The Google Health Data Privacy Notice applies only to health data connected through the Google Health API.
League, Inc. (“League”, “we”, “us”, “our”), by itself and through its affiliated entities, provides health and benefits technology. Some people use an application League provides directly. Others use an application provided by their insurer, health plan, employer or another organization (“Customers”), built on League’s technology. This notice describes how League handles the activity and fitness data that Users choose to connect from their Google account through the Google Health API, and it applies the same way in both cases.
Where a User’s application is provided by a Customer, that Customer decides what information is collected and how it is used, and the Customer’s own privacy policy or notice of privacy practices governs that relationship. Users should contact their Customer with any question about their information or to exercise their individual privacy rights. Where a User’s application is provided by League directly, League’s Platform Privacy Policy governs and Users can contact League.
This notice does not replace either document. It describes only how League handles the data it receives through the Google Health API, and does not apply to any other information League processes.
What we collect
When a User connects their Google account to a Customer application, League requests read-only access to the User’s activity and fitness data, and to the time zone setting on their Google account. The activity data League receives and uses is:
- Steps
- Active duration
- Floors climbed
- Distance
- Energy burned
The time zone setting is used only to attribute activity to the correct local day.
Why we collect it
League uses this data to provide the following features inside the Customer’s application, which the User can see:
- Health Dashboard — displaying activity metrics and trends over time
- About Me — populating personal health insights
- Health Programs and Challenges — automatically completing activities when a User meets a goal, such as a daily step target
How we store it
Data received through these scopes is stored on League’s platform in the environment operated for the relevant Customer, protected by the security controls described in League’s agreement with that Customer.
Connected activity data is retained under League’s record retention schedule, which applies to member records generally and provides for deletion after a defined period of account inactivity, or under the Customer’s own retention requirements where their agreement with League specifies a shorter period.
Who we share it with
We share this data with the Customer whose app the User is enrolled in, and with service providers that operate parts of the platform on League’s behalf under contract — including hosting and storage, the device-connection service, and the service that calculates program and challenge achievements. The subprocessors League engages are listed at https://trust.league.com/item/subprocessors. We do not share this data with anyone else.
Limits on how we use it
League’s use of data obtained through the Google Health API is limited to providing and improving the User-facing features described in this notice. These limits apply equally to data in aggregated, anonymized or derived form. We do not:
allow humans to read it, except where necessary to investigate a security issue or a technical problem such as a device sync failure, to comply with the law, or where the data is aggregated and used for internal operations
- sell this data, or transfer it to advertising platforms, data brokers or information resellers
- use data to serve advertising of any kind, including retargeting or interest-based advertising
- use data to determine credit-worthiness or for lending purposes
- allow humans to read it, except where necessary to investigate a security issue or a technical problem such as a device sync failure, to comply with the law, or where the data is aggregated and used for internal operations