In this Consumer Health Data Privacy Policy (“Policy”), we describe how Tam(squared) Inc., doing business as Paceline (“Paceline,” “we,” “us,” or “our”), collects, uses, discloses, and otherwise processes consumer health data that is protected under the Washington My Health My Data Act and the Nevada Consumer Health Data Privacy Law (collectively, “US State Consumer Health Data Privacy Laws”) through our websites, mobile applications, products, services, rewards programs, partner programs, and related offerings (collectively, the “Services”).

This Policy supplements our main Privacy Policy available at https://paceline.fit/pages/privacy-policy. If there is a conflict between this Policy and our main Privacy Policy regarding consumer health data subject to US State Consumer Health Data Privacy Laws, this Policy controls with respect to that consumer health data.

This Policy does not apply to information or practices that are not subject to the US State Consumer Health Data Privacy Laws, such as publicly available information, de-identified information, or job applicant and employee information. Terms used in this Policy have the meanings given to them under the applicable US State Consumer Health Data Privacy Law.

We may change this Policy from time to time. If we make material changes, we will post the updated version on our websites and, where required by law, provide additional notice or obtain consent.

1. The Categories of Consumer Health Data We Collect

The consumer health data we collect depends on how you interact with Paceline, the Services you use, the permissions you grant, the programs you join, and the data you allow your wearable device, mobile device, or third-party service to share with us. Consumer health data generally means personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status, subject to certain exceptions under applicable law.

Depending on your interactions with the Services, we may collect the following categories of consumer health data:

• Fitness, activity, and workout information, such as exercise minutes, workout type, activity frequency, steps, distance, pace, duration, calories or energy expenditure, active energy, workout history, and activity trends;
• Bodily functions, vital signs, symptoms, or measurements, such as heart rate, resting heart rate, heart rate variability, respiratory rate, VO2 max or cardio fitness estimates, sleep duration or sleep quality, and similar metrics that you authorize a device or service to share with us;
• Wellness goals, progress indicators, streaks, achievements, reward eligibility, engagement activity, and other information related to fitness, wellness, motivation, and habit formation;
• Information related to individual health conditions, where you choose to provide such information or where such information is generated, derived, or inferred from your use of the Services;
• Device-connected information from wearable devices, mobile operating systems, health platforms, and other third-party services you choose to connect to Paceline;
• Location or geolocation information, if enabled, where such information may reveal or be used to infer consumer health data;
• Inferences, predictions, trends, segments, or other information derived or extrapolated from non-health information or from the categories of information described above, where such information identifies or is reasonably linkable to your past, present, or future physical or mental health status.
• Other data provided by linking your device to Paceline.

2. Purposes of Collection and How Paceline Uses Consumer Health Data

As described further in the “How We Use Your Information” section of our main Privacy Policy, we may collect and use consumer health data for the purposes set forth below:

