Isofit Consumer Health Data Privacy Policy

Version

1.2

Effective Date

September 24, 2026

Applies to

Everyone who uses Isofit. This policy is written to meet the Washington My Health My Data Act and Nevada's consumer health data law (SB 370), and it supplements our Privacy Policy.

Contact

privacy@isofit.app

This policy explains what consumer health data Isofit collects, why, where it comes from, who it is shared with, and the rights you have over it. It is the "Consumer Health Data Privacy Policy" linked from the health-data consent screen in the Isofit app.

We do not sell consumer health data. We do not use it for advertising. Our AI providers do not train their models on your conversations or your health data.

1. What We Mean by Consumer Health Data

Consumer health data is personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status. In Isofit that includes:

• Workouts you log: Activity sessions, exercises, sets, reps, weight, RPE (rate of perceived exertion), session notes, and quick logs entered by text or voice.
• Voice input: Recorded audio and transcripts from voice workout logging or Atlas dictation when they contain health or fitness information. Section 2 explains the processing for each feature.
• Injury, pain, and limitation details you share, whether in your profile, a session note, or a conversation with Atlas.
• Atlas coaching conversations: Messages to our AI coach, images or video you submit for form checks, voice transcriptions, and — if you opt in to personalization — the memory items Atlas keeps about your goals, injuries, and preferences.
• Apple Health data, if you connect it: Workouts (type, time, duration, distance, average and maximum heart rate, active energy) and daily summaries (steps, exercise minutes, sleep duration, resting heart rate, walking and running distance).
• Derived data: Training insights we compute from the above, such as muscle-group frequency, volume trends, and personal records.

2. Why We Collect It and How We Use It

Apple speech recognition runs on your device when supported and may otherwise process audio on Apple's servers. When you choose voice workout logging, the transcript is sent to Isofit and then to OpenAI to create a workout draft. If recognition is unavailable, fails, returns no text, or has low confidence, the recorded clip is sent to Isofit and then to OpenAI for transcription. You review the draft before saving it. This voice workout processing occurs whether or not Atlas personalization is enabled; you can use text entry instead.

Atlas dictation places recognized text in a draft and does not send the audio to Isofit or OpenAI. Once you choose Send, that text is processed and stored like other Atlas messages.

We also use technical and security data to keep the platform safe, as described in our Privacy Policy. We do not use consumer health data for advertising, and we do not sell it.

If we ever want to collect a new category of consumer health data, use it for a new purpose, or share it in a new way, we will update this policy and ask for your consent first.

3. Where It Comes From

• You, when you log a workout, share an injury or limitation, or talk to Atlas.
• Apple Health, through Apple's HealthKit framework, only after you connect it and allow each data type in the iOS permission screen.
• Isofit itself, when we derive insights from the data above.

4. Who We Share It With

We do not sell consumer health data, and we do not share it with advertisers. Isofit has no affiliates with whom it shares consumer health data.

The following service providers process consumer health data on our behalf, under contracts that limit them to providing their service to us:

• Supabase hosts our backend, database, and authentication. It stores the health data saved to your account and processes voice workout transcripts and fallback recordings on their way to OpenAI.
• OpenAI receives your Atlas messages and form-check media and, when you have opted in to personalization, the training context described in our Privacy Policy, including Apple Health summaries, to generate Atlas's responses. It also receives voice workout transcripts to create workout drafts and, in the fallback cases described in Section 2, recorded workout clips for transcription. This voice workout processing does not depend on Atlas personalization. Under OpenAI's API terms this data is not used to train OpenAI's models, and Isofit does not opt in to any such use.

Voice features also use Apple Speech Recognition. Recognition runs on your device when supported; otherwise Apple may receive and process the audio on its servers.

We do not share consumer health data with any other third party, except:

• At your direction. Your workout data is private by default. If you change a visibility setting or post about a workout in Bonfire, what you chose to show is visible to other members.
• As required by law, such as a court order or a lawful request from a regulator. We will notify you unless the law prohibits it.

5. Your Rights

You can:

• Confirm and access. Ask whether we collect, share, or sell your consumer health data, and get a copy of it, including a list of every third party and affiliate with whom we have shared it and a way to contact each of them.
• Withdraw consent. Withdraw your consent to our collection or sharing of consumer health data at any time. The controls live in the app: disconnect Apple Health or withdraw your Atlas personalization opt-in (which deletes Atlas's memory items). Withdrawal applies going forward.
• Delete. Ask us to delete your consumer health data. We delete it from our systems, including backups on their normal cycle, and instruct our service providers to do the same. Deleting your account from the app does this for everything at once. Pseudonymized consent records are retained as described in Section 8 of our Privacy Policy.
• Not be discriminated against for exercising any of these rights.

How to exercise them. Use the in-app controls, or email privacy@isofit.app from the address on your account. We may ask you to confirm your identity. We respond within 30 days. If a request is unusually complex, the law allows us up to 45 additional days, and we will tell you if we need them.

Appeals. If we decline to act on a request, we will explain why. You can appeal by replying to our response or by emailing privacy@isofit.app with "Appeal" in the subject line. We will answer an appeal within 45 days with our decision and the reasons for it. If we deny your appeal, you can submit a complaint to your state attorney general: in Washington, the Washington State Office of the Attorney General (atg.wa.gov); in Nevada, the Office of the Nevada Attorney General (ag.nv.gov).

6. Security and Retention

Health data saved to your account is encrypted in transit and at rest. Saved workouts, Atlas messages, and other account data are retained as described in Section 8 of our Privacy Policy: with your account while it is active, and deleted when you delete your account, except the pseudonymized consent records noted there. Voice input is processed as described in Section 2.

7. Changes to This Policy

We will update this policy when our practices change and update the effective date above. Material changes are announced by email or in-app notification, and any new category, purpose, or sharing of consumer health data requires your consent before it starts.

8. Contact

• Privacy Contact: privacy@isofit.app
• General Support: ops@isofit.app
• Website: https://isofit.app

End of Consumer Health Data Privacy Policy | Isofit | v1.2 | September 24, 2026