Last updated 17 October 2026
This Consumer Health Data Privacy Policy (“Consumer Health Data Policy”) describes how Cevren Health LLC (“Cevren,” “we,” “us,” or “our”) collects, uses, and shares consumer health data and explains the rights available to consumers under the Washington My Health My Data Act (“MHMD”).
This Consumer Health Data Policy supplements our general Privacy Policy. It applies to “consumer health data” as that term is defined by MHMD and should be read together with our Privacy Policy.
Under MHMD, consumer health data generally includes personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status. The definition is broad and includes information concerning health conditions and treatment, medications, bodily functions, vital signs and measurements, reproductive or sexual health information, and information that is processed to identify, associate, or infer health-related information.
Cevren is an educational and informational software application. It is not a healthcare provider, and this Policy does not represent that information processed through Cevren is subject to HIPAA.
The consumer health data Cevren collects depends on the features you choose to use and the information you choose to provide or make available.
We collect information you enter about protocols you choose to track, including supplements, medications, peptides, hormones, and other substances; amounts and units; schedules and timing; protocol start dates; and related tracking information.
Depending on what you enter, this information may reveal or permit inferences about your health, medical treatment, health goals, or other aspects of your physical condition.
We collect daily observations and other information you choose to record, which may include information concerning energy, mood, sleep quality, recovery, and free-text notes.
Free-text notes may contain additional consumer health data depending on what you choose to write.
If you choose to use Cevren’s menstrual-cycle functionality, we collect the menstrual-cycle information you provide. This information may constitute reproductive or sexual health information under applicable law.
We collect laboratory information that you enter manually, choose to retain following extraction from an uploaded laboratory report, or import from Apple Health Records.
Stored laboratory information may include the laboratory test or marker, result or value, unit, reference range, date, and related information.
When you choose to upload a laboratory report for extraction, the complete document is transmitted to our AI-processing provider, Anthropic PBC (“Anthropic”), for processing. Laboratory documents may contain additional consumer health data and identifying information, including your name, date of birth, healthcare-provider information, testing information, and other information appearing in the document.
Cevren does not retain the original laboratory PDF or image after that processing request. We retain the laboratory information you choose to save following extraction.
If you choose to authorize access to Apple Health Records, Cevren may collect laboratory results you make available through the Health app.
Cevren currently requests only the Lab Results category through this functionality. Information collected may include the test or marker name, value, unit, reference range, and date.
Cevren does not write information to Apple Health Records.
Importing laboratory results from Apple Health Records does not, by itself, transmit those results to Anthropic. If you subsequently choose to request AI Insights, relevant laboratory markers may be included in the information processed for that separate feature.
If you choose to connect Apple Health, Cevren may access health and wellness information for which you grant permission, including sleep information, heart rate variability, resting heart rate, steps, active energy, exercise minutes, blood oxygen saturation, blood pressure, body weight, body fat percentage, lean body mass, and waist measurement.
If you type a weight or blood pressure and Apple Health isn’t available or you haven’t allowed Cevren to write to it, the reading is stored on your device rather than in Cevren’s server database.
Cevren does not persistently store these ordinary Apple Health fitness and wellness metrics in its server database. Cevren nevertheless “collects” this information for purposes of this Consumer Health Data Policy when it accesses or processes the information to provide functionality you request. MHMD defines “collect” broadly to include accessing, receiving, inferring, deriving, retaining, or otherwise processing consumer health data.
If you separately request AI Insights, relevant recent Apple Health metrics may be included in the information processed for that request.
If you choose to connect an Oura ring, Cevren may access each night’s sleep information (duration, stages, efficiency, and bedtime and wake time), heart rate variability, lowest heart rate, Oura’s readiness score, and the night’s temperature change from your own baseline. This information is kept on your device and is not stored in Cevren’s server database. Cevren’s servers retain only what is needed to maintain the connection: your encrypted Oura login, its expiry, and the permissions you granted. Disconnecting Oura, or deleting your account, deletes that information and revokes Cevren’s access at Oura. Oura information is not included in AI Insights requests. If you have allowed Oura's own app to write data to Apple Health, Cevren treats that data as Apple Health data.
