Consumer health data privacy policy
For people in Washington and Nevada, whose state laws give specific rights over health data. It covers only the health-related part of what Repcord holds; everything else is in the privacy policy, which also applies to you.
Last updated:
Who this is from
Leo André, an individual developer in Sweden. There are no affiliates: no parent company, no subsidiaries, no group. Contact: support@repcord.app.
What is collected
Two things, both treated as consumer health data:
- Body measurements — every one you log, such as your weight, each with the date recorded.
- Reminders you write yourself — the name, icon and schedule of each one. All of them, because Repcord cannot tell which are about your health: "Creatine, 9am" and "Stretch, 9am" are the same record to it. Reminders about your planned workouts are not included — those are settings, not something you write.
Repcord does not collect your date of birth. It does not collect or infer any diagnosis, condition, symptom, medication, treatment, test result, reproductive or sexual health information, gender-affirming care information, biometric identifier, genetic data, or precise location. It reads nothing from Apple Health, Google Fit or any other health service, and trains no model on your data.
Your workout history is not consumer health data: a record that you did five sets of squats is an activity you chose to write down. It remains your personal data under the privacy policy and is deleted with your account.
Why, and how it is used
Repcord asks for your consent before collecting either — a separate question during signup, which you can decline. Both fields are optional and the app works without them. Each exists for one feature:
- Body measurements — so each one you track can be drawn as a chart and can have a goal measured against it.
- Reminders you write — so each one is kept with the time you chose, shown to you on the Reminders screen, and sent to you at that time. Nothing is sent if you turn notifications off, in the app or in your device settings.
It is used to show you your own information and run the feature you entered it for. It is never used for advertising, marketing, profiling, any automated decision, research, or aggregate analysis.
Where it comes from
Only from you, typed into the app on your own device. Repcord buys no data, receives none from data brokers, and collects none from any other app, service, website or device. If you did not enter it, Repcord does not have it.
What is shared, and with whom
None of it is shared with anyone, and none is sold. There is no category that is shared and no third party or affiliate that receives it.
- It has never been sold. Washington requires signed authorisation before any sale; none has been sought, because there has been no sale.
- The storage provider is a processor, not someone the data is shared with. The nightly backup is encrypted before it leaves the server, so the provider holds a file it cannot read and may not use it for anything. The privacy policy lists it for completeness.
If that changes, this page changes first: you would be asked for consent before any sharing, and separately again before any sale.
Where it is stored
On your phone, and on a server in the EU, with encrypted nightly backups also held in the EU. None of it is sent outside the EU. European Union data protection law therefore also covers it, wherever you live. The privacy policy has the detail.
Your rights
Exercising any of these is free, and you will never be denied the app, charged differently or given a worse version for doing so.
To know, and to get a copy
You can ask whether Repcord collects, shares or sells your consumer health data, and get a copy of what is held with a list of every third party and affiliate it has been shared with, and an email address for each. That list is empty and always has been, and you will be told so plainly.
To withdraw consent, from collection and from sharing
You can withdraw your consent to Repcord collecting this data, and to sharing it, at any time. Preferences → Privacy has one control that withdraws consent and deletes both. Each can also be removed on its own: delete a measurement on Statistics → Body, or a reminder on the Reminders screen's Custom tab. Withdrawal applies immediately on the device and at the next sync on the server.
To have it deleted
Deleting your account removes it with everything else, from the server and the device, immediately and without review.
Backups are the exception. A backup taken before deletion still contains the data and is not rewritten afterwards. Backups age out after about a month — a few of the most recent are always kept — and are only ever read to restore the whole database after a failure. Nothing is restored selectively, so deleted data does not return.
How to make a request
Email support@repcord.app from the address on your account, saying which right you want to use. Sending it from that address is how the request is verified. You may use an authorised agent, who will be asked to prove that you authorised them.
You will have an answer within the 45 days Washington allows, and normally inside the one month the GDPR requires. That can be extended once for a complicated request, and you will be told before the first period runs out. If a request is refused you will be told why and can appeal by replying; an appeal is answered within 45 days, and a refused appeal comes with a way to complain to your attorney general.
Complaints
Write to the address above first. You can also complain to the Washington State Attorney General or the Nevada Attorney General. Washington's law also lets you bring your own claim under the state's Consumer Protection Act.
Changes
If what Repcord collects or does with consumer health data changes, this page changes and the date at the top is updated. A change that widens collection or introduces sharing will ask for your consent before it takes effect.