Consumer Health Data Privacy Policy

Last updated: September 23, 2026

This page explains how Outliyr LLC handles your health information when you use your Outliyr account: the member dashboard, the Outliyr mobile apps, and the tools that save to your account. It follows Washington’s My Health My Data Act and Nevada’s consumer health data law (SB 370).

Our Privacy Policy covers everything else we do. The free Supplement Finder has its own page: Supplement Finder Health Data Policy.

“Consumer health data” means information that is linked to you and says something about your physical or mental health. That includes things we work out from your data, not just what you type in.

What we collect

What we collect depends on the features you use. It can include:

What you tell us: symptoms, goals, notes, measurements, sleep, energy, stress, recovery, fasting, journal entries, and other check-ins.
What you try: supplements, medications, devices, and protocols, plus how well you stick to them, what happens, side effects, photos, and any sponsored trial you join.
Labs, genetics, and scans: lab results, genetic test files you upload (such as 23andMe or AncestryDNA), clinical records you import from Apple Health, and Mirror photo results.
Wearable and sensor data: heart rate, heart rate variability, sleep, activity, blood glucose, blood pressure, breathing sessions, and weather for your general area.
Voice and cognition data, only if you turn those features on: voice recordings, voice features, a voice age estimate, and cognitive test results.
What we calculate about you: scores, trends, links between your habits and results, recommendations, insights, and comparisons with groups of other members.
Coaching information, if you work with a coach: notes, goals, assignments, and the data areas you share.
How you use Outliyr: saved items, ratings, feature use, and messages that could show your health interests.

Where it comes from

You, when you type, upload, or record something.
Your use of Outliyr features.
Devices and apps you connect: Oura, Whoop, Ultrahuman, Apple Health, and Android Health Connect.
A coach you connect with.
Apple or Google, if you sign in with them. They send account details, not health data.
The U.S. National Weather Service, for weather in your general area if you turn that on.
Our own calculations based on all of the above.

Why we use it

To give you the tracking, analysis, experiments, summaries, and recommendations you ask for.
To connect and keep in sync the devices, apps, and coaches you choose.
To calculate your scores, trends, and personal insights.
To run, secure, fix, and support Outliyr.
To improve our scoring formulas, only if you turn on “Help improve Outliyr’s scoring.” That setting uses measurements with your identity removed, only in groups of at least 10 members.
To keep records of your consent, meet legal duties, and stop abuse.

If we want to use your health data in a new way, we will update this page and ask for your consent first when the law requires it.

Who we share it with

We do not sell your consumer health data. We do not share it with any affiliate company.

Apart from the companies listed in the next section, which help us run Outliyr, we share it only when you choose to:

A coach you connect with sees only the data areas you grant. You can remove a coach’s access at any time in Privacy & Security.
A trial sponsor. No sponsor receives your data today. If you join a sponsored trial, the sponsor gets only group results from groups of at least 10 people, unless your trial consent clearly says more.
Anyone you send an export or share card to.

Companies that help us run Outliyr

These companies handle your information so we can run Outliyr. Here is what each one gets.

Hetzner hosts our servers, where your account and health data live.
Cloudflare delivers and protects our site. It also stores Mirror photos and Voice recordings while we process them (see how long we keep them below), holds our encrypted server backups, and can run some AI requests.
Google Drive stores copies of our website database backups.
Groq, Cerebras, and OpenRouter (plus the AI model companies OpenRouter picks, with data collection turned off) receive the health details an AI feature needs when you use it. That covers chat, insights, recommendations, summaries, and reading your lab reports or Mirror photos.
Your own AI provider. If you add your own API key under Me, then Advanced, the company you pick (OpenRouter, Google AI Studio, Cerebras, Groq, or DeepSeek) handles those requests under your account and its own terms.
Emailit sends our email, with Amazon SES as a backup. Some emails you choose to get include your own health data, like the weekly digest with your HRV and sleep averages.
Kit runs our newsletter and referral program. It gets your email address, first name, and signup and newsletter tags, not health data.
Apple and Google push services get a device token and a short notification message for the alerts you turn on.
Stripe, ThriveCart, the Apple App Store, and Google Play handle payments. They get purchase and account details, not health data.
Notion gets the name of an intervention and your note, only when you ask us to review a custom intervention.
Slack gets our internal error alerts. These include an account number and the page where the error happened, not health data.
The U.S. National Weather Service gets a location rounded to about 35 miles, with nothing that identifies you, if you turn on weather context.
Usercentrics and Termageddon run our consent banner and host our privacy policy.
Google Analytics, Google Analytics for Firebase, and Firebase Crashlytics. See the next section.

