Consumer Health Data Privacy Policy

• Your daily step totals, read from Apple Health or Health Connect with your permission, each reading with when it was read and received, and whether Health had any steps recorded that day.
• What we work out from them: the steps that counted for you each day (up to the 40,000 daily cap), your season totals, and your team's totals, averages and results, which include your steps.
• Whether your phone has sent step data on a given day and at what time (not the number).

We collect no other health information: no heart rate, sleep, workouts, location, weight or medical information.

To run the step league you joined: to score each day's games, keep the standings, show you and your teammates your steps, show other teams your team's totals, remind you to sync before each day's cutoff, and fix sync problems. Nothing else.

• Your phone, from Apple Health (HealthKit) or Health Connect, only after you give Rallyday permission there and agree in the app.
• Our own calculations from those readings (§ 1).

We don't sell consumer health data, and we don't share it for advertising.

As part of the league you joined, and shown to you on the Connect screen before you connect:

• Your teammates in the season: your step total for today, and when your phone last synced; after the season, your season total.
• Everyone in your season, including other teams: your team's totals and results, which include your steps.
• Your employer's administrator: whether your phone synced today and at what time, or when it last synced. Never your step numbers, unless they also play on your team, when they see them as any teammate does.

We'll never share it any other way, or use it for anything else, without asking you first, separately.

Service providers that process it on our instructions, under contract:

• Supabase (database and servers, US), which stores it.
• Expo, Apple and Google, which deliver notifications carrying team names and team scores (the 9:00 result).
• Resend, which delivers the end-of-season email with your team's results, and Rallyday's own daily safety email (team results, and the account numbers of deletion requests).

We have no affiliates that receive consumer health data.

We may also disclose it if the law requires it (for example, a valid court order).

You can:

• confirm whether we have your consumer health data and get a copy, including a list of every third party and service provider it has gone to, with how to contact them;
• withdraw your consent: to stop us collecting it, turn off Rallyday's Health access in your phone's settings (you'll stop counting in the league). To stop us sharing it, delete your account or email us: your teammates stop seeing your past daily totals at once, and you leave the league. Results already published stay, without your name (see below);
• delete it: in the app (More › Account › Delete account), at joinrallyday.com/delete-account, or by email. We delete your readings from our systems and tell our service providers to delete it; it leaves our backups within 7 days. One exception: the season's published results for days you played keep your daily totals for those days (the raw total and the capped total that counted), under a season membership number no longer linked to you, so published results never change. We won't try to re-identify them.

How: email privacy@joinrallyday.com from the address you sign in with (so we know it's you), or use the app. You don't need to create an account. We answer within 45 days; if we need longer (up to another 45 days), we'll tell you why. Requests are free up to twice a year. We won't treat you differently for using these rights.

Appeal: if we turn down your request, reply to our answer within 30 days to appeal, and we'll respond within 45 days. If we still say no, you can contact the Washington State Attorney General (https://www.atg.wa.gov/file-complaint) or, in Nevada, the Nevada Attorney General (https://ag.nv.gov/Complaints/File_Complaint/).

• Sell your consumer health data.
• Use it for advertising or marketing.
• Use location or set up "geofences" (Rallyday collects no location at all).
• Collect or share it beyond § 1 and § 4 without updating this policy and asking you again first.

If we change what we collect, why, or who receives it, we'll update this policy and ask for your consent again before the change applies to you.

Contact: Boop Technologies, LLC (Rallyday) · 1207 N Landing Way #1061, Renton, WA 98057 · privacy@joinrallyday.com