← Back to Legal Documents

Health Data Processing Notice

View History
Version: 1.2.1 | Effective Date: 2026-08-19 | Document Status: Standalone | Governing Law: EU GDPR (Lithuania), global applicability | Contact: legal@motiw8.com

1. Introduction

This Health Data Processing Notice ("Notice") supplements the Motiw8 Privacy Policy and explains in full detail how Motiw8 MB ("we", "us") processes health-related data, including:

Under the GDPR, this data is classified as Special Category Personal Data (Article 9), subject to enhanced protection and explicit consent. This document expands on the Privacy Policy and provides transparency into every aspect of processing.

2. Categories of Health Data We Collect

2.1 Data Users Provide Directly

2.2 Data From Device Integrations

Apple HealthKit (iOS)

If the user grants permission, we collect:

HealthKit permissions are granular and controlled by the user.

HealthKit data never leaves the device unless explicitly approved by the user.

Android Health Connect (Android)

On Android, Motiw8 reads health data through Android Health Connect (the current Android integration; Google Fit is being phased out by Google). With your permission, we read:

Health Connect permissions are granular and revocable at any time in Health Connect settings. With your separate background-access grant, steps and distance are read in the background only while you have an active step challenge, to keep your progress and streaks current. This data is used to show you your activity, track your progress toward your goals, power reminders, and let you earn rewards for staying active. It is never used for advertising and is never sold or shared with advertisers or data brokers.

Google Fit (Android)

If user consents, we collect:

Wearables / Integrations

If user connects:

We may receive:

2.3 Derived Data

We also create derived health data:

This data is mathematically derived from raw health data and still considered health data under GDPR.

3. Purposes of Processing Health Data

Each purpose below is a direct expansion of what appears in your Privacy Policy.

3.1 Challenge Participation (Primary Purpose)

Health data is necessary to:

This is contractual necessity (GDPR Art. 6(1)(b)) and requires explicit consent (Art. 9(2)(a)).

3.2 Fair Play & Integrity

We use health data to:

3.3 Syncing With Health & Fitness Providers

We process synced data to:

3.4 Analytics (Strictly Aggregated/Anonymous)

We may use anonymized, aggregated data to:

No identifiable health data is used for analytics.

3.5 Dispute Handling

If a user disputes results:

3.6 Safety & Abuse Prevention

Health data helps detect:

3.7 Laboratory Verification for Premium Challenges

For premium challenges requiring lab documents, we process health data to:

The scope of this processing is limited to verification purposes only. We do not request broader medical records or any information beyond what is necessary to confirm the authenticity and identity verification of the submitted document.

4. Legal Basis for Processing

4.1 Explicit Consent (GDPR Art. 9(2)(a))

You provide explicit consent before:

For lab documents: Uploading lab documents containing body fat % test results requires explicit consent before submission. This consent must be:

Consent can be withdrawn anytime. When you withdraw consent for lab document processing, we delete the lab documents you submitted under that consent, because consent is the only basis on which we hold them. Withdrawing consent may make verification impossible and may result in disqualification from the challenge, and we cannot restore a document once it is deleted.

4.2 Contract (GDPR Art. 6(1)(b))

To participate in challenges, certain health data is required.

4.3 Legitimate Interests (GDPR Art. 6(1)(f))

For:

This does not override user fundamental rights.

5. How Health Data Is Stored

5.1 Storage Infrastructure

Health data is stored in:

5.2 Security

6. Data Retention Policy for Health Data

This expands the retention periods from the main Privacy Policy.

Data Type Retention Reason
Health metrics Until account deletion Needed for challenge history
Steps history Until deletion So you can see your activity history
Weight history Until deletion Needed for your challenge history
Videos 120 days after we notify you of the result Necessary evidence retention; extended window covers the appeal period
Photos 180 days after challenge end Necessary evidence retention
Derived metrics 3 years Auditability
Lab documents (body fat % reports) 180 days after the challenge they were submitted for is settled. If a lab document is not linked to any challenge, 30 days after we identify it as unlinked. You can ask us to delete one sooner at any time. Verification integrity and appeals

Some of the health data above has no fixed end date because it is your own ongoing record — your weight history and step history stay with your account so you can see your progress and join future challenges. A lab document is different: it exists to verify one measurement for one challenge. Once that challenge is settled and the window for disputing the result has closed, we no longer have a reason to keep it, so we delete it.

You can ask us to delete a lab document at any time, and you do not have to give a reason. Deleting one during an active challenge may make verification impossible and may affect your participation in that challenge. Before a lab document is deleted on the schedule above, you can download your own copy from your account.

If a challenge is cancelled, no result is produced and there is nothing to dispute, so we do not keep its evidence for the full period above. Evidence for a cancelled challenge is deleted 30 days after the cancellation, or 30 days after this policy takes effect, whichever is later.

6.1 Third-Party Contact for Verification

For premium challenges requiring lab documents, we may contact the issuing laboratory to verify the authenticity of submitted documents. This contact is limited to:

We do not:

This contact is for verification purposes only and is necessary to ensure the integrity of premium challenges. By participating in a premium challenge requiring lab documents, you consent to this limited contact with the laboratory.

7. Access to Health Data

7.1 Internal

7.2 External

No health data is sold or shared with advertisers.

8. Automated Decision-Making & Example Scenarios

Some decisions are machine-evaluated:

8.1 Automated

8.2 Human Review Required

Example: Baseline Rejection

If your baseline looks inconsistent:

Example: Unusual Step Spike

If 25,000 steps appear in a 5-minute interval:

9. Your Rights Regarding Health Data

You may request:

Exercise via: legal@motiw8.com

10. Revocation & Consequences

If you revoke consent:

You may re-enable consent anytime.

11. Special Notes for HealthKit (Apple Rules)

Apple requires:

Motiw8 fully complies.