Consumer Health Data Privacy Policy
Last updated: September 18, 2026 · Effective: not yet. Staven has not launched. This policy takes effect when the app is released, and this draft will be reviewed by a lawyer before then.
Who this applies to
This policy applies to consumer health data we collect about residents of Washington and Nevada, and to Connecticut residents' sensitive data. We apply it to everyone who uses Staven.
Categories of consumer health data we collect
- Body measurements: weight, height
- Nutrition and diet: food logs, meals, portions, timing
- Physical activity: steps, workouts, active energy, exercise minutes
- Heart rate: resting heart rate
- Sleep: sleep duration and timing
- Health goals and status you tell us, including pregnancy status
- Health-related conversation content — everything you write to and receive from the Staven coach
- Inferences we derive from the above, such as adherence patterns and coaching recommendations
Categories of sources
- Directly from you, in the app.
- From Apple Health (HealthKit), with your permission, limited to the data types you approve. Apple Health may itself contain data from your iPhone, Apple Watch, or other apps you have connected.
- Generated by the Service — targets, inferences, and coaching output.
Why we collect it
Solely to provide the coaching service you asked for: to calculate and adjust your targets, to remember your history, to enforce safety limits, to detect patterns that may need attention, and to operate and secure the Service.
We do not collect consumer health data for advertising, marketing, profiling for advertising, or sale.
Who we share it with
We share consumer health data only with these specific third parties, each acting as our processor under a binding contract, and only to provide the Service:
| Third party | What they receive | Purpose |
|---|---|---|
| Anthropic, PBC | Conversation content and limited health context | Generating coaching responses |
| Supabase, Inc. | All stored account and health data (encrypted) | Database hosting |
| Vercel Inc. | Data transiting the application | Application hosting |
We have no affiliates. Staven is a single-entity company with no parent, subsidiary, or affiliated companies. If that ever changes, we will update this list before sharing anything.
We do not share consumer health data with any advertising platform, ad network, data broker, or analytics vendor.
Sale of consumer health data
We do not sell consumer health data. We never have and we do not intend to.
"Sell" here means any exchange for money or other valuable consideration — the broadest statutory definition. Because we do not sell, we will never ask you to sign an authorization to sell your consumer health data. If you ever receive such a request purporting to be from Staven, it is not from us — please report it to josh@staven.app.
How we get your consent
- Collection — we collect consumer health data only to provide the coaching service you ask for when you use the app, and only the categories listed above.
- Consent to share with Anthropic — a separate, explicit step before any of it is sent to Anthropic to generate coaching responses. It tells you what is sent, why, and how to withdraw, and you can use the rest of the app without it.
- No sale, so no authorization is ever sought.
We do not use dark patterns. Declining is as easy and as visible as accepting.
Your rights
| Right | How to use it |
|---|---|
| Confirm whether we collect, share, or sell your consumer health data | Email josh@staven.app |
| Access your consumer health data | Settings → Account → Download My Data |
| Get a list of all third parties and affiliates we shared it with, with contact information for each | Email josh@staven.app — we will provide active contact details |
| Withdraw consent to collection or sharing | Settings → Privacy, or email us. As easy as giving it. |
| Delete your consumer health data | Settings → Account → Delete Account, or email us for partial deletion. We will notify Anthropic, Supabase, and Vercel of your deletion request and direct them to delete their copies. |
| Appeal a denied request | Reply to our response. We decide within 45 days and explain in writing. |
We respond within 45 days, extendable by 45 more if we tell you why within the first 45.
Data security
We restrict access to consumer health data to the people who need it to operate the Service, and we maintain administrative, technical, and physical safeguards appropriate to the volume and nature of the data — including encryption in transit and at rest, row-level access controls, least-privilege access, and logging.
Geofencing
We do not use geofencing. The Staven app does not request or collect location data of any kind. We do not place a virtual boundary around any healthcare facility, and we never will.
Changes
If we ever want to collect additional categories of consumer health data, or use it for additional purposes, we will update this policy and obtain your affirmative consent first. We will not apply changes retroactively.
Contact
josh@staven.app · Staven LLC, 2001 E Hopi Ln, Mount Prospect, IL 60056
Washington residents may also contact the Washington Attorney General at atg.wa.gov. Nevada residents may contact the Nevada Attorney General at ag.nv.gov.