Consumer Health Data Privacy Policy

This Consumer Health Data Privacy Policy applies to "consumer health data," as defined by Washington's My Health My Data Act and similar state laws, that Medo Ventures LLC ("Medo Ventures," "we," "us") collects through WattAscent. It explains what we collect, why, where it comes from, who we share it with, and how you can exercise your rights.

1. Consumer health data we collect

Heart rate data: heart rate recorded during rides, your resting and maximum heart rate settings, and heart rate from activities you sync from Strava.
Body measurements: your weight.
Exercise and performance data: power, cadence and workout data from your rides and tests, your FTP, and your post-ride effort ratings.
Readiness check results: heart rate response and heart rate recovery measured during the optional warm-up readiness check.
Inferences: fitness, fatigue, form, training load, readiness and workout levels that WattAscent calculates from the data above.

2. Why we collect it and how we use it

To create and adapt your training: setting power and heart rate targets, estimating and updating your FTP, adjusting your plan and workout levels, and deciding whether to ease a workout after a readiness check.
To show you your training history, trends, fitness and fatigue.
To calculate training load from heart rate when an activity has no power data.
To keep the Service working and secure, and to meet legal obligations.

We collect consumer health data only with your consent, which we ask for in the app before collecting it, and only for the purposes above. We won't use it for any other purpose without first telling you and getting your consent.

3. Where it comes from

Directly from you, when you enter it in the app.
From the devices you connect: heart rate monitors, power meters and smart trainers.
From Strava, if you connect your Strava account.
Calculated by WattAscent from the data above.

We share consumer health data only as needed to provide WattAscent to you:

All of the categories in section 1 are stored and processed by our service providers (processors), who handle them only on our instructions.
If you choose to upload a ride to Strava, that ride's heart rate, power, cadence and timing data is sent to Strava.

We don't sell consumer health data.

5. Third parties and affiliates we share with

Processors: our database and sign-in provider (Supabase, Inc.) and our hosting and security provider (Cloudflare, Inc.).
Third parties, at your direction: Strava, Inc., only if you connect Strava and choose to upload rides.
Affiliates: none.

6. Your rights and how to use them

You have the right to:

confirm whether we collect, share or sell your consumer health data;
access your consumer health data, including a list of all third parties and affiliates we've shared it with or sold it to, and how to reach them;
withdraw your consent to our collection and sharing of your consumer health data;
have your consumer health data deleted. We'll also tell our processors and any third parties we've shared it with to delete it.

To make a request, email hello@medoventures.com with the subject line "Consumer health data request." You can also delete your data or account, and disconnect Strava, in the app. We'll verify your request using the email address on your account, then respond within 45 days. If we need more time, we'll tell you why and may extend once by up to 45 more days. Requests are free, up to twice a year.

Appeals. If we decline your request, you can appeal by replying to our response within a reasonable time. We'll answer your appeal in writing within 45 days and explain the reasons for our decision. If your appeal is denied, you can contact the Washington State Attorney General.

7. Contact

Medo Ventures LLC, Seattle, Washington, USA. Email hello@medoventures.com.