• Providing Services and support. To provide, operate, maintain, administer, and support the Services; to communicate with you about your use of the Services; to respond to your inquiries; to verify your account; to troubleshoot, provide technical support, and improve user experience; and to facilitate features, programs, rewards, or partner offerings you request or authorize.
• Wellness goals, suggestions, and personalization. To provide consumer-facing wellness goals, activity prompts, educational content, habit-building suggestions, progress tracking, rewards experiences, and other personalization features. These features are designed to support general fitness, wellness, motivation, and habit formation. They are not medical advice, diagnosis, treatment, disease-risk assessment, insurance advice, underwriting advice, or a substitute for professional healthcare advice.
• Automated systems, analytics, and AI-supported features. To use automated systems, analytics tools, rules-based logic, machine-learning tools, or service providers to help personalize wellness goals, activity prompts, rewards, and suggestions. We do not use consumer health data to make medical diagnoses, provide treatment recommendations, or determine insurance eligibility, pricing, underwriting, claims outcomes, or risk classification. If we use service providers to support these features, we require them to process consumer health data only to provide services to Paceline and not to use identifiable consumer health data to train, fine-tune, or improve their own models except as expressly authorized by Paceline and permitted by applicable law. Service providers may create, retain, and use de-identified information as permitted by applicable law and our agreements with them; as noted above, this Policy does not apply to de-identified information.
• Insurance-related programs you request or authorize. To facilitate your application for insurance products offered by our partners or your participation in research, pilot, rewards, engagement, or related programs with insurance partners, where you choose to participate and authorize the relevant use or disclosure. We do not disclose identifiable consumer health data to insurance carriers or insurance partners for underwriting, pricing, eligibility, claims adjudication, risk classification, or similar insurance decisions unless we provide separate notice and obtain any consent required by applicable law.
• Separate studies and partner research programs may use separately recruited cohorts, separate consent flows, study-specific notices, or other authorization processes. Data collected from Paceline users through the general consumer app is not shared with insurance carriers for underwriting, pricing, eligibility, claims adjudication, or risk classification unless separately disclosed and authorized as required by law.
• Analytics and improvement. To better understand how users access and use the Services, products, and offerings; to evaluate and improve our Services, products, rewards, programs, features, user experience, and business operations; and for internal quality control, testing, debugging, and training purposes, including through affiliates and subsidiaries such as Polymath.
• Research and analysis. To conduct research and analysis and to monitor and analyze trends and usage, including through affiliates and subsidiaries such as Polymath and, where permitted by applicable law and subject to appropriate safeguards, in conjunction with partners. Where possible, we use aggregated or de-identified information for these purposes.
• Marketing and communications. To send you service-related communications and, where permitted by law and your preferences, marketing communications about Paceline products, services, rewards, and partner offerings. We do not sell consumer health data, and we do not use consumer health data for targeted advertising where prohibited by applicable consumer health data laws.
• Security and protection of rights. To protect our rights, users, partners, and business operations; to prevent, detect, investigate, and address fraud, unauthorized activities, unauthorized access, security incidents, misuse, violations of our policies, or other potentially illegal or harmful activity.
• Legal proceedings and obligations. To comply with applicable laws, regulations, legal processes, and governmental requests; to establish, exercise, or defend legal claims; and to cooperate with law enforcement or regulators where required by law.
• General business and operational support. To administer our general business operations, including accounting, auditing, compliance, recordkeeping, legal, financing, insurance, corporate governance, restructuring, merger, acquisition, bankruptcy, diligence, or other business transaction-related activities.

3. The Categories of Sources From Which We Collect Consumer Health Data

In general, we may collect consumer health data from the following categories of sources:

• Directly from you, such as when you create an account, provide information, set goals, respond to prompts, contact us, participate in a program, or otherwise use the Services;
• From your devices, including wearable devices, mobile devices, health platforms, operating systems, and connected applications that you authorize to share information with Paceline;
• From our business partners, including rewards partners, insurance partners, research partners, and program partners, where permitted by law and consistent with your choices or authorization;
• From service providers and processors that support the Services, analytics, customer support, security, and business operations;
• From our affiliates and subsidiaries, including Polymath Analytics, Inc. (“Polymath”), where they process consumer health data in support of Paceline's Services, analytics, research, personalization, product improvement, rewards, reporting, or other purposes described in this Policy;
• From publicly available sources, where permitted by law and relevant to the Services.

4. The Categories of Consumer Health Data That We Share

We may share the categories of consumer health data described in Section 1 of this Policy as described below, with your consent or as reasonably necessary to provide Services, features, programs, rewards, partner offerings, or transactions that you request or authorize, and as otherwise permitted by applicable law.

For example, if you choose to participate in a research, pilot, rewards, engagement, insurance application, or related program with one of our partners, we may share consumer health data necessary to administer that program, subject to the applicable program terms, consents, authorizations, and notices.

We do not disclose identifiable consumer health data to insurance carriers or insurance partners for underwriting, pricing, eligibility, claims adjudication, or risk classification unless we provide separate notice and obtain any consent required by applicable law.

We do not sell consumer health data as “sell” is defined under applicable US State Consumer Health Data Privacy Laws. If our practices change, we will provide any notice and obtain any authorization required by applicable law before selling consumer health data.

