Consumer Health Data Privacy Policy

Version of 16 October 2026 · The separate consumer health data privacy policy Milewise maintains under the Washington My Health My Data Act (chapter 19.373 RCW) and the Nevada consumer health data provisions (NRS 603A.400 to 603A.550). Everything else is in the Privacy Policy. The rights described here belong to consumers in Washington and in Nevada. This English version is the operative one, and requests under these Acts are handled in English.

1. Who we are
2. What we collect, and what we use it for
3. Categories of sources
4. What is shared, and with whom
5. No sale, no geofence
6. Your rights, and how to exercise them
7. If you are in Nevada
8. Changes to this policy

1. Who we are

Milewise is operated by Moritz Niedermann, Essenweinstr. 37, 76131 Karlsruhe, Germany, contact@milewise.de. A sole proprietorship with no affiliates.

2. What we collect, and what we use it for

• Vital signs and body measurements: heart rate, including per-point heart rate during a workout; heart-rate variability; resting heart rate; respiratory rate; blood oxygen; weight; height; body composition; VO2max; threshold heart rate and pace; functional threshold power; heart-rate zones.
• Sleep: time asleep and time in bed, the split into deep, REM, light or core and awake, and your source’s sleep or recovery score.
• Wellness you log yourself: mood, motivation, soreness, fatigue, an all-day stress score your source computes, steps, calories, and free text describing an injury.
• Workouts and where they happened: duration, distance, pace, power, cadence, elevation, calories, average and maximum heart rate, and the route, including the full track inside any file you upload or record and inside the original files we keep from intervals.icu. We treat precise location as consumer health data here.
• What you write, and your calendar titles: coach chat, workout notes, goals and constraints, including anything you say about an injury, an illness, a symptom, medication or a clinician; and, if you connect a calendar, the entry title, date and start and end time. Locations, descriptions and organisers are never read. Of the guest list we read only whether you yourself declined, and we keep none of it.
• What we and the coach infer: readiness, fitness, fatigue and form figures, coach notes filed under injury, health and safety, the daily brief, the plan and its reasoning, and the coach’s replies about your training and recovery.

It is used only to run the coaching service you asked for: showing you your training and recovery, computing readiness and load, building and adjusting your plan, and producing coaching replies and summaries. Where a fault has to be reproduced on your account, the operator can switch on a support copy; section 4 says who then reads it. We collect and share only as far as that service requires, or with your consent, asked for separately and never bundled into an acceptance of our terms. We do not use consumer health data for advertising, marketing, profiling, tracking or training AI models.

3. Categories of sources

• Sports and wearable accounts you connect: intervals.icu, Strava, Polar, Suunto. intervals.icu is an aggregator, so a watch that sent its data to another platform reaches us through it.
• Your phone’s health store, if you switch it on: Apple Health on iPhone, Health Connect on Android.
• Your phone’s sensors while you record: satellite positioning, barometer, step counter, and any Bluetooth heart-rate, cadence, speed or power sensor you pair.
• Workout files you upload, and you, through what you type.
• Your calendars, if you connect them: Google Calendar, read when the coach needs it, and your phone’s calendar, which the app sends and we store.
• Us, through what the app computes and the coach writes.

4. What is shared, and with whom

Every category in section 2 goes to the providers below, only as far as running the service requires.

• AI coaching processors: cloud artificial-intelligence and model providers in the technology sector that produce the coach’s replies, plans and analyses, namely Mistral AI, Microsoft Azure OpenAI, Amazon Web Services Bedrock and Google Cloud Vertex AI. They receive your profile, goals, plan, notes, chat text, the values the coach reads for that reply, route coordinates when it asks for them, and calendar titles. Not your name or email address: the identifier they see is an internal number. Strava-recorded data is never sent.
• Hosting and backup: an infrastructure provider in Germany holding every category in section 2, and the encrypted off-site store holding our backups.
• Support access: where the operator switches on the support copy from section 2, the AI development assistant the operator works with can read that account’s coach transcripts, wellness rows, calendar titles and workouts, so its provider receives them.
• Email delivery, when you ask for a copy of your data: our outbound mail passes through a relay, carrying that copy as an attachment.
• Weather, time-zone, place-name and map-tile services: rounded coordinates and no account identifier. Your browser or app fetches map tiles itself, so that service sees your IP address and the map area.
• The training platform you connect yourself, at your request and only while the switch is on: the planned sessions the coach writes onto your calendar there, your training zones and threshold, a guide for your watch, and, if you turn that on separately, an activity file or an edited title.
• The calendar service you subscribe with, if you add our feed to it: that service then polls the address regularly and receives your training history and your plan with titles, times and distances. You choose it, and we cannot see or limit what it does with what it receives.

