Washington Consumer Health Data Privacy Notice
Effective Date: November 3, 2026
Last updated: November 3, 2026
Entity: ORTHOREP LLC, Washington State
Introduction
This Washington Consumer Health Data Privacy Notice describes how ORTHOREP LLC ("OrthoRep," "we," "our," or "us") collects, uses, discloses, and otherwise processes consumer health data as defined by Washington’s My Health My Data Act, chapter 19.373 RCW.
This notice supplements our Privacy Policy and applies to consumer health data handled by the OrthoRep iPhone and Apple Watch apps.
OrthoRep is a local-first app. Consumer health data you enter or that your devices measure is stored on your iPhone and Apple Watch and is not transmitted to OrthoRep servers. We do not operate servers that store your training data. The only information that leaves your device is the anonymous usage analytics described below, which you can turn off.
Categories of Consumer Health Data Collected and Why We Collect It
1. Body measurements and fitness profile data
Examples: body weight, height, sex, birth year, experience level, training goal, and the equipment you train with, which you may enter during setup or in Settings.
We use this data on your device to:
- set up and maintain your profile;
- calculate loads for bodyweight exercises and display progress; and
- tailor starting routines and suggestions to your experience and goals.
2. Workout, exercise, and performance data
Examples: exercises performed, sets, reps, weight used, reps in reserve, workout duration, routines and templates, workout history, and personal records.
We use this data on your device to:
- provide workout logging and history;
- detect personal records and show progress; and
- generate progression and weight suggestions.
3. Apple Health, Apple Watch, and connected device data
If you grant permission, we read heart rate, active energy, resting energy, and body weight from Apple Health or Apple Watch sensors during workouts, and we can write completed workouts and active energy to Apple Health. If you connect a Bluetooth heart rate monitor, we read heart rate from it during a workout.
We use this data on your device to:
- show live stats during a workout;
- save a workout’s average and maximum heart rate with the workout;
- keep your body weight current for bodyweight exercises; and
- save your workouts to Apple Health so they count toward your Activity rings.
4. Derived or inferred health-related data
Examples: personal records, estimated one-rep maxes, progression suggestions, and weight suggestions calculated from the categories above.
We use this data on your device to display progress and suggest what to lift next.
5. Identifiers reasonably linkable to the categories above
The App does not collect your name, email, or account identifier. The anonymous usage analytics described below use a random identifier generated by the analytics SDK on your device, which is linkable only to the limited usage data sent with it.
Categories of Sources From Which Consumer Health Data Is Collected
- Directly from you, when you enter body measurements, profile details, workouts, routines, or notes into OrthoRep.
- From Apple Health and Apple Watch sensors, only when you grant permission.
- From a Bluetooth heart rate monitor, only when you connect one during a workout.
- From your use of the App, when the App derives personal records, estimated one-rep maxes, and suggestions from your history on your device.
- From your paired device, when workouts, routines, and settings move between your iPhone and Apple Watch over Apple’s Watch Connectivity framework.
We do not purchase consumer health data from data brokers, advertising networks, or other third-party vendors.
Categories of Consumer Health Data That Are Shared
For purposes of Washington law, we do not share consumer health data with third parties or affiliates for their own use, and we do not sell it.
Consumer health data stored on your devices is not transmitted to us or to any processor. The categories that may be disclosed to a processor acting on our behalf are limited to the anonymous usage analytics described in the next section, which may include:
- a limited subset of workout, exercise, and performance data: the number of sets in a workout, its duration, whether it was logged on iPhone or Apple Watch, the time from workout start to the first logged set, the catalog ID of a bundled library exercise when you add it (custom exercises are reported only as "custom"), the number of exercises and days per week in a routine, and the number of personal records in a workout you chose to share; and
- a limited subset of fitness profile data: experience level, training goal, and an equipment category.
Weights lifted, reps, body weight, heart rate, Apple Health data, exercise names you type, and notes are never included.
If you turn on Apple Health, workouts you save are written to Apple Health on your device under Apple’s privacy terms. This is a disclosure you direct, not a disclosure by us.
