Consumer Health Data Privacy Policy
Last updated 20 October 2026
This policy covers the consumer health data that GOSUBIT PTY LTD (“we”) collects through Stiff, as Washington’s My Health My Data Act and Nevada’s consumer health data law define it. Everything else we collect is in our Privacy Policy.
The health data we collect, and how we use it
| Health data | Why, and how it’s used |
|---|---|
| Body measurements from your scans: where your joints are in each frame, and the joint angles and squats worked out from them | To work out your Move Age and your five area scores |
| Your Move Age, its range and your five area scores (ankles, knees, hips, trunk and shoulders) | To show you how you move, how it changes over time, and to build your plan |
| Your 30-day plan | To give you each day’s routine for your tight spots |
| Your routines: when you started and finished them, what you did and for how long, and the streak, points, level and badges they earn | To run your plan, keep your streak, and time your reminders (we learn the time from when you usually finish) |
| Your age on the day of each scan, from your birth date | To measure your Move Age against your real age |
| Your answers to the app’s setup questions, when it asks them: your main goal, how active you are, how long you sit, your tight spots, and how long and when you want to stretch | To shape your plan and your reminders |
We use your health data only for these purposes. We never sell it and never use it for advertising, and no one else can collect it through Stiff to follow you over time or across other apps and websites.
Where it comes from
- You: your answers and your birth date.
- Your phone: during a scan the app measures your body positions on the phone. Only the measurements are sent; the video never leaves your phone.
- Our software: your angles, scores, Move Age and plan are worked out by our server from your measurements and your age.
The health data we share, and with whom
We share health data only with the following, and only for the purposes above.
| Who | What they receive |
|---|---|
| Friends you add with an invite link (other Stiff users) | Your streak, points, level, rank among your friends and badges, and, as a count in their reminders, whether you stretched today. Never your Move Age, scores, measurements or age |
| Supabase, our database and server provider (a processor) | All of the health data above, to store it and work out your results |
| Expo and Apple, which deliver notifications (processors) | Reminder notifications, which can mention your streak, how many routines are left in your plan, or how many of your friends stretched today |
| PostHog, our product analytics provider (a processor) | That you started or finished a scan or a routine, whether a scan gave a result, and the day of your plan. Never a measurement, score or Move Age |
We have no affiliates that receive health data.
Your rights, and how to use them
- Know and get a copy. Ask whether we collect, share or sell your health data, and get a copy of it with a list of everyone we shared it with and how to contact them.
- Withdraw consent. In Stiff, open Settings, then Your data, then Withdraw consent, or email us. Scans, squat checks and Move Age stop; past results stay until you delete them.
- Delete. In Stiff, open the Profile tab, tap Settings, then Delete account, or email us. We delete your health data from our systems and ask PostHog to delete your usage events; Expo clears its records of delivered reminders within a day. Copies in our database backups go as those backups are replaced by newer ones.
Email support@trystiff.com. We’ll confirm the request comes from you, may ask for one more detail to do that, and answer within 45 days; a deletion you ask for by email is done within 30 days of that confirmation. If we need longer to answer, we’ll tell you within those 45 days, and take at most 45 more. A request is free.
If we turn a request down, we’ll say why, and you can appeal by replying to our answer. We’ll answer your appeal in writing within 45 days. If we turn the appeal down too, you can complain to the Washington State Attorney General at atg.wa.gov, or, in Nevada, to the Nevada Attorney General at ag.nv.gov.
Changes to this policy
We’ll update the date above when this policy changes. Before we collect a new kind of health data or use it for a new purpose, we’ll tell you and ask for your consent.
Contact
GOSUBIT PTY LTD, support@trystiff.com, our postal address (published here before Stiff is on the App Store).