5. The Categories of Third Parties and Specific Affiliates With Whom We Share Consumer Health Data

Paceline may share the categories of consumer health data described in Section 4 with the following categories of third parties and specific affiliates:

• Business partners, including rewards partners, marketplace brand partners that sell and fulfill products you order, research partners, and insurance providers, where you request, authorize, or participate in a program involving such partners;
• Vendors, service providers, and processors that assist us with hosting, data storage, analytics, wearable-device data integration and connectivity, customer support, communications, security, fraud prevention, debugging, quality assurance, personalization, AI-supported features, and other business operations;
• Operating systems, platforms, wearable-device providers, health platforms, and connected application providers that you choose to connect to or use with the Services;
• Professional advisors, including attorneys, auditors, consultants, insurers, lenders, and other advisors;
• Government authorities, law enforcement, regulators, parties to litigation, and others as required or permitted by law;
• Parties to business transactions, including third parties involved in an actual or potential merger, acquisition, financing, reorganization, bankruptcy, insolvency proceeding, sale of assets, investment, restructuring, or other corporate transaction, subject to applicable law and appropriate safeguards.

6. Security and Retention of Consumer Health Data

We use reasonable administrative, technical, and physical safeguards designed to protect consumer health data from unauthorized access, acquisition, disclosure, alteration, or destruction. However, no system can be guaranteed to be completely secure.

We retain consumer health data for as long as reasonably necessary to provide the Services, fulfill the purposes described in this Policy, comply with legal obligations, resolve disputes, enforce agreements, maintain security, prevent fraud, and support legitimate business operations, unless a longer retention period is required or permitted by law. When consumer health data is no longer needed, we delete, de-identify, or aggregate it in accordance with our retention practices and applicable law.

7. Geofencing and Location-Based Practices

We do not use geofencing technologies around health care facilities to identify, track, collect consumer health data from, or send targeted messages to consumers in a manner prohibited by applicable US State Consumer Health Data Privacy Laws.

If you enable location-based features, we may process location information as described in our main Privacy Policy and this Policy, subject to your device settings and applicable law.

8. Your Privacy Rights

Subject to applicable exceptions, you may have the following rights under applicable US State Consumer Health Data Privacy Laws:

• Know/Access. The right to confirm whether we collect, share, or sell your consumer health data; to access your consumer health data; and, where required by applicable law, to obtain information about the third parties and affiliates with whom we have shared or sold your consumer health data.
• Withdraw consent. The right to withdraw consent from our collection or sharing of your consumer health data where our processing is based on consent. Withdrawal of consent may limit your ability to use certain features of the Services.
• Deletion. The right to request deletion of your consumer health data, subject to applicable exceptions.
• Appeal. The right to appeal our denial of a consumer health data rights request, where required by applicable law.

Exercising Your Privacy Rights

To exercise your rights, please email us at opt-out-ca@paceline.fit or use our Contact Us form. Before completing your request, we may need to verify your identity or your authority to make a request on behalf of another person. We may request additional documentation or information solely for the purpose of verifying your identity, depending on the type of request.

If we deny your request to exercise a right, you may appeal our decision by sending an email to opt-out-ca@paceline.fit with the subject line “APPEAL.” If your appeal is unsuccessful, you may file a complaint with:

• Washington residents: the Washington State Attorney General at www.atg.wa.gov/file-complaint.
• Nevada residents: the Nevada State Attorney General at https://ag.nv.gov/Complaints/CSU_Complaints___FAQ/.

9. Changes to this Policy

We may make changes to this Policy from time to time. When we do, we will post the updated version on this page and update the “Last Updated” date. We encourage you to review this Policy periodically. Changes to this Policy take effect from the date of publication unless stated otherwise. Where required by law, we will provide additional notice or obtain consent before applying material changes to our collection, use, disclosure, or sale of consumer health data.

10. Contact Us

If you have questions regarding this Policy, or if you wish to exercise your rights, you may contact us by email at opt-out-ca@paceline.fit or log a request on https://help.paceline.fit

Privacy inquiries: privacy@paceline.fit 

Mailing address: Tam(squared) Inc., 595 Pacific Ave, 4th Floor, San Francisco, CA 94133, Attn: Privacy Officer.