Privacy & Consumer Health Data Policy

1. Scope and operator

This policy applies to the Work + Workout website, progressive web app, iOS and Android applications, account services, AI Coach, calendar sync and related support services (together, the “Service”).

Bibinii Holdings LLC, a New Jersey limited liability company with a mailing address in Branchburg, New Jersey, United States (“Work + Workout,” “we,” “us” or “our”), is the operator and data controller responsible for the Service except where a provider acts as its own controller under its terms.

2. Personal data we collect

Passwords are handled by our authentication provider and are not stored by us in readable form. We do not intentionally collect government identifiers, precise GPS location, payment-card numbers, genetic data, diagnoses or medical records through the ordinary planner flow.

3. Sources of data

We receive information:

• Directly from you, including entries, account details, files, photos, chats, support messages and permissions you choose to provide.
• From your device, including locally stored planner records, camera/photo selections, notification permission, supported health-export files you select and—only after you connect the relevant feature—daily step or calorie-burn totals from Apple Health or Android Health Connect.
• From services you connect, such as Google Calendar, Microsoft Outlook Calendar, your chosen WebDAV server and app-store billing where paid features are offered.
• From service providers, including authentication/account status, AI responses, food/product data, performance measurements and limited operational logs.
• From calculations and inferences, such as estimated calories, TDEE, BMI, strength, recovery readiness, trends and suggested training or nutrition plans based on your entries.

4. How and why we use data

We process data to:

• provide the planner, diary, training history, recovery trends, invite-only challenge boards, reminders, backups and account sync you request;
• personalize schedules, fitness and nutrition suggestions around your stated goals, work pattern, availability and recovery;
• authenticate accounts, restore data across devices and protect each user’s records;
• run optional AI, food lookup, calendar sync, file import and private WebDAV features;
• maintain service reliability, enforce rate limits, diagnose broad error categories, prevent abuse and secure the Service;
• respond to support and privacy requests and comply with legal obligations; and
• create aggregated or de-identified information that cannot reasonably identify you.

Depending on the law that applies, we process ordinary personal data to perform the service or contract you request, with your consent, for our legitimate interests in securing and reliably operating the Service where those interests are not overridden by your rights, and to comply with law. You may withdraw consent at any time, without affecting processing that was lawful before withdrawal, but the affected feature may stop working.

EEA and United Kingdom legal bases. Where the EU GDPR or UK GDPR applies, the corresponding bases are Article 6(1)(b) for account and requested-service performance, Article 6(1)(f) for proportionate security, fraud prevention and service reliability, Article 6(1)(c) for legal obligations, and Article 6(1)(a) for optional processing based on consent. We do not rely on legitimate interests as the Article 9 condition for health data.

Remembering your choices. At the start of onboarding, terms acceptance and acknowledgment of this policy are shown separately from the optional health-data choices. We save the terms and policy versions, statement and acceptance time with your account, independently of planner backups. Both on and off choices are restored when you sign in again or use another device; ordinary app updates do not reset them. Without an account, the record stays on this device and cannot survive clearing browser storage. A new agreement is requested only for relevant material changes, not every visit or feature use. You can change optional choices at any time. Account deletion also removes these account-linked records.

5. Consumer health data notice

Nutrition, exercise, body, sleep, heart-rate, recovery, schedule and wellness information—and inferences drawn from it—may be “consumer health data,” “special personal data” or “sensitive personal information” under applicable law.

Categories and purposes

We collect the fitness, nutrition, body/recovery, challenge, schedule and AI categories listed in Section 2 to provide requested logging, planning, trend, sync, challenge-board and coaching features; keep your records available; and protect the Service. We do not collect additional health categories or use health data for a materially different purpose without giving the required notice and obtaining consent where required.

Health-data sources

Sources are you, files and photos you select, Apple Health or Health Connect when you intentionally connect phone activity, other services you intentionally connect, and estimates the app derives from those inputs. We do not buy health data from data brokers.

