Consumer Health Data Privacy Policy

Effective October 25, 2026 | C04-EN-REV04

 

1. Operator, scope and contact

 

 

Gear-Apps LLC operates TITANS FACTORY and The Hercules App. This notice explains how we collect, use and share consumer health data in our fitness planning, tracking and coaching services. Consumer health data includes information linked or reasonably linkable to you that identifies or can reveal your physical or mental health status, including health-related inferences from other information.

 

Contact sgarcia@gear-apps.com about your health data. Our technical administrator coordinates requests, with help from Manny, our trainer, when needed. The state-specific sections explain the rights and time limits that apply when the relevant law covers your information.

 

2. Categories of health data and why we use them

 

 

The categories we handle depend on the features you request and the information you provide. Account-linked fitness information can be health data even when it does not name a medical condition.

 

Body information and changes: age, sex assigned at birth, height, weight, weight units, recent weight changes and whether a change was intentional; weight history and related goals. We use these inputs to establish a starting point, check supported planning limits, calculate estimates and track progress.

 

Activity, sleep and training: work or study activity, daily steps you report, activity outside work, exercise types and experience, frequency and duration, available training days and time, sleep hours, and gym or home equipment. We also handle workouts, sets, loads, repetitions, performance assessments, completion records and notes. These support suitable scheduling, exercise selection and progress review.

 

Nutrition and restrictions: food allergies, dietary requirements and preferences, meal patterns, food exclusions, meal records, quantities, calories and macronutrients. Free-text answers may include professional advice or other health information you choose to provide. We use relevant details to assess suitability and select or adjust supported recommendations within our lawful scope; not every medical or dietary need can be handled by the service.

 

Suitability and support needs: limited confirmations about understanding the guidance with appropriate support, safe use with usual assistance or equipment, pregnancy or breastfeeding, recovery after childbirth requiring tailored guidance, professional restrictions, and whether the requested exercise or nutrition guidance needs individual or clinical review. We use these answers to determine whether the selected feature is within its supported scope and to route a requested review. You may request review without identifying a diagnosis. These questions do not request a complete medical history or certify that you have no health conditions. We obtain the applicable health-data choice before collecting these answers. Health details you voluntarily provide through a supported private channel may also be handled for your specific request.

 

Goals, estimates and plans: selected goals, calculated body mass index checks, estimated energy needs, calorie and macronutrient targets, portions, meal and training plans, revisions and progress assessments. These are derived from your inputs and records. Automated planning calculations are estimates, not a diagnosis or a direct measurement of your metabolism.

 

Coaching content and progress photographs: photographs you send directly to Manny, relevant coaching messages, observations and plan adjustments. We use them for the coaching or progress review you request. Private photographs are not made public merely because you send them to your coach. We do not record or transcribe coaching calls.

 

Linked identifiers and service context: your name, email, account identifiers, coach assignment, requested program and relevant service-event or communication information where linked to the health data above. These connect records to the correct client, deliver the requested feature, support your request and protect access where permitted by law.

 

3. Sources and processing

 

 

We receive health data from your questionnaire answers, goals, entries, messages, photographs and other content; records created through app use; and Manny or an assigned trainer providing requested coaching. Calculations and progress comparisons produce additional information. You may contact us by text message or Instagram direct message and use the app's available questionnaire, tracking and support fields. For one-to-one coaching, you may report injuries or relevant health changes through text messages, WhatsApp or another direct contact channel agreed with us. Communications and infrastructure providers transmit or store the information involved in the channel you use.

 

Processing includes collecting and recording your inputs; linking them to your account; storing questionnaire drafts and confirmed records; performing planning calculations; generating and displaying plans; maintaining progress history; and reviewing or adjusting the agreed coaching service. Authorized personnel also use relevant information to answer support or privacy requests and correct records. We do not use a general security or support purpose as permission for unrelated health-data collection or sharing.

 

The reviewed app obtains step counts from your entries. Its planning workflow does not use a wearable feed or GPS measurement. The app calculation engine uses software formulas and rules; hosting the app through OpenAI Sites does not itself send questionnaire answers to a generative AI model.

 

4. Categories shared and recipients

 

 

We make the relevant categories described above available to recipients needed for the feature, communication or disclosure involved. A provider does not receive the complete health record merely because it supplies one part of the service. A provider acting outside our instructions may handle information under its own applicable terms and privacy notice.

 

App database and processing providers - Supabase: account-linked questionnaire responses, suitability confirmations, goals, generated plans, fitness and nutrition records, and related identifiers used for app authentication, storage, calculations and delivery.

 

Website, membership and communications providers - Wix and its relevant services: account, membership and requested service information, plus health-related content that you choose to place in a website or community feature. The checkout integration reviewed sends purchase and identity information; it does not send your questionnaire answers, weight or allergies. Identity and service context may itself be health-related in context.

 

Hosting and delivery providers - OpenAI Sites and Cloudflare: browser, network and service-request information involved in delivering the app and assets, including health-related context if a request or identifier reveals it. These hosting roles are distinct from the app database and from submitting health information to an AI model.

 

Email, social and telephone communications providers: Google/Gmail handles business email; Meta services support Instagram/Facebook interactions and WhatsApp contact. Mobile carriers and relevant messaging services support text or picture messages where available. The information processed depends on the channel, content, settings and encryption: it can include message or photograph content handled through that service and associated contact or technical data. This does not mean every provider can read every message. Instagram is also used for marketing and initial contact; a private health message does not authorize advertising use.

 

Sign-in and anti-abuse providers: Google or Meta processes the authentication involved if you select its sign-in option, and Google reCAPTCHA supports abuse prevention. These interactions involve identifiers, browser or network information and service context, which may reveal health information in context. They are not an authorization to send the full health questionnaire to those providers.

