This Consumer Health Data Privacy Notice ("Notice") describes how Four Pillar Wellness Labs LLC ("we," "us," or "our") collects, uses, shares, and protects consumer health data through the Myta Wellness app and related services (the "Services"). It supplements our main Privacy Policy and is provided to comply with the Washington My Health My Data Act, the Nevada consumer health data law, and Connecticut's consumer health data provisions.
"Consumer health data" means personal information linked to you that identifies your past, present, or future physical or mental health status — here, primarily your biometric data and the menstrual-cycle and reproductive information you choose to provide.
Nevada note. Nevada's consumer health data law (SB 370, in effect since March 31, 2024) covers "regulated health information," which expressly includes biometric and health data derived from a wearable device such as the Oura Ring. The disclosures in this Notice are designed to address Nevada's requirements alongside Washington's My Health My Data Act and Connecticut's consumer health data provisions.
1. Categories of consumer health data we collect, and our purposes
| Category of consumer health data | Sources | Why we collect it (purpose / use) |
|---|---|---|
| Biometric & wellness metrics from Oura — sleep, readiness/recovery (resting heart rate, HRV, body-temperature deviation), and activity data | Oura Ring API, with your consent | To generate your personalized daily and periodic wellness recommendations and to show trends and insights |
| Menstrual-cycle & reproductive information you enter manually (cycle dates, phase) | Directly from you (manual entry) | To tailor recommendations to your cycle and to display cycle-aware insights |
| Wellness inputs — goals, survey responses, journal entries that reveal health status | Directly from you (manual entry) | To personalize your plan and track your progress |
We collect this data only to provide the features you request. We do not use it for advertising or to infer characteristics about you for unrelated purposes.
2. Categories of sources
- Directly from you (cycle data, goals, surveys, journals); and
- From the Oura Ring API, with your authorization, through a secure OAuth connection.
3. Categories of consumer health data we share, and with whom
We share consumer health data only with service providers (processors) that help us operate the Services, under contracts that require confidentiality and limit their use to our instructions:
| Category shared | Categories of third parties (processors) | Purpose |
|---|---|---|
| Biometric/wellness metrics and cycle data needed to generate recommendations | AI processing provider (OpenAI) | To generate your recommendations |
| Consumer health data at rest | Cloud hosting / database provider (Supabase) | Secure storage and app backend |
Specific affiliates: We have no corporate affiliates, so we do not share consumer health data with any affiliate.
We do not share consumer health data with advertisers, data brokers, or any third party for advertising, and we do not disclose it except as described here, as you direct, or as required by law.
4. We do not sell consumer health data
We do not sell, and have no plans to sell, your consumer health data. Consistent with the My Health My Data Act, we would not sell consumer health data without first obtaining your valid written authorization — and we are not seeking any such authorization.
5. Consent
- We collect your consumer health data only after your affirmative, opt-in consent — for example, when you connect Oura or enter cycle data. We do not use pre-checked boxes, bundled consent, or implied consent.
- Where we need to share consumer health data beyond what is necessary to provide a feature you requested, we obtain your separate opt-in consent first.
- You may withdraw consent at any time by disconnecting Oura, deleting the data, or deleting your account. Withdrawal does not affect processing already performed.
6. Your rights
You have the right to:
- Confirm whether we collect, share, or sell your consumer health data and access it;
- Withdraw consent to our collection and sharing;
- Delete your consumer health data; and
- Appeal a denial of any request.
To exercise these rights, email privacy@fourpillarwellnesslabs.com or use the in-App controls. We will verify your request (typically by confirming control of your account email) and respond within the time the law requires. We will not discriminate against you for exercising these rights.
When you ask us to delete your consumer health data, we delete it from our active systems and direct our processors to do the same, and we purge backups on our routine schedule.
7. No geofencing
We do not use geofences around any health-care, reproductive-health, or mental-health facility, and we do not use precise geolocation to identify or track your visits to such places.
8. Security and retention
We protect consumer health data with encryption in transit (TLS 1.2+) and at rest, access controls, and other safeguards appropriate to its sensitivity. We retain it only while your account is active or as needed to provide the Services, and delete it on account deletion or earlier on request, as described in our Privacy Policy.
9. Washington residents
If you are a Washington resident, the My Health My Data Act may give you a private right of action for violations, in addition to enforcement by the Washington Attorney General.
10. Contact us
Four Pillar Wellness Labs LLC — Attn: Privacy Officer 116 Agnes Rd, Suite 200, Knoxville, TN 37919, USA Email: privacy@fourpillarwellnesslabs.com Web: https://www.fourpillarwellnesslabs.com/consumer-health-data
This Notice is provided for general informational purposes and does not constitute legal advice. Four Pillar Wellness Labs LLC should have it reviewed by qualified counsel before publication.