1. Scope

This policy supplements the Project Warfighter Privacy Notice and applies to personal data that identifies or can reasonably be linked to a member and reveals or can be used to infer past, present, or future physical or mental health status. Project Warfighter is operated by Dylan Seaton, an individual in Arkansas. Contact: privacy@neascan.org.

This policy is designed to give all nationwide United States beta members a clear consumer health data process. It does not state that Project Warfighter is a healthcare provider, a HIPAA covered entity, or compliant with every health-privacy law in every circumstance.

2. Consumer health data we collect or infer

• Fitness assessment selections, dates, baseline, prior, current, and goal results, independent score estimates, pass projections, and progress attempts.
• Workout plans and logs, exercises, sets, repetitions, load, time, distance, effort, heart rate, discomfort, recovery, training streaks, and exercise trends.
• Height, weight, age, formula sex category, general activity, body-related goals, and measurement trends.
• Food-search terms and UPC/EAN barcodes; food, drink, hydration, caffeine, alcohol, serving and nutrient entries; dietary pattern; allergies; avoided foods; nutrition goals; and resulting education or summaries.
• Sleep, energy, stress, soreness, motivation, optional resting heart rate, pain, illness, limitation selections, warning flags, readiness categories, and safety holds.
• Inferences and recommendations created from those entries, including plan phase, training focus, readiness status, alternative exercises, nutrition substitutions, and progress indicators.

We do not ask for diagnoses, prescriptions, medical documents, genetic data, reproductive or sexual-health history, or precise location. Do not enter those details into free-text fields.

3. Sources of consumer health data

• You, through setup forms, assessment entries, check-ins, workout and nutrition logs, and optional notes.
• Project Warfighter's deterministic calculations and source-backed rules, which create estimates, plans, categories, education, and trends from your entries.
• Service providers that return data already associated with your account as needed to operate the app. The beta does not currently import health data from wearables, healthcare providers, employers, or data brokers.
• USDA FoodData Central and Open Food Facts, which return public food or packaged-product records in response to the food-search text or barcode you submit.

4. Why we collect and use consumer health data

• Save the fitness, assessment, nutrition, wellness, limitation, and readiness information you choose to record.
• Generate the estimates, plans, logs, histories, trends, checkpoints, safety holds, and educational alternatives you request.
• Filter exercises and food examples using selected equipment, limitations, dietary pattern, allergies, and avoided foods.
• Protect the service, investigate errors or abuse, and maintain owner-only data boundaries.
• Respond to support, consent-withdrawal, access, correction, deletion, and appeal requests.

Project Warfighter does not use consumer health data for targeted advertising, data-broker profiles, insurance or employment decisions, or artificial-intelligence model training. It does not make decisions that produce legal or similarly significant effects.

5. Consent and feature access

We request a separate affirmative consent before collecting or processing consumer health data through member features. The consent identifies this exact policy version. Declining or withdrawing is permitted, but assessment, training, nutrition, readiness, and related history features cannot process covered data without current consent. Sign-out, account deletion, and privacy requests remain available.

6. Consumer health data disclosures

We disclose consumer health data only as needed for the purposes described here, at your direction, or as required by law:

• Supabase provides authentication and database infrastructure and processes stored member records, account identifiers, and related security events for Project Warfighter.
• Vercel hosts and runs the web application and may process transmitted entries plus technical request and runtime information needed to deliver, secure, and troubleshoot the service.
• USDA FoodData Central receives food-search text and pagination parameters sent by Project Warfighter's server to return matching public food records.
• Open Food Facts receives a UPC or EAN barcode and requested product-data fields sent by Project Warfighter's server to return a packaged-food record.
• A person you choose may receive the limited information shown in a sharing preview. Current Wingman and progress-card controls do not share detailed assessment, nutrition, limitation, pain, illness, readiness-answer, or note data by default.
• Authorities or other parties may receive limited information when reasonably necessary to comply with valid legal process, investigate misuse, or protect a person's rights or safety.

These food-provider requests do not include your Project Warfighter account identifier, email address, authentication token, or browser IP address. The providers receive the search text or barcode and server request metadata and may maintain logs under their own privacy practices. Because a search or barcode can reveal or allow an inference about nutrition, allergy, or dietary interests, Project Warfighter treats it as covered consumer health data.

We do not sell consumer health data. We do not disclose it to advertisers, data brokers, employers, military units, commanders, insurers, or healthcare providers. If a future feature would share consumer health data beyond what is necessary to provide the service, we will present a separate authorization describing the recipient, data, and purpose before sharing.

7. Your consumer health data rights

• Confirm whether we collect, use, or disclose your consumer health data and request access to it.
• Request a list of the categories of consumer health data disclosed and the categories of recipients, where applicable.
• Request correction of inaccurate consumer health data you entered.
• Request deletion of consumer health data from active systems, subject to lawful exceptions and provider backup or security-log timing.
• Withdraw consent for future covered collection and processing.
• Appeal a denied request and, where applicable, contact your state attorney general or another regulator.

Use available account controls or email privacy@neascan.org from the account email. Identify the request type and account, but do not send a password or unnecessary health details. We may take reasonable steps to verify the request and will not discriminate against you for exercising a privacy right.

8. How to withdraw consent

Use the consent-withdrawal control when available or email privacy@neascan.org with the subject "Withdraw health data consent." Withdrawal applies to future covered processing after it is recorded; it does not make earlier authorized processing unlawful. Covered features will remain unavailable unless you later provide valid consent to the current policy. You may separately request deletion or delete the account.

9. Retention and security

We retain consumer health data only as reasonably needed for the requested beta features, security, privacy requests, disputes, and legal obligations. Account deletion removes associated live member records, but limited provider backups, authentication or security logs, incident evidence, and copies another member received can persist as described in the Privacy Notice.

We use authenticated access, owner-only database policies, least-privilege service access, reviewed migrations, and security tests. No system can guarantee absolute security.

10. Changes and contact

Material changes are published as a new dated version. We will request new consent before materially different collection, use, or disclosure when required. The exact version connected to a consent record remains available at its versioned URL.

Questions, requests, withdrawals, appeals, or complaints may be sent to Dylan Seaton at privacy@neascan.org.