If you use Cevren’s Supplement Facts label feature, we collect the label photograph you choose to submit for purposes of extracting information from it. The photograph is transmitted to Anthropic for processing and may contain information beyond the Supplement Facts panel if other objects or surroundings appear within the image.
Cevren does not retain the original photograph after processing. We may retain extracted supplement information you choose to save.
Supplement and product information may constitute or permit an inference of consumer health data depending on the product, ingredient, protocol, and surrounding information.
You may optionally identify your sex as female, male, or other. This selection is stored on your device rather than in Cevren’s server database.
If you choose to use AI Insights, your selected sex may be transmitted to Anthropic as part of the information used to generate that analysis. Cevren does not retain a separate server-side copy of your sex following the request.
You may optionally record health conditions (chosen from a list or described in your own words), your year of birth (year only), and an upcoming surgery or procedure with its date. This information is stored on your device rather than in Cevren’s server database. It is used to give context to AI Insights you request, and Cevren never uses it to recommend anything.
If you choose to use AI Insights, this information may be transmitted to Anthropic as part of the information used to generate that analysis. Cevren does not retain a separate server-side copy of it following the request.
When you affirmatively choose to request AI Insights, Cevren may process consumer health data relevant to the requested analysis, including laboratory markers, medications and other protocol information, your chosen goal, recent daily logs, free-text notes, connected health metrics, menstrual-cycle information where applicable, optional sex information, and any health conditions, year of birth, and upcoming procedure and date you have chosen to record.
If you turn on automatic weekly reports, Cevren also prepares one AI Insights report each week without a separate request, using the same categories of information. You can turn this off at any time.
Cevren also receives the resulting AI-generated analysis. AI-generated information may itself constitute consumer health data because it may contain or infer information concerning your health status.
Cevren keeps a record of each AI Insights request and of any rating you give an answer (for example, "Did this help?") or answer you give to an in-app survey. These records are linked to your account and are used to provide the feature, apply usage limits, and understand in aggregate which features are useful. This record does not include the text of your question or the answer.
Cevren does not include your name, email address, or Cevren account identifier in the content of an AI Insights request sent to Anthropic. The information should nevertheless not be regarded as anonymous merely because those direct account identifiers are omitted.
Cevren may generate scores, trends, summaries, correlations, and other derived information from information you provide or make available. Because derived information may identify or infer information about your physical or mental health status, we treat it as consumer health data where applicable.
We collect and use consumer health data to provide the Cevren features you request.
Depending on the feature, these purposes include maintaining your protocol and laboratory history; displaying information you choose to track; generating scores, trends, summaries, and other informational outputs; importing laboratory information you authorize from Apple Health Records; accessing Apple Health information you authorize for connected features; extracting information from laboratory documents and Supplement Facts labels; generating AI Insights when you request them or, if you turn them on, as automatic weekly reports; providing exports and other user-requested functionality; maintaining the security and integrity of the Service; and complying with applicable law.
We limit access to consumer health data to personnel, processors, and contractors for whom access is reasonably necessary for the purposes for which the information was collected or to provide a product or service you requested.
We do not collect consumer health data for targeted advertising.
We do not sell consumer health data.
We do not use consumer health data to make decisions concerning eligibility for employment, housing, credit, insurance, or similar services.
MHMD generally permits collection with the consumer’s consent for a specified purpose or to the extent necessary to provide a product or service requested by the consumer. Where MHMD requires consent, Cevren will obtain the applicable consent before the collection or sharing occurs.
We currently collect consumer health data from the following categories of sources:
You. Most consumer health data is provided directly by you when you enter information, complete logs, upload documents or photographs, or otherwise use Cevren.
