Consumer Health Data Privacy Policy
Effective date: October 12, 2026 · Last updated: October 12, 2026
This policy explains how BUNNYSOFT LLC (“BUNNYSOFT”, “we” or “us”) handles “consumer health data” in the Maiva app. It’s written to meet Washington’s My Health My Data Act, Nevada’s consumer health data law (Senate Bill 370) and Connecticut’s consumer health data rules, and it applies to everyone who uses Maiva. It adds to our Privacy Policy, which covers all the personal information we handle.
1. Our approach
Maiva is designed not to collect health information. We don’t ask about injuries, medical conditions, symptoms, medications, pregnancy or body measurements, and the app has no place to enter them. We don’t connect to Apple Health, Google Health Connect or wearable devices. The “movements to skip” list records which movements you want left out of your workouts, not why, and we don’t use it to infer anything about your health.
Even so, you might type health information into a chat with an AI trainer, and some laws define health data broadly. This policy covers both.
2. Consumer health data we may collect
- Health information you choose to type into a chat or a free-text field, such as a mention of an injury, pain, a condition, a medication or a pregnancy.
- Fitness information: the workouts you log (exercises, sets, repetitions, loads and duration), the activity snacks you complete, and the movements you skip. We don’t consider this health data, but some laws may treat information about physical activity as health data, so we include it here.
We collect and use this information only to the extent necessary to provide the Service you’ve asked for: generating your workouts and responding to your messages.
3. Where it comes from
- From you, when you type it or log a workout.
- From the Service, when the AI generates responses, plans or summaries based on what you’ve told it.
4. How we use it
- To generate responses to your messages, and to build and personalize your workouts.
- To keep the Service safe and secure, and to prevent abuse.
- To comply with the law.
We don’t use consumer health data for advertising, and we don’t sell it. We don’t use geofencing around health care facilities.
5. How we limit it
- Removal before saving. We use automated tools to detect health details and remove them before chat messages and training summaries are saved. These tools can miss things.
- Your control. You can delete any chat in the app at any time.
- Deletion. Everything is deleted when you delete your account (see section 8). Deleted information may stay in backups for up to 30 days until they are overwritten.
6. Who we share it with
We don’t share consumer health data with third parties, and we have no affiliates. We disclose it only to the processors that handle it for us under contract, to provide the Service you’ve asked for:
| Processor | Why | Contact |
|---|---|---|
| Supabase, Inc. | Stores the app’s data and runs our servers | supabase.com/privacy |
| OpenAI, L.L.C. | Generates AI responses from your messages and training information | openai.com/policies/privacy-policy |
| Google LLC (Gemini API) | Generates AI responses from your messages and training information | policies.google.com/privacy |
| Anthropic, PBC (if used) | May generate AI responses from your messages and training information | anthropic.com/legal/privacy |
The AI providers may keep requests for a limited time to monitor for abuse, for the period set in their own terms. Their contracts with us don’t allow them to use your data to train their models. We may also disclose information when the law requires it.
7. Your rights
You have the right to:
- confirm whether we collect, share or sell your consumer health data
- access your consumer health data, including a list of every third party and affiliate we’ve shared it with or sold it to, with their contact details (today there are none: we use only the processors listed above)
- delete your consumer health data. When you ask, we’ll also tell our processors to delete it, and it’s removed from backups within 30 days
- withdraw consent. We rely on what’s necessary to provide the Service, not on consent. You can stop us using what you type by not entering health information, and by deleting your chats or your account
- not be discriminated against for using these rights
We’ll respond within 45 days. If we need more time, we may extend this by another 45 days, and we’ll tell you why. Requests are free, up to twice a year.
8. How to make a request
- Delete everything: delete your account in the app’s settings (instructions on our Delete your account page).
- Any other request: email legal@bunny-soft.com with the subject “Health data request”, or use our support portal .
We’ll confirm your identity, usually by checking that the request comes from your account’s email address. You can use an authorized agent; we may ask for proof of their authority.
Appeals. If we decline your request, we’ll explain why. You can appeal within 45 days by replying to our decision with the subject “Appeal”. We’ll answer within 45 days and explain the outcome. If you disagree with the outcome, you can contact your state’s attorney general:
- Washington: atg.wa.gov/file-complaint
- Nevada: ag.nv.gov
- Connecticut: portal.ct.gov/ag
9. Changes to this policy
If we change this policy, we’ll post the new version here and change the dates at the top. Before we collect or share consumer health data in a new way, we’ll update this policy and ask for your consent where the law requires it.
10. Contact us
BUNNYSOFT LLC, 418 Broadway Ste R, Albany, NY 12207, United States · legal@bunny-soft.com · bunnysoft.zohodesk.com