Health-data disclosures

Depending on the feature you select, health data may be disclosed to Supabase (account storage/authentication and invite-only challenge boards), Vercel (API hosting), Cloudflare Workers AI (AI Coach, nutrition guidance, equipment-image understanding and Meal Scan), OpenAI (AI onboarding, optional roster reading, schedule reading and plan refinement), Google or Microsoft (calendar sync), Open Food Facts (food/barcode lookup), your chosen WebDAV provider, app stores for subscription status where applicable, and the people on a challenge board you intentionally join as described in Section 6. We have no affiliate that receives consumer health data for its own independent use.

Your health-data rights

Where applicable, you may confirm whether we collect, share or sell consumer health data; access it; obtain a list of third parties and affiliates that received it; withdraw consent; and request deletion from us and the processors we control. You may exercise these rights through the controls described in Section 10 or by email. If we deny a request, reply with “Appeal” and the reason you disagree. We will provide a written appeal decision and, where required, information about contacting the relevant regulator.

We will not discriminate against you for exercising a privacy right. We will obtain separate valid authorization before any sale of consumer health data. We do not use geofencing around healthcare facilities to identify, track, collect from or send health-related messages to people.

6. Feature-specific details

Guest planning

You can use the core planner without an account. Guest calendar, training and nutrition records stay in this app or browser on your device, separate from signed-in account copies. They are not automatically uploaded when you sign in. Use an export to keep a backup: clearing app/browser storage or losing the device can remove guest records. Online features such as food lookup still contact the providers described below when you choose to use them. Cloud backup, AI and challenge boards require an account.

Invite-only challenge boards

Challenge boards are optional and require a signed-in account and a separate saved Challenge sharing choice. The unchecked sharing confirmation when creating or joining a board explains that participants can see your chosen display name and aggregate score, rank and progress, including steps, completed workouts or active calories you send. Other participants do not receive your email address, account ID, meals, food entries, workout details, schedule, body measurements, health records or the source data behind a score.

Turn off Challenge sharing in your privacy choices, or turn off all optional uses, to stop new score updates and hide your name and scores from other participants. This is enforced by the server even for older app versions. Existing records are retained privately until you remove your scores, leave a board or delete your account. Allowing sharing again does not restart automatic updates or republish previous scores by itself; you must choose to send a score or enable automatic updates. Withdrawal cannot recall information others already saw or saved. Safety reporting, blocking, leaving and removal controls remain available.

For step, active-calorie and completed-workout challenges, explicit sync sends only that day’s aggregate challenge number already available on your device. Step and active-calorie scores can also be entered manually; custom goals use the number you enter. Automatic updates are off by default; enabling them in a board’s Safety & options saves that choice and permits updates while you use the app. These values may be estimates, self-reported or incomplete. Boards are not public or searchable. Only an owner receives the private invite code and can replace it. Anyone receiving a valid invitation may be able to join, so share it only with intended people.

You can remove your shared scores and turn off automatic updates, or leave to immediately remove your membership, display name and scores. An owner can end a board to keep the final results or permanently delete the board and its members’ scores. Challenge data is hosted by Supabase and served through Vercel. It is not sent to OpenAI and is not used for advertising or employment decisions. Removing data cannot recall copies other participants already saw or saved.

Challenge safety: when you report a board or member, we store the reason, board/name snapshot, your account reference, the reported account reference where applicable, and review decisions for moderation. We do not include underlying health records or score histories in the report. Reports are not visible to other participants. Resolved reports, appeals and private notices are retained for 90 days after the latest resolution, then removed by daily maintenance; open reports and pending appeals remain until reviewed. Deleting the reporter’s or reported member’s account removes linked reports, appeals and notices. A minimal decision trail with opaque case and responder references remains for its 90-day retention period; it does not contain copied report text, health records or account identifiers. Blocking stores the two account references and a display-name label until unblocked or an account is deleted; the app exposes only opaque safety-action handles, not account IDs. Blocks hide names and scores in both directions. On boards owned by either person, the other person’s membership and scores are removed. Moderators may hide content or suspend challenge access, and you may appeal from Challenges → Safety updates or contact support for help. Internal review notes and the reporter’s identity are not included in the decision notice. See the Community rules.

