Consumer health data privacy policy

1. Who this policy is for

This policy is for people in the United States, and in particular for consumers covered by Washington’s My Health My Data Act, Nevada’s consumer health data law (SB 370), and similar laws in other states. It adds to our privacy policy, which covers everyone.

Surplus is run by Forge Wealth Group Ltd, 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom (“we”, “us”). You can reach us at [email protected].

2. The consumer health data we collect

“Consumer health data” means personal information that is linked or reasonably linkable to you and identifies your past, present or future physical or mental health. In Surplus, it covers:

• Your body and goals: your weight and weigh-ins, height, sex, date of birth, activity level, goal weight and how quickly you want to gain.
• What you eat and drink: the foods and drinks you log, with their calories and nutrients, the time you had them and the meal they were in; your water; your recipes, meal plans and meal times.
• Figures Surplus works out for you: your calorie and macro targets, your weight gain zone, and your stomach level. Your stomach level is worked out on your phone and isn’t stored; your Digestion setting is.
• Progress photos you add to your weigh-ins. These stay on your phone.
• Your step count from Apple Health, if you allow it. Surplus reads it on your phone to show it to you, and never stores it or sends it to us.
• Your consent records: when you agreed to us processing your health data.

3. How we use it

Only to provide the features of Surplus that you ask for: working out your targets, showing your progress, estimating your stomach level, planning meals, reminding you to eat, and keeping your information in your account when you’re signed in. We don’t use it for advertising, and we don’t sell it.

4. Where it comes from

• From you, when you enter it in Surplus.
• From your phone, with your permission: steps from Apple Health, and photos you take or choose.
• Worked out by Surplus from what you enter, like your targets and your stomach level.

5. Who we share it with

We don’t sell consumer health data. We share it only with service providers that process it for us, under contracts that limit what they can do with it:

• Supabase, Inc. hosts our database. When you’re signed in, the consumer health data in section 2 that’s kept in your account (everything except your photos, your stomach level and your steps) is stored with Supabase on servers in Ireland.
• Open Food Facts, a food database, receives the words you search for, the barcodes you scan and your food country, so Surplus can find the food. It doesn’t receive your name, your account or any identifier from us.

We don’t share consumer health data with any affiliates.

6. Your rights

You have the right to:

• confirm whether we collect, share or sell your consumer health data, and see it;
• get a list of the third parties and affiliates we’ve shared it with, and how to contact them;
• withdraw your consent to us collecting and sharing it;
• have it deleted, including from our service providers’ systems.

How to use them:

• To delete everything in the app, go to Profile › Help › Delete account. This deletes your account and its data from our servers straight away. Copies in our hosting provider’s backups are overwritten within 30 days.
• If the app is showing the subscribe screen, email [email protected] from the address on your account. We’ll check the request comes from you and delete your account within 30 days.
• For anything else, email [email protected] with “Health data request” in the subject, from the email address on your account if you have one.

We’ll need to check the request comes from you, and we’ll answer within 45 days. If we need longer, we’ll tell you why within those 45 days, and take no more than another 45. Using these rights is free, and we won’t treat you differently for using them.

Appeals. If we turn down your request, reply to our answer with “Appeal” in the subject. We’ll answer within 45 days and explain our decision. If you’re still unhappy, you can complain to your state’s attorney general: in Washington, the Washington State Attorney General; in Nevada, the Nevada Attorney General.

7. Geofencing

We don’t use geofences, or any location tracking, around places that provide health care or anywhere else.

8. Contact us

Email: [email protected]

Post: Forge Wealth Group Ltd, 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom