Consumer Health Data Privacy Policy

This Consumer Health Data Privacy Policy explains how Biomapa collects, uses, processes and discloses consumer health data and how individuals may exercise applicable rights.

It is designed to address obligations under the Washington My Health My Data Act, Nevada's consumer health data laws and other applicable United States privacy requirements. It supplements the general Biomapa Privacy Policy.

Biomapa is operated by NATARIO LABS DESENVOLVIMENTO DE PROGRAMAS LTDA, CNPJ 67.312.898/0001-04, based in Rio de Janeiro, Brazil.

For purposes of this policy, "consumer health data" includes personal information that identifies, describes or can reasonably be linked to an individual's physical or mental health status, subject to the definition and scope of applicable law. This can include information inferred from other data and information identifying a consumer as using health-related services.

Depending on the features used and information provided, Biomapa may process:

• Medical and laboratory information: laboratory results, imaging reports, check-up reports, prescriptions, reported conditions and other uploaded medical documents.
• Body composition: weight, height, body measurements, body fat, muscle mass, visceral fat and related measurements.
• Physical activity: exercise, workout history, steps, energy expenditure, running records and training goals.
• Physiological information: heart rate, resting heart rate, sleep, VO2 max and other authorized wearable measurements.
• Nutrition: meals, food records, nutrient estimates, hydration and meal photographs.
• Medication and supplements: medication names, usage information, supplements, reminders and user-provided prescriptions.
• Reproductive and sexual-health information: menstrual-cycle information and any other sensitive information voluntarily included in user-uploaded records.
• Health-related photographs: photographs provided for supported document-reading, nutrition or training features.
• Health-related inferences: insights, trends, classifications, estimates and other outputs derived from available information.
• Health-service association information: information that identifies or reasonably links an individual to use of Biomapa, such as the fact that a device installed or opened the app, created an account or subscribed.

We do not intend to collect information unrelated to the features requested by the user.

Consumer health data may originate from:

• Information entered directly by the consumer.
• Documents and photographs voluntarily uploaded by the consumer.
• Apple Health, Health Connect, Samsung Health, Strava or other authorized integrations.
• Information derived through Biomapa's analytical or AI-supported features.

We do not collect information from health integrations without the applicable authorization.

We process consumer health data for the following disclosed purposes:

• Importing and organizing information requested by the user.
• Providing personal health-history views and comparisons.
• Displaying laboratory measurements and reference information.
• Generating informational insights and trends.
• Providing exercise, nutrition and wellness features.
• Supporting authorized device integrations.
• Delivering requested AI-supported functions.
• Maintaining account security.
• Providing requested support.
• Measuring our own advertising campaigns, only with the separate consent described in section 7.
• Complying with applicable legal obligations.

We do not use consumer health data for employment screening, credit eligibility, insurance underwriting or unrelated commercial profiling.

We do not collect, use or disclose additional consumer health data categories for materially different purposes without the disclosure and consent required by applicable law.

When you create an account in the United States, Biomapa asks for your affirmative consent to collect and process consumer health data. This consent is a separate control, not preselected and distinct from your acceptance of the Terms of Use and your acknowledgment of the Privacy Policy.

The consent request explains the categories of data involved, the purpose of collection, how the information will be used (including that the documents you upload are read by our disclosed AI provider, Anthropic) and how consent may be withdrawn.

Each consent you give is recorded with its version, its purposes, the date and an audit identifier, without recording health content.

This consent is necessary for the service, which consists of organizing the health information you provide. You can withdraw it at any time by requesting deletion of your account in Profile > Privacy and data or by email; processing then stops and your data is deleted within the periods described in this policy.

Optional integrations and optional uses, such as connected health apps and ad measurement, have their own separate authorizations, and refusing them does not prevent you from using Biomapa.

Biomapa may disclose consumer health data to the following recipient categories when necessary to provide requested functionality, with legally required consent or under another applicable legal authorization:

• Infrastructure processors: providers responsible for database operations, authentication, secure storage, hosting and related technical services (Supabase and Vercel).
• AI processing providers: Anthropic, which receives the information necessary to perform an AI-supported function requested by the user.
• User-selected AI assistants: Claude, by Anthropic, which receives only the categories authorized through the connection flow.
• Ad measurement partners: Meta, TikTok and Google, only with the separate consent described in section 7.
• Legal recipients: government authorities or other recipients where disclosure is legally required or authorized.

Current infrastructure and service-provider categories are described in the general Privacy Policy. Biomapa currently identifies no corporate affiliates that receive consumer health data.

We require appropriate contractual and technical safeguards for processing performed on our behalf.

When sharing requires consent under applicable consumer health data law, Biomapa obtains authorization that is separate and distinct from consent to collect the information.

Ad measurement. Biomapa shares health-service association information with advertising platforms only if you allow it on the separate "Can we measure our ads?" screen, which is off until you choose. With your consent, Meta, TikTok and Google may receive: that your device installed and opened the app, created an account, started a free trial or subscribed; your device's advertising identifier (on iPhone, only if you also allow tracking in Apple's prompt) and your IP address; a hashed copy of your email, sent by our servers to Meta and TikTok; and the subscription events that RevenueCat reports to Meta and Google with those identifiers. The purpose is to measure which of our own ads work. Health data from your records, such as lab results, measurements, meals, medications, workouts, sleep or heart rate, is never shared with them.

AI assistant. Connecting Claude is a separate authorization, given on a screen that lists the categories it can read (see the Privacy Policy, section 7).

