LiftSage

Privacy

Consumer Health Data Privacy Policy

Who this covers

This policy explains how [TODO: legal — operator name and type (individual or company)] ("LiftSage", "we") handles consumer health data. Effective [TODO: legal — effective date].

Health data we collect

Only if you turn on health information (Settings → Privacy): injuries, pain and movements to avoid; bodyweight and waist measurements; and how hard sets felt and how ready you feel (RPE and readiness).

Anything health-related you choose to write in free-text fields such as goal notes or session notes.

Your workout log (sessions, sets, personal records and weekly totals) where it's used to learn about your physical health.

Why we collect it and how we use it

To show you your log and progress, and to build and adjust workout plans that work around injuries. We don't sell it or use it for ads.

Where it comes from

From you: what you enter or import into LiftSage. Weekly totals and averages are calculated by the app from your log.

Health data we share, and with whom

Trainers you link: only the categories you switch on for that trainer, each with its own consent (Effort (RPE & readiness), Injuries / avoid list, Body metrics, and the other sharing switches). They lose access as soon as you switch a category off or stop sharing.

Service providers who process it for us and only on our instructions: Supabase (database), Vercel (hosting) and Google (Gemini API, to generate plans) [TODO: legal — confirm which fields go to Gemini; today the planner sends your goals (including the avoid list) and recent sets (including RPE)].

Affiliates: none.

Your rights and how to use them

Access: ask us to confirm whether we have your health data, for a copy, and for a list of everyone we shared it with. Email [TODO: legal — privacy contact email].

Withdraw consent: turn off health information in Settings → Privacy (we stop collecting it), or switch off trainer sharing in Settings → Trainer (they lose access straight away).

Delete: email [TODO: legal — privacy contact email] and we'll delete your health data, including from backups within [TODO: legal — N] days, and tell anyone we shared it with.

We answer requests within [TODO: legal — response time, e.g. 45 days]. [TODO: legal — how to appeal a decision on your request, and the state Attorney General contact, if the lawyer agrees CT applies]

We won't treat you differently for using these rights.