Version 2026-10-05 · in force 2026-10-05

Consumer Health Data Privacy Policy

Last updated 5 October 2026.

This is a separate page on purpose. Washington's My Health My Data Act (RCW 19.373.020) requires a business that handles a Washington resident's health data to publish a consumer health data privacy policy of its own and to link to it from the homepage. Nevada and Connecticut ask for something similar. Corner is run from Texas, but the law that applies is the law where you are, so this page exists for everybody and everything on it is true for everybody.

Corner is run by Roni Ricardo Rizk, an individual doing business as Corner in College Station, Texas. Write to support@cornercoachfit.com.

The general Privacy Policy covers everything else. This page covers health data only, in the shape the statute asks for.

The categories of consumer health data we collect

• Body measurements — your weight, your waist, and anything else about your body you record in a check-in or a message.
• Progress photographs you upload.
• Training — what you did, how much, how hard, how it felt, and how it changed over time.
• Nutrition — what you ate, when, the nutrients in it, and the targets you or your coach set.
• Sleep and daily steps, where you enter them.
• Health status you tell us about — injuries, limitations, conditions, medications, allergies and intolerances, usually through a screening form your coach sends you, and anything you write in a check-in or a message.
• Your goals, and how you describe how you feel.

Why we collect each of them

For one reason: to run the coaching or the training you asked for. Your program is built from them, your targets are worked out from them, your progress is measured with them, and your coach reads them so they can coach you. There is no second purpose. We do not profile you for advertising, we do not score you for anybody, and we do not build a product out of you.

Where it comes from

• From you, typed into Corner.
• From your coach, where they record something about you — a program, a note, an adjustment.
• From nowhere else. We do not buy health data and we do not import it from data brokers. If Corner ever connects to a device or a health app, that connection will be something you switch on yourself and this page will name it before it exists rather than after.

The categories we share, and who receives them

Your coach, if you have one, receives all of it. That is what having a coach means, and it is the service you asked for. You choose the coach by accepting their invitation, and you can end it at any time from your own account, which stops the sharing.

The companies that run pieces of Corner hold it because they run the database, the hosting and the file storage: Supabase and Netlify. Resend sends our emails, and when your coach is told you sent a check-in, that email carries your answers to them. They are contractually forbidden to use any of it for anything else. Payments (Stripe) never receive health data.

Notifications, if you turn them on, are delivered by your browser's own push service — Apple's, Google's or Mozilla's. What a notification says is encrypted on the way, so the push service cannot read it.

Nobody else. Not another coach. Not an advertiser. Not an insurer. Not an employer. Not a data broker.

We do not sell it

Corner has never sold consumer health data and will not. Washington requires a signed authorization on a prescribed form before health data may be sold; Texas forbids a business our size from selling sensitive personal data without prior consent. We are not asking for either, because there is no sale to consent to. There is no buyer, no revenue line and no code path.

Your consent, and taking it back

Before Corner stores any of this, you tick a box that is never pre-ticked, next to a sentence that names what is collected, what it is for and who sees it. Sharing with your coach is a second, separate agreement, made when you accept their invitation. We record which version of this policy you agreed to and when.

To withdraw consent: email support@cornercoachfit.com, or delete your account in your settings. Withdrawing means we can no longer run your program, so it ends the service — we say that plainly before you do it rather than after. Withdrawing does not undo what was lawfully done before you withdrew.

Your rights over health data

• See it — all of it is in the app.
• Get a copy — one click, a file you can read.
• Correct it — in the app, or ask us.
• Have it deleted — from your settings, or ask us. We delete it from the live service at once and purge it within 30 days; it ages out of our encrypted backups within 7 days after that. Each company that runs a piece of Corner lets go of its copy too, and the Privacy Policy names how, company by company: Supabase's backups within 7 days of the purge, Resend's copies of the emails we sent 30 days after each was sent (sooner for a particular email, if you ask us), notifications still in the push services within 24 hours.
• Withdraw your consent, as above.
• Appeal. If we refuse a request, we will tell you why and how to appeal. If we refuse the appeal you can complain to the Attorney General of your state.

We answer within 30 days, free, and we do not treat you differently for asking.

Where it is held, and how it is protected

In the United States, on Supabase's infrastructure. The wall is in the database itself: every row belongs to somebody and the database refuses to hand it to anybody else, including if the application asks wrongly. Photographs and files are private, reachable only through links that expire in minutes. The one key that could bypass the wall lives only on our servers, is used only by the few jobs that need it, and never reaches a browser. Logs never carry the contents of a diary.

How long it stays

For as long as your account exists. After deletion: gone from the live service at once, purged within 30 days, and out of our encrypted backups within 7 days after that.

If there is ever a breach

We will tell you within 60 calendar days, by email and in the app, and tell you what happened and what to do. The Federal Trade Commission's Health Breach Notification Rule treats an unauthorized sharing as a breach too, not only a break-in, and we treat it the same way.

Who to contact

support@cornercoachfit.com for anything on this page — a question, a copy, a correction, a deletion, or to withdraw consent.

In Washington, the My Health My Data Act is enforced through the Consumer Protection Act, and you may bring your own claim. Nothing here takes that away.

This page has its own address, `/legal/health-data`, and is linked from the homepage, because the statute asks for both.