Consumer Health Data Privacy Policy

---

EveryBody Yoga is a wellness company. We are not a healthcare provider, a covered entity, or a business associate under HIPAA. Nothing you tell us is protected health information under that law, and nothing in our app is medical advice.

EveryBody Yoga (Saskatchewan business name registration 102214886) is a Saskatchewan based partnership between EveryBody Yoga and 13251314 Canada, Inc., Dartmouth, Nova Scotia, Canada 

privacy@everybodyyoga.app 

Privacy Officer: N. Moser

We do not ask you for medical information and we do not want it. But some of what the app records can suggest something about your body or your mind, and under these state laws that counts.

Category

What it is

Where it comes from

Health-suggestive preferences

Favourites and playlists — saving a prenatal, restorative, or back-care sequence, for example

You, when you save or organise videos

Health information you share publicly

Anything about an injury, pregnancy, illness, mood, or condition that you write in a community post or comment

You, when you post it

Inferences

Any conclusion about your physical or mental health that could be drawn from the above

Derived from the categories above

We do not record which videos you watch. There is no viewing history in your account — we know what you chose to save, not what you played. This is unusual for a wellness app and it is deliberate.

We do not collect: precise location, biometric data, genetic data, reproductive health records, diagnoses, medications, lab results, insurance information, or data from Apple Health, Google Fit, or any wearable.

No AI processes any of this. We do not run automated analysis, sentiment detection, health inference, or profiling of any kind over your activity or your posts. Moderation is done by a person.

We do not record your screen. Our analytics provider offers a session-recording feature and we do not use it, so nothing you write in the community is captured by analytics.

For one reason: to provide the app you asked for.

• To play the videos you select and remember where you stopped
• To show you your own favourites and playlists
• To publish your community posts to other subscribers, as you intended
• To moderate the community and keep it safe
• To understand, in aggregate and without identifying you, which content members find useful

We do not use consumer health data for advertising, marketing, profiling, or any purpose other than running the Services.

We do not sell consumer health data. We never have. We will not do so without first obtaining your separate, written, signed authorisation — which these laws require and which we have no intention of asking for.

We share consumer health data only with:

1. Other subscribers — but only what you choose to post publicly in the community. Your viewing history, favourites, and playlists are never shown to other members.
2. The service providers below, under contracts limiting them to processing on our instructions and prohibiting any use of their own.

Provider

Category

What they receive

Supabase (US company, Canadian servers)

Database, authentication, and app backend

Posts, comments, favourites, playlists, viewing history, account data

Bunny.net (Slovenian company, Frankfurt servers)

Video hosting and delivery

Playback requests and IP address, kept 3 days

Apple Inc.

App distribution, sign-in, payment on iPhone and iPad

Name, email, subscription status — no health data

Google LLC

Sign-in, and app distribution and payment on Android

Name, email, subscription status — no health data

RevenueCat (US company)

Subscription management

Account identifier and subscription status — no health data

Expo (US company)

Push notifications

A device token and general notification text — we keep notification wording non-specific

Resend (US company)

Sending email

Name and email address

GoDaddy (US company)

Our email mailboxes, including privacy@everybodyyoga.app

Anything you email us — which may include health information you choose to write to us

We do not currently use an analytics service. If we add one, it will handle aggregate counts only — never what you save, watch, or write. We will update this policy and tell you first.

Affiliates we share with: None. 13251314 Canada, Inc. holds all technology accounts directly; no other company receives your consumer health data.

Category

Retention

Favourites and playlists

While your account is open; deleted immediately when you close it, with backup copies overwritten within seven days

Community posts and comments

Until you delete them, or deleted with your account

Viewing history

Never recorded

Health-related inferences

We do not create or store standing health profiles about members

Access to member data is limited to one named administrator, and only where access is necessary to run the service or moderate the community.

Data is encrypted in transit and at rest by our hosting providers. Every administrative account we hold — database, developer, video, and email — is protected by multi-factor authentication. Our database enforces row-level security, meaning each member's data is technically walled off from every other member's rather than merely hidden by the app.

If you are a resident of Washington, Nevada, Connecticut, or Maryland, you have the right to:

• Confirm whether we collect, share, or sell your consumer health data
• Access it, including a list of all third parties and affiliates we have shared it with, and contact information for each
• Withdraw consent to our collection and sharing of it
• Delete your consumer health data
• Appeal if we refuse a request

When you ask us to delete your consumer health data, we delete it from our live systems straight away, and we instruct every service provider holding it to do the same. Our database backups run on a rolling seven-day cycle, so any copy held in a backup is overwritten within a further seven days.

Deleting your consumer health data ends your ability to use most of the app, because that data is how the app works. We will tell you before we act.

Email privacy@everybodyyoga.app with the subject line "Consumer Health Data Request."

We confirm receipt and respond within 45 days. If we need more time we will tell you why within that period and take no more than 45 additional days. There is no fee.

We may verify your identity first — usually by confirming you control the email address on your account.

We will tell you why in writing and explain how to appeal. Reply to our decision within 30 days and a different person will review it. If we deny your appeal, we will give you a written explanation and a link to your state Attorney General's complaint form.

We do not use geofencing. We do not collect precise location data, and we do not build virtual boundaries around healthcare facilities or anywhere else.

We post changes here with a new "Last updated" date. If a change materially affects how we handle consumer health data, we will notify you before it takes effect and, where the law requires consent, ask for it.

Contact us first at privacy@everybodyyoga.app.

You may also contact:

• Washington State Attorney General — atg.wa.gov/file-complaint
• Nevada Attorney General — ag.nv.gov
• Connecticut Attorney General — portal.ct.gov/ag
• Maryland Attorney General — marylandattorneygeneral.gov

Washington residents may also bring a private action under the Consumer Protection Act.