Consumer Health Data Privacy Policy

1. About This Policy

This Consumer Health Data Privacy Policy supplements our general Privacy Policy and applies specifically to "consumer health data" as defined under Washington's My Health My Data Act (MHMDA), Nevada's SB 370, and Connecticut's health data law. It describes the categories of consumer health data we may collect through beyondtime.ai (the "Service"), how we use and share it, and the rights you have over it.

Beyond Time is a goal, habit, and routine planning tool — not a medical or healthcare service. We do not provide medical advice, diagnosis, or treatment. However, because some of the data you voluntarily log may relate to wellness-adjacent activities, we are providing this notice out of an abundance of caution and in compliance with applicable consumer health data laws.

2. Categories of Consumer Health Data We May Collect

We only collect consumer health data that you voluntarily provide when you use features of the Service. This may include:

• Habits you track that relate to physical or mental wellness (e.g., exercise, sleep, meditation, hydration, screen time)
• Routines you define that include wellness-related activities
• Goals and milestones that reference fitness, weight, nutrition, recovery, mental health, or other wellness outcomes
• Qualitative self-ratings for sleep, health, work, and life (available in premium features)
• Reflections, journal entries, or AI conversations in which you voluntarily describe your physical or mental state
• Personal context you choose to share with the AI coach regarding your wellbeing

We do not collect precise biometric identifiers (e.g., fingerprints, retinal scans), genetic data, or diagnostic medical records. We do not connect to medical providers, insurers, or electronic health record systems.

3. Sources of Consumer Health Data

All consumer health data we hold comes directly from you — entered into the Service through the app or web interface, or shared in conversation with our AI features. We do not purchase consumer health data from data brokers and we do not infer consumer health data from third-party sources.

4. How We Use Consumer Health Data

We use consumer health data solely to provide and improve the features you have chosen to use, including:

• Displaying your habits, routines, goals, and progress back to you
• Generating AI-powered suggestions, milestones, and coaching prompts tailored to your inputs
• Sending reminders and notifications you have opted into
• Debugging, security, fraud prevention, and complying with legal obligations

We do not use consumer health data for targeted advertising, and we do not profile you based on consumer health data for purposes other than delivering the Service.

5. Sharing of Consumer Health Data

We do not sell your consumer health data. We do not share it with data brokers. We share it only with a limited set of processors who help us operate the Service, and only to the extent needed for them to perform their function:

• Cloud hosting and database infrastructure (e.g., Supabase)
• AI model providers that process your inputs to generate responses for you
• Analytics and error-monitoring tools, configured to avoid ingesting free-text wellness content where feasible
• Authorities, when required to comply with a valid legal process

Each processor is contractually bound to use consumer health data only to provide services to us and to apply appropriate security safeguards.

6. Your Rights

Regardless of where you live, you can exercise the following rights over your consumer health data:

• Right to confirm: ask whether we are processing your consumer health data
• Right to access: request a copy of the consumer health data we hold about you
• Right to withdraw consent: revoke any consent you previously gave to collect or share your consumer health data
• Right to delete: request deletion of your consumer health data from our systems and from our processors
• Right to appeal: if we decline a request, you may appeal the decision by replying to our response

Most of these rights can be exercised directly in the app by editing or deleting the relevant habits, routines, goals, reflections, or your entire account. For everything else, email us at privacy@beyondtime.ai. We will respond within 45 days and will not discriminate against you for exercising these rights.

Washington residents may also file a complaint with the Washington State Attorney General's Office.

7. Security and Retention

We apply the security practices described in Section 4 of our Privacy Policy to consumer health data, including encryption in transit, encryption at rest for sensitive fields, access controls, and monitoring. We retain consumer health data for as long as your account is active. If you delete an entry or your account, the data is removed from our active systems and, subject to routine backup rotation, from backups thereafter.

8. Changes to This Policy

If we materially change how we handle consumer health data, we will update this page, revise the "Last Updated" date, and — when required by law — obtain your consent before the change takes effect.

9. Contact

Questions or requests about your consumer health data:

• Email: privacy@beyondtime.ai
• Data Protection Officer: dpo@beyondtime.ai
• Mail: Tribble Software Private Limited, T-Hub Phase 2, 20, Inorbit Mall Rd, Vittal Rao Nagar, Madhapur, Hyderabad, Telangana 500081, India