Consumer Health Data Privacy Policy

1. Who is responsible

This notice describes consumer health data processed by Andrii Kuts Mobile Inc., the provider of Fitle, and rights under applicable consumer health privacy laws, including Washington's My Health My Data Act and Nevada's consumer health data provisions. Contact our Privacy Officer at support@getfitle.com. Our company and contact information are available on our Contact Fitle page.

2. Categories and sources

We process these categories when you provide them, use the related feature, or authorize access:

• Physical characteristics and fitness goals, including height, weight, desired weight, activity level, age-related fitness inputs, and training experience.
• Information about injuries, physical limitations, and health conditions you enter to personalize workouts.
• Exercise records, including workout dates, exercises, sets, repetitions, weights lifted, exertion feedback, completed or skipped activity, and progress.
• Authorized Apple Health readings: steps, active energy, move and stand time, body mass, BMI, body fat percentage, lean body mass, heart rate, resting heart rate, heart-rate variability, and sleep analysis.
• Derived fitness information, including workout plans, estimated fatigue, workload, readiness, and progression. These are estimates, not diagnoses.
• Account, device, and session identifiers when linked to the categories above; support messages that contain health information; and app events that reveal use of fitness features.

Sources are you, your use of Fitle, Apple Health when authorized, and calculations performed by the app. Sign-in and technical identifiers come from our authentication and infrastructure services and can be linked to your records. Raw Apple Health readings are queried on-device; separately, profile data you enter and workout records are uploaded for account features. Plans can reflect those readings.

3. Purposes

We use these categories to deliver the fitness service you request: adapt workouts to your inputs, show activity, record exercise, calculate progress, store account history, and resolve your support requests. We use the necessary identifiers to associate these records with the correct account.

General Google Analytics for Firebase collection is disabled in this version of the app. Detailed workout events, exercise and session identifiers, weights, repetitions, and health information are not sent to general analytics. Workout records stored to provide your history and progress are processed separately as part of the requested service.

We obtain the consent required by applicable law before collecting or sharing health data beyond what the law permits to provide your requested service. Any new category, purpose, or recipient requiring consent will be explained before processing begins.

4. Disclosures and recipients

Google/Firebase processes account-linked profiles, workout records and profile photos to provide cloud account features. Google Workspace hosts Fitle’s mailboxes; it processes support messages delivered to our mailboxes. If you choose to include health information in the website contact form, Cloudflare handles the request and Resend (Plus Five Five, Inc.) delivers the message to hello@getfitle.com. Please do not send health records or identity documents through the general contact form. Apple Health receives completed workouts only when you authorize writing them; Apple also operates its own platform services under its own terms.

The recipient categories are cloud infrastructure and authentication providers, website hosting/security providers, and email delivery and mailbox providers acting in the relevant service-provider roles. Each receives the data needed for its particular function, not every category of your health information. On the company's side, only the company owner has access to Firebase, Cloudflare, Resend and the work mailbox; no additional company personnel or contractors have access to those services. We may use professional advisers or disclose information in response to a lawful request only where the applicable health-data law permits it.

We do not sell consumer health data, use it for targeted advertising, or create advertising profiles from it. Disclosures to authorities, professional advisers, or a business successor occur only when the applicable health-data law permits them; these are not blanket exceptions to consent or deletion duties.

5. Access, withdrawal, deletion, and appeals

Withdraw health-data consent in Profile → Privacy choices. The app pauses health features, and an offline withdrawal must reach the server to affect other devices. Withdrawal does not itself delete existing records. Request deletion in Profile → Delete account or from the privacy gate when health access is locked. Email support@getfitle.com for access, applicable recipient information, withdrawal or deletion assistance. We verify identity using proportionate information; you do not need to create a new account.

For Washington requests, we respond within 45 days, with one further 45-day extension where allowed and explained. An applicable deletion request extends to recipients and backups; Washington permits backup deletion to take up to six months after authentication. To appeal a refusal, reply to the decision or email the same address with "Health privacy appeal." We explain the appeal outcome within 45 days. You may complain to the Washington Attorney General.

Other applicable laws may provide different or additional rights and deadlines, which we honor. Nevada users may also complain to the Nevada Attorney General.

For requests covered by Nevada consumer health data law, we respond without undue delay and within 45 days after authentication. Where permitted, we may extend this once by 45 days and explain why within the initial period. To appeal a refusal, reply to the decision or email support@getfitle.com with “Health privacy appeal.” We respond to the appeal in writing within 45 days of receipt, explaining our decision and providing the Attorney General’s contact information if we deny it.