Analytics and tracking

We use Google Analytics on our website, including the pages you see when signed in. Our mobile apps use Google Analytics for Firebase and Firebase Crashlytics.

Google receives the pages and screens you visit, feature events (for example, that you set a goal, uploaded a lab report, or started an experiment), and crash reports. Page addresses and events can show which tools or topics you used. We do not send Google Analytics the text of your notes or your lab or wearable readings.

Google may collect information about your activity on our site over time and across other websites. A browser or extension that blocks trackers can stop this.

How long we keep it

Your account data: kept while your account is open, unless a shorter period below applies. We do not delete it just because time passes.
Mirror photos: deleted after we analyze them. A capture you don’t finish is removed after 24 hours.
Voice recordings: deleted once we pull out your voice features. If that step fails, the recording can stay until you withdraw your voice consent or delete your account.
Voice transcripts: kept 7 days, or 90 days if you choose the longer setting.
Sponsored trial photos: kept 90 days.
Voice features and scores: deleted when you withdraw your voice consent or delete your account.
Account deletion: finishes 90 days after you ask, so you can change your mind.
Records we must keep: consent, billing, fraud, and security records may be kept when we need them for legal, tax, dispute, or security reasons.
Backups: deleted information can stay in backup copies until those copies are removed.

Your rights

If you live in Washington or Nevada, or we collected your health data while you were there, you can:

Confirm whether we collect, share, or sell your consumer health data.
Get a copy of your consumer health data.
Get a list of every third party we shared it with, with their contact details.
Withdraw your consent to us collecting or sharing it.
Have it deleted. We also tell the companies and people who received it to delete it.
Appeal if we turn down your request.

These requests are free.

How to use your rights

If you have an Outliyr account: open Me, then Privacy & Security, then Your health data. Tap Request my data, Request third-party list, or Request health-data deletion. Each request shows the date you sent it, the date our answer is due, its status, and our written answer.

Without an account, or if you prefer email: write to support@outliyr.com with the subject “Consumer Health Data Request.” Tell us which right you want to use and the email tied to your data. Don’t send health records, passwords, codes, or ID documents by email. We may ask for a few details to confirm it’s really you.

Timing: we answer within 45 days. If we truly need more time, we may extend that once by up to 45 more days and will tell you why. For Nevada deletion requests, we delete within 30 days after we confirm your request.

Appeals

If we turn down a request, tap Appeal decision next to it in Privacy & Security, or email support@outliyr.com with the subject “Consumer Health Data Appeal.” We answer appeals in writing within 45 days.

If we deny your appeal, you can contact the Washington State Attorney General or the Nevada Attorney General.

Withdrawing consent is not the same as deleting

Stop collection: members we identify as being in Washington see a Withdraw button under “Consumer health data collection” in Privacy & Security. It stops new health data from saving to your account until you consent again. Anyone else can email us to withdraw consent.
Stop sharing: remove a coach’s access in Privacy & Security, or email us.
Delete what we have: withdrawing consent does not erase data you already saved. To erase it, send a deletion request or delete your account.

How we protect it

We use technical and administrative safeguards to protect your health data, and we limit who on our team can reach it. No system is perfectly secure, so we can’t promise that nothing will ever go wrong.

Changes to this page

When our health data practices change, we update this page and the date at the top. If a change means collecting, using, or sharing your health data in a new way, we will ask for your consent first when the law requires it.

Contact

Outliyr LLC, 1500 E Riverside Dr, Austin, Texas 78741. Privacy requests: hello@outliyr.com. Support and deletion requests: support@outliyr.com.