This Notice explains how CurioCore ("we") collects, uses and shares consumer health data through Flowbase, SportsFlow and FlowCoach. It is provided under the Washington My Health My Data Act, Nevada Senate Bill 370, the Connecticut Data Privacy Act and similar state laws, and applies to residents of those states. It supplements our Privacy Policy. Where the two differ for consumer health data, this Notice controls.
1. Consumer Health Data We Collect
| Category | Examples |
|---|---|
| Wellbeing and mental health responses | Daily check-ins; answers to wellbeing, emotional regulation, gratitude, self-compassion and resilience questionnaires; WHO-5 and GAD-7 screening answers |
| Physiological and biometric readings | Heart rate, heart rate variability, resting heart rate, sleep, activity and recovery data from connected devices |
| Health-derived information | Wellbeing scores, readiness indicators, load tolerance, trends, threshold events |
| Body measurements | Weight class and age category used for rankings and handicaps |
| Health-related conversations | Health or wellbeing topics you raise with FlowCoach or a coach |
2. Why We Collect and Use It
We collect and use consumer health data only to:
- Provide the features you request, including scores, readiness, trends and FlowCoach answers;
- Share it with coaches as you choose in your settings;
- Notify your club's Wellbeing Lead that a screening result met its threshold, without the score, if your club uses screening questionnaires, which are available only through clubs at this time;
- Check the reliability of our questionnaires using de-identified data;
- Keep the Services secure and comply with law.
We do not use consumer health data for advertising or marketing.
3. Sources
You; devices and services you connect (Apple Health, Garmin, Polar, WHOOP, Oura, Concept2); and information we derive from those sources.
4. Consent
We ask for your consent before collecting consumer health data, and separately before sharing it, except as needed to provide a service you requested. For users under 18, a parent or guardian gives this consent. You may withdraw consent at any time in settings.
5. Who We Share It With
| Recipient | What | Why |
|---|---|---|
| Your coaches | Readiness by default; scores and other data only if you share them | To support your training, at your direction |
| Your club's Wellbeing Lead | That a screening result met its threshold. Never the score or answers | Safeguarding |
| AI provider (Anthropic, PBC, which provides the Claude model) | De-identified context needed to answer a FlowCoach question | To generate the answer. Not used for training |
| Hosting provider ({HOSTING}) | Stored data | To operate the Services |
We have no affiliates that receive consumer health data. Contact details for each recipient are available on request.
6. We Do Not Sell Consumer Health Data
We do not sell consumer health data and do not use geofences around health care facilities.
7. Your Rights
You have the right to:
- Confirm whether we collect, share or sell your consumer health data;
- Access it, including a list of all third parties and affiliates we have shared it with and their contact information;
- Withdraw consent to its collection and sharing;
- Delete it, including from archives and backups. We will tell our processors and any third parties to delete it too;
- Appeal our decision on a request.
To make a request, use settings or email {PRIVACY_EMAIL}. We respond within 45 days, and may extend once by 45 days when reasonably necessary, with notice. Deleted data is removed from backups on their next rotation, within 35 days.
Appeals. If we decline a request, reply to our decision within a reasonable time to appeal. We answer within 45 days and explain our reasons. If your appeal is denied, you may contact the Washington State Attorney General at atg.wa.gov, the Nevada Attorney General at ag.nv.gov, or the Connecticut Attorney General at portal.ct.gov/ag, as applicable.
8. Security
Access to consumer health data is limited to employees and processors who need it to provide the Services, under confidentiality obligations. We use encryption in transit and at rest and log access.
9. Contact
CurioCore, {ADDRESS} · {PRIVACY_EMAIL}