Your device. Certain information is stored or made available locally through the Cevren application on your device.
Apple Health. If you grant permission, Cevren may access the categories of health and wellness information you authorize.
Apple Health Records. If you grant permission, Cevren may import laboratory results that you choose to make available through Apple’s Health Records functionality.
Oura. If you connect an Oura ring, Cevren may access the sleep, heart rate variability, lowest heart rate, readiness and temperature information you authorize.
Information generated through Cevren. Cevren generates scores, trends, summaries, calculations, and other derived information based on information available to the Service.
Anthropic. When you choose a feature using Anthropic, Cevren receives extracted information or AI-generated output resulting from the information submitted for that request.
Cevren does not currently collect consumer health data from data brokers or advertising networks.
For purposes of this Policy, we use “share” or “sharing” consistently with MHMD where applicable.
MHMD's statutory definition contains exclusions for certain disclosures to processors and certain disclosures necessary to provide a consumer-requested service. Accordingly, a service provider may process consumer health data on Cevren's behalf without that disclosure necessarily constituting statutory “sharing.”
Subject to that distinction, consumer health data may be disclosed or made available as follows.
Railway Corporation provides Cevren's cloud infrastructure and database hosting.
Railway may process consumer health data stored in or transmitted through Cevren's backend as necessary to provide infrastructure services. Depending on the Cevren feature, this may include account-associated protocol information, daily logs, stored laboratory information, and other consumer health data maintained in Cevren's server environment.
Railway does not receive ordinary Apple Health fitness and wellness metrics merely because those metrics are read locally if Cevren does not transmit or persistently store them through the backend.
Railway processes information for Cevren under a data processing agreement.
Anthropic provides AI-processing functionality for Cevren.
Consumer health data is transmitted to Anthropic when you choose functionality that requires Anthropic processing, including AI Insights and laboratory-document extraction. A Supplement Facts photograph may also contain or reveal consumer health information depending on its contents and context.
For AI Insights, Cevren may transmit relevant laboratory markers, protocol and medication information, recent daily logs and free-text notes, relevant connected health metrics, menstrual-cycle information where applicable, optional sex information, your chosen goal, and any health conditions, year of birth, and upcoming procedure and date you have chosen to record.
For laboratory-document extraction, the entire selected document is transmitted and may contain your name, date of birth, healthcare-provider information, and other information contained in the report.
For Supplement Facts extraction, the selected image is transmitted, including anything else appearing within the photograph.
Cevren does not send your name, email address, or Cevren account identifier as part of the AI Insights analysis content. This limitation does not make the underlying health information anonymous.
Apple provides Sign in with Apple, Apple Health, Apple Health Records, and App Store functionality.
Cevren receives information from Apple through the permissions and services you choose to use. Cevren does not disclose Cevren-held consumer health data back to Apple merely because you connect Apple Health or Apple Health Records, and Cevren does not write information to Apple Health except in one situation: when you type a blood pressure or body weight reading into Cevren and choose to save it to Apple Health, under a separate iOS write permission covering only those two data types that you may decline or revoke. Cevren never writes to Apple Health Records.
Apple may independently process information in connection with its own products and services under Apple's own privacy practices.
RevenueCat provides subscription and entitlement-management infrastructure.
RevenueCat receives an internal user identifier and subscription or entitlement status as necessary to manage access to paid functionality. Cevren does not provide the consumer health data categories described in this Policy to RevenueCat for subscription management.
We may disclose consumer health data where permitted or required by applicable law, including when reasonably necessary to comply with valid legal process or to prevent, detect, protect against, or respond to security incidents, fraud, malicious activity, or other unlawful activity.
Any such processing remains subject to applicable legal requirements.
Cevren does not currently have an affiliate with which it shares consumer health data.