Local-first planner and account sync

Planner records are stored in browser/app storage. Creating or signing into an account does not by itself upload planner health data. When you separately consent to private account cloud sync and choose sync or migration, eligible schedule, training, nutrition, body, recovery, profile and settings records are uploaded to your private account. Authentication sessions are also stored on the device so you can remain signed in. WebDAV credentials, backup passphrases and private sync passwords are excluded from account migration.

Local Hours & pay tracker

Hourly rates, actual work hours, break times, pay rules, deductions and payslip amounts you enter in Hours & pay are stored in this browser or app on your device, separately for each signed-in account. These records are not included in Work + Workout cloud sync, WebDAV backups, AI requests or usage analytics. Calendar shifts used to make an estimate retain their existing calendar sync settings. The work timer saves timestamps; it does not track your location.

You choose whether to export a timesheet. An exported file may contain work and pay information, so share and store it carefully. Excluding an entry keeps it available to restore in the tracker. Confirmed account deletion removes that account’s tracker records on the current device; clearing this app’s local storage also removes them. Exported files and copies on other devices are not automatically deleted. Export a copy before changing devices or clearing storage.

AI Coach, AI onboarding and Meal Scan

Nova day planning is a separate choice: after you enable both AI tools and Nova day planning, sending a Nova message shares recent conversation and a limited view of your next seven days with Cloudflare Workers AI. The view can include calendar titles, dates, times and event identifiers; work availability and sleep windows; training goals, equipment, movement limitations and recent workout effort; logged sleep; today's nutrition totals, food preferences and restrictions; and the measurements and activity setting used to estimate your targets. Your device's local date, time and time zone help resolve scheduling requests. Hours & pay records, credentials and your full planner archive are excluded. Existing AI consent alone does not enable this additional context. You can decline or withdraw this choice in Account & privacy and continue using the on-device planner.

Proposed actions: Nova can prepare an event or workout change. The app validates the proposal and you apply it before it changes your calendar. Applied changes use existing planner records and follow your account-sync and connected-calendar choices. A local save does not mean another device or calendar provider has received it; check sync status. Clearing chat does not undo events or workouts you already saved.

Chat and action records: the device keeps up to 60 recent chat entries, including proposal details. Your account stores conversation text separately from planner backup; opening Nova refreshes its recent text history. Proposals restored from a saved conversation cannot be applied without a fresh schedule check. Clearing chat deletes account conversation text and recoverable answers and clears this device's chat. Other devices refresh account text when Nova is reopened; offline copies and exported files may remain until refreshed or removed there. Applied calendar records retain an action identifier to avoid duplicate saves and follow planner retention.

Calculated targets: calorie estimates use the adult age, height, weight, equation setting and activity level you provide, with the method and inputs saved alongside the estimate. Missing measurements do not justify an invented target. Schedule changes do not count as measured calorie expenditure.

Recovering interrupted AI requests: we temporarily store generated answers and scan, schedule or plan previews in your private account so retrying can return the same result without another generation. These saved results stop being available after seven days and are scheduled for deletion by maintenance. Request IDs, input fingerprints, feature and allowance records remain until account deletion to prevent duplicate charges; this retry record does not contain the original input or photo. Your device keeps account-specific pending request IDs and fingerprints for retry. Ordinary saved chats and plans have the retention described below. Clearing a saved chat also deletes its recoverable answer. Account deletion removes all account-linked AI and billing records.

Reporting an AI answer: if you choose Report answer, you can preview the text before sending it to our safety reviewer. Sending a report authorizes us to review that text, which may include health or personal details already present in the answer. We store the reported text, your chosen reason, your account reference, timestamps and the review decision in a private Supabase inbox through Vercel. Your question, original photo and other planner records are not attached. Reports are not shared with other users or automatically sent to an AI provider. An open report remains until reviewed; the reviewer deletes resolved reports after 90 days. Permanent account deletion also deletes your AI reports. Deleting a chat alone does not delete its separately submitted report; you can contact us about a report using the privacy contact below.

