Gout Compass Consumer Health Data Privacy Policy

Last updated: August 22, 2026

This Consumer Health Data Privacy Policy is issued by Hampi LLC ("we"), operating as MetabolicOS Health, for the Gout Compass app ("the app"). It describes how we collect, use, and handle "consumer health data" as defined by Washington's My Health My Data Act (MHMDA), and it applies to Washington State residents and to consumers whose consumer health data we process. It supplements our general Privacy Policy; where the two address the same practice, both describe the same handling.

What Consumer Health Data We Collect

The following categories of consumer health data are collected through the app:

• Heart rate variability (HRV/SDNN) and sleep analysis data from Apple HealthKit, with your permission
• Symptom logs and severity notes you record
• Hydration logs
• Lab results (such as uric acid values) you enter as text
• Menu scan history (item names and counts only; photos are not retained after the scan)
• Baseline uric acid level, age range, and prior gout flare history you enter during setup

We collect this data only when you provide it or grant permission. The app functions without HealthKit access; connecting it is optional.

How We Collect Consumer Health Data

• Directly from you, when you enter it in the app
• From Apple HealthKit, with your explicit permission
• From menu photos you choose to capture. Menu images may be sent to Google's Gemini API for processing, to identify the dishes printed on the menu. The photo is resized on your device and travels over encrypted HTTPS via our backend. It is not retained by us after the scan, and Google does not use it to train its models (see Who Has Access). You are asked before the first such scan, and can turn this off at any time in Settings.

Why We Collect It and How We Use It

We collect and use consumer health data for a single purpose: to compute your factor score — a wellness summary of signals associated with gout flares — and to generate wellness insights within the app. We do not use it for advertising, profiling for advertising, or any purpose beyond providing the app's core functionality.

To compute your factor score, your health metrics are transmitted to our backend over encrypted HTTPS. This data is not linked to your name or email, and it is not stored after the response is returned. Our backend keeps no database of user health data.

A menu photo is handled separately and never travels with your health data. It is sent only when you scan a menu, only to identify the dishes printed on it, and the dish risk ratings you see are computed by our backend from a fixed nutritional table — no AI model rates them.

How Consumer Health Data Is Stored

• Health and log data is stored locally on your device using Apple's SwiftData framework.
• If you have iCloud enabled, your data is stored in your own iCloud account, subject to Apple's privacy policy. We have no access to it.
• Factor-scoring requests are processed on our backend and are not retained after the response is returned. We do not log the contents of scoring requests.

We Do Not Sell or Share Your Consumer Health Data

We do not sell your consumer health data, and we have never done so. "Sale" has the meaning given in MHMDA (an exchange of consumer health data for monetary or other valuable consideration).

We do not share your consumer health data for advertising, cross-context behavioral advertising, or any third party's own purposes. Because we do not sell or share consumer health data, we do not maintain a list of third parties to whom such data is sold or shared.

Who Has Access

We do not share your consumer health data with third parties for their own use. Our infrastructure providers process data only to operate the service on our behalf and are not permitted to use it for their own purposes:

• Railway (railway.app) — hosts our backend API; data in transit is encrypted.
• Google (Gemini API) — reads dish names from a menu photo when you use the dining co-pilot. It receives the photo only, at the moment you scan; it is never sent your health metrics, symptom logs, lab results, name, or email. Under Google's paid API terms, prompts and responses are not used to train or improve Google's models, and are retained for a limited period solely to detect abuse.
• Apple iCloud — optional device sync under your own account; Apple's privacy policy applies.

Within our organization, access to any consumer health data is limited to personnel who need it to operate and maintain the service.

Your Rights Under MHMDA

If you are a Washington resident, or a consumer whose consumer health data we process, you have the right to:

• Confirm whether we are collecting, sharing, or selling your consumer health data, and to access that data. (We do not sell or share it.)
• Withdraw consent to our collection and processing of your consumer health data. You can do this at any time by revoking HealthKit permission in iOS Settings, stopping manual entry, or deleting the app.
• Delete your consumer health data. Because we do not retain factor-scoring data after the response is returned, and health data is otherwise stored only on your own device, deleting the app removes your local data. For any server-side records (the optional integration-interest logs described in our general Privacy Policy), email us and we will delete them within the timeframes MHMDA requires.

We will not discriminate against you for exercising any of these rights, and exercising them is free.

How to Exercise Your Rights

Email us at support@metabolicos.health. We will respond within the timeframe required by MHMDA. If you are not satisfied with our response, you may file a complaint with the Washington State Office of the Attorney General.

Changes to This Policy

If we make material changes to how we handle consumer health data, we will present those changes in the app and ask for your consent before the new processing begins. Non-material changes will be reflected by updating the "Last updated" date above.

Contact

Questions about this Consumer Health Data Privacy Policy? Email MetabolicOS Health at support@metabolicos.health.