Effective date: [____]
This Consumer Health Data Privacy Notice (“Health Data Privacy Notice”) supplements Insight Timer’s Privacy Policy and sets forth how we treat certain Personal Data that may be deemed Consumer Health Data (as defined below). When you choose to use certain functionality within the Services, including but not limited to when you connect Insight Timer with third-party applications (such as Apple HealthKit) or other third-party products (such as connected fitness devices) (collectively, “Connected Health Services”), you acknowledge and agree that:
- You accept the practices and policies outlined below; and
- You hereby consent to the collection, use, and disclosure of your Personal Data, which may include Consumer Health Data (as defined below), as described in this Health Data Privacy Notice.
Please read this Health Data Privacy Notice carefully. You understand that you are free to decline to provide your Consumer Health Data to Insight Timer. However, if you decide to proceed with providing us with Consumer Health Data, including through a Connected Health Service, you must agree to this Health Data Privacy Notice. If you do not want to provide such information, please do not provide Insight Timer with any Consumer Health Data and do not connect Insight Timer with a Connected Health Service.
Remember that your use of our Services, including when you connect Insight Timer to a Connected Health Service, is at all times subject to our Terms of Service (which includes the Teacher Terms, as applicable), which incorporates the Privacy Policy and, where applicable, this Health Data Privacy Notice. Any capitalized but undefined terms used in this Health Data Privacy Notice will have the definitions given to them in the Terms of Service or Privacy Policy. You may print a copy of this Health Data Privacy Notice by clicking here[LINK].
We do not knowingly collect or solicit Consumer Health Data from minors under 18 years of age and Connected Health Service features are available only to individuals who are over the age of 18. If you are a minor under 18 years of age, please do not provide Insight Timer with any Consumer Health Data. If we learn we have collected Consumer Health Data from a minor under 18 years of age, we will delete that information as quickly as possible. If you believe that a minor under 18 years of age may have provided Consumer Health Data to us, please contact us at privacy@insighttimer.com.
Collection of Consumer Health Data
You acknowledge and agree that by using certain functionality within the Services (e.g., connecting Insight Timer to a Connected Health Service), we may collect Personal Data that may be deemed to be “Consumer Health Data” certain laws such as the Connecticut Data Privacy Act, the Nevada Consumer Health Data Privacy Law, or the Washington My Health My Data Act (as applicable, “Consumer Health Privacy Laws”).
Consumer Health Data does not include information that is publicly available, or information that is de-identified or aggregated such that it is not linked, or reasonably linkable, to you.
Categories of Consumer Health Data We May Collect
Insight Timer only collects Consumer Health Data with your consent and as needed to facilitate your use of the Services, including, as applicable, your choice to sync Insight Timer with a Connected Health Service. We may collect the following Consumer Health Data:
- Heart rate, including heart rate variability;
- Respiratory rate;
- Sleep analysis;
- Blood oxygen;
- Cardio fitness (VO2 max);
- Workouts and mindful minutes;
- Individual health conditions, treatment, diseases, or diagnosis, including reproductive or sexual health information and substance use or recovery;
- Social, psychological, behavioral, and medical interventions;
- Bodily functions, vital signs, symptoms, or measurements of any Consumer Health Data;
- Diagnoses or diagnostic testing, treatment, or medication;
- Data that identifies a consumer seeking health care services; or
- Any other information that we process to associate or identify you in connection with the Consumer Health Data described above that is derived or extrapolated from nonhealth information (such as proxy, derivative, inferred, or emergent data by any means, including algorithms or machine learning).
Categories of Sources of Consumer Health Data
As described in the Categories of Sources of Personal Data section of the Privacy Policy, we may collect Personal Data, including Consumer Health Data, directly from you, or with your authorization from third parties, including but not limited to Teachers, Mental Health Professionals, and third-party providers of Connected Health Services.
Our Purposes for Collecting and Using Consumer Health Data
We may collect, use, disclose, or otherwise process your Consumer Health Data as reasonably necessary for the purposes described in the Our Purpose(s) for Collecting or Disclosing Personal Data and Other Permitted Purposes for Processing Personal Data sections of the Privacy Policy but primarily to provide you with features that you have requested or authorized, including by syncing Insight Timer with a Connected Health Service. We do not process your Consumer Health Data for purposes of targeted advertising or automated decision-making or profiling in furtherance of legally-impactful decisions.
We do not engage in geofencing around any entity that provides in-person health care services to: (1) identify or track you when seeking health care services; (2) collect your Consumer Health Data; or (3) send notifications, messages, or advertisements to you related to your Consumer Health Data or health care services.
How We May Disclose Your Consumer Health Data
We may disclose your Consumer Health Data to certain third parties, which may include:
- Service Providers. We may disclose your Consumer Health Data to our Service Providers for the purposes of providing and improving relevant features and related Services to you.
- Government Agencies. We may be required to disclose your Consumer Health Data to comply with applicable laws or respond to valid legal processes.
- Parties You Authorize, Access or Authenticate. We may disclose your Consumer Health Data to third parties where you explicitly give us consent to do so for the purposes to which you consent, such as third-party providers of Connected Health Services when authorized, accessed, or authenticated in Insight Timer by you.
Security and Retention of Consumer Health Data
You can read about our security and retention practices in the Data Security and Data Retention sections of our Privacy Policy.
Consumer Health Data Rights
In addition to the rights described in the U.S. State Privacy Rights and European Privacy Rights sections of our Privacy Policy, as applicable, you may have the following rights depending on the applicable Consumer Health Privacy Law:
- Withdraw Consent or Right to Limit:You have the right to withdraw consent for our collection and disclosure of some or all of your Consumer Health Data at any time. If you are a California resident, you have the right to limit our use of your Sensitive Personal Data (which may include Consumer Health Data).
- You can withdraw your consent to sync Insight Timer with a Connected Health Service by following the steps described here.
- To withdraw consent for our processing of any of your Consumer Health Data, please contact us at privacy@insighttimer.com.
- To limit our use of your Sensitive Personal Data, please contact us at privacy@insighttimer.com.
- Appeal: If we refuse to take action on your request within a reasonable period of time after receiving your request in accordance, you may appeal our decision. If we deny your appeal, you have the right to contact your state’s Attorney General (e.g., CT, NV and WA).
If you have any questions about this section or this Health Data Privacy Notice, please contact us at privacy@insighttimer.com.