Consumer Health Data Privacy Policy
Last updated: October 1, 2026
This policy is required by Washington's My Health My Data Act (RCW 19.373) and applies to consumer health data as that law defines it. It supplements our Privacy Policy, which covers everything else. Where the two differ on consumer health data, this one governs for Washington consumers.
Compound is operated by Hieu Luu, sole proprietor trading as Compound, 3575 Arden Way Unit #2014, Sacramento, CA 95864, United States. Compound has no affiliates. Where the law requires us to list "specific affiliates," the answer is that there are none.
1. What consumer health data we collect, and why
| What | Why |
|---|---|
| Body measurements | Weight over time, height, age, sex — to calculate your calorie and protein targets and show progress |
| Medication information | GLP-1 medication name, dose, date, injection site and side effects you record — so you can keep a diary and see it back in date order. During onboarding, if you choose to answer: whether you take a GLP-1 medication, which one, its dose and schedule, the benefits you want and any side effects, to build your plan |
| Nutrition information | Foods you log, calories, macronutrients, times, saved meals — to track what you eat against your targets |
| Photographs of food | Images you take or pick from your photo library with the meal scanner, and any note you add, to estimate the nutrition content of a meal |
| Progress photos | Body photos you choose to take to track how your shape changes. Stored privately in your account, and never sent to our AI, analytics or advertising providers |
| Exercise information | Workouts, sets, weights, training history — to plan and track your training |
| Content you post | Anything you choose to share in the social features, which may reveal health information you decided to share — to show it to the people you chose |
| Inferences | Nutrition estimates derived from your food photographs, and targets calculated from your measurements |
We do not collect precise location, biometric identifiers, genetic data, information about reproductive or sexual health, gender-affirming care information, or data about your use of health care services. We do not infer health conditions or diagnoses, and Compound is not a medical device.
2. Where it comes from
- You — everything above is either entered by you or produced by a feature you chose to use. Body measurements, medication entries, food logs, workouts and posts are all self-reported.
- Your device, with your permission — the camera and photo library, for meal, progress and workout photos, and to scan barcodes.
- Derived from your own data — nutrition estimates from your photographs, and targets calculated from your measurements.
We do not buy consumer health data, and we do not obtain it from data brokers, advertising networks, other apps, or any other outside source.
3. What we share
We do not sell consumer health data. We have never sold it, and we have no process for selling it. Under RCW 19.373.070 a sale would require your signed authorization; we do not ask for one because we do not do this.
The only consumer health data that leaves our systems is:
- Photographs of food, sent to our AI provider to estimate nutrition, and only at the moment you scan a meal.
- Food names and barcodes, sent with no account details to our food-database provider to look up nutrition values.
- Content you post yourself in the social features, shown to the people you chose to share it with.
Nothing else. In particular, our analytics, attribution and advertising-measurement providers receive no consumer health data at all. That is enforced in our code rather than by policy: health information is stripped before any analytics or error-reporting service can receive it, and the advertising services receive only the fact that an event such as a purchase occurred, with no accompanying details.
4. Who we share it with
Specific affiliates: none. Compound is a sole proprietorship with no affiliates, parent or subsidiaries.
Categories of third parties:
| Category | What they receive |
|---|---|
| Cloud database and storage | Stores your data on our instructions so the app works |
| AI nutrition analysis | Receives food photographs to estimate nutrition, at the moment you scan |
| Food database | Receives food names and barcodes to look up nutrition values. No account details |
| Error and crash monitoring | Receives technical error reports. Health information is stripped before it is sent |
| Subscription management and onboarding screens | Receives purchase and entitlement information, and which of the early onboarding screens you viewed. Your answers to the health questions stay in the app and are not sent to it, and it does not record which health questions you were shown |
| Push notification delivery | Delivers notifications to your device |
| Product analytics | Receives usage events. Health information is stripped before it is sent |
| Advertising measurement and attribution | Receives only that a conversion event occurred, with no details attached |
| Other users of Compound | Only content you choose to post or share |
Each of these acts on our instructions under contract, except other users, who see only what you chose to share. Our main Privacy Policy names each provider individually.
5. Your rights, and how to use them
Under RCW 19.373.040 you have the right to:
- Confirm whether we are collecting, sharing or selling your consumer health data, and to access it — including a list of all third parties and affiliates who received it;
- Withdraw your consent to our collection and sharing of your consumer health data; and
- Delete your consumer health data.
How to ask. Email hello@compoundfit.app with what you want. You can also delete your account and all of its data at any time from inside the app, under Settings.
What happens next. We respond without undue delay and within 45 days of receiving your request. If we genuinely need more time we may take one further 45-day extension, and we will tell you within the first 45 days if that happens and why.
What deletion means here. We delete it from our own database and storage straight away. Your analytics identity at PostHog is deleted automatically as part of that, and we record a deletion request for every other processor that holds something about you, which we send on and they complete under their own schedules. Backups are retained for up to 30 days, so a copy may sit in an encrypted backup for that long after we confirm your request.
If we say no. You may appeal. Email hello@compoundfit.app with "Appeal" in the subject line and we will give you a written explanation within 45 days. If we deny your appeal, we will tell you how to contact the Washington State Attorney General’s Office, which accepts complaints at atg.wa.gov/file-complaint.
Withdrawing consent is not the same as deleting. Withdrawing stops future collection and sharing; deleting removes what we already hold. You can ask for either or both.
6. Changes to this policy
We will not collect, use or share categories of consumer health data, or use it for purposes, that are not described above without telling you first and getting your affirmative consent. If we update this policy we will change the date at the top.
7. Contact
hello@compoundfit.app
Hieu Luu, trading as Compound
3575 Arden Way Unit #2014, Sacramento, CA 95864, United States