Consumer Health Data Privacy Policy
Last updated: July 8, 2026
This Consumer Health Data Privacy Policy explains how Lymes, a service of MyloTech, Inc. (“Lymes,” “we,” “us,” or “our”), collects, uses, and shares consumer health data through the Lymes app, and the rights you have over that data. It supplements our Privacy Policy and is provided to satisfy Washington’s My Health My Data Act and similar state consumer-health-data laws.
1. Consumer health data we collect
- Health information you provide — messages you send to the app, lab reports, photos (for example, meals or body composition), and voice notes, to the extent they contain health information;
- Apple Health (HealthKit) data — sleep, heart rate variability, and resting heart rate, only if you grant HealthKit access;
- Connected wearable and lab data — measurements from devices you connect and results from lab panels you order, via our integration partner;
- Derived health insights — summaries, trends, and experiment results the app computes from the data above.
2. Sources of consumer health data
- Directly from you, inside the app;
- From Apple Health, with your HealthKit permission;
- From wearables and labs you choose to connect, via Junction (Vital).
3. Why we collect it
Consumer health data is collected and used for exactly one product purpose: generating your own insights, answers, and summaries inside the app. We also process it as needed to secure the service, comply with law, and honor your requests (for example, export or deletion).
We do not use consumer health data for advertising or marketing. We do not sell consumer health data, and we have not sold it in the past. Your data is never used to train AI models — ours or anyone else’s.
4. Who we share it with
We share consumer health data only with service providers (processors) acting on our behalf, each limited to what its role requires:
| Processor | Role |
|---|---|
| Convex | Database and backend hosting — stores consumer health data, encrypted in transit and at rest |
| Clerk | Sign-in and account identity (email, name — not health data) |
| Google (Gemini) and Anthropic (Claude) | AI processing — relevant parts of your data are sent to generate your insights and answers, under agreements that prohibit training on your data |
| Junction (Vital) | Wearable-device connections and lab integrations, only if you connect a device or order a panel |
| Expo | Push-notification delivery (device token, notification content) |
Our product-analytics provider (PostHog) receives event names and flags only — never message text and never health values — so it does not receive consumer health data. We may also disclose information if required by law. We do not share consumer health data with data brokers, advertisers, or social media platforms.
5. Your rights
You have the right to:
- Confirm and access — confirm whether we collect, share, or sell consumer health data about you, and access that data, including a list of the third parties with whom we have shared it (Section 4 above);
- Withdraw consent — withdraw your consent to our collection and sharing of consumer health data (for example, revoke HealthKit access in iOS Settings, disconnect a wearable, or stop using the app);
- Delete — have your consumer health data deleted. In-app: Settings → “Delete my data” schedules permanent deletion of your account and all your data in 7 days (cancelable in that window by signing back in). Deletion removes your data from our database, your sign-in identity, and connected integrations.
You can exercise any of these rights in the app (Settings → Export / Delete) or by emailing worthenbenton@gmail.com. We will respond within 45 days. We will not discriminate against you for exercising your rights.
6. Appeals
If we decline to act on your request, you may appeal by replying to our decision or emailing worthenbenton@gmail.com with the subject “Appeal.” We will respond to appeals within 45 days. If your appeal is unsuccessful and you are a Washington resident, you may contact the Washington State Attorney General.
7. Changes & contact
We will update the “Last updated” date above when this policy changes. Questions or requests: MyloTech, Inc. — worthenbenton@gmail.com.