Consumer Health Data Privacy Policy

KYGO HEALTH CONSUMER HEALTH DATA PRIVACY POLICY

Effective Date: September 13, 2026 | Last Updated: October 2, 2026

1. What This Policy Is

Washington's My Health My Data Act and Nevada's Senate Bill 370 require a separate, dedicated policy for consumer health data. This is that policy for Kygo Health LLC ("Kygo," "we," "us"). It covers our mobile app, our web app at app.kygo.app, and our website at kygo.app.

It applies to residents of Washington and Nevada as those laws require. In practice we apply the same handling to everyone who uses Kygo, because it is how the product is built rather than a regional setting. Our general Privacy Policy covers everything else, including data that is not health data; where the two overlap, this policy governs consumer health data.

Kygo is a general wellness product. We are not a HIPAA covered entity or a business associate, and the data described here is not protected health information under HIPAA.

2. Consumer Health Data We Collect, and Why

We collect the following categories of consumer health data, and we collect each one only to provide the features you have asked for:

Diet and nutrition data. Food and drink entries, portion sizes, meal timing, saved foods, custom meals, recipes, and the nutrition values derived from them. Used to log what you eat and show your intake against your targets.
Supplement data. Supplements you log and the regimen you set up. Used to track intake and include supplements in correlations.
Body measurements. Weight, height, age, and sex where you choose to provide them. Used to calculate your targets and show weight trends.
Sleep data. Duration, stages, efficiency, and sleep scores from a wearable you connect. Used for trends and for correlation with what you eat.
Cardiovascular and recovery data. Heart rate, heart rate variability, resting heart rate, respiratory rate, blood oxygen, body or skin temperature, readiness, recovery, strain, stress and body battery from a wearable you connect. Same purpose.
Activity and fitness data. Steps, distance, active and basal calories, workouts, exercise minutes, and cardio fitness or VO2 max. Same purpose.
Bodily functions and measurements you log yourself. Hydration and any note you attach to an entry.
Images you choose to capture. Photos of meals and supplement labels, used to identify what they contain. These are held in server memory for up to 30 minutes and then discarded; they are never written to our database.
Health-related inferences. The correlations, trends, and insights Kygo derives from the data above, which are health data in their own right under both laws.
Support correspondence. Anything health-related you tell us in a support request, plus any screenshot you attach, used only to answer you.

We do not collect precise geolocation, and we do not collect or infer data about reproductive or sexual health, gender-affirming care, or any other specific health condition or diagnosis. Kygo has no physical location and operates no geofence around any facility.

3. Where It Comes From

You, directly, when you log food, supplements, weight, or a note, or when you use the camera or voice input
Wearables and health platforms you connect: Oura, Fitbit through the Google Health API, Garmin, WHOOP, Apple Health, and Android Health Connect. Nothing is read from any of them until you complete that provider's own authorization
Our own processing, where a correlation or insight is derived from the data above

We do not buy consumer health data, and we do not obtain it from data brokers or advertising networks.

4. What We Share, and With Whom

We do not sell consumer health data. Not for money, not for other valuable consideration, and not with your authorization, because we do not offer it. We have never sold it and we have no plans to.

We share consumer health data only with service providers that process it on our behalf, under contract, to run the features you use. As of the date above, those are:

MongoDB Atlas (Atlas is operated by MongoDB, Inc.), which stores your account data in encrypted form
Render, which hosts the backend servers that process your requests
Google Cloud (Vertex AI), inside our own private Google Cloud project, for photo recognition, supplement label reading, and generating your insights. This data is not used to train Google's models and is not shared onward
Google Workspace, which delivers our email, including replies to support requests you send us

The wearable and health platform providers listed in section 3 are the sources of data, not recipients of it. We do not send your Kygo data back to them, with one exception you control: if you turn on writing nutrition and hydration back to Apple Health or Health Connect, those records go to that platform on your device at your instruction.

Kygo Health LLC has no affiliates, parent, or subsidiaries, so there are no affiliates to name.

