Consumer Health Data Privacy Policy

Effective date: 2026-07-03 · Applies to Washington consumers under the My Health My Data Act (RCW 19.373). Maintained as a separate policy per RCW 19.373.020. Our general Privacy Policy continues to apply to all users.

1. Who we are

FitScan (Gregory Dich (sole proprietor), Brodetsky St 36, Tel Aviv 6905155, Israel, contact privacy@fitscan.io) is the regulated entity determining the purposes and means of processing consumer health data described here.

2. Consumer health data we collect

• Foot measurements derived on your device from a LiDAR or photo scan: foot length, width, and arch metrics in millimetres. Under WA MHMD's broad definition, biometric data is consumer health data regardless of identification purpose, so we treat these measurements as consumer health data for Washington consumers.
• Email address, only if you opt in to a Size Passport (cross-device profile keyed to your email).

Camera images and foot photos are processed on your device or in your browser and are not collected by FitScan.

3. Sources

All consumer health data comes directly from you: your device's scan produces the measurements, and you provide your email if you choose to create a Size Passport.

4. Why we collect it (purposes)

• Calculating your shoe size and per-brand recommendations.
• Maintaining your optional Size Passport across devices and partner storefronts.
• Rendering your foot in the app's 3D/AR features.

We do not use consumer health data for advertising, and we do not process it for any purpose beyond those listed without your consent.

5. Sharing and third parties

• Processors: Amazon Web Services (cloud hosting, United States) stores synced measurements on our behalf under contractual data-protection obligations.
• Partner storefronts: when YOU use your Size Passport on a partner store, that store receives your size recommendation for the products you view — only at your request.
• No sale. FitScan does not sell consumer health data. If a sale were ever contemplated, a separate, specific, signed authorization meeting RCW 19.373.100 would be obtained first.
• Legal process: we may disclose data if required by law or valid legal process.

6. Your rights (RCW 19.373.040)

• Right to know: confirm whether we collect, share, or sell consumer health data about you and obtain a list of third parties with whom it was shared.
• Right to withdraw consent at any time.
• Right to delete: deletion requests are honored and propagated to our processors and to third parties to whom the data was disclosed.

Exercise any right via privacy@fitscan.io or the in-app "Delete My Data" control. We respond within the timelines required by RCW 19.373.040. If we deny your request, you may appeal by replying to our decision; appeal outcomes include instructions for contacting the Washington Attorney General.

7. Consent and geofencing

We obtain your affirmative consent on the scan page before any measurement is collected (RCW 19.373.030). FitScan does not use geofencing around any facility that provides health care services (RCW 19.373.080).

8. Changes

Material changes to this policy will be posted on this page with an updated effective date.