Consumer Health Data Privacy Policy

Effective Date: March 20, 2026

This Consumer Health Data Privacy Policy (“CHD Policy”) supplements the Prism Biometric Privacy Policy and applies to certain data that may qualify as “consumer health data” (“CHD”) under the Washington state My Health My Data Act (“MHMDA”) or Nevada’s Consumer Health Data Privacy Law (“Nevada CHD Law”).  Data about individuals who reside outside Washington state and Nevada may be handled differently. 

Specifically, this CHD Policy applies to our handling of Washington and Nevada CHD in the context of Prism’s own product improvement research activities.  These activities take place only with user consent and are not part of the service we provide to our business customers (our “Customers”).  These Customers include popular consumer health and fitness brands.  Prism’s service powers the body-scanning features of applications that our Customers offer to their users.  Prism’s collection and use of those users’ data as a service to those Customers are not subject to this CHD Policy.  

In some of those Customers’ applications, users are invited to consent to Prism’s use of certain data for Prism’s own product improvement research purposes.  This is optional and not a condition of using the Customer’s body scanning service.  If the user consents, Prism will handle a second, separate copy of some of the user’s data under this CHD Policy in the context of those product improvement research activities.

In both its body scanning service and its research activities, Prism does not receive direct user identifiers like name, email address, or username, and Prism makes no attempt to identify the users.  Although Prism’s service is designed to estimate body fat composition and similar metrics, Prism also makes no attempt to deduce anything about the health of any users.  The data described in this CHD Policy is linked to the images that users take when using the body scanning service.  For transparency, for purposes of this CHD Policy, we will assume that the data discussed in this policy may qualify as CHD under the laws mentioned above.

Categories of CHD Collected

As described further in Prism’s Biometric Privacy Policy, and depending on applicable law and how you interact with Prism, we may collect or generate the following categories of data, which may qualify as CHD under the MHMDA and/or the Nevada CHD Law:

• 3D body scans and geometric measurements: E.g., face, waist, hip, torso, and limb geometry derived from images or videos captured during your use of the body scanning technology supplied by Prism.
• Body-composition estimates: E.g., body fat %, lean mass, and fat mass based on your scans and data such as height and weight.
• Information identifying the Customer’s service through which you used the Prism technology: E.g., information indicating you used our service from within a specific Prism-enabled part of a specific health or fitness application provided by a Prism Customer.  
• Height, weight, and gender (in the context of our use of the information to help estimate body composition).
• Certain other information about you that we infer, derive, or extrapolate: E.g., rate of change of fat mass or other insights.

We do not receive or attempt to infer, derive, or extrapolate medical diagnoses, health conditions, medical histories, etc.

Sources of CHD

As described further in Prism’s Biometric Privacy Policy, we collect information that may include CHD from the Prism Customer application in which you use Prism’s body scanning feature.

Purposes for Collection of CHD

We describe the purposes for collection and use of CHD in the “Collection and Use of Data” section of Prism’s Biometric Privacy Policy that discusses Prism’s research database. As further described there and subject to applicable law (including, where required, your consent), we may collect, generate, store, analyze, and use CHD (1) to help improve future body scan insights and Prism’s technology; (2) help support the development of healthier-range benchmarks, recommendations, and indicators; (3) to address legal matters, such as to comply with laws or to establish, exercise, or defend our legal rights; and (4) to create anonymized or aggregated insights or data.  We may also use your as CHD for other purposes you authorize.

How and Why We Share CHD

For the purposes described below, as further described in Prism’s Biometric Privacy Policy, and subject to applicable law (e.g., subject to your additional consent where legally required), we may share any category of the CHD described above with any of the following categories of third parties:

• Service providers and affiliates;
• The Prism Customer whose application you used to interact with Prism (such as during coordination with that Customer to process a request from you);
• An acquirer of some or all of our business or assets;
• Other third parties as relevant to the purposes below. 

We may share each of the categories of CHD described above with the entities listed above for the purposes described below, subject to applicable law (and, where legally required, your consent):

• to help improve future body scan insights and Prism’s technology;
• help support the development of healthier-range benchmarks, recommendations, and indicators;
• to protect Prism and others;
• to address and comply with legal obligations; 
• in connection with any negotiation or completed acquisition, merger, or purchase involving our business assets
• to create anonymized or aggregated insights or data; and
• for other reasons at your direction or with your consent.

Under Nevada law, we inform you that no third party may collect Nevada CHD over time and across different Internet websites or online services when you opt in to our research activities or use our website.  

How To Exercise your MHMDA or Nevada CHD Rights

Subject to exceptions, the MHMDA and Nevada CHD Law extend certain rights relating to CHD. Depending on your jurisdiction and situation, this may include rights (1) to confirm whether Prism is collecting, sharing or selling your CHD; (2) to access your CHD; (3) to delete your CHD; and (4) to withdraw your consent to the collection or sharing of your CHD. You can contact us about these rights by emailing us at contact@prismlabs.tech. 

Depending on the nature of your request, we may contact you for further information if appropriate to authenticate your identity.  For your privacy protection, we take certain measures to avoid, reduce, or eliminate the identifiability of the CHD we maintain.  For example, we do not receive or store your name, email address, or username when you use our body scan feature.  For that reason, this identity authentication process depends on the cooperation and records of the Prism Customer in whose application you used our body scan technology, and even with that cooperation, it may not be feasible for us to locate CHD associated with you.  Note that Prism will never ask you for sensitive personal or financial information when authenticating your identity, and no Prism employee will ask you to tell them your password.

If we deny your request in whole or in part and the MHMDA or Nevada CHD Law applies to our handling of your CHD, you may appeal that decision by emailing us at contact@prismlabs.tech. 

Updates to this CHD Policy

We reserve the right to change this CHD Policy at any time, such as to reflect changes in the law, lawful changes to our data practices or the features of our services, or advances in technology. We will make the revised CHD Policy accessible from a link in the footer of www.prismlabs.tech, so you should review it periodically. The date this CHD Policy was last revised is identified at the top of the document. You are responsible for periodically monitoring and reviewing any updates to the CHD Policy. 

Contact Us

If you have any questions about this CHD Policy or Prism’s privacy practices, please contact us at contact@prismlabs.tech.