Consent to one optional connection does not automatically authorize another connection.

You can withdraw ad measurement and disconnect integrations or the AI assistant in Profile > Privacy and data, or by contacting Biomapa. Withdrawal stops future sharing that depends on the withdrawn consent; for ad measurement, it also asks RevenueCat to delete the measurement identifiers stored with your subscription. Information already shared before the withdrawal remains subject to the recipient's own policies.

Biomapa does not sell consumer health data.

We do not exchange consumer health data with advertising networks for monetary or other valuable consideration.

We do not disclose consumer health data to advertising platforms for behavioral advertising or profiling. The limited sharing for measuring our own campaigns happens only with your separate consent, as described in section 7, and never includes health data from your records.

Biomapa does not use geofencing around healthcare facilities for advertising, identifying individuals seeking healthcare or collecting consumer health data.

No consumer is required to authorize the sale of consumer health data, or ad measurement, as a condition of using Biomapa.

Service providers processing consumer health data on behalf of Biomapa must operate under appropriate contractual arrangements and authorized processing instructions.

We seek to restrict unnecessary access and secondary processing, and we require appropriate assistance with valid access and deletion requests.

Where applicable, service providers and other recipients must honor deletion requests communicated to them.

Any independent processing performed by a user-selected third-party service may be governed by that service's own terms and legal obligations.

Subject to applicable law, consumers may request:

• Confirmation: whether Biomapa collects, shares or sells consumer health data concerning them.
• Access: a copy of consumer health data maintained about them.
• Recipient information: a list of applicable third parties and affiliates with whom their consumer health data has been shared or sold, together with legally required contact mechanisms.
• Withdrawal: withdrawal of consent to applicable collection or sharing.
• Deletion: deletion of covered consumer health data.
• Appeal: review of certain refusals to act on privacy requests.

Biomapa will not unlawfully discriminate against consumers for exercising these rights. Consumers are not required to create a new account solely to submit a valid rights request.

Requests can be submitted through the in-app privacy controls (Profile > Privacy and data, where you can export your data, delete your account, withdraw ad measurement and disconnect integrations and the AI assistant) or by email to biomapa@biomapa.app.br.

Account-deletion information: https://www.biomapa.app.br/en/delete-account

We may request information reasonably necessary to authenticate a request. We will not request unnecessary medical records or other sensitive information merely to verify identity.

Information responsive to requests will be provided without charge as required by law.

For consumers protected by the Washington My Health My Data Act:

Biomapa will respond to valid consumer health data requests without undue delay and within 45 days after receipt, subject to any extension permitted by law. Where an extension is justified, we will notify the consumer within the initial response period and explain the reason.

Consumers may request confirmation, access, applicable recipient information, withdrawal of consent and deletion.

Following a valid deletion request, Biomapa will delete applicable information from its records and notify relevant recipients as required by law.

When information exists in archived or backup systems, applicable deletion may be delayed for restoration-related reasons, but not beyond the six-month statutory limit.

Consumers may appeal a refusal by contacting biomapa@biomapa.app.br with the subject "Privacy Rights Appeal." We will respond to the appeal in writing within 45 days and provide an explanation of our decision.

If an appeal is denied, the consumer may contact the Washington State Attorney General: https://www.atg.wa.gov/file-complaint

For consumers protected by Nevada's consumer health data provisions:

Biomapa will respond to applicable authenticated rights requests without undue delay and generally within 45 days after authentication, subject to a legally permitted extension.

For valid deletion requests, applicable active consumer health data will be deleted within 30 days after authentication, subject to statutory exceptions.

We will communicate applicable deletion requests to relevant affiliates, processors, contractors or other recipients as required by law.

Archived and backup-system deletion is subject to NRS 603A.515, including the statutory outer limit of two years where the relevant backup exception applies.

Consumers may appeal a refusal to act by contacting biomapa@biomapa.app.br with the subject "Privacy Rights Appeal." We will provide a written appeal response within 45 days, explaining the decision and providing the relevant Attorney General contact information when required.

Nevada Attorney General: https://ag.nv.gov/

We maintain administrative, technical and organizational safeguards appropriate to the sensitivity of consumer health information.

These measures are designed to restrict access to personnel and providers with a legitimate need to process the data.

Security practices include access management, authentication, encryption, infrastructure protections, appropriate logging and incident response.

We periodically review the security of systems and contracted services as appropriate.

No electronic service can guarantee zero risk.

Consumer health information is retained according to the purposes disclosed in this policy, our general Privacy Policy and applicable law.

Information is deleted or de-identified when no longer reasonably required, subject to legitimate retention obligations.

Valid consumer deletion requests are handled under the applicable statutory deadlines, and deletion requests are propagated to relevant processors and recipients as required.

Backup and archive deletion follows the special rules applicable in each state. We do not use statutory backup exceptions as permission to continue ordinary processing of deleted active health data.

We may amend this policy to reflect changes in our services, practices or legal obligations.

Where applicable law requires advance notice or new consent before collecting or sharing additional categories of consumer health data or processing data for new purposes, we will comply before beginning that activity.

Material changes will be communicated through appropriate channels.

NATARIO LABS DESENVOLVIMENTO DE PROGRAMAS LTDA
CNPJ: 67.312.898/0001-04
Rio de Janeiro, Brazil
Email: biomapa@biomapa.app.br

Related documents:

• Terms of Use: https://www.biomapa.app.br/en/terms
• Privacy Policy: https://www.biomapa.app.br/en/privacy