Consumer health data
Required disclosures about the health data Gaja collects, under Washington's My Health My Data Act and the state laws modelled on it.
Last updated 2026-08-18.
This page is not final. Gaja is not yet incorporated, so the governing law is still to be settled and is marked below where it belongs. Everything else describes how Gaja actually works today, and is meant to be relied on. If you are deciding whether to trust Gaja with health or financial data, ask us first — hello@gaja.life.
What this covers
This page covers consumer health data only, and contains only the disclosures the law requires it to contain. Everything else about privacy at Gaja — how data is protected, what we will never do with it, how households share — is in the privacy policy.
What we collect, and what it is used for
| Category | What it is | What it is used for |
|---|---|---|
| Sleep | Sleep periods, their duration and stages, and time in bed | Shown back to you in your own health view. Nothing else. |
| Cardiovascular measurements | Heart-rate samples and heart-rate variability | Shown back to you in your own health view. Nothing else. |
| Bodily functions and physical activity | Readiness scores and recorded workouts | Shown back to you in your own health view. Nothing else. |
| Identifiers linked to the above | The account identifier your provider issues, and the person record it belongs to | To keep your data attached to you and separate from anyone else's in your household. |
This data is not used for advertising, is not sold, and is not used to train any model.
Where it comes from
- You, by connecting a device or service and authorising Gaja to read it.
- Oura, the provider of that device, which supplies the measurements listed above.
Gaja does not buy health data, does not receive it from data brokers, and does not infer it from anything other than the sources you connect.
Your rights, and how to use them
You have the right to:
- Confirm whether we hold consumer health data about you, and see it.
- Know the list of third parties it has been shared with, and contact them.
- Withdraw your consent to its collection and sharing.
- Have it deleted, including by the third parties it reached.
- Appeal a refusal, if we ever refuse one of these.
To withdraw consent immediately: disconnect the provider on your connections page. That stops the collection and deletes the health data it fed, along with the stored keys.
For anything else on this list, including deletion of everything at once, email hello@gaja.life. A person handles it and confirms when it is done; there is no form. If we ever decline a request we will say why in writing, and you can reply to appeal it.
Questions about any of this go to hello@gaja.life. A person reads it.