Consumer Health Data Privacy Policy — Connecticut

Effective October 25, 2026 | C04-EN-REV04

 

1. Operator, scope and contact

 

 

Gear-Apps LLC operates TITANS FACTORY and The Hercules App. This notice explains how we collect, use and share consumer health data in our fitness planning, tracking and coaching services. Consumer health data includes information linked or reasonably linkable to you that identifies or can reveal your physical or mental health status, including health-related inferences from other information.

 

Contact sgarcia@gear-apps.com about your health data. Our technical administrator coordinates requests, with help from Manny, our trainer, when needed. The state-specific sections explain the rights and time limits that apply when the relevant law covers your information.

 

2. Categories of health data and why we use them

 

 

The categories we handle depend on the features you request and the information you provide. Account-linked fitness information can be health data even when it does not name a medical condition.

 

Body information and changes: age, sex assigned at birth, height, weight, weight units, recent weight changes and whether a change was intentional; weight history and related goals. We use these inputs to establish a starting point, check supported planning limits, calculate estimates and track progress.

 

Activity, sleep and training: work or study activity, daily steps you report, activity outside work, exercise types and experience, frequency and duration, available training days and time, sleep hours, and gym or home equipment. We also handle workouts, sets, loads, repetitions, performance assessments, completion records and notes. These support suitable scheduling, exercise selection and progress review.

 

Nutrition and restrictions: food allergies, dietary requirements and preferences, meal patterns, food exclusions, meal records, quantities, calories and macronutrients. Free-text answers may include professional advice or other health information you choose to provide. We use relevant details to assess suitability and select or adjust supported recommendations within our lawful scope; not every medical or dietary need can be handled by the service.

 

Suitability and support needs: limited confirmations about understanding the guidance with appropriate support, safe use with usual assistance or equipment, pregnancy or breastfeeding, recovery after childbirth requiring tailored guidance, professional restrictions, and whether the requested exercise or nutrition guidance needs individual or clinical review. We use these answers to determine whether the selected feature is within its supported scope and to route a requested review. You may request review without identifying a diagnosis. These questions do not request a complete medical history or certify that you have no health conditions. We obtain the applicable health-data choice before collecting these answers. Health details you voluntarily provide through a supported private channel may also be handled for your specific request.

 

Goals, estimates and plans: selected goals, calculated body mass index checks, estimated energy needs, calorie and macronutrient targets, portions, meal and training plans, revisions and progress assessments. These are derived from your inputs and records. Automated planning calculations are estimates, not a diagnosis or a direct measurement of your metabolism.

 

Coaching content and progress photographs: photographs you send directly to Manny, relevant coaching messages, observations and plan adjustments. We use them for the coaching or progress review you request. Private photographs are not made public merely because you send them to your coach. We do not record or transcribe coaching calls.

 

Linked identifiers and service context: your name, email, account identifiers, coach assignment, requested program and relevant service-event or communication information where linked to the health data above. These connect records to the correct client, deliver the requested feature, support your request and protect access where permitted by law.

 

3. Sources and processing

 

 

We receive health data from your questionnaire answers, goals, entries, messages, photographs and other content; records created through app use; and Manny or an assigned trainer providing requested coaching. Calculations and progress comparisons produce additional information. You may contact us by text message or Instagram direct message and use the app's available questionnaire, tracking and support fields. For one-to-one coaching, you may report injuries or relevant health changes through text messages, WhatsApp or another direct contact channel agreed with us. Communications and infrastructure providers transmit or store the information involved in the channel you use.

 

Processing includes collecting and recording your inputs; linking them to your account; storing questionnaire drafts and confirmed records; performing planning calculations; generating and displaying plans; maintaining progress history; and reviewing or adjusting the agreed coaching service. Authorized personnel also use relevant information to answer support or privacy requests and correct records. We do not use a general security or support purpose as permission for unrelated health-data collection or sharing.

 

The reviewed app obtains step counts from your entries. Its planning workflow does not use a wearable feed or GPS measurement. The app calculation engine uses software formulas and rules; hosting the app through OpenAI Sites does not itself send questionnaire answers to a generative AI model.

