Privacy Policy
Overview
RTK Health is a pseudonymous health tracking service. Your identity within the service is a cryptographic hash — we never ask for your name, phone number, or physical address. You can sign in with a cryptocurrency wallet, Google account, Apple account, or email magic link; regardless of which method you choose, the user record attached to your data is identified by a hash, not your email or real-world identity.
Email is optional profile data. If you sign in with Google, Apple, or an email link, we store your email in a profile field used exclusively for weekly summary delivery and sign-in. Email is stored separately from your health data, never sold, never shared with advertisers, and clearing the field opts you out instantly without affecting any other part of your record.
What We Collect
- Internal identity hash (derived from your sign-in method; pseudonymous)
- Health profile (age, sex, height, weight, activity level, medical history, allergies, medications)
- Health log entries (vitals, nutrition, sleep, workouts, symptoms)
- Uploaded files (fitness data, blood panels, cycle tracking)
- Connected tracker data (Fitbit, Whoop, Oura — synced automatically when connected)
- AI analysis results
- Email address (optional) — only if you provide one for sign-in or weekly summary delivery. Stored separately from health data; never sold; clear the field in your profile to opt out.
What We Do NOT Collect
- Names, phone numbers, or physical addresses
- Wallet private keys or seed phrases
- IP addresses for identification
- Tracking cookies or advertising identifiers
- Any contact info beyond the optional email — and even that, only if you choose to provide it
How We Use Your Data
Primary: To provide the RTK Health service — storing logs, generating AI analyses, displaying dashboards.
AI Processing: When you use an AI feature (health analysis, the AI coach chat, meal-photo estimation, or AI document parsing), the health data relevant to that request is sent to Anthropic (the Claude AI service), our third-party AI provider, to generate your result. We ask for your permission in the app — naming Anthropic and describing what is sent — before any health data is sent for AI processing the first time, and you can withdraw that permission at any time in Profile → Data & Privacy. Data is sent under your pseudonymous identifier, never your name or contact information. Anthropic does not use data submitted through its API to train its models and retains it only for a limited period for abuse monitoring; it is contractually bound to protect this data at a level comparable to the protections described in this policy. If you do not grant permission, AI features remain off and the rest of the app continues to work.
Research & licensing — only if you opt in: RTK Health includes two optional, separate, default-OFF opt-ins. Nothing in the app is conditioned on them, you can withdraw either at any time in Profile → Privacy & Data, and each expires after 12 months. If you opt in: (1) Research & study matching — we may include your de-identified data in research datasets and match you to (often paid) studies you may qualify for (you separately decide whether to enroll, under that study's own IRB-approved consent); and (2) Commercial licensing — we may license or sell de-identified, aggregated data (group statistics, never identifiable records) to research and commercial partners for a fee. We license aggregated group statistics only; we do not currently license individual-level records, and any future individual-level licensing would require its own separate opt-in.
De-identification: Before any data is used for research or licensing, we strip your identity hash, email, and other identifiers and de-identify it using the HIPAA Expert Determination method (a qualified expert confirms a very small risk of re-identifying anyone) — which we use rather than identifier-stripping alone because movement-capture and biometric data can be individually distinctive. Every recipient is contractually barred from re-identifying or re-disclosing the data.
Optional reimbursement: If you opt into commercial licensing, you may provide a wallet to receive optional reimbursement in USDC (Base network) if your aggregated data is included in a paid license. It is optional and not guaranteed; no reimbursement has been paid to date.
Email (only if you opt in or sign in with it): When an email is associated with your account we use it solely for (a) sign-in via magic-link, and (b) weekly summary delivery via our transactional email provider (Resend). Your email is not added to any marketing list, not shared with any third party beyond the delivery provider, and is removed the moment you clear it from your profile.
We will never sell or share data that identifies you — your identity hash, email, or any field that could reasonably link a record to your real-world identity. We will never share records with advertisers, use your email for marketing, or use your data to train our own AI models; our data-license agreements also prohibit licensees from using the licensed data to train AI models on data attributable to you.