 

Private photograph storage - Microsoft OneDrive: progress photographs and associated file/account information for requested coaching, accessible to Manny and the technical administrator as needed. OneDrive is the selected destination. Legacy Apple iCloud copies, phone files and message attachments remain within applicable retention and deletion until their disposition is verified. They are not a public gallery.

 

Authorized personnel: Manny and our technical administrator access relevant information for requested coaching, administration and support. App access depends on role, purpose and client assignment. Access by a coach for requested coaching also requires active health-processing permission and permission for the current assigned coach. A reassignment requires a new permission before access. The technical administrator's limited support, administration or rights-handling access is separate from coaching. Both responsible individuals can read the shared business email and Instagram/Facebook messages; a trainer role does not give unrestricted access to every client record.

 

Affiliates: we do not share consumer health data with any other company under common ownership or control with Gear-Apps LLC. The service providers described above remain separate recipients supporting the relevant services.

 

An audience you choose: other members or visitors may see health-related content you intentionally post through an available community feature according to that feature's audience settings. A member profile may be public; membership alone does not make a post private. Sending private progress photographs to Manny does not authorize posting them or using them in advertising. A dedicated public/private progress-photo website feature is not currently offered.

 

Legally required recipients: a public authority, court or other recipient only to the extent a disclosure is required or otherwise expressly permitted under applicable health-data law. This does not create a general right to disclose your health history to anyone who requests it.

 

We do not sell customer data. We do not use or disclose your health information, weight, injuries or programs for targeted advertising.

 

5. Consent and withdrawal

 

 

Where required, we obtain your affirmative consent before collecting or sharing consumer health data. A narrowly applicable exception for information necessary to provide a product or service you requested applies only to the extent the law allows it; it does not authorize unrelated purposes. Where consent is required, consent to share health data is separate and distinct from consent to collect it. The App presents its health-processing choice before sensitive suitability answers, drafts, autosave or other health-data processing. Choices are not preselected. Assigned-coach permission is a separate requested-service access choice tied to the current assignment; it is not a general authorization for independent third parties. Where a disclosure requires distinct sharing consent, its specific recipients and purposes must be explained and that consent obtained before disclosure.

 

Required consent identifies relevant categories, purposes and specific use, recipient categories for sharing, and withdrawal. Registration, general terms, purchase or a suitability checkbox does not replace it. This notice is not processing consent, and publicity permission is separate. We do not use customer personal information with external AI tools or collect, use or sell personal information to train large language models. Future changes require accurate prior disclosure and any required consent.

 

Use Health Data Choices in the App or email sgarcia@gear-apps.com to withdraw health-data consent or assigned-coach permission. Tell us which account and activity your email request concerns; a required subject line is not a condition of exercising your rights. Withdrawal stops future processing that depends on the withdrawn permission, including relevant collection, calculations, coach reviews and disclosures. We will explain if stopping that processing prevents us from continuing the requested feature. We will not unlawfully discriminate against you for exercising your rights. Account and privacy-request options, and access to your own existing records as permitted by law, remain available without a new health-data grant. Withdrawal, deletion and subscription cancellation are distinct requests. Any information retained for a separate lawful purpose remains subject to the applicable limits and retention requirements.

 

Before adding a health-data category or purpose not disclosed here, we will update the relevant notice and obtain the consent required by applicable law. A notice change or continued use alone is not consent to a new health-data activity.

 

6. How to submit a request

 

 

Email sgarcia@gear-apps.com, for example with the subject Health data request. Identify your account and whether you want confirmation, access, recipient information, correction, withdrawal, deletion or an appeal. You do not need to create a new account. Do not include a password, full questionnaire, medical record or unnecessary sensitive detail in the initial message.

 

We may ask for proportionate information to authenticate the request and arrange a suitable way to deliver a sensitive response. We will not disclose another person's health data simply because a requester knows their email. Requests made by a representative are handled as applicable law permits, with verification of their authority. The state sections below explain applicable rights and deadlines; they do not limit rights available under another applicable law. Day-based deadlines in those sections are calendar days.

 

Washington consumer health data rights

 

 

This section applies when your information is covered by Washington's My Health My Data Act, including covered Washington residents and people whose consumer health data is collected in Washington. Employment-context information is outside the Act's consumer definition. Statutory scope and exemptions apply to the particular information and activity.

 

You may confirm whether we collect, share or sell your consumer health data; access that data; and obtain a list of all third parties and affiliates with whom it has been shared or sold, with an active email address or other online means to contact each recipient. You may withdraw consent to collection or sharing, request deletion, and appeal a refusal to act.

 

Use the request channel in section 6. We respond without undue delay and within 45 days after receiving your request. If the number or complexity of requests makes an extension reasonably necessary, we may take one additional 45-day period, explaining the extension and reasons within the first 45 days. Authentication does not extend the response deadline. Information is provided free of charge up to twice annually, subject only to the Act's rules for manifestly unfounded, excessive or repetitive requests.

 

For a valid deletion request, we delete the covered health data from our records and network and notify all affiliates, processors, contractors and other third parties to which we disclosed it so they also delete it. If the data is on archived or backup systems, the Act permits delay to enable restoration of those systems for no more than six months after authentication. That is an outer legal limit, not our routine retention period.

 

To appeal, email the same address with the subject Health data appeal or otherwise clearly explain that you are appealing. We provide a written decision and reasons within 45 days after receiving the appeal. If denied, we provide a means to contact the Washington Attorney General to complain. You may also use the Washington Attorney General complaint process. You do not have to complete our process before exercising any independent legal right.