After you turn on AI tools once and submit a request, the Work + Workout server sends only the message, selected photo and relevant planner context needed for the tool you chose. This can include work schedule, goals, training, nutrition, body or recovery information. AI Coach, nutrition guidance, equipment photos and Meal Scan are sent to Cloudflare Workers AI. AI onboarding, roster and schedule reading, and plan refinement are sent to OpenAI with API storage disabled by Work + Workout. Cloudflare states that it does not use Workers AI customer content to train models or improve services without explicit consent; see its data-use documentation. OpenAI may retain limited request data under its security and abuse-monitoring practices. We do not enable model training on your planner data. Work + Workout stores AI Coach text conversations in your account for continuity until you delete the conversation or account. Declining or withdrawing AI-tools consent does not prevent the deterministic on-device planner from building a starting plan.

If you attach an equipment photo, a resized image is transmitted for that answer. Work + Workout does not intentionally save the image in its chat database; it saves the text “[equipment photo]” and the resulting conversation.

If you use Meal Scan, a resized meal photo is sent to Cloudflare Workers AI for one-time analysis after you select the photo and confirm the analysis action. Work + Workout does not intentionally store the meal photo or add it to your AI conversation. The estimated foods are returned to your device and remain an unsaved draft until you review and confirm them; confirmed items are then handled like other diary entries and may be included in account or WebDAV sync you enable. Do not include faces, name badges, medical documents or other sensitive background information in equipment or meal photos.

Schedule photos, PDFs and voice

For roster photos, you highlight your own row, date headings and any needed shift-code key on your device. Only those selected image sections, the name or employee ID you enter to identify your row, and the roster month are sent through our server to OpenAI, after you enable personalized AI and confirm this scan. Unselected parts of the photo stay on your device. If you choose “Photo is only mine”, the whole photo becomes selected; use that option only when it contains no other employees’ information. Do not include patient details, medical records or unrelated personal information.

Work + Workout does not intentionally save the original photo, selected image, or roster identity in server logs or a photo database. OpenAI requests use API storage disabled, but limited provider retention for security and abuse monitoring may still apply. Proposed shifts remain an unsaved preview until you approve them. Approved dates and shift times become calendar records and may be included in account or WebDAV sync you enable. AI can misread photos, so check dates, times and missing entries before approval. You may cancel before sending, or use manual calendar entry instead; cancelling after a request has been sent cannot undo that transmission.

PDF text extraction runs in the app/browser. If you choose the AI accuracy check for an extracted PDF roster, the app sends only the locally matched row and relevant date headers for a review-before-save proposal. Voice input uses the speech-recognition service supplied by your browser or operating system and is subject to that provider’s privacy practices.

Health and CSV imports

Selected Apple Health export or CSV files are parsed on your device to extract supported values such as weight, sleep, steps and resting heart rate. The original file is not intentionally uploaded through the normal import flow. Extracted values become local planner records and may later be included in account or WebDAV sync you enable.

Automatic phone activity tracking

The iOS and Android apps can request read-only access to your daily step total and calorie-burn total through Apple HealthKit or Android Health Connect. Step access is requested when you connect phone steps. Apple Health Active Energy Burned or the corresponding Health Connect calorie total is requested only when you choose to sync a calorie challenge. Work + Workout does not write to those services, request precise location for activity tracking, or run its own continuous motion sensor in the background.

The daily aggregate, source label and last-sync time are stored in the existing health log on your device. Reading the value does not send the underlying Apple Health or Health Connect records to us. If you deliberately join a challenge, the relevant daily aggregate score is sent to that private challenge board so participants can see your score; they do not receive the underlying health records. Like manually entered or imported recovery data, locally saved values may also be included if you separately enable account sync or encrypted WebDAV sync. You can revoke access in Apple Health/Settings or Health Connect.

Food search and barcodes

Barcode images are processed on your device where supported. Barcode numbers and food-search terms are sent to Open Food Facts to return product information. Meal photos are handled through the optional AI process described above. Food database and Meal Scan values can be incomplete or wrong; review estimates and verify labels when accuracy matters.

Google and Outlook Calendar

If you connect a calendar, we request access to read and write calendar events. We store the connected email/ID, permission scopes, event-link identifiers and encrypted access/refresh tokens. Sync compares a limited date range, creates or updates approved events, and returns external changes for review. You can disconnect either provider in the app; we delete our stored connection and event links and attempt provider-token revocation where supported. Events already written to the provider may remain until you delete them there.

