Nostos

Nostos Consumer Health Data Privacy Policy

Effective date: October 10, 2026 Last updated: October 11, 2026

This policy describes how the Nostos team ("Nostos," "we," "us"), based in India, which operates the Nostos iOS app and the nostos.fit website, collects, uses, shares and deletes consumer health data. It is written for the Washington My Health My Data Act (RCW 19.373), Nevada's consumer health data law (SB 370, NRS Chapter 603A) and Connecticut's consumer health data provisions of its Data Privacy Act. We apply it to all US users, wherever they live.

"Consumer health data" means personal information that is linked or reasonably linkable to you and that identifies your past, present or future physical or mental health status. We treat all of the information listed in §1 as consumer health data, even where a law might not.

Our general Privacy Policy covers everything else. If the two seem to differ on consumer health data, this policy controls.

1. Categories of consumer health data we collect

  1. Daily activity and body measurements from Apple Health, only if you allow access, and only for the metric your active challenge uses: daily step count, active energy (active calories), exercise minutes, resting heart rate, or hours asleep. We read one total per day. We do not read individual samples, workouts, locations or any other Health data, and we never write to Apple Health.
  2. Daily goal results: for each challenge day, the date, the metric, that day's total, your target, and whether you met it; plus the FitCoins and streaks that result.
  3. Health-related goals and habits you choose and record yourself: the habits and challenges you join (for example "walk 2,000 steps" or "sleep 7 hours"), their targets, and the days you check in.
  4. Goal-related usage records: in-app analytics records saying which type of goal a challenge or check-in involved and whether the goal was met. These records never contain the health readings themselves. You can turn analytics off at any time.
  5. Your health-data consent status: whether you agreed to Nostos's health-data screen.
  6. Health information you choose to tell us in feedback or emails, if any.

2. Purposes for which we collect and use it

We collect and use consumer health data only to:

We do not use consumer health data for advertising, marketing, data mining, profiling or any decision with legal or similarly significant effects. We will not collect a new category of consumer health data, or use it for a new purpose, without telling you first and getting your consent.

3. Sources

We do not get consumer health data from data brokers, advertisers or any other third party.

4. How we get your consent, and how to withdraw it

Before Nostos reads anything from Apple Health, it shows you its own screen explaining what it reads and why, and then the iPhone's Health permission sheet, where you choose which data types to allow. Nothing is read unless you agree on both. If you tap "Not now," you can still use habits you check in yourself.

To withdraw consent:

5. Categories of consumer health data we share, and with whom

We do not sell consumer health data, and we do not share it with anyone for their own purposes. The only parties that handle it act as our processors (service providers), under contract, only to provide their service to us:

Third party (category) Consumer health data involved Why
Cloudflare, Inc. (network and security provider) All categories in §1 that are sent to our server, encrypted while passing through its network Carries traffic between the app and our server
Our email provider (email hosting) Only health information you choose to include in an email to us Stores our email

Our database is on a server in India that we operate ourselves, and is accessed from India by the founder.

We have no affiliates. We may also disclose consumer health data if the law requires it (for example, a valid court order). Gift-card providers (Amazon, and Tremendous if used) and Apple or Google sign-in receive no consumer health data from us.

Other commitments:

6. Your rights

You have the right to:

  1. Confirm whether we collect, share or sell your consumer health data.
  2. Access your consumer health data, including a list of all third parties and affiliates we've shared it with or sold it to, and an email address or other online way to contact them. (We've never sold it; the full list of recipients is in §5.)
  3. Delete your consumer health data.
  4. Withdraw consent to our collection and sharing of your consumer health data, which stops further processing.
  5. Review and request changes to your consumer health data if you think it's inaccurate.

How to use these rights

Verification: we confirm the request comes from you by checking you control the email address or account. If we can't verify a request, we'll tell you why.

Timing: we respond within 45 days of receiving your request. If we reasonably need more time, we may extend this once by up to 45 more days and will tell you why within the first 45 days. Nevada residents: we act on authenticated requests within 45 days, and we complete deletion and notify our processors within 30 days.

Deletion: when we delete, we remove your consumer health data from our live systems immediately (in-app) or within 30 days (by email), and from our backups within 30 days, as backups are overwritten. We tell our processors to delete it too. Goal-related usage records are no longer linked to you after your account is deleted: they stay only under a random install ID, and we commit not to try to re-identify them.

Cost: free, up to two requests per year. For requests that are clearly unfounded, excessive or repetitive, we may charge a reasonable fee or decline, and we'll explain why.

Authorized agents: someone you authorize in writing may make a request for you. We may still verify the request with you directly.

No discrimination: we won't deny you the service or treat you differently for using these rights.

7. Appeals

If we decline your request, in whole or in part, you can appeal by replying to our decision or emailing [email protected] with "Appeal" in the subject. We'll respond within 45 days and explain our decision in writing. If we deny your appeal, you can contact:

8. Changes to this policy

We'll post any change here and update the "Last updated" date. Before a material change takes effect (for example, a new category of consumer health data, a new purpose, or a new type of recipient), we'll tell you in the app or by email and ask for your consent where the law requires it.

9. Contact

The Nostos team [email protected]

Effective date: October 10, 2026