Staminabar Consumer Health Data Privacy Policy
Effective date: October 17, 2026
Last updated: October 17, 2026
This policy explains how Staminabar collects, uses, shares and deletes consumer health data. It is written to meet the Washington My Health My Data Act, Nevada's consumer health data law (Senate Bill 370 of 2023), and Connecticut's consumer health data rules under the Connecticut Data Privacy Act. We apply it to every Staminabar user, wherever you live.
It sits alongside our main Privacy Policy at https://staminabar.io/privacy, which covers all personal data, including information that is not health data. If the two ever differ on consumer health data, this policy controls.
Summary
| Question | Short answer |
|---|---|
| What consumer health data do we collect? | Apple Health readings you allow (up to 58 types), daily summaries of them, and nine game attributes worked out from them. |
| Why? | To work out your game attributes, show them to you, and let games you approve read them. |
| Who receives it? | Our service providers (mainly Amazon Web Services), and games you approve, which receive only the nine attribute scores. |
| Do you sell it? | No. Never. |
| Do you ask first? | Yes. One consent to collect, and a separate consent for each game before it can see anything. |
| Do you use location or geofencing? | No. We collect no location data and do not geofence. |
| How do I see, delete or stop sharing it? | Delete your account or remove games in the app, or email privacy@staminabar.io. |
| Can I appeal a decision? | Yes. Email privacy@staminabar.io with the subject "Privacy appeal". |
Contents
- Who we are
- What "consumer health data" means here
- Categories of consumer health data we collect
- Why we collect and use it
- Where it comes from
- Who we share it with
- Your consent to collect and to share
- We never sell consumer health data
- No geofencing
- Your rights
- How to exercise your rights
- How to appeal
- How long we keep it and how deletion works
- How we protect it
- HIPAA does not apply
- Changes to this policy
- Contact us
1. Who we are
Staminabar is operated by Lynn Allen Holdings, LLC, a Georgia limited liability company doing business as Staminabar ("Staminabar", "we", "us").
- Mailing address: 5450 Glenridge Drive, Apt 251, Atlanta, GA 30342
- Privacy and rights requests: privacy@staminabar.io
- Support: support@staminabar.io
- Security: security@staminabar.io
Staminabar is only for adults 18 and older.
2. What "consumer health data" means here
Consumer health data is personal information that is linked or reasonably linkable to you and that identifies your past, present or future physical or mental health status. That includes readings about bodily functions, vital signs and measurements, and inferences drawn from them. We treat everything in section 3 as consumer health data, including the nine game attributes, because they are inferred from your health readings.
3. Categories of consumer health data we collect
| Category | What it includes |
|---|---|
| Activity and energy readings | Steps, active and resting energy, flights climbed, exercise, stand and move minutes, physical effort and workout effort scores, wheelchair pushes, swimming strokes, and distances for walking and running, cycling, wheelchair, swimming, snow sports, cross-country skiing, rowing, paddle sports and skating |
| Heart and fitness readings | Heart rate, resting heart rate, heart rate variability, one-minute heart rate recovery, VO2 max |
| Breathing and overnight readings | Respiratory rate, sleeping wrist temperature, blood oxygen saturation |
| Sleep | Sleep periods and stages (in bed, asleep, core, deep, REM, awake) |
| Movement measures | Walking speed, step length, asymmetry, double support time and steadiness; six-minute walk distance; stair ascent and descent speed; running speed, stride length, vertical oscillation, ground contact time and power; cycling speed, power, cadence and functional threshold power; cross-country skiing, rowing and paddle sports speed; underwater depth; water temperature |
| Body measurements | Weight, height, body mass index, body fat percentage, lean body mass, waist circumference |
| Reading details | For each reading: value, unit, start and end time, Apple's sample ID, and your time zone offset at the time |
| Daily summaries | Per-day combinations of the readings above, including readiness and sleep quality figures, vital sign averages, sleep timing and stages, activity totals, fitness and movement measures, and body measurements |
| Inferred game attributes | Readiness, rest, exertion, discipline, stamina, power, mobility, balance and constitution, each with a 0 to 100 score, tier, state, trend, difference from your own usual score, and update cadence, plus an "as of" date and "stale" flag |
That is up to 58 Apple Health types in total. The full list is in section 3.3 of our Privacy Policy.
We do not collect: clinical or medical records, diagnoses, medications, reproductive or sexual health data, gender-affirming care data, genetic data, biometric data used to identify you, precise or approximate location, or information about visits to health care services.