Backups and WebDAV

You can export plain or AES-GCM encrypted backup files. After you separately consent to encrypted WebDAV sync and configure it, encrypted backup content is sent directly to the HTTPS server you specify. The server address and username remain in local device storage; the WebDAV password and encryption passphrase are kept for the browser session. Your chosen storage provider controls copies held there.

Optional usage counts

In More, you can choose to share anonymous usage counts. This is off until you turn it on and is separate from account and health-data consent. The app sends only small counts of app opens and visits to six fixed main screens. Our server adds these to shared daily totals in Supabase; it does not keep individual usage events or associate the totals with an account. These aggregate statistics may be retained to compare usage over time.

The usage report contains no email, account or device identifier, health or planner content, search terms, exact event time, page URL, referral source, location, or browser/device details. It uses no tracking cookie or visitor fingerprint and does not measure unique people. A local yes/no setting remembers your choice on this device. Turning it off stops future counts and clears unsent counts; already combined totals cannot be separated by person. Global Privacy Control and Do Not Track also stop these reports. As with other requests to the app, hosting infrastructure receives ordinary network information; that information is not copied to the usage tables or dashboard. Existing error monitoring is separate, as described below.

Performance and error monitoring

Vercel Speed Insights may measure page performance. Our first-party error reporter sends the error type, a privacy-filtered message pattern and stack, app-relative route path, platform, release and time. Repeated incidents are grouped with an occurrence count. It does not send an account ID, name, email, cookies, authorization tokens, request bodies, URL queries, planner contents or health data. The server removes common credentials, identifiers, email addresses, quoted values, long numbers and query strings before storage. To prevent abuse, we derive a rotating daily HMAC from the network address and retain that pseudonymous rate-limit value for about seven days; we do not store the raw address in the incident table, although hosting systems receive ordinary request data such as IP address, time and user agent.

On iOS, Apple MetricKit may deliver crash and hang diagnostics to the app after the incident; on Android, a small private crash report is sent after the next launch. These native reports include the app version, error class and app call-stack information, not the exception’s user-entered message. A reporting failure never blocks normal app use.

7. When we disclose data

We do not disclose personal data except:

• At your direction, to run a feature, show your chosen display name and aggregate score to participants on an invite-only challenge board you join, export/share a file, connect a calendar or send a backup to your chosen provider.
• To processors and infrastructure providers that help operate the Service, subject to their contracts and applicable law. Current providers include Supabase, Vercel, Cloudflare, OpenAI, Open Food Facts, Google and Microsoft.
• For legal and safety reasons, if reasonably necessary to comply with law, respond to lawful process, protect rights or safety, investigate fraud, or secure the Service. We will limit disclosure where legally permitted.
• In a business transaction, such as financing, merger, acquisition or asset transfer, subject to confidentiality and notice/consent obligations that apply to sensitive health data.

Providers may process data in other countries and may act as independent controllers for their own account, security or legal obligations. Their policies govern those independent uses.

8. No sale, targeted advertising or unrelated profiling

We do not sell or rent personal data or consumer health data. We do not share personal data for cross-context behavioral advertising, serve targeted advertisements based on health information, or use health data to determine eligibility for employment, insurance, credit, housing or similar decisions. We do not currently use third-party advertising cookies or SDKs.

9. Retention and deletion

• Device data: remains until you delete it in the app, clear site/app storage, or uninstall/reset the app. Recovery snapshots are limited in the app, but device or system backups may retain copies.
• Account data: planner state, profile/onboarding data, generated plans, AI conversations, calendar connections, challenge memberships/scores and per-account usage records remain while your account is active unless you delete the relevant record, leave the challenge or disconnect a service. Permanent account deletion removes the authentication user and associated cloud rows through database cascade.
• Consent receipts: versioned grants and withdrawals remain with the account as an accountability record. They are append-only so a later withdrawal does not rewrite the earlier grant. Permanent account deletion removes them through database cascade; limited legal-claim records may be retained where law permits.
• Calendar authorization state: expires after approximately ten minutes and is cleared during later connection attempts. Encrypted tokens remain until disconnection, account deletion or provider revocation.
• Error reports and operational logs: privacy-filtered incident rows are configured for deletion after approximately 90 days as new reports are processed, and rotating diagnostic rate-limit hashes after approximately seven days. Other hosting logs are retained only as long as reasonably necessary for security, fraud prevention, troubleshooting and legal compliance, according to our hosting configuration and provider retention schedules.
• Your exports and third-party copies: backups, calendar events, screenshots or files you saved or shared are outside our control and must be deleted where you stored them.

