Effective date: October 29, 2026 Last updated: November 4, 2026
This Consumer Health Data Privacy Policy supplements the Enphana Privacy Policy. It describes how Colyden LLC handles consumer health data in Enphana and is intended to provide the disclosures required by applicable consumer-health privacy laws, including Washington's My Health My Data Act.
Privacy contact: privacy@colyden.com
Enphana is a general-audience app and is not directed to children under 13. See the Privacy Policy for our children's privacy practices.
1. Consumer health data we collect
By default, Enphana handles the following consumer health data on your device. Enphana's servers receive it only if you choose a feature described in Sections 3 and 4.
- wellness reflections, symptoms or experiences, body-location notes, ratings, and free-text notes;
- meal, recipe, ingredient, nutrition, food-preference, and barcode or nutrition-label scan information;
- sleep-session timing, sleep stages, and related observations;
- activity or exercise-session type, timing, and related measurements;
- body measurements such as weight;
- an optional nutrition reference profile (an age group and a sex or reference value you choose, used to show general nutrition reference targets);
- questions, self-directed experiments, projects, an optional AI Profile (personal background you write), results, and patterns generated from the information you enter; and
- information imported from Apple Health or Health Connect after you grant the relevant read permission. From Apple Health this can include sleep sessions and stages; workouts with type, timing, distance, and speed (for some workouts, route location points are read only to calculate elevation gain and are not stored); steps; heart rate and resting heart rate; and body weight. From Health Connect it can include sleep sessions; exercise sessions with type and timing; distance, speed, elevation gained, and average heart rate for those workouts; daily step totals; heart rate; resting heart rate; and body weight.
2. Sources and purposes
We receive consumer health data directly from you when you use the App, including when you scan a barcode or nutrition label and, only when you choose to connect them, from Apple Health or Health Connect. We use it to provide logging, reflection, pattern, experiment, history, backup, restore, export, import, and the optional sharing features described below. Calculations and patterns are performed locally on your device.
Apple Health and Health Connect access is optional. You can refuse or withdraw access through Enphana and your device's connected-app or health settings. Withdrawing access stops future imports; you can delete already imported content through Settings → Reset Local Data and delete any backups separately.
3. Sharing and sale
Enphana does not sell consumer health data. It does not use consumer health data for advertising or cross-context behavioral advertising.
Consumer health data leaves your device only when you direct it to, as follows.
| Feature (all optional) | Data that may be included | Recipient | When |
|---|---|---|---|
| Cloud backup | Any content in your App database, including imported health data | Supabase (our storage provider), in a private area only your account can read | You tap to create a backup |
| AI link | Selected logs and dates, projects, your AI Profile | Cloudflare (our hosting provider); then the AI app, such as ChatGPT, Claude, or Grok, that you give the link to; and anyone else who has the link | You create the link |
| Nutrition share link | A recipe or meal, with ingredients, portions, and nutrition values | Cloudflare and Supabase (hosting); anyone with the link | You create the link |
| Export or system share | The file or content you choose | The destination or recipient you choose | You choose to export or share |
Our service providers process this data only on our behalf. We do not sell it and do not allow them to use it for their own advertising. AI providers and other recipients you give a link to are not our processors; they handle the information under their own terms and privacy policies. We do not use consumer health data to train AI models.
Imported Apple Health and Health Connect data is not sent to Supabase, RevenueCat, Apple, Google, or another provider unless you include it in a cloud backup or an AI link.
Supabase Auth also processes your email address, account identifier, authentication/session data, and security metadata for your Enphana account. RevenueCat and the applicable app store process subscription or transaction information. These services do not receive consumer health data from the App except as described in this Section. Apple or Google may process audio you dictate for voice food search under their own policies.
4. Consent and changes to use
You choose whether to connect Apple Health or Health Connect and grant the applicable read permissions. Enphana collects and uses the connected-health information needed for the import feature you request.
Cloud-backup and nutrition-share creation flows show what is being uploaded and ask you to confirm the upload. When you first share information through an AI link, Enphana describes the information included and requests confirmation. After a link has been created or you have acknowledged AI-link sharing, using the link creation, copy, or refresh action again may replace the link with a newly uploaded snapshot without showing the same confirmation dialog again. The new snapshot may include changes to information within the chosen sharing scope, and these uploads happen only when you take that action. Your confirmation is your consent to the collection and sharing of that data for that feature. Any additional consent required by applicable law is obtained separately. You can withdraw consent or stop sharing by deleting the backup in Settings → Local Backups, revoking an AI link on the AI screen, or choosing Stop sharing in Settings → Shared Links. Revoking a link stops further access through Enphana but cannot undo anything the recipient already received. If we plan to collect, use, or share a new category of consumer health data, or use it for a new purpose, we will first update this Policy and obtain consent when required by law.
5. Your rights and how to exercise them
Depending on where you live, you may have the right to confirm whether we collect, share, or sell consumer health data about you; access consumer health data we control; receive a list of third parties and affiliates with whom it has been shared; withdraw consent; and request deletion.
You can access and delete most of this data yourself: locally stored content through the App controls described in our Data Deletion Policy, and cloud backups and links in Settings → Local Backups and the AI and sharing screens. To request action regarding information Colyden controls, email privacy@colyden.com with the subject line Consumer Health Data Request. Do not include health entries, passwords, or one-time codes in your request.
We may verify your identity before acting on a request. We aim to respond within 45 days. If an applicable law permits us to extend that period, we will notify you, explain the reason, and provide an updated timeline. If we deny your request, you may appeal by replying with the subject line Consumer Health Data Appeal. Washington residents may also submit a complaint to the Washington State Attorney General.
6. Data retention and deletion
Consumer health data remains on your device until you remove it, reset local data, delete local backups, uninstall the App, or your device/platform removes it. Projects may remain recoverable for up to 30 days. Exports and files you share can remain with the service or person that receives them until you remove them there.
On our servers: cloud backups remain until you delete them or your account, or until they become eligible for scheduled deletion 90 days after your Premium access ends; AI link snapshots expire within 2 to 72 hours or when you revoke them; and nutrition share links expire within 30 days or when you revoke them. See the Privacy Policy for a full retention table.
If you delete an Enphana account, we delete the account identity and authentication data and the cloud backups that we control, subject to limited retention required for legal, security, or enforcement reasons. We also keep a limited, pseudonymous trial-eligibility record after account deletion; see the Privacy Policy and Data Deletion Policy. That record does not contain your wellness entries. Account deletion does not delete local App content, exported files, or independent records kept by Apple or Google. We also request deletion of your customer record at RevenueCat. See the Data Deletion Policy for instructions.
7. Updates and contact
We will update this Policy before material changes to our consumer-health-data practices and provide notice or consent when required. For questions, requests, or security reports, contact privacy@colyden.com.