Privacy Policy

Introduction

WhyWeight is dedicated to protecting your privacy and ensuring that your personal information is handled securely and in compliance with the Personal Health Information Protection Act (PHIPA) and the Personal Information Protection and Electronic Documents Act (PIPEDA). This policy outlines how we collect, use, and safeguard your personal data.

Information Collection

We collect personal and health information that you provide to us, including your name, contact details, medical history, and other relevant data. This information is necessary to deliver our services, communicate effectively, and comply with legal requirements.

Use of Information

Your personal data is used for the following purposes:

Service Delivery: To provide and improve our services, including managing your care, scheduling appointments, and maintaining records.

Communication: To communicate with you regarding appointments, updates, and important information about your care.

Regulatory Compliance: To comply with legal and regulatory requirements, including PHIPA and PIPEDA.

Service Providers: Transferring personal information to providers of our services, such as physicians, nurse practitioners, pharmacists, dieticians, fitness coaches, obesity educators, telephone support, data storage, processing providers, and other professionals reasonably within the circle of care.

Emergency Situations: In the event of an emergency, at the reasonable judgment of WhyWeight or a third-party service provider, disclosing personal information to emergency contacts, a public authority, an agent of a public authority, or another party with whom we have a contractual relationship.

Insurance Disclosure: Disclosing information to an insurer with your consent for coverage or claims processing.

Business Transactions: Disclosing personal information to a potential acquirer in connection with a transaction involving the sale of some or all of the business of WhyWeight.

Data Security

We take the security of your personal and health information seriously. All data is stored on secure servers with industry-standard security measures, including encryption, firewalls, and access controls. Regular reviews and updates to our security practices ensure the ongoing protection of your information.

PHIPA and PIPEDA Compliance

As a healthcare service provider, we adhere to PHIPA and PIPEDA, which govern the collection, use, and disclosure of personal health information in Ontario and personal information in commercial activities across Canada, respectively. We are committed to ensuring your information is managed in accordance with these laws' stringent privacy and security requirements.

Cookies and Tracking

Our website may use cookies and similar technologies to enhance your experience, analyze website usage, and assist in our marketing efforts. You have the option to manage your cookie preferences through your browser settings.

Your Rights

You have the right to access, correct, or request the deletion of your personal information at any time. Additionally, you can withdraw your consent for the collection, use, or disclosure of your personal data, subject to legal and contractual restrictions. If you wish to exercise these rights or have concerns about your privacy, please contact our Privacy Officer.

Third-Party Services

We may share your information with trusted third-party service providers who assist us in delivering our services. These providers are bound by confidentiality agreements and are required to comply with PHIPA, PIPEDA, and other relevant privacy laws.

Body Scan Privacy

Our Body Scan feature (powered by Prism Labs, Inc.) creates 3D body scans and body-composition insights — such as body fat percentage and lean mass — from your phone's camera.

Information we collect. When you use Body Scan, we collect the profile details you enter (weight, height, sex, region, and date of birth) and the camera images captured during your scan. If you choose to view your results, we also collect your name, email address, and phone number. Your scan images and measurements are sent to Prism Labs to generate your 3D scan and insights; this includes rough face geometry, which some laws (such as the Illinois Biometric Information Privacy Act) treat as biometric identifiers. Your name and contact details are not sent to Prism Labs with your scan — they stay with us.

Your consent. Before your first scan, we ask for your explicit consent to the collection, use, and storage of your images and scan data. This consent is required to use Body Scan. We separately offer an optional consent to let Prism Labs use de-identified scan data to improve its technology — you may decline and still use Body Scan with full functionality. We record the version of the terms you accepted and the time of acceptance.

Use and sharing. Your scan data is used to display your body metrics and track changes over time. Prism Labs processes scan data on our behalf under contractual confidentiality and data-protection obligations. We do not sell your body scan data.

Retention and deletion. We keep your scan information only as long as needed to provide the service or as required by law. For Illinois residents, Prism Labs permanently destroys face-geometry scans once the purpose of collection is satisfied or three years after your last interaction with us, whichever comes first. If you agreed to the optional research use, you may withdraw that consent at any time and the associated research data will be deleted. You may also request access to, correction of, or deletion of your Body Scan information at any time through our Privacy Officer (see Contact Information below); deleting your WhyWeight records also removes the corresponding data held for research.

Prism Labs' policy. Prism Labs' own collection, use, and storage of scan data is described in Prism Labs' privacy policy.

You can withdraw this research consent at any time by contacting us. Please note that deleting a 3D avatar does not remove it from the research database used for product improvement.

Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected or as required by law. When your information is no longer needed, we securely dispose of it in accordance with our data retention policies.

Changes to This Policy

We may update this policy periodically to reflect changes in our practices or to comply with legal and regulatory requirements. Any updates will be posted on our website, and we encourage you to review this policy regularly to stay informed about how we protect your information.

Contact Information

If you have any questions or concerns about this privacy policy or how we handle your personal information, please contact our Privacy Officer at: