Consumer Health Data Privacy Policy

1. Scope and Purpose

This Consumer Health Data Privacy Policy supplements the Cult of Running Privacy Policy and is provided pursuant to the Washington State My Health My Data Act (RCW 19.373). We extend these rights to all members, wherever they live. It applies to personal information linked or reasonably linkable to an individual that identifies the individual's past, present, or future physical or mental health status ("Consumer Health Data"), including athletic biometric and physiological telemetry.

Affirmative Consent to Collect: Before any Consumer Health Data is collected, we present a consent screen listing the categories collected, why we collect them, who processes them, and how to withdraw consent. Collection begins only after you select "I consent." Connecting a Garmin account or uploading a file without completing this screen does not result in collection.

Consent to Share: Physiological metrics are private by default, even on a public profile. Publishing any Consumer Health Data (such as heart rate, HRV, or sleep) on a public profile requires a second, separate, explicit consent, and you choose per metric which data points appear.

2. Categories of Consumer Health Data We Collect

When you complete the consent screen to sync your wearable account or upload workout files, we collect the following canonical categories of data:

• Activity and Movement Telemetry: Distance, duration, moving time, pace, split times, elevation gain and loss, running cadence (steps per minute), daily step counts, ground contact time, vertical oscillation, stride length, vertical ratio, running power (watts), caloric expenditure, estimated fluid/sweat loss, GPS route polylines, and raw .FIT workout files.
• Cardiovascular, Recovery, and Physiological Telemetry: Average heart rate, maximum heart rate, resting heart rate (RHR), heart rate zone durations, overnight heart rate variability (HRV) averages and baseline status, sleep duration, sleep stage durations (deep, light, REM, and awake times), sleep quality scores, device-calculated energy scores, aerobic and anaerobic training effect, training load, and device-calculated fitness age.

3. Sources of Consumer Health Data

We collect Consumer Health Data solely from the following sources:

• Directly from You: When you manually upload workout files (such as .FIT or .GPX archives).
• Authorized Wearable Platforms: From Garmin Connect when you explicitly initiate and authorize an OAuth connection between your Garmin Connect account and Cult of Running.

4. Purposes for Collection and Use

We collect and use Consumer Health Data strictly for the following purposes requested by you:

• To display your personal running log, biometric summaries, recovery indicators, and personal records (PRs) on your Cult of Running ledger profile according to your chosen per-metric visibility settings.
• To calculate your progress and contributions toward community running events and distance challenges.
• To assign decorative community badges and seals based on your logged distances and habits.

We never use Consumer Health Data for targeted advertising, profiling that produces legal or similarly significant effects concerning you, employment screening, credit scoring, or training artificial intelligence (AI) or machine learning models.

5. Sharing and Selling of Consumer Health Data

• No Sale of Consumer Health Data: Cult of Running does not sell, rent, or trade Consumer Health Data to any third party, and will never do so without a separate, statutorily compliant written authorization signed by you.
• No Third-Party Sharing for Marketing: We do not share Consumer Health Data with third-party advertisers, data brokers, or corporate affiliates. Cult of Running has no corporate parents, subsidiaries, or affiliates that receive Consumer Health Data.
• Service Providers (Processors): Railway Corp. (managed cloud hosting and PostgreSQL database storage) and Cloudflare, Inc. (encrypted network routing and edge security) act as infrastructure processors that may handle Consumer Health Data solely to host and deliver the Cult of Running platform to you. Google LLC (Google Analytics), Microsoft Corp. (Clarity), and Plus Five Five, Inc. (Resend) provide site analytics and transactional email services and do not receive Consumer Health Data. Inbound emails sent by you to ministry@cultofrunning.com are hosted by Google LLC (Google Workspace).
• Member-Directed Public Display: Even if you configure your Cult of Running profile to be "Named among the Congregation" (public), all physiological metrics (such as heart rate, HRV, or sleep) remain private by default. A specific physiological metric is displayed on your public profile only if you grant separate, explicit consent and toggle that individual metric to public in your account settings. You may toggle any metric back to private at any time.

6. Your Rights Under the My Health My Data Act

You have the following rights regarding your Consumer Health Data:

• Right to Confirm and Access: You have the right to confirm whether Cult of Running is collecting, sharing, or selling your Consumer Health Data, and to access a copy of that data.
• Right to Withdraw Consent: You have the right to withdraw your consent for the collection and sharing of your Consumer Health Data at any time. You can do this immediately by disconnecting your wearable integration in your Cult of Running account settings or in your Garmin Connect account settings. Withdrawing consent stops future data collection immediately and permanently purges your device authentication credentials, while preserving your existing workout ledger.
• Right to Deletion: You have the right to request permanent deletion of all Consumer Health Data we hold about you, including synced metrics and uploaded workout files. Upon a verified deletion request or account closure, we permanently delete your Consumer Health Data from our active databases within 30 days. Copies in encrypted disaster-recovery backups expire and are permanently deleted within 90 days. We notify all processors of your deletion request and require them to honor it.

7. Retention

We retain Consumer Health Data associated with your account for as long as your membership remains active or until you request its deletion. Disconnecting a wearable stops future data synchronization without wiping your historical ledger entries, allowing you to manage, troubleshoot, or reconnect your devices without losing your logged activities.

8. How to Exercise Your Rights and Appeals Process

You may exercise your rights at any time by:

• Using the self-service disconnection and deletion controls inside your account settings at /account; or
• Submitting a request via email to ministry@cultofrunning.com with the subject line "Consumer Health Data Request."

We will authenticate your request using the email address associated with your account and fulfill it free of charge within 30 days (and no later than the 45-day statutory maximum).

Appeals: If we decline to take action on your request, we will inform you of the justification for declining. You may appeal any refusal by replying to our determination or emailing ministry@cultofrunning.com with the subject line "MHMDA Appeal." Within 45 days of receiving an appeal, we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decision. If your appeal is denied, you may submit a complaint to the Washington State Attorney General at www.atg.wa.gov.

9. Contact the Ministry

A link to this policy appears on the cultofrunning.com homepage.

Cult of Running
Email: ministry@cultofrunning.com
Washington, United States