The following never receive consumer health data: our analytics, attribution, error monitoring, and payment providers (Mixpanel, Tenjin, Google Analytics, Sentry, RevenueCat, Stripe, Apple, Google Play), the advertising platforms whose measurement tags we use on our website (Meta, Google, TikTok, Reddit), advertisers, data brokers, and information resellers.

When we advertise Kygo, the platform we advertise on may place a measurement tag on the kygo.app pages our ads link to, such as the homepage. It loads only if you accept advertising cookies in the banner, and it receives only that you viewed that page, ad click and browser cookie identifiers, and your IP address and browser type. We do not place these tags in the web app at app.kygo.app, and from our website and web app they never receive any data showing that you created a Kygo account, started a trial, or subscribed, or any of the consumer health data listed in section 2.

We do not use consumer health data for advertising of any kind, and we do not use it to determine creditworthiness or eligibility for anything.

We may disclose data if we are legally required to by a subpoena, warrant, or other valid legal process, and we will tell you where we are permitted to. If Kygo is ever acquired, consumer health data would transfer only to a buyer bound by this policy, and you would be notified before any material change.

5. Consent

We collect and share consumer health data only as necessary to provide the product you asked us for, or with your consent. Each wearable connection requires you to complete that provider's own authorization screen, which is separate from creating a Kygo account. Camera, photo library, microphone, and speech recognition are separate device permissions, requested only when you first use the feature that needs them. Writing nutrition back to Apple Health or Health Connect is a further separate permission. You can withdraw any of these at any time, in App Settings or in your device settings, and withdrawal stops the collection it covers going forward.

Advertising cookies on our website are a separate choice in the cookie banner, off until you accept them, and you can withdraw that choice at any time from the cookie settings link in the footer.

6. Your Rights

You have the right to:

Confirm whether we collect, share, or sell your consumer health data, and access it
Get a list of all third parties with whom we have shared or sold your consumer health data, with contact information for each
Withdraw consent to our collection and sharing of it
Have it deleted

How to exercise them. Deletion is self-service in the app under Settings, then Privacy and Data, then Delete Account. For anything else, email info@kygo.app with the email address on your Kygo account and what you want. We may need to verify that the account is yours before we act, and we will not ask you for more information than that takes.

How fast we respond. Within 45 days of receiving your request. If we need more time we will tell you within those 45 days, with the reason, and take at most 45 more.

What deletion means here. We delete your consumer health data from our live systems immediately, and from our database backups within 30 days, as those daily snapshots expire. We notify every service provider and third party that received it, and we delete data held by a wearable provider within 72 hours of your request.

If we say no. You can appeal by replying to our decision or emailing info@kygo.app with "Appeal" in the subject line. A person will review it and respond within 45 days with a written explanation. If we deny the appeal, you may contact the Washington Attorney General at atg.wa.gov/file-complaint or the Nevada Attorney General at ag.nv.gov.

We will not deny you the service, charge you a different price, or give you a lesser experience for exercising any of these rights.

7. How We Protect It

Consumer health data is encrypted in transit with TLS 1.3 and at rest with AES-256. Passwords are stored only as salted cryptographic hashes. Wearable connections use OAuth 2.0 and access tokens are encrypted at rest. Database credentials are least-privilege, and we have completed Google's CASA Tier 2 security assessment for our health data integrations.

Kygo is run by a small team. Access to systems holding consumer health data is restricted to the people who need it to operate, secure, or support the product, it is limited to what that job requires, and it is logged. We do not read your logs or health data for any other reason.

8. Changes

If we start collecting a new category of consumer health data, use it for a new purpose, or share it with a new category of recipient, we will update this policy first and obtain your consent before that collection, use, or sharing begins. Changes are posted here with a new Last Updated date, and material changes are also sent to you by email or in the app.

9. Contact

Email: info@kygo.app

Address: Kygo Health LLC, 30 N Gould St Ste N, Sheridan, WY 82801