As described above, Railway Corporation and Anthropic PBC may process consumer health data in connection with services provided to Cevren. Whether a particular disclosure constitutes “sharing” under MHMD depends on the nature of the relationship and the statutory exclusions applicable to processors and consumer-requested services.
Apple acts as a source of consumer health data when you choose to connect Apple Health or Apple Health Records, and Oura acts as a source when you choose to connect an Oura ring; Cevren does not send your consumer health data to Oura. RevenueCat receives subscription and entitlement information but is not provided the consumer health data categories described in this Policy for that purpose.
If Cevren begins sharing consumer health data with an additional category of third party or specific affiliate in a manner requiring disclosure or consent under MHMD, we will update this Policy and obtain any required consent before that new sharing occurs. MHMD specifically prohibits collection, use, or sharing of undisclosed additional categories or for undisclosed additional purposes without the required prior affirmative consent.
Cevren does not sell consumer health data.
We do not exchange consumer health data for money or other consideration in a manner that constitutes a sale under MHMD.
If our practices were to change in the future, Cevren would comply with applicable requirements before any sale occurs, including any separate valid authorization required by law.
Subject to applicable law and appropriate authentication, MHMD provides consumers with specific rights concerning their consumer health data.
You may request confirmation of whether Cevren is collecting, sharing, or selling consumer health data concerning you.
You may also request access to consumer health data concerning you.
Where required by MHMD, access includes a list of the third parties and affiliates with whom Cevren has shared or sold your consumer health data and an active email address or other online mechanism you may use to contact those recipients.
Where Cevren relies on your consent to collect or share consumer health data, you may withdraw that consent for future collection or sharing.
Withdrawing consent does not necessarily delete consumer health data already collected. You may separately request deletion as described below.
Certain functionality may no longer operate if you withdraw permission necessary to provide that feature. For example, revoking access to Apple Health or Apple Health Records will prevent future access through that permission.
You may request deletion of consumer health data concerning you.
You can delete your Cevren account through the account-deletion functionality in the application. You may also delete certain individual information through available in-app controls.
You may also submit a consumer health data deletion request using the method described in Section 8 below.
When a deletion request subject to MHMD is authenticated, Cevren will delete the applicable consumer health data from its records and will notify applicable affiliates, processors, contractors, and other third parties to whom the consumer health data was disclosed of the deletion request as required by law. Those recipients are required to honor qualifying deletion requests subject to applicable law.
Consumer health data deleted from Cevren's active systems may remain temporarily in encrypted backup systems.
Cevren's ordinary backup lifecycle is currently up to 35 days. MHMD permits deletion from archived or backup systems to be delayed where necessary to enable restoration of those systems, but the statutory delay may not exceed six months from authentication of the deletion request. Cevren's current backup lifecycle of up to 35 days is shorter than that statutory outside period.
If deleted information is restored from a backup before final deletion, Cevren will maintain processes designed to prevent the restored information from being returned to ordinary active use contrary to the deletion request.
If Cevren refuses to take action on a consumer health data request, you may appeal that refusal.
To appeal, contact us at [email protected] with the subject line Consumer Health Data Appeal and explain the request you submitted and why you believe Cevren's response should be reconsidered.
We will review the appeal and inform you in writing of the action taken or not taken in response to the appeal and the reasons for the decision within the period required by applicable law.
If your appeal is denied, we will provide an online mechanism, if available, or another method through which you may contact the Washington Attorney General to submit a complaint as required by MHMD.
MHMD expressly requires a mechanism for appealing a refusal to act on a consumer request.
Cevren will not unlawfully discriminate against you for exercising rights provided by MHMD.
You may submit a consumer health data request by contacting:
Please use the subject line Consumer Health Data Request and describe the right you wish to exercise.
Where available, you may also exercise certain deletion and data-control rights directly through Cevren, including through existing account and item-deletion controls.
You do not need to create a new Cevren account to exercise consumer health data rights. If you already have an account, we may use your existing account to help authenticate your request.
