Effective 26 August 2026 · Version 2026-08-26
This page exists because Washington's My Health My Data Act and Nevada's SB 370 require a separate policy for consumer health data, distinct from the general Privacy Policy. Where the two say the same thing, they agree deliberately. Where this page is more specific, this page governs consumer health data.
1. What we treat as consumer health data
These laws define health data broadly, and we have read them broadly rather than narrowly. In Tapir, consumer health data means:
- Age, height, weight and sex.
- Resting heart rate, maximum heart rate, heart-rate variability and sleep, whether you enter them or a connected wearable reports them.
- Heart rate, when you enter it yourself.
- Injuries, where they hurt, and how severe you said they were.
- Your effort ratings, the factors you tag as affecting a session, and anything you write in a session note.
- Measures we calculate from the above, including your fitness estimate and your daily readiness score. The law expressly covers health data derived or extrapolated by algorithm, so these count even though you never entered them.
2. How we collect it
From you, when you type it in. From a service you connect, at your instruction and only after you authorise it. And by calculation, from the two sources above. We collect none of it from data brokers, advertising networks, or any third party you have not personally connected.
3. Why we collect it, and the only purposes we use it for
- Setting your training paces and heart-rate zones.
- Deciding how hard tomorrow should be, and trimming a session when you are underslept, ill or hurt.
- Calculating carbohydrate targets for long sessions.
- Showing you your own history.
That is the complete list. We do not use consumer health data for advertising, marketing, profiling, pricing, eligibility, research, or to train any model.
4. Who we share it with
We do not sell consumer health data. Under these laws selling it would require a separate signed authorisation from you, in a prescribed form. We have never sought one and do not intend to.
We share it only with processors acting on our written instructions, in the categories listed in section 5 of the Privacy Policy: our cloud host and database, so that your account backup exists. Nobody else receives it. In particular it is never shared with an advertising network, a data broker, an analytics company, or another athlete.
You may ask us for a list of every third party and affiliate we have shared your consumer health data with, including how to contact them. Email privacy@tapirapp.com and we will provide it.
5. Your rights
- To know what consumer health data we hold about you, and to a copy of it.
- To a list of every third party and affiliate it has been shared with.
- To withdraw consent, separately, both to our collecting it and to our sharing it. These are two different permissions and you can withdraw either without the other.
- To delete it. We will delete it from our live systems and instruct our processors to do the same. Encrypted backups age out within 30 days.
- Not to be discriminated against for exercising any of these.
Do any of it in the app, under You → Privacy, or email privacy@tapirapp.com. We respond within 45 days and may extend once by a further 45 where a request is genuinely complex, telling you why. If we refuse, you may appeal by replying, and a different person reviews it.
6. Consent
We ask before collecting any of this, separately from the terms and separately from the general privacy policy, and separately again before sharing it with a processor. Consent is never a condition of having an account or of using the app: decline it and you lose heart-rate zones and carbohydrate targets, and nothing else. Both the asking and any later withdrawal are recorded, so what you agreed to and when is always recoverable.
7. Geofencing
Washington's law prohibits geofencing around health-care facilities to collect health data or target advertising. Tapir operates no geofence of any kind, runs no advertising, and collects no location data except what is already inside an activity you chose to import.
8. Contact
privacy@tapirapp.com. Tapir, New York, United States. Washington residents may also contact the Washington State Attorney General; Nevada residents, the Nevada Attorney General.