Consumer Health Data Privacy Policy

This policy applies to “consumer health data” as defined by US state consumer health data laws, including Washington's My Health My Data Act and Nevada's SB 370, and supplements our Privacy Policy. It applies to residents of those states, and to anyone whose consumer health data is collected in them.

• Answers you give to onboarding and check-in questions about injuries, pain and mobility, medications and supplements, diagnosed medical conditions, food allergies and dietary requirements, alcohol consumption, and sources of stress.
• Health notes you provide when using the AI meal planner or workout builder (conditions, medications, allergies, injuries).
• Data read, with your device-level permission, from Apple Health or Google Health Connect: steps, sleep duration and stages, dietary nutrition, resting heart rate, workout heart rate (average and maximum), active energy, and workout sessions.
• Data you log in the daily tracker: sleep, stress and motivation ratings, nutrition, water intake, and body weight.
• Body measurements and progress photos, if you use those features.

Solely to provide the service: personalising your training and nutrition coaching, letting your coach coach you, generating AI coaching responses, and showing you your own trends. We do not use consumer health data for advertising, and we do not sell it.

We collect the health data described above only with your consent, given on a dedicated screen during onboarding. Sharing it with your coach and including it in AI coaching requests are covered by the same consent, described on that screen before you decide. Declining skips the health questions, and the rest of the app works normally. You can withdraw consent at any time from your Account page, and revoke device health permissions in your device settings.

We share consumer health data only as needed to provide the service, with: your assigned coach (if you have one); Supabase (database hosting); OpenAI (processing AI coaching requests — inputs are not used to train their models); Vercel (application hosting); and Apple or Google if you enable writing workouts back to your device's health store. We do not sell consumer health data, and we do not share it with advertisers or data brokers. A list of the categories each provider receives is in our Privacy Policy.

• Access. Ask what consumer health data we have about you and who we have shared it with.
• Withdraw consent. Use the health data toggle on your Account page, or contact us.
• Deletion. Ask us to delete your consumer health data, or your whole account. See our account deletion page. Deletion requests are honoured within the timelines the applicable law sets.
• Non-discrimination. We will not deny you the core service for exercising these rights — declining health-data consent only switches off the health-dependent features.
• Appeal.If we refuse a request, you may appeal by replying to our decision email with “Appeal” in the subject line. We will respond within the period the applicable law sets. If your appeal is unsuccessful, you can contact your state Attorney General.

To exercise any of these rights, email info@gymbro.com.au. We will verify the request using the email address on your account.