Your email address, user ID and device records are not health data on their own, but because they are linked to the data above, we protect them under this policy as well.
4. Why we collect and use it
We collect and use consumer health data only to:
- Provide the Service you asked for: sync the readings you allow, build daily summaries, work out your nine attributes, and show them to you in the app.
- Let games you approve read your attributes, and stop them when you remove access.
- Keep the Service secure and working, for example to stop abuse and fix problems with syncing.
- Comply with law and respond to your rights requests.
We do not use consumer health data for advertising, marketing, data mining, or decisions about employment, insurance, credit, housing or eligibility for any benefit. We do not use your consumer health data to train models unless you give separate opt-in consent for that specific purpose (see section 10 of our Privacy Policy). Today, only one of our founders' own data is used for modelling, with his agreement.
5. Where it comes from
| Source | Data |
|---|---|
| Apple Health on your iPhone, with your permission | Readings and reading details |
| Our servers, calculating from your readings | Daily summaries and inferred game attributes |
We do not buy consumer health data or receive it from any other company. When an Android app is available, readings will also come from Android Health Connect with your permission; we will update this policy before then.
6. Who we share it with
6.1 Categories and recipients
| Recipient | Category of recipient | What they receive | Why |
|---|---|---|---|
| Amazon Web Services, Inc. | Processor (service provider) | All consumer health data in section 3, stored and processed in the United States (us-east-1) | Hosting, database, storage, backups and encryption keys |
| Staminabar-operated game servers (today: Staminabar for Skyrim) | Our own servers, run by us on Amazon Web Services | Inferred game attributes only, held in memory for up to 60 seconds | To apply in-game effects in a Staminabar mod you connected |
| Third-party game studios | Third party | Inferred game attributes only, and only for games you approve | To apply in-game effects in a game you connected. No third-party studio can connect today. Before one can, we will add it to this table by name. |
| Courts, regulators and law enforcement | Third party | Only what the law requires | To comply with a valid legal obligation |
| A successor business | Third party | Data covered by this policy | Only in a merger, acquisition or asset sale, subject to this policy; any new use of consumer health data requires your consent |
Every game, ours or a third party's, receives only the nine attributes with their score, tier, state, trend, difference from your usual score and cadence, plus the "as of" date and "stale" flag. No game receives your raw readings, daily summaries, reading times, name, email or Staminabar user ID.
Today, Staminabar for Skyrim is the only game that can connect. Minecraft and Fallout 4 integrations are listed in the app as "coming soon" and receive nothing.
6.2 What our providers do not receive
Apple provides HealthKit, which runs on your phone; Apple does not receive your data from us. Cloudflare (website delivery and DNS), Google Workspace (our email), Supabase (website waitlist) and Lovable (website hosting) do not receive consumer health data from us. If you include health information in an email to us, it is stored in Google Workspace as part of that conversation.
6.3 Third-party studios
Studios that connect in the future must agree to the Staminabar Developer Terms (https://staminabar.io/developer-terms). They may use attributes only for in-game features, and may not sell them, use them for advertising, share them onward, use them for profiling or for decisions about employment, insurance or credit, use them to train AI models, use them to identify players or work out raw health data, or link players across games. Each studio's own privacy policy governs anything else it collects from you.
7. Your consent to collect and to share
We ask for two separate kinds of consent. Neither is buried in our Terms of Service.
Consent to collect. Before the app reads any Apple Health data, it shows a screen that explains what Staminabar reads and why, and asks you to tap Allow Apple Health. Apple's permission screen then lets you choose each data type. If you tap "Not now" or allow nothing, we collect no consumer health data.
Consent to share, for each game. No game can receive anything until you:
- scan its code (or type it) in the app;
- review the game's name and publisher, taken from our own records and marked "Verified by Staminabar", and what it will be able to see; and
- tap Allow.
Each game requires its own Allow. A request expires after 5 minutes if you do nothing.
Withdrawing consent. You can withdraw either consent at any time, as easily as you gave it:
- Stop collection: Connectors tab > Apple Health > Disconnect, or turn Staminabar off in iOS Settings > Health.
- Stop sharing with a game: Games tab > Remove access. The game loses access within about 60 seconds and its server is told the connection has ended.
- Or email privacy@staminabar.io.
After you withdraw consent, we stop the collection or sharing. Readings already collected are kept only until their 90-day period ends, unless you ask us to delete them or delete your account.
