Consumer Health Data Privacy Policy

1. Scope

This policy supplements our general Privacy Policy and explains our practices for consumer health data under applicable United States consumer health privacy laws, including Washington's My Health My Data Act. Consumer health data is personal information linked or reasonably linkable to a person that identifies or can be used to infer a person's physical or mental health status.

2. Consumer Health Data We Collect and Why

We do not collect precise location for health profiling, purchase health data from data brokers, or combine consumer health data for advertising.

3. Sources

We collect consumer health data from:

• You, when you enter, upload, record, or communicate information.
• Apple Health or another service you expressly connect, limited to the permissions you approve.
• Your device or platform when needed to deliver a feature you request, such as a workout timer or calendar synchronization.
• Calculations and inferences made from the information above to provide the features you choose to use.

4. When Consumer Health Data Is Shared

We share consumer health data only as needed to provide a feature you request, with your direction or consent, or when required for legal and safety obligations. Our service providers are contractually limited to processing data for the services they provide to us.

AI Recipients and Your Permission

• Content you choose to post may be shared with the audience you select, such as followers, friends, a trainer, or everyone.
• We may disclose data when legally required or reasonably necessary to protect a person, investigate abuse, or secure the service.
• We have no affiliates with which we share consumer health data.
• We do not sell consumer health data or share it for targeted or cross-context behavioral advertising.
• We do not share consumer health data with employers or insurers.

5. Your Choices and Rights

Subject to applicable law, you may ask us to:

• Confirm whether we collect or share your consumer health data.
• Access the data and receive a list of third parties and affiliates with whom it was shared.
• Withdraw consent for future collection or sharing.
• Delete consumer health data, including data held by service providers where required.
• Appeal a denial of your request.

Use the app's data controls or email privacy@totalfitconnect.com. You do not need to create a new account to submit a request. We may take reasonable steps to verify your identity and authority while requesting only the information needed for verification. We will respond within 45 days when Washington law applies, subject to any extension permitted by law. If we deny a request, our response will explain why and how to appeal.

We will not discriminate against you for exercising a privacy right. Withdrawing consent may prevent an optional health feature from working, but it does not remove access to unrelated app features.

6. Retention, Security, and Deletion

We retain consumer health data only while your account is active or while it is needed to provide a feature you requested, meet legal obligations, resolve disputes, or protect the service. Account deletion starts deletion from active systems and service providers, subject to limited legal, security, and backup retention described in our general Privacy Policy. We use access controls, encryption in transit, restricted production access, and vendor safeguards appropriate to the data.

When you use AI credits for a Coach answer, scan, or meal parser, TotalFit Connect stores that action’s inputs, including any photo, message, or meal transcript you selected, encrypted while the action is pending. Those inputs are deleted when the action finishes, fails, or expires. The result is kept encrypted for up to 7 days so you can recover it in Settings, then deleted. Workouts, recipes, and logs you choose to save from a result follow their usual retention.

7. Changes

We will not collect new categories of consumer health data or use existing consumer health data for materially new purposes without providing notice and obtaining any consent required by law. The updated date at the top identifies the current version.