We may ask for information reasonably necessary to verify your identity and authenticate the request. We will not require information beyond what is reasonably necessary for that purpose.
If we cannot authenticate a request using commercially reasonable efforts, we may request additional information reasonably necessary to authenticate you and your request. MHMD expressly permits this authentication process.
We will respond within the period required by applicable law.
Many Cevren features involving consumer health data are initiated by you. Some features also provide a separate disclosure or permission screen before particular information is accessed or transmitted.
For example, Cevren provides specific disclosures before first use of AI Insights, laboratory-document upload, and Supplement Facts label processing. Apple separately presents its permission process when you choose to connect Apple Health or Apple Health Records.
Where MHMD requires consent, that consent must be a clear, affirmative, specific, informed, opt-in, voluntary, and unambiguous act. Acceptance of a general Terms of Service containing unrelated information does not itself constitute MHMD consent.
Where consent is legally required for sharing consumer health data, the applicable sharing consent will be obtained separately and distinctly from consent to collection, as required by MHMD.
You may withdraw applicable consent for future collection or sharing as described in this Policy.
We maintain administrative, technical, and organizational safeguards designed to protect consumer health data appropriate to the nature and volume of the information we process.
We restrict access to consumer health data to personnel, contractors, and service providers for whom access is reasonably necessary to provide the features you request, operate and secure Cevren, or otherwise process the information for the purposes described in this Policy.
MHMD requires covered businesses to maintain security practices meeting at least a reasonable standard of care appropriate to the volume and nature of consumer health data and to restrict access to persons for whom access is necessary for the relevant purposes.
Where a service provider acts as a processor of consumer health data subject to MHMD, we require processing to be governed by an applicable binding agreement. MHMD requires a processor contract to establish processing instructions and limit the processor's actions concerning the consumer health data, and requires processors to assist covered businesses in meeting their statutory obligations where possible.
No method of electronic storage, processing, or transmission is completely secure, and we cannot guarantee absolute security.
Cevren retains consumer health data for as long as reasonably necessary to provide the Service and features you request, unless you delete the information, delete your account, exercise an applicable deletion right, or a different retention period applies.
Protocol information, daily logs, and stored laboratory information generally remain associated with your account until deleted.
Original laboratory documents and Supplement Facts photographs submitted for extraction are not retained by Cevren following the applicable processing request.
Ordinary Apple Health fitness and wellness metrics are not persistently stored in Cevren's server database.
Information transmitted to a service provider may be subject to the provider's applicable processing and retention practices, as further described in our general Privacy Policy and applicable feature-specific disclosure.
AI-generated analyses. Full AI Insights reports are stored with your account so you can read them again, and are deleted automatically 12 months after they are created. You can delete an individual report at any time in the app, and deleting your account deletes all of them. Other AI-generated answers (answers to your saved questions, weekly reports and stack reviews) are stored only on your device; before your device collects them, they are held encrypted on Cevren’s servers and deleted once collected, for no more than 7 days. Because AI-generated analyses may repeat or infer information about your health, including conditions or procedures you have recorded, Cevren treats them as consumer health data covered by the deletion rights in Section 7.
Cevren's encrypted backup lifecycle is currently up to 35 days, subject to the deletion provisions described above.
We may update this Consumer Health Data Policy to reflect changes in Cevren, our practices, or applicable law.
We will not collect, use, or share additional categories of consumer health data, or collect, use, or share consumer health data for additional purposes, where MHMD requires prior disclosure and affirmative consent, without providing the required disclosure and obtaining that consent before the new collection, use, or sharing begins.
The “Last Updated” date at the beginning of this Policy identifies the current version.
If you have questions about this Consumer Health Data Policy or wish to exercise your consumer health data rights, contact:
Cevren Health LLC 7901 4th St N #35717 St. Petersburg, FL 33702 United States [email protected]
Cevren Health LLC
7901 4th St N #35717
St. Petersburg, FL 33702
United States