.
We may update this policy before adding a new category of consumer health data, a new purpose, or a new recipient in circumstances that require affirmative consent.
6. Sale of Consumer Health Data
VEXO does not sell consumer health data.
VEXO does not use consumer health data for targeted advertising or cross-app tracking.
7. Your Consumer Health Data Rights
Subject to applicable law and authentication, you may have the right to:
- confirm whether VEXO collects, shares, or sells consumer health data concerning you;
- access your consumer health data;
- receive a list of third parties and affiliates with whom VEXO shared or sold your consumer health data, together with available contact information;
- withdraw consent from future collection or sharing where consent is the legal basis;
- request deletion of consumer health data; and
- appeal VEXO’s refusal to take action on a request.
8. How to Submit a Request
You may submit a request:
- through available in-app account, consent, or deletion controls; or
- by emailing info@vexoapp.ai.
Use a subject such as “Consumer Health Data Request” and describe the right you want to exercise.
We may ask for information reasonably necessary to authenticate you and protect your data. You do not need to create a new account to exercise a right, although we may ask you to use an existing account where appropriate.
9. Response Timing and Fees
We will respond without undue delay and, where Washington law applies, within 45 days after receiving the request.
We may extend the response period once by up to 45 additional days when reasonably necessary. If we do, we will notify you during the initial period and explain the reason.
Requests are free up to twice per year. We may charge a reasonable fee or decline to act on a manifestly unfounded, excessive, or repetitive request as permitted by law.
10. Deletion
When we authenticate a deletion request, we will:
- delete applicable consumer health data from our active records;
- notify applicable affiliates, processors, contractors, and other third parties that received the data; and
- direct them to honor the deletion request, subject to applicable law.
Deletion from archived or backup systems may be delayed until the systems are restored or overwritten, but will not be delayed more than six months after authentication where Washington law applies.
We may retain limited information where permitted or required by law, including limited security, fraud-prevention, contractual, or legal-claim records. Retained information will not be used for an unrelated purpose.
11. Withdrawal of Consent or Permission
You may withdraw optional analytics permission or AI permission through Settings.
Withdrawing analytics permission stops future analytics collection but does not delete analytics events collected before withdrawal. Previously collected analytics events remain subject to the applicable retention period. Deleting your VEXO account immediately removes your PostHog person profile and initiates deletion of associated analytics events, which PostHog completes asynchronously.
Withdrawing AI permission blocks future Anthropic requests. Withdrawing permission does not automatically remove a plan generated before withdrawal.
If you withdraw a consent required for a feature, that feature may stop functioning. Withdrawal does not affect processing that occurred lawfully before withdrawal.
12. Appeals
If we deny a consumer-health request, you may appeal by emailing info@vexoapp.ai with the subject “Consumer Health Data Appeal.”
We will respond to an appeal in writing within 45 days where Washington law applies and explain the action taken or not taken.
If we deny the appeal, we will provide information about how to submit a complaint to the Washington Attorney General.
13. Security
We restrict access to consumer health data to personnel, processors, and contractors that need access for disclosed purposes or requested Services.
We use safeguards designed to protect consumer health data, including access controls, private storage, encryption in transit and at rest where supported, and contractual restrictions on processors.
No security system can guarantee absolute protection.
14. Changes to This Policy
We will post changes with a new effective date.
Before collecting, using, or sharing an additional category of consumer health data or using consumer health data for an additional purpose not disclosed here, we will update this policy and obtain affirmative consent where required.
15. Contact
SummitSync LLC
Washington, United States
Email: info@vexoapp.ai