Consumer Health Data Privacy Policy

Effective date: October 18, 2026

This Consumer Health Data Privacy Policy explains how we collect, use, share and delete consumer health data: information linked to you that describes your past, present or future physical or mental health. It covers the Superpower app and the maxmaxmax.today website (together, “Superpower,” “we,” “us”), operated by Amma Health Inc. It is written for Washington’s My Health My Data Act and similar laws in Nevada, Connecticut and other states, and it applies to everyone who uses Superpower. Our Privacy Policy covers everything else.

The short version: we use your health data only to run the plan you asked for. We never sell it, never use it for advertising, and never share it with advertising or social media companies. There are no advertising, analytics or social media trackers in the app or on our website.

1. Consumer health data we collect

Your goals and routine: what you want to work on (for example sleep, energy, focus, stress, training, skin and hair, or longevity), your sleep and wake times, meals and workouts, and your answers to program questions (for example caffeine, training experience or skin type).
Supplements: the supplements you take and your answers to their safety questions (for example pregnancy or breastfeeding, health conditions, prescription medicines you tell us about, age range and sex).
Peptides and other prescribed medications (Peptidemax): the peptides you take; who prescribed them and how you were evaluated; where they come from and their form; what your pharmacy label shows (the schedule, and whether it shows your name, the dispensing pharmacy, your prescriber and a use-by date); your answers to health screening questions (for example pregnancy, thyroid cancer, eating disorders, diabetes, heart disease, cancer or an upcoming procedure); whether your prescriber knows about them; your follow-up and supply timing; and, if you give it, the name and state of a compounding pharmacy. We don’t ask for doses, and we don’t store photos of your label or your prescription number.
What you log: tasks you complete or skip, side effects and notes, and progress photos or face scans you choose to take.
What we work out from it: the plan we build for you (for example which reminders you get and why) and, if you connect Onairos, the personality and interest traits Onairos provides.
Messages: anything you tell the in-app coach or text to our SMS number, which may include health information.
Places you add: places you type in, like your gym or work. We don’t collect your device’s precise location, and we don’t use geofences around health care facilities.

2. Where it comes from

You, when you answer questions, log something, chat with the coach or upload a photo.
Services you choose to connect: Google Calendar (your busy times and the events we add), Onairos, and Apple or Google sign-in (your name and email, not health data).
Us: your plan, your reminders and the results of the Peptidemax check are generated from your answers.
The national provider registry (NPPES): when you name a compounding pharmacy, we look up that pharmacy’s public registration. We send only the pharmacy’s name and state, nothing about you.

3. Why we use it

To build, run and adjust your plan and reminders.
To run the Peptidemax safety checks: whether reminders can be set, what to raise with your prescriber, and when to point you to a clinician or emergency care.
To answer your questions in the coach.
To send the reminders, push notifications and texts you’ve allowed. These never name a peptide or medication.
To keep Superpower secure, find and fix problems, and prevent abuse.
To meet our legal obligations.

We don’t use consumer health data for advertising, to build advertising audiences, or to make decisions about your insurance, employment, credit or housing.

4. Your consent

We collect consumer health data only to provide the features you ask for, or with your consent. Peptidemax asks for your consent, separately from our terms, before it asks any health question; if you say no, nothing is saved. We will ask for your separate consent before sharing consumer health data with anyone other than the service providers listed below. You can withdraw your consent at any time (see Your rights).

5. Who we share it with

We share consumer health data only with service providers (processors) that handle it on our behalf, under contracts that limit them to providing their services to us:

Hosting, database and storage: Render (servers), Supabase (database) and Amazon Web Services (photo storage and community chat).
AI model providers: Anthropic and OpenAI, to write the coach’s replies and parts of your plan.
Notifications and texts: Apple (push notifications) and Sendblue (texts, only if you give us your phone number). Peptide and medication names are never included.
Calendar: Google, only if you connect Google Calendar. Peptidemax items appear there as “Private reminder.”
Onairos, only if you connect it. We send Onairos a general topic, not your health data.

Our payment providers (Apple and Stripe) and sign-in providers (Apple and Google) don’t receive consumer health data. No third party collects information about your activity over time or across other apps and websites through Superpower. We may disclose information when the law requires it, for example under a valid court order. If our company is merged or acquired, consumer health data would transfer only under protections at least as strong as this policy. We have no affiliates that receive consumer health data, and we do not sell consumer health data.

6. Your rights

Wherever you live, you can:

Confirm whether we collect, share or sell your consumer health data, and get a copy of it along with a list of the third parties and service providers we’ve shared it with.
Delete it, including copies held by our service providers. Backups are cleared on their normal cycle, within 6 months.
Withdraw your consent.
Appeal if we decline your request.

How to do it:

In the app: stopping Peptidemax deletes its answers and the details of its tasks (we keep only each task’s time and whether it was done, for your streak). Deleting your account in Settings permanently deletes your data, including the photos you uploaded.
By email: write to us from the email address or phone number on your account, with the subject “Health data request,” so we can confirm it’s you.

Our address for requests is mog.max123@gmail.com.

We respond within 45 days. If we need more time (up to 45 more days), we’ll tell you why. Requests are free up to twice a year. If we decline a request, we’ll explain why. To appeal, reply to our answer with “Appeal” and we’ll respond within 45 days. If we deny your appeal, you can contact your state attorney general:

7. How long we keep it

As long as your account, or the program that uses it, is active. Stopping Peptidemax deletes its answers and task details right away. Deleting your account deletes your consumer health data and the photos you uploaded.

8. Security

Data is encrypted in transit and access is limited to the people and systems that need it to run Superpower. No system is perfectly secure. If a breach involving your health data happens, we’ll notify you as the law requires.

9. Age

Peptidemax is only for adults 18 and over. Superpower isn’t for children under 13.

10. Changes to this policy

We’ll update the effective date and tell you in the app before a material change takes effect. If a change affects how we use or share consumer health data, we’ll ask for your consent again.

11. Contact

Amma Health Inc., 1481 Peralta Boulevard, Fremont, California, USA.

Email: mog.max123@gmail.com