8. We never sell consumer health data
We do not sell consumer health data, and we do not exchange it for money or anything else of value. Washington law requires a separate, signed authorization before any sale of consumer health data, and Nevada and Connecticut also restrict sales. We do not ask for that authorization because we do not sell. If that ever changed, we would not sell any of your data without first getting your signed authorization as the law requires.
9. No geofencing
We do not collect location data, and we do not set up virtual boundaries (geofences) around health care facilities or anywhere else to identify, track, collect data from, or send messages or ads to anyone.
10. Your rights
You have the right to:
- Confirm and access. Confirm whether we collect, share or sell your consumer health data, get a copy of it, and get a list of every third party and affiliate with whom we have shared it, with their contact details. For Staminabar, that list will include each game you have connected.
- Delete. Have your consumer health data deleted. We delete it from our live systems, and copies in backups age out within 35 days, well within the 6 months the law allows. We will also notify every processor and third party with whom we shared your consumer health data of your deletion request.
- Withdraw consent to collecting or sharing your consumer health data (section 7).
- Not be discriminated against for exercising any of these rights. We will not deny you the Service, charge you differently or give you a different level of service because you used them. Without health data the app cannot work out attributes, because that is what it does.
11. How to exercise your rights
- Delete everything in the app: Settings > Delete account. This first revokes every game connection, then deletes your health readings, daily summaries, devices and account. It takes effect right away.
- Withdraw consent in the app: see section 7.
- Anything else, including access and the list of third parties: email privacy@staminabar.io.
We confirm requests come from you by checking that they come from your account's email address, or by sending a confirmation link to it. We will not ask for more information than we need. You may use an authorized agent; we will ask for your signed permission and may ask you to confirm your identity with us directly.
We respond within 45 days of receiving your request. If we need more time, we will tell you within those 45 days and explain why, and we will respond within 45 more days. Requests are free, up to twice a year, and beyond that where the request is reasonable.
12. How to appeal
If we decline your request, in whole or in part, we will explain why. You can appeal:
- Email privacy@staminabar.io with the subject line "Privacy appeal" within a reasonable time after our decision.
- Someone who did not make the original decision will review it.
- We will respond in writing within 45 days, explaining what we decided and why.
If you are still not satisfied, you may contact your state Attorney General. In Washington: https://www.atg.wa.gov/file-complaint. In Nevada: https://ag.nv.gov/Complaints/File_Complaint/. In Connecticut: https://portal.ct.gov/AG/Common/Complaint-Form-Landing-page.
13. How long we keep it and how deletion works
| Data | How long |
|---|---|
| Apple Health readings | 90 days from when each reading started |
| Daily summaries | 90 days from the day they describe |
| Inferred game attributes | Not stored; worked out each time they are requested |
| Copy held by a Staminabar-operated game server | Up to 60 seconds, in memory |
| Database backups | Up to 35 days |
Expired data is removed by an automatic sweep, normally within 48 hours. Server logs do not contain health values. When you delete your account, all of the above is deleted from our live systems right away, and backup copies age out within 35 days.
If you delete a reading in Apple Health, it is not automatically removed from Staminabar; it expires after 90 days or when you delete your account. A Staminabar mod keeps the scores it applied inside your game save files on your computer, which you can remove by deleting those saves.
14. How we protect it
Consumer health data is encrypted in transit over the internet with TLS and encrypted at rest using encryption provided by AWS. Access is limited to the services and people who need it to run Staminabar. Games authenticate every request with a key unique to each connection, and old requests cannot be replayed. Our logs never contain health values. If a breach affects your consumer health data, we will notify you and the US Federal Trade Commission as the FTC Health Breach Notification Rule and state law require. More detail is in section 18 of our Privacy Policy.
15. HIPAA does not apply
Staminabar is not a health care provider, health plan or clearinghouse, or a business associate of one, so HIPAA does not apply. We protect your consumer health data under this policy and the laws described in it. Staminabar is not a medical device and its attributes are not health advice.
16. Changes to this policy
We will post any update at https://staminabar.io/consumer-health-data and change the "Last updated" date. Before we collect new categories of consumer health data, use it for a new purpose, or share it with a new category of recipient, we will ask for your consent.
17. Contact us
Lynn Allen Holdings, LLC, d/b/a Staminabar
5450 Glenridge Drive, Apt 251, Atlanta, GA 30342
privacy@staminabar.io
Privacy Policy: https://staminabar.io/privacy