Deletion may not remove de-identified data that cannot reasonably be linked to you or records we must keep to establish, exercise or defend legal claims. When an applicable consumer-health law requires deletion through our processors, we will transmit the request to processors we control.

10. Your choices and privacy rights

Controls available now

• Edit or delete individual meals, foods, workouts, measurements, schedule items and AI conversations in the app.
• Export a planner backup or diagnostics file from More → Data & Backup.
• Disconnect Google or Outlook Calendar from calendar settings.
• Remove shared scores, pause automatic updates, leave a board, report or block another participant; owners can end or permanently delete a board.
• Connect or refresh read-only Apple Health or Health Connect activity access from the relevant step or challenge screen, and revoke the permission in your phone settings.
• Delete device data from More → Data & Backup.
• Permanently delete your account and associated cloud data from the account menu.
• Review granular health-data purposes or withdraw all health-data consent from More → Account & sync. Local planning remains available after withdrawal.

Requests

Depending on where you live, you may request access, confirmation, correction, deletion, restriction, objection, portability, withdrawal of consent, a description of recipients, or review of a significant automated decision. You may also opt out of sale/sharing and limit certain uses of sensitive data; because we do not sell/share for advertising, no opt-out is needed for those practices.

Email support@workandworkout.com with the subject “Work + Workout Privacy Request.” Describe the right you want to exercise and the email on the account, if any. Do not email passwords, full health exports or unnecessary medical details. We may verify your identity or authority to protect the account. You do not need to create a new account to make a request.

We make this request channel available to users worldwide, even when a local law grants fewer rights. Some rights may be limited by lawful exceptions, and we will explain any refusal. We will respond within the period required by applicable law. If you are dissatisfied, reply with “Appeal.” You may also complain to the New Jersey Division of Consumer Affairs or your local privacy regulator. Region-specific deadlines and complaint options appear in Section 12.

11. Security

We use HTTPS, authenticated sessions, database row-level access controls, restricted server credentials, encryption for stored calendar tokens, encrypted-backup options, rate limits and data-minimizing request design. Access is limited to people and systems that need it to operate the Service. No system is perfectly secure. Protect your device, account password, exported files and backup passphrases, and contact us promptly if you suspect unauthorized access.

If a breach affects covered health information, we will investigate and provide notices to affected people and regulators as required by applicable breach-notification laws.

12. Global and regional privacy notices

Global baseline and international transfers

Our business mailing address is in the United States and offer the request process, no-sale commitment, data-minimization practices and health-data protections in this policy to users worldwide. Local law may provide additional or stronger rights, which are not limited by this policy.

Our providers may process data in Ghana, the United States, the European Economic Area, the United Kingdom and other countries whose privacy laws may differ from yours. Where a restricted transfer requires a mechanism, we use an applicable adequacy decision or approved contractual safeguard, such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Agreement or UK Addendum, together with a transfer-risk assessment and supplementary measures where required. Vercel’s Data Processing Addendum, Cloudflare’s Data Processing Addendum and OpenAI’s Data Processing Addendum publish their transfer terms. We must ensure a valid mechanism covers each restricted transfer; policy text alone is not a transfer mechanism. If you direct data to a calendar, app store, Open Food Facts or WebDAV provider, that provider’s locations and transfer terms also apply.

European Economic Area (EEA)

For people in the EEA, Bibinii Holdings LLC is the controller for the processing described in this policy. The Article 6 and Article 9 bases are stated in Section 4. Subject to exceptions in the EU GDPR, you may be informed about processing; access and receive a copy of your data; correct it; erase it; restrict processing; receive portable data; object to processing based on legitimate interests; withdraw consent; and not be subject to a decision based solely on automated processing that produces legal or similarly significant effects. Work + Workout’s coaching, recovery, nutrition and training suggestions do not make such decisions.