 

4. Categories shared and recipients

 

 

We make the relevant categories described above available to recipients needed for the feature, communication or disclosure involved. A provider does not receive the complete health record merely because it supplies one part of the service. A provider acting outside our instructions may handle information under its own applicable terms and privacy notice.

 

App database and processing providers - Supabase: account-linked questionnaire responses, suitability confirmations, goals, generated plans, fitness and nutrition records, and related identifiers used for app authentication, storage, calculations and delivery.

 

Website, membership and communications providers - Wix and its relevant services: account, membership and requested service information, plus health-related content that you choose to place in a website or community feature. The checkout integration reviewed sends purchase and identity information; it does not send your questionnaire answers, weight or allergies. Identity and service context may itself be health-related in context.

 

Hosting and delivery providers - OpenAI Sites and Cloudflare: browser, network and service-request information involved in delivering the app and assets, including health-related context if a request or identifier reveals it. These hosting roles are distinct from the app database and from submitting health information to an AI model.

 

Email, social and telephone communications providers: Google/Gmail handles business email; Meta services support Instagram/Facebook interactions and WhatsApp contact. Mobile carriers and relevant messaging services support text or picture messages where available. The information processed depends on the channel, content, settings and encryption: it can include message or photograph content handled through that service and associated contact or technical data. This does not mean every provider can read every message. Instagram is also used for marketing and initial contact; a private health message does not authorize advertising use.

 

Sign-in and anti-abuse providers: Google or Meta processes the authentication involved if you select its sign-in option, and Google reCAPTCHA supports abuse prevention. These interactions involve identifiers, browser or network information and service context, which may reveal health information in context. They are not an authorization to send the full health questionnaire to those providers.

 

Private photograph storage - Microsoft OneDrive: progress photographs and associated file/account information for requested coaching, accessible to Manny and the technical administrator as needed. OneDrive is the selected destination. Legacy Apple iCloud copies, phone files and message attachments remain within applicable retention and deletion until their disposition is verified. They are not a public gallery.

 

Authorized personnel: Manny and our technical administrator access relevant information for requested coaching, administration and support. App access depends on role, purpose and client assignment. Access by a coach for requested coaching also requires active health-processing permission and permission for the current assigned coach. A reassignment requires a new permission before access. The technical administrator's limited support, administration or rights-handling access is separate from coaching. Both responsible individuals can read the shared business email and Instagram/Facebook messages; a trainer role does not give unrestricted access to every client record.

 

Affiliates: we do not share consumer health data with any other company under common ownership or control with Gear-Apps LLC. The service providers described above remain separate recipients supporting the relevant services.

 

An audience you choose: other members or visitors may see health-related content you intentionally post through an available community feature according to that feature's audience settings. A member profile may be public; membership alone does not make a post private. Sending private progress photographs to Manny does not authorize posting them or using them in advertising. A dedicated public/private progress-photo website feature is not currently offered.

 

Legally required recipients: a public authority, court or other recipient only to the extent a disclosure is required or otherwise expressly permitted under applicable health-data law. This does not create a general right to disclose your health history to anyone who requests it.

 

We do not sell customer data. We do not use or disclose your health information, weight, injuries or programs for targeted advertising.

 

5. Consent and withdrawal

 

 

Where required, we obtain your affirmative consent before collecting or sharing consumer health data. A narrowly applicable exception for information necessary to provide a product or service you requested applies only to the extent the law allows it; it does not authorize unrelated purposes. Where consent is required, consent to share health data is separate and distinct from consent to collect it. The App presents its health-processing choice before sensitive suitability answers, drafts, autosave or other health-data processing. Choices are not preselected. Assigned-coach permission is a separate requested-service access choice tied to the current assignment; it is not a general authorization for independent third parties. Where a disclosure requires distinct sharing consent, its specific recipients and purposes must be explained and that consent obtained before disclosure.

 

Required consent identifies relevant categories, purposes and specific use, recipient categories for sharing, and withdrawal. Registration, general terms, purchase or a suitability checkbox does not replace it. This notice is not processing consent, and publicity permission is separate. We do not use customer personal information with external AI tools or collect, use or sell personal information to train large language models. Future changes require accurate prior disclosure and any required consent.