Your Choices & Rights
The research and commercial-licensing programs above are strictly optional, off by default, and require your affirmative opt-in. You can withdraw either choice at any time in Profile → Privacy & Data, and each opt-in expires after 12 months. Nothing in the app is ever conditioned on these choices, and we will not deny you any feature or charge you differently for opting out.
Subject to applicable law — including the California Consumer Privacy Act (CCPA/CPRA) and Washington's My Health My Data Act — you may request to access, correct, delete, or port your data, and you may withdraw consent to its collection and sharing. Because we identify you only by a cryptographic identifier, you exercise these rights by demonstrating control of that identifier (and your email, if you provided one). To make a request, contact rtkmotion.io/contact.
Third-Party Integrations
| Service | Purpose | Data Shared |
|---|---|---|
| Cloudflare | Hosting & Database | All app data |
| Anthropic (Claude) | AI analysis, coach chat, meal-photo & document AI (only after your in-app permission) | Health data per request, under your pseudonymous ID; not used to train AI models |
| WalletConnect | Wallet connection (if used) | Wallet address only |
| Google Identity Services | Google sign-in (if used) | Verified email + Google subject ID |
| Apple Sign In | Apple sign-in (if used) | Apple subject ID + optional email |
| Fitbit | Fitness data sync | Read-only health metrics |
| Whoop | Recovery / strain sync | Read-only health metrics |
| Oura | Readiness / sleep / HRV sync | Read-only health metrics |
| USDA FoodData Central | Food calorie / macro lookup | Food name only (no user identity) |
| FDA OpenFDA | Medication side-effect labels | Drug name only (no user identity) |
| Resend | Magic-link + weekly summary email delivery | Your email + message text only |
Body Scans & Biometric Data
The optional Body Scan feature (Premium) processes a 360° video of your body — which necessarily includes your face — to compute your body measurements and a 3D body model ("avatar"). This is our written policy for that data.
Consent before collection: a scan is collected and processed only after your explicit in-app consent at the point of capture, describing what is collected, why, and for how long. Use of your scan to improve our body-scan model is a separate, optional, default-off consent.
Purpose limitation: scan data is used only to build your avatar, compute your measurements, and track changes over time (plus model development only under that separate consent). We never perform facial recognition; your face appears only because a full-body capture necessarily includes it, and once processing completes we automatically blur faces in the stored video so the retained copy carries no recoverable facial imagery.
Retention & destruction schedule: your scan video, body model, and measurement records are kept while the scan exists in your account, and are permanently destroyed — including the underlying stored files — when you delete the scan or your account, and in any event no later than three (3) years after your last interaction with the Service, whichever comes first.
No sale — ever: we will never sell, lease, trade, or otherwise profit from your scan video, body model, or body measurements, in identifiable, de-identified, or aggregated form. Scan data is excluded from the research/licensing opt-ins by a hard-coded rule; no consent setting can include it.
Disclosure: the scan video is never shared with anyone. Your avatar and measurements are visible only to you unless you enable coach sharing for body scans (avatar + measurements only — never the video) or grant per-scan support access; both default-off and revocable.
Data Retention & Deletion
Active accounts: data retained for life of account. Deletion: within 30 days of request. Body-scan data follows the stricter schedule above. Contact rtkmotion.io/contact.
GDPR & International Users
Your internal identity hash is pseudonymous personal data under GDPR. You have the right to access, rectify, erase, restrict, and port your data. Contact us to exercise these rights.
HIPAA Considerations
RTK Health is not a HIPAA-covered entity. We voluntarily follow HIPAA principles where applicable: minimum-necessary access, secure transmission, and — for any research or licensing use — de-identification using the HIPAA Expert Determination method (45 CFR §164.514), under which a qualified expert determines the risk of re-identifying anyone is very small, before records leave the operational service. We use Expert Determination rather than identifier-stripping alone because movement-capture and biometric data can be individually distinctive, and we additionally aggregate data into group statistics before licensing.
Children's Privacy
RTK Health is not intended for individuals under 18. We do not knowingly collect data from minors.
Contact
Questions? rtkmotion.io/contact