Names and countries are on our recipients list; on request we give you that list with a contact route for each recipient.

5. No sale, no geofence

We do not sell consumer health data. We operate no geofence around any facility providing health care.

6. Your rights, and how to exercise them

You may confirm whether we collect, share or sell your consumer health data and get a copy, with a list of every third party it was shared with and a contact route for each; withdraw consent to our collecting and to our sharing it; and have it deleted.

How. In the app, open the You tab and then Privacy: “Email me my data” sends a copy to your verified address, one click withdraws a consent, and “Delete my account” deletes the account and its data. Withdrawing the wellness consent alone erases the nights your phone and Suunto sent us, the workouts from your phone’s health store, your phone’s calendar entries, and the wellness days and Garmin workout files we keep from intervals.icu. You never have to create an account to make a request: without one, write to contact@milewise.de, and we check that address against the account. Responding is free of charge; only a manifestly unfounded, excessive or repetitive request can attract a reasonable fee, and a request never worsens your service.

Our clock. Within 45 days of receiving your request, extendable once by 45 further days where reasonably necessary; if we extend, we tell you inside the first 45 days, with the reason. Nevada’s clock differs, see section 7.

Deletion. We delete from our live records and from every part of our network, and we withdraw the authorisations you gave the services you connected. Planned workouts written to your intervals.icu calendar go first. We do not ourselves direct the recipients in section 4 to delete their copies; ask us, and we pass your deletion request to any of them you name and tell you when we have. In our encrypted off-site backups your data disappears as snapshots rotate out, which can run to about seven months; within six months of the day we authenticate your request the operator removes any snapshot that still holds it. One model provider we use screens requests for abuse, and flagged content can sit in a store we can neither inspect nor purge.

Appeal. If we refuse a request, appeal by replying to our answer or writing to contact@milewise.de with “appeal” in the subject. We answer in writing within 45 days, with reasons. If we deny an appeal we also give you a way to complain to your own Attorney General: in Washington the form is at atg.wa.gov/file-complaint, and in Nevada at ag.nv.gov/Complaints/File_Complaint.

Our processors. Our AI providers, our hosting and backup provider and our mail relay are bound by processor contracts under RCW 19.373.060. For the provider of the development assistant there is no processor contract at all. How we secure the data is in the Privacy Policy.

7. If you are in Nevada

Nevada grants the same rights and adds the following.

• Our clock: no later than 45 days after we authenticate your request, extendable once by up to 45 further days; if we extend, you get notice and the reasons inside those first 45 days (NRS 603A.510).
• Deletion: within 30 days of authenticating the request we delete the data. We do not ourselves direct the recipients in section 4 to delete their copies; ask us, and we pass your request to any of them you name (NRS 603A.515).
• Reviewing and changing your data: in the app. Profile, zones and thresholds, a workout’s name, sport and note, goals, plan sessions and coach notes are editable, and you can delete a single workout or a whole conversation. A value that keeps arriving from a connected account is corrected there and replaces ours at the next sync. A value you delete on intervals.icu stays in the wellness days we keep from there until you withdraw the wellness consent, delete your account or have the recovery data deleted when you disconnect intervals.icu.
• How it is processed: on servers in Germany, by automated software; the only person who reads it is the operator, for support and fault-finding.
• Third parties collecting over time and across websites: none. The one third-party request a Milewise page makes is for map tiles, described in section 4.
• Effective date: the version date at the top of this page.

8. Changes to this policy

We will not collect, use or share a category of consumer health data, or use it for a purpose, that this policy does not name, without first updating this policy and, where the law requires it, obtaining your consent. A material change carries a new date at the top of this page, and we tell account holders in the app and by email before it takes effect. Questions: contact@milewise.de, or by post to the address in section 1.