 

Use Health Data Choices in the App or email sgarcia@gear-apps.com to withdraw health-data consent or assigned-coach permission. Tell us which account and activity your email request concerns; a required subject line is not a condition of exercising your rights. Withdrawal stops future processing that depends on the withdrawn permission, including relevant collection, calculations, coach reviews and disclosures. We will explain if stopping that processing prevents us from continuing the requested feature. We will not unlawfully discriminate against you for exercising your rights. Account and privacy-request options, and access to your own existing records as permitted by law, remain available without a new health-data grant. Withdrawal, deletion and subscription cancellation are distinct requests. Any information retained for a separate lawful purpose remains subject to the applicable limits and retention requirements.

 

Before adding a health-data category or purpose not disclosed here, we will update the relevant notice and obtain the consent required by applicable law. A notice change or continued use alone is not consent to a new health-data activity.

 

6. How to submit a request

 

 

Email sgarcia@gear-apps.com, for example with the subject Health data request. Identify your account and whether you want confirmation, access, recipient information, correction, withdrawal, deletion or an appeal. You do not need to create a new account. Do not include a password, full questionnaire, medical record or unnecessary sensitive detail in the initial message.

 

We may ask for proportionate information to authenticate the request and arrange a suitable way to deliver a sensitive response. We will not disclose another person's health data simply because a requester knows their email. Requests made by a representative are handled as applicable law permits, with verification of their authority. The state sections below explain applicable rights and deadlines; they do not limit rights available under another applicable law. Day-based deadlines in those sections are calendar days.

 

Connecticut health-data supplement

 

 

This section supplements the general Privacy & Cookie Policy for information covered by the Connecticut Data Privacy Act. Consumer health data includes personal data used to identify physical or mental health status, conditions or diagnoses. The Act's scope, exceptions and protections for sensitive information apply to the particular processing. This health-data supplement does not replace the general notice for other personal data.

 

When required, we obtain consent before processing sensitive health data, including inferred health information. Consent must be specific, informed and unambiguous; general acceptance of service terms does not supply it. Revocation must be at least as easy as giving consent. Use Health Data Choices in the App or email sgarcia@gear-apps.com to revoke it. Where Connecticut's consent-revocation requirement applies, processing based on that consent will stop as soon as practicable and within 15 days after receiving the revocation. This outer deadline is not permission to delay an immediately available control.

 

Covered consumers may request confirmation and access, including applicable inferences; correction; deletion; and a portable copy. Applicable rights also include information about third parties that purchased personal data and opting out of targeted advertising, sale and profiling used for decisions producing legal or similarly significant effects. We do not sell customer data or use or disclose health information for targeted advertising. Automated fitness planning does not by itself establish that the app makes a legally significant decision within that statutory category.

 

Deletion also covers public information combined into a profile about you that is accessible through a public website, for free or for a fee; public information offered for sale; and inferences generated from those categories, subject to applicable exceptions. You may request a list of third parties to which your personal data was sold. If no individualized purchaser list is maintained, the Act provides for a list of all third parties to which personal data was sold. These rights do not require disclosure of protected trade secrets.

 

Submit requests through the channel in section 6. We respond without undue delay and within 45 days after receipt; a reasonably necessary extension may add 45 days, with an explanation during the initial period. We explain a refusal and how to appeal. Send an appeal to the same address. We give a written appeal decision and reasons within 60 days after receipt; if denied, we provide an online or other means to contact the Connecticut Attorney General. See the Connecticut Attorney General privacy information and complaint channel.

 

We do not use customer personal information in external AI tools to provide these services. We do not collect, use or sell personal information for training large language models. The app generates plans through software formulas and rules, not an external generative AI model. Coaching calls are not recorded or transcribed. These statements concern our handling of customer information; our providers must be assessed separately under their applicable terms and settings. This business-wide restriction also appears in the general Privacy & Cookie Policy.

 

We will obtain any consent required before processing health data for a new purpose that is neither reasonably necessary to nor compatible with the disclosed purpose. The required privacy notice identifies its latest update month and year. For a material retroactive change, affected consumers receive the notice and opportunity to withdraw consent required by the Act.