Categories of Third Parties and Specific Affiliates With Whom We Share Consumer Health Data
- Third parties for their own use: None.
- Specific affiliates: None.
For transparency, the following processor may process the limited consumer health data described above on our behalf:
- PostHog, Inc. (product analytics, EU-hosted), which receives anonymous usage events from the iPhone app unless you turn off "Share anonymous usage data" in Profile › Data & Privacy. The Apple Watch app sends no analytics.
Apple provides the operating system services the App relies on (Apple Health, Watch Connectivity, and App Store purchases). Apple processes data on your devices and under your Apple ID according to Apple’s privacy policy; we do not direct Apple’s processing, and Apple does not receive your training data from us.
We require processors to handle consumer health data only on our instructions and for the purposes disclosed in this notice.
Consent and Requested Services
We collect consumer health data only:
- with your affirmative consent for a specified purpose; or
- to the extent reasonably necessary to provide a product or service that you request.
Logging workouts and entering profile details are services you request, and the data is kept on your device to provide them. Apple Health access requires your separate permission through iOS, and heart rate monitors require your separate Bluetooth permission. Anonymous usage analytics can be turned off at any time in Settings.
Where consent is required for sharing consumer health data, that consent is separate from consent for collection.
Withdrawing consent stops future collection or sharing that depends on it. It does not undo prior processing and does not prevent the App from processing data on your device that is necessary for a feature you continue to use. To stop on-device processing of a category of data, stop using that feature or delete the data.
Your Rights and How To Exercise Them
Subject to applicable law, you have the right to:
- confirm whether we are collecting, sharing, or selling consumer health data concerning you;
- access that consumer health data;
- receive a list of all third parties and affiliates with whom we have shared or sold your consumer health data, and an active email address or other online mechanism to contact them;
- withdraw consent from our future collection and sharing of your consumer health data; and
- request deletion of consumer health data concerning you.
How to exercise your rights in the App
- Access and portability: your data is on your device. Profile › Export Data produces a complete JSON file.
- Deletion: delete individual workouts, routines, and records in the App, or delete the App from your iPhone and Apple Watch to remove all OrthoRep data from those devices. Workouts saved to Apple Health must be deleted in the Health app.
- Withdraw consent: turn off "Share anonymous usage data" in Profile › Data & Privacy; change Apple Health permissions in the Health app; change Bluetooth permission in iOS Settings.
How to submit a request to us
Email privacy@orthorep.app. We may ask for information reasonably necessary to verify your identity and your request. We will not require you to create an account.
Because we do not hold a copy of your training data and analytics are not linked to your name or contact details, we usually cannot locate analytics records that belong to a specific person. We will tell you if that is the case for your request.
Timing, deletion, and appeals
We respond to requests without undue delay and within 45 days of receipt. We may extend that once by up to 45 additional days when reasonably necessary, and we will tell you why within the initial 45-day period.
Responses are free of charge up to twice a year per consumer, unless a request is manifestly unfounded, excessive, or repetitive.
If you request deletion of consumer health data we hold, we will delete it from our records and notify any processor that received it, which must also delete it. If data is in archived or backup systems, deletion may be delayed as necessary to restore and delete from those systems, but not for more than six months after your request is authenticated.
If we decline to act on a request, you may appeal by emailing privacy@orthorep.app with the subject line Appeal. We will respond in writing within 45 days. If we deny your appeal, we will give you a way to contact the Washington Attorney General to submit a complaint.
Sale of Consumer Health Data
We do not sell consumer health data. If that ever changed, we would first obtain a valid authorization that satisfies Washington law.
Precise Geolocation and Geofencing
OrthoRep does not collect precise geolocation. PostHog derives an approximate location (country, region and city) from the IP address of each analytics request. It is not linked to your name or any account, and we use it only for aggregate product analytics. The App never asks for or uses your device’s location services. We do not use geofencing around health care facilities or services.
Changes to This Notice
If we make a material change to this notice, we will update the dates above, post the revised notice at orthorep.app, and ask you to review and accept it in the App before continuing to collect consumer health data under the new terms.
Contact Us
Email: privacy@orthorep.app
Entity: ORTHOREP LLC, Washington State