This policy explains how Based Health LLC ("we") collects, uses, and shares consumer health data, and how you can see it, delete it, or withdraw your consent. It is written for Washington's My Health My Data Act and applies to everyone we work with, wherever they live. Our general privacy notice is separate.
We are a consulting practice, not a medical provider, and we are generally not a HIPAA covered entity. So HIPAA may not protect the health information you give us, and this policy and the laws behind it do.
What we collect, and why
Health history and goals you tell us. From the intake form, check-ins, emails, uploads, and calls: health conditions and family history, medications and supplements, symptoms, sex assigned at birth and hormone or menstrual status, sleep, training, nutrition, stress and mental health, and your goals. We use it to prepare your analysis, protocol, and check-ins, and to flag anything you should take to your doctor.
Test results. Blood test results, DEXA body-composition scans, Omega-3 Index results, genetic results you choose to share, and other health records you send us. We use them to prepare your analysis and report, and to track your results over time on your private client page.
Measurements you record. Home blood pressure, resting heart rate, grip strength, VO2max test results, and waist size. We use them the same way as test results.
Daily wearable summaries, only if you give separate consent. Daily totals for steps, exercise and workout minutes, sleep times and duration, resting heart rate, and heart rate variability, sent from your phone. We use them only to prepare your check-ins and show your progress on your client page.
What we conclude. Our analysis of your data, your risk estimates, our recommendations, and notes from our calls. Calls may be recorded and transcribed so that we can write these notes. We use them to deliver and follow up on our services.
That you are a client. Your name, email, the services you buy, and your appointments, which can show that you sought health services. We use them to schedule, bill, and contact you.
From website visitors. Anything you write to us in the contact form, which we use only to reply. We do not use website visits to infer anyone's health.
De-identified results, only if you opt in. With your separate opt-in on the consent form, we remove your name and other identifying details from your records and compare them across clients to learn what works and to test analysis tools.
Where it comes from
- From you: forms, emails, uploads, calls, and messages.
- From labs and testing facilities that perform tests we order for you or that you arrange.
- From the app on your phone that sends daily wearable summaries, if you consent.
- From our own analysis of the above.
Who receives it
We do not sell consumer health data. We do not share it for advertising, and we do not share it with any affiliated company.
Service providers. These companies process data for us, under their terms, to help us deliver our services:
- Website hosting and database: Vercel and Neon.
- Email, documents, and file transfer: Google Workspace and Resend.
- Forms and electronic signatures: Tally.
- Scheduling: Cal.com.
- Payments: Stripe. Stripe receives payment details and what you bought, not your test results.
- AI model providers that read lab documents and help prepare analyses: OpenAI and Anthropic, and occasionally Fireworks. We turn off model training on what we send to OpenAI and Anthropic.
- Call notes: a call notes service, which records and transcribes our calls.
- Training coaching: Telegram, if you choose to be coached there. Your coaching chat, with what you tell us about your training, injuries, and health, passes through Telegram.
- Practice tools that we use to run the practice: Todoist for tasks and Telegram for messages to Tyler, which can include your name and client details.
Your client files stay on Based Health's own computers.
Others, only to provide what you asked for, or as the law requires.
- Lab-ordering platforms and labs, when we order tests for you: Fullscript (and Rupa Health for earlier orders) and the labs that perform your tests. They receive what is needed to fill the order, such as your name, date of birth, contact details, and the tests ordered.
- Anyone you ask us to send your information to, such as your doctor.
- Government authorities, when the law requires it.
If we ever want to share your consumer health data for any other reason, we will first ask for your separate consent.
Your rights
You can ask us to:
- Confirm and show you the consumer health data we hold about you, with a list of every third party and service provider that received it and how to contact them.
- Delete your consumer health data. We delete it from our systems and tell our service providers and the third parties that received it to delete it too. Copies in backups are deleted within six months.
- Withdraw your consent at any time, including your wearable consent or your de-identified results opt-in. After you withdraw, we stop collecting that data. Wearable summaries are deleted within 30 days.
To make a request, email support@basedhealthconsulting.com from the address we have on file for you, or tell us another way to confirm that it is you. You do not need an account. We answer within 45 days. If we need more time, we will tell you why, and we will answer within 45 more days. Requests are free up to twice a year.
Appeals. If we decline your request, you can appeal by replying with "Appeal" in the subject line. We answer within 45 days and explain our decision. If we deny your appeal, you can contact the Washington State Attorney General at atg.wa.gov/file-complaint.
Changes
If we start to collect a new kind of consumer health data, or want to use or share it for a new purpose, we will update this policy and ask for your consent first.
Effective October 11, 2026.