We generally respond to a valid request within one month. A lawful extension of up to two further months may apply for a complex or numerous request, and we will explain it within the first month. You may complain to the data-protection authority where you live, work or believe an infringement occurred; the European Data Protection Board lists EEA supervisory authorities. You also retain the right to a judicial remedy.

United Kingdom

For people in the UK, the UK GDPR and Data Protection Act 2018 may provide the rights and one-month response period described above. You may complain to the Information Commissioner’s Office (ICO) and seek a judicial remedy. Restricted transfers from the UK will use an applicable UK adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another permitted safeguard.

EEA and UK representative status

Our business mailing address is in the United States and have not named a separate EU or UK representative in this policy. You can contact the controller directly using Section 15. Before we actively target people in the EEA or UK, or conduct monitoring that triggers Article 27 of the EU or UK GDPR, we must appoint the required representative or establish that a documented exception applies, then publish the representative’s details here. Direct contact with us does not remove that legal requirement.

Switzerland

Swiss residents may request access, correction, deletion, restriction or portability where provided by the Federal Act on Data Protection and may complain to the Federal Data Protection and Information Commissioner. Transfers from Switzerland will use an adequacy decision, recognized contractual clauses or another lawful safeguard where required.

United States

Depending on your state, you may have rights to know, access, correct, delete and port personal data; opt out of sale, targeted advertising or certain profiling; limit or consent to sensitive-data processing; obtain a list of certain recipients; and appeal a refusal. We do not sell personal data or use it for targeted advertising. Residents covered by Washington’s My Health My Data Act, Nevada’s consumer-health law or similar laws also have the health-data rights in Section 5. Washington residents may contact the Washington Attorney General after completing our appeal process. California and other state residents may use the same private request channel in Section 10, and an authorized agent may submit a request where law permits.

Canada

Where the Personal Information Protection and Electronic Documents Act (PIPEDA) or a provincial privacy law applies, you may request access to and correction of personal information and challenge our compliance. Consent will be meaningful and appropriate to the sensitivity of the information. You may complain to the Office of the Privacy Commissioner of Canada or the applicable provincial regulator.

Brazil

Where Brazil’s Lei Geral de Proteção de Dados (LGPD) applies, you may request confirmation of processing, access, correction, anonymization, blocking or deletion of unlawful or unnecessary data, portability where regulated, information about recipients and consent choices, withdrawal of consent, and review of qualifying automated decisions. You may petition Brazil’s National Data Protection Authority (ANPD).

Australia and New Zealand

Australian users may request access and correction and complain under the Privacy Act 1988 and Australian Privacy Principles where they apply; unresolved complaints may be made to the Office of the Australian Information Commissioner (OAIC). New Zealand users may request access and correction under the Privacy Act 2020 and complain to the Office of the Privacy Commissioner. We will take the steps required by applicable law before disclosing personal information overseas.

South Africa, Singapore and Japan

Where applicable, South African users may exercise access, correction, deletion and objection rights under the Protection of Personal Information Act (POPIA) and complain to the Information Regulator. Singapore users may request access and correction and withdraw consent under the Personal Data Protection Act (PDPA), subject to exceptions, and contact the Personal Data Protection Commission. Japanese users may exercise rights available under the Act on the Protection of Personal Information (APPI) and contact Japan’s Personal Information Protection Commission.

Other locations

If your country or region is not listed, the baseline commitments and request channel in this policy still apply. We will also honor non-waivable local privacy, data-protection, consumer-health and breach-notification rights. Contact us if you need the name of a local regulator or an accessible copy of this policy.

13. Children

The Service is intended for adults aged 18 and older. We do not knowingly collect personal or health data from anyone under 18. If you believe a minor has provided data, contact us so we can investigate and delete it. This age limit does not replace parental-consent requirements that may apply in a particular country.

14. Changes to this policy

We may update this policy to reflect new features, providers or legal requirements. We will change the effective date and provide additional notice or obtain consent when required. We will not use previously collected consumer health data for a materially different purpose without the notice and consent required by law.

15. Contact us