Consumer Health Data Privacy Policy

What we collect

Only what you add to Labs, and the records that keep it under your control:

• Your lab values, with the reference range the lab printed, the collection date and the lab's name.
• The original file of a lab report, when you add one.
• The suggestions Marrow shows on each report.
• Your agreement to the Labs terms, and each time you agreed to share your labs with a coach, by name, and when sharing stopped.
• A record of every time your coach opened your labs.

Where it comes from

From you. You type your values in, or you add a file and check the values we read from it before anything is saved. If you share with your coach, your coach can drop a lab file to read it for you; nothing from it is saved to your account unless you add it yourself.

Why we collect it

To show you where each value sits and how it moves over time, to suggest general training and food habits, to remind you when a retest is due, to answer a question you ask with Ask Marrow in general education terms, and, only if you choose, to let the coach you name adjust your training and nutrition. Labs are general education, not medical advice, and nothing here is a diagnosis.

We never use your lab data for advertising, and it never goes to Meta or any marketing tool.

Who receives it

• Your coach, only if you choose. Sharing is off until you turn on Share with my coach and agree to share with that coach by name. Other coaches at your gym and your gym owner do not see it, and Marrow staff look at it only when you ask us for help or to keep the service safe. Turn sharing off at any time and your coach sees none of your reports, past or future. If you stop training with that coach, their access ends too.
• Cloudflare stores the original files.
• Supabase stores your values and the records above.
• No AI provider. Marrow sends your lab files and values to no AI provider. If you want a file read, you show it to your own Claude or ChatGPT, under your own account with that company, and check what it read before you save it. You can type your values in instead. If you ask your own Claude or ChatGPT about a report, you copy that report's marker table into it yourself; Marrow sends nothing.
• Anyone you choose, with Share with my doctor. Marrow makes a one page PDF of your lab values, the ranges your lab printed and the collection dates, with no Marrow comments, and hands it to you to save or send. Marrow does not send it to anyone and keeps no copy.
• Sentry receives error reports from our app and website. Before our servers send a report, they remove email addresses, payment keys and sign in tokens from it. Screen replays hide all text and images.

Each of these companies works for Marrow and handles the data only to provide its service to us. The full list is on our subprocessors page.

The program writer. Marrow does not write programs with an AI. If you draft one with your own Claude or ChatGPT, anything you tell it, including injuries or limits, stays with that company under your own account, and only the draft it saves comes into Marrow, where you or your coach can read and change it.

Your food log works the same way. Your coach sees the foods you log, day by day, only after you turn on Share my food log and agree to share with that coach by name. You can stop sharing at any time from your Fuel page, and your coach then sees none of your days, past or future. If you stop training with that coach, their access ends too. Notes your coach leaves on a day stay in your account.

We do not sell it

We do not sell, rent or license your consumer health data, including in a form with your name removed.

Your rights

You can ask us to:

• Confirm whether we hold consumer health data about you, and give you a copy. Download your data under Settings, Download your data. The export lists your lab records, who you shared with, and a link to each original file.
• Tell you every company and person we shared it with.
• Delete it. Delete one report or all of your labs on your Labs page. Deleting your account deletes them too. Copies in our encrypted backups clear within 6 months.
• Withdraw your consent. Turn off Share with my coach to stop sharing. To stop Labs altogether, delete your labs.
• Reconsider a request we turned down. Reply to our answer and ask us to look again.

How to ask

Use the contact form and say it is about consumer health data. We may ask you to confirm it is your account. We answer within 45 days. If we need longer, we tell you why within those 45 days and answer within 45 more. There is no charge.

Changes to this policy

If we change what we collect or who receives it, we update this page first and ask for your agreement again where the law requires it.