This policy describes the consumer health data Stride League collects, where it comes from, what it is used for, who it is shared with, and the rights a person has over it. It is written to meet the consumer health data laws of Washington (the My Health My Data Act), Nevada and Connecticut. The practices it describes apply to every participant, wherever they live. Everything else about the service, including account, registration, messaging and payment data, is covered by the Stride League Privacy Policy; where the two overlap, this policy governs health data.
Stride League is a step-challenge platform. A challenge organizer (a community organization, a company, a school or a family) runs a challenge, and the people who join it have their daily step counts read from their phones and added to their team's score. Stringbet Software operates the apps, the web interface and the servers. Stringbet has no affiliates.
Step counts. A daily step count for each day of the challenge, with the identity of the app or device each count came from (for example "iPhone", "Apple Watch", or the name of a fitness app) and each source's count by hour of the day, which is how overlapping sources are told apart. Where the challenge allows it, steps or activities a participant types in by hand (for example minutes of cycling at a chosen effort level, or a pedometer count), with when they were entered and any note added.
Figures derived from step counts. Daily and weekly totals and averages, standings within the challenge, whether a personal step goal was reached on a day or in a week, progress along a virtual walk the participant chose to join, distance milestones, and the private trophy case that counts those achievements.
Purposes. To compute individual and team standings in the challenge the participant joined; to move the participant along a virtual walk they joined; to show the participant their own days, goals and achievements; to show the people named below what the participant chose to show them; and to diagnose a phone that is not syncing. Nothing else. Health data is never used for advertising, never used to build a profile of a person, and never used to infer anything beyond the figures above.
What we do not collect. No other health data: no heart rate, sleep, weight, workouts, menstrual or reproductive data, no medications, diagnoses or conditions. No precise location: the apps request no location permission, and location and camera metadata in any uploaded photo is removed before storage. No biometric data. The records the apps keep about each sync attempt (when it ran, whether it succeeded, the permission state, battery and network conditions) contain no step counts.
We will not collect, use or share a category of consumer health data not listed here without first asking for consent to it.
We obtain no health data from data brokers, other companies, public records or anyone other than the participant's own phone and the participant.
Consent to collect and consent to share are asked separately, at setup, before any step count is read, with nothing chosen in advance:
Each choice can be changed at any time in Settings, in the app or on the web. Consent to collect is withdrawn by revoking step-count permission in Apple Health or Health Connect, which stops all further reading while the app stays installed, by deleting the app, or by deleting the account. Withdrawing consent to share takes effect the next time the figures are shown; withdrawing consent to collect stops new data; neither by itself deletes data already held, which the deletion right below does.
When the wording of these choices changes in a way that widens what is shared or with whom, the apps show the new wording and ask again before anything new is shared.
Affiliates. None. Stringbet Software has no parent, subsidiary or affiliated company.
The challenge organizer. The organization running the challenge the participant joined sees each participant's daily totals, whether the phone is syncing, whether a goal was met on a day (never the goal itself), and progress on a virtual walk; once the participant has agreed to the consent wording that says so, which apps supply the totals (for example "Google Health"; a phone is never named). This is what running the challenge the participant asked to join requires: the organizer verifies results, answers participants' questions about missing days and awards the standings. The organizer can download a results file and a people file for its challenge. Under the terms for organizers the organizer may use participant data only to run the event, must keep it confidential, and must delete any copy it downloaded when the event's business is done. The organizer sees only the challenge it runs.
Other participants. Teammates and the team captain see what the sharing choices above allow. The captain always sees each teammate's daily average and whether the phone is syncing. On a virtual walk's map a participant is shown, by name and position, to teammates they share daily totals with and to friends if they chose to appear on challenge-wide lists; to nobody else.
Service providers (processors). Health data is stored on servers and in a database hosted by Render in the United States, and in the backup copies described below, which are kept on encrypted equipment Stringbet controls in the United States. No other provider holds health data: Cloudflare stores photos, Postmark delivers email, Apple and Google deliver push notifications to their own devices, and Stripe processes payments, and none of those services receives a step count. Notifications and emails never contain step figures. Each provider processes data only on our instructions, under a contract that limits it to that.
Nobody else. Health data is not shared with challenge sponsors, who supply posts that appear in the app and receive no data about participants; not with advertisers or advertising networks, since the apps contain no advertising and no third-party advertising or analytics SDKs; not with data brokers; and not with any government body unless the law requires it, in which case we disclose the minimum required.
On request, we will provide the names of the specific third parties with whom a particular participant's health data has been shared, which for every participant is the organizer of each challenge they joined and the providers named above.
We do not sell consumer health data and have never done so. If that ever changed, the law requires a separate written authorization, signed by the person, naming the buyer and the purpose, valid for one year at most and revocable at any time; we do not ask for such authorizations and have no plans to. We do not use geofencing of any kind, and the apps collect no location data, so no geofence can be set around any place that provides health care services.
Every participant has the right to:
How to exercise them. Use Settings in the app or on the web for sharing choices and deletion, or write to privacy@strideleague.com from the email address on the account or registration, which is how we confirm who is asking. If no address is on file, we will ask for enough to match the request to an account. We answer within 45 days. If a request is unusually complex we may take up to 45 more, and we will say so, with the reason, inside the first 45 days. Requests are free.
Appeals. If we decline a request, the answer says why. The person may appeal by replying to that answer or writing to privacy@strideleague.com with "Appeal" in the subject line within 45 days. We answer an appeal in writing within 45 days, with the reasons for the decision. A person whose appeal is denied may contact the attorney general of their state: in Washington, the Office of the Attorney General at atg.wa.gov; in Nevada, the Office of the Attorney General at ag.nv.gov; in Connecticut, the Office of the Attorney General at portal.ct.gov/ag.
Participation requires being 18 or older. The apps and the web interface ask for confirmation of age before any health data is read, and we do not knowingly collect data from anyone under 18.
Changes appear at this address with an updated date. Every version is kept, so we can say what this page said on any date. A change that widens what is collected or shared is not applied to a participant until they have agreed to it. This page is the canonical location of the Stride League Consumer Health Data Privacy Policy.