Consumer Health Data Privacy Notice

last updated 15th October 2026

This Consumer Health Data Privacy Notice supplements the Univa Health Privacy Notice (United States) above and provides the additional information required by Washington’s My Health My Data Act and Nevada’s consumer health data privacy law (SB 370).

“Consumer health data” means personal information that is linked or reasonably linkable to you and that identifies your past, present or future physical or mental health status.

A. Consumer health data we collect

• information about eating difficulties, eating disorders and related mental health, including symptoms, diagnoses you tell us about, and the reason you are using Univa;
• diaries, logs and questionnaire answers about eating, mood, thoughts, behaviors, goals and progress, and measurements such as weight if you choose to enter them;
• information about your care, treatment and treating team;
• notes, messages, photos, audio and video you record in the app that relate to your health;
• information a parent or caregiver records about the health of the person they care for; and
• information about how you use health-related features of the Service, to the extent it reveals health status.

B. Sources

We collect consumer health data directly from you when you create an account, use your program, complete questionnaires, record diaries, or contact us; from your parent, guardian or caregiver; and from your healthcare provider if they refer you.

C. Why we collect and use it

• Service delivery: to create your account, deliver and personalize your program, track your progress, support you, and keep the Service secure and reliable;
• Safety: to identify risk and, where we are seriously concerned, contact you, your emergency contact, your parent or guardian, your care team or emergency services;
• Care coordination: to report to your referring care team, where a provider referred you;
• Quality and improvement: to review and improve the safety and quality of our programs, using de-identified data wherever possible;
• Research: using de-identified data, or identifiable data only with your separate consent; and
• Protection and compliance: to detect and prevent security incidents and misuse, to protect the rights and safety of Univa, our members and others, and to meet our legal obligations.

We use consumer health data for other purposes only with your consent. We do not sell consumer health data, and we do not use it for advertising.

D. Who we share it with

We share consumer health data only as necessary for the purposes above, with the following categories of recipients:

• our affiliate, Univa Health Ltd (United Kingdom), for support, safety, clinical quality and engineering;
• service providers acting on our behalf under contract — cloud hosting (Amazon Web Services), messaging providers, customer support tools, and our product analytics provider (which receives usage events but not the content of your health data);
• your care team, if you ask us to;
• your parent, guardian or caregiver, if you are under 18 or they support your care;
• emergency services and your emergency contact, if we are seriously worried about your safety;
• legal authorities, where required by law; and
• a buyer or successor in a corporate transaction, which will remain bound by this notice.

A current list of the specific affiliates and third parties with which we share consumer health data is available on request at dataprivacy@univa.health.

E. Your rights

You have the following rights with respect to your consumer health data:

• Right to Access/Know – you can ask us to confirm what consumer health data we hold about you and to receive a list of all third parties and affiliates that we have shared or sold consumer health data.
• Right to Delete – you have the right to request we delete your consumer health data.
• Right to Withdraw Consent – You may withdraw your consent for the collection, processing, or sharing of your consumer health data.
• Right of Non-Discrimination – We will not treat you differently, charge you more, or lower the quality of the Service because you exercised a privacy right.

To exercise these rights, email dataprivacy@univa.health. We will verify your identity and respond within 45 days (extendable once by 45 days for complex requests). If we deny your request, you may appeal by emailing dataprivacy@univa.health with “Consumer health data appeal” in the subject line; we will respond within 45 days. If your appeal is unsuccessful, you may contact your state Attorney General:

• Washington: www.atg.wa.gov/file-complaint
• Nevada: ag.nv.gov/Complaints