Consumer health data privacy policy.

About this policy

This policy is for people in the United States, and is written for the Washington My Health My Data Act, Nevada SB 370, Connecticut's consumer health data law and similar state laws. It sits alongside the main privacy policy.

Helix is operated by Isam Yahya Naqib, trading as Helix, United Kingdom. Contact: support@helixapp.co.uk.

The consumer health data we handle

• Heart rate, heart rate variability, resting and sleeping heart rate, respiratory rate, wrist temperature and blood oxygen, read from Apple Health with your permission.
• Sleep, workouts, energy, VO2 max, body measurements and nutrition, and your date of birth and biological sex, used to choose the right reference intakes for vitamins and minerals.
• Morning check-ins, meals, training sessions and health records you add.
• Scores Helix derives from these (readiness, recovery, strain, sleep), and the vitamins and minerals it works out on your iPhone from the meals you log.
• Precise location while you record a session, used to measure the route.

Where it comes from

From Apple Health on your iPhone, from what you enter, and from your phone's location while recording. We do not buy health data or receive it from anyone else.

Why we collect it and how we use it

To work out your scores and training guidance, show your history, run the group features you join, and — only if you turn it on — Helix AI. Most of it is processed on your iPhone and never reaches us.

What reaches our servers

Only: the daily summaries (readiness, strain, training form, sleep duration, sleep debt) you choose to share with a group, metric by metric; posts and routes you publish; and Helix AI requests if you turn Helix AI on.

Who we share it with

• People you choose: members of the groups you share with, and the audience of posts you publish.
• Service providers who process it only for us: Supabase (database), Anthropic and Groq (Helix AI, only if you use it).
• Authorities, where the law requires.

We do not sell consumer health data, use it for advertising, or use geolocation to target anyone near a health care facility.

Consent

We collect consumer health data only after you consent during sign-up, and share it with a group only after you turn on sharing for that group and that metric. You can withdraw either at any time in the app (Settings › Privacy and your data, or the group's sharing settings).

Your rights

You can:

• see the consumer health data we hold and get a list of every third party and affiliate we have shared it with, with an email address for each;
• delete it — in the app (Account › Delete account) or by email;
• withdraw consent at any time.

Most of this is self-serve in the app. Otherwise email support@helixapp.co.uk; we answer within 45 days (extendable once by 45 days where necessary, and we will tell you). We may need to confirm the request comes from you.

Appeals: if we decline a request, reply to our answer to appeal. We answer appeals within 45 days. If you are unhappy with the outcome you can contact your state attorney general (in Washington: atg.wa.gov/file-complaint).

Changes

We will update this policy and the date above when practices change, and ask for fresh consent before using consumer health data in a new way.