Consumer Health Data Privacy Policy

Consumer health data we collect

• Body weight, body measurements and body-fat estimates you log.
• Workouts, sets, steps, activity and exercise minutes.
• Meals, nutrition estimates and water.
• Sleep quality, energy, hunger, pain, injuries, limitations and mood you report.
• If you allow it, from Apple Health: daily totals (steps, distance, active energy, resting heart rate, VO2 max and sleep), heart rate variability (used for your daily readiness and coaching, not stored in the daily totals), each weigh-in, body-fat readings (for example from a smart scale; at most one a day is saved), lean body mass (shown in the app, not saved), and a summary of each workout (type, start time, duration and calories).
• In the Android app (in testing now, coming to Google Play), the same kinds of data from Health Connect instead of Apple Health, if you allow it, under the same rules.
• With expanded Health access enabled, authorized imported workouts can include distance, available aggregate heart rate and the source app. Relevant readiness summaries can also include breathing rate, floors climbed, daylight or mindfulness activity, and food recorded by authorized sources, where the platform supplies them. No workout routes are read.
• During enabled live workout sharing, current heart rate can be relayed from the Watch through the phone and a private realtime channel to signed-in devices following the session. Live readings are broadcast rather than stored as heart-rate history. Apple TV support is coming soon.
• Progress photos, only if you turn on Back up progress photos; otherwise they stay on your phone. They’re stored privately for your account and never sent to our AI providers.
• Badges, streaks and personal bests worked out from what you log.
• What Coachh remembers about you to coach you over time (Settings › Memory): health notes you keep (a diagnosis, a medication, what your doctor said), injuries, diet and allergies, supplements, and the events and goals you mention. Health notes are only used after you tap “Keep this”, and you can edit, delete or stop all of it at any time (details).
• Your fitness goals and the training plan built for you.
• Feature requests and, if you’re a founding member, your answers to the optional day-14 founder survey, which may mention your health. The first survey answer stays private as feedback; the second is counted on the public roadmap like a feature request, never with your name (details).

Where it comes from

Directly from you in the app, and from Apple Health on your iPhone or Health Connect on your Android phone when you grant permission.

Why we collect and use it

To provide the coaching you asked for: logging, plans, progress, meal estimates, reminders you turn on, and safety checks that point you to help in an emergency. Optional recognition emails can use independently verified actions you logged directly in Coachh, with the messaging consent described below. We do not use Apple Health or Health Connect data for marketing, use consumer health data for targeted advertising, or sell it. Detailed recipe or meal-plan content goes into email only when you explicitly request that copy.

Who we share it with

Processors that run Coachh for us receive the consumer health data each one needs, and may use it only to provide their service to us:

• Supabase: our database, sign-in and file storage; the account records and optional private files described above are stored there; raw on-device readings and live broadcasts are not all persisted (United States).
• OpenRouter, with models from OpenAI, Anthropic and Google, served by those companies or by Microsoft Azure, Amazon Bedrock or Google Cloud: AI replies, plans and meal estimates, from your message, a summary of your recent logs and daily health totals, and any meal photo. Every request goes only to providers that don’t train on it and to endpoints that don’t keep it (zero data retention).
• Google (the Gemini API): voice mode, with your voice and the same summary (including what Coachh remembers and your recent conversation), and replies read aloud, with only the reply’s words. On Google’s paid service, Google doesn’t use it to improve its products and keeps it for a limited time (up to about 55 days) only to detect abuse and meet legal requirements.
• xAI (Grok voice and xAI text to speech), which we may use for voice mode and replies read aloud instead of Google, with the same data. Zero Data Retention is on for our xAI account: xAI doesn’t keep any of it or train on it.
• OneSignal and Resend, for the messaging flows each one owns: Optional coaching, education and lifecycle emails require your email and topic preferences. We select them using explicit interests, supported features, lifecycle stage and messaging choices. Where enabled and consented, independently verified actions logged in Coachh, such as a first workout, can make a milestone email eligible; imported Health workouts do not. The email uses general recognition rather than exercise details. We do not use Apple Health or Health Connect data, health measurements, private chat or remembered health notes to select promotional emails. Detailed personal progress stays inside authenticated Coachh views. You can unsubscribe or change topics without losing access to your account. If you explicitly request a recipe or meal-plan email, that copy can contain recipe names, ingredients, preparation instructions, portions, estimated nutrition and planned meal or cooking dates. Those details pass through the email provider and your mailbox provider. This is separate from optional promotional email and does not log a meal or confirm that you ate it. Do not request an emailed copy if you do not want those details in email. Messaging providers receive account/subscription identifiers and the permitted message, not your full health history.
• Apple (Apple Push Notification service) and Google (Firebase Cloud Messaging), when push delivery is available and you permit it, directly or through OneSignal. Discreet notification copy does not contain your detailed health records.

Other sharing, only as described:

• Apple, when you allow Coachh to save to Apple Health: workouts, weigh-ins, waist and body-fat measurements, water, meal nutrition and mood check-ins.
• Health Connect on your Android phone, when you allow Coachh to save to it: workouts, walks recorded on your watch, weigh-ins, body fat, water and meal nutrition. Health Connect keeps this on your phone; we never sell Health Connect data or pass it to advertising platforms or data brokers.
• Apple, only if you ask Apple for a refund: information about your use of Coachh, for example how much of the subscription you used, to help Apple decide. It doesn’t include what you log or your health data.
• Authorities, only when legally required.

We don’t sell consumer health data or share it for cross-context behavioral advertising.

These services also help run Coachh. None of them receives your logs, health readings, what Coachh remembers about you, or anything you type or say:

• PostHog, for anonymous in-app usage analytics and short crash and error reports (iPhone and Android): which features are used (for example, that a meal was logged and whether by photo or barcode), with rough counts, and what went wrong in the code when the app crashes, under a random ID that isn’t linked to your account, name or email. It never receives weights, calories, meals, Apple Health or Health Connect data or anything else you log.
• Sentry (iPhone and Apple Watch) and Firebase Crashlytics (Google; Android), for crash reports: what went wrong in the code (the error type, where in the app it happened, the app and system versions and the device model), under random IDs made for that install, not your account, name or email. Never consumer health data, what you type or say, anything you log, or pictures of the screen.
• RevenueCat, Apple and Google, for subscriptions and payments; Apple and Google also for sign-in and for the device checks behind the founding month (DeviceCheck, App Attest, Play Integrity).
• Vercel, which hosts this website.
• GitHub, where the apps’ exercise demo pictures load from: like any website, it sees your IP address and which pictures your phone loads, nothing from your account.
• Open Food Facts and the USDA FoodData Central database, which get only the barcode number when you scan one. When you scan a product’s label because they don’t have it (or their numbers look off), its nutrition numbers and name go on Coachh’s shared food list so the next person who scans it gets them: never the photo, and never who scanned it.

Usage and crash reports use random identifiers rather than your account ID, name or email. This reduces direct identification; it is not a promise that technical data is irreversibly anonymous. Reports already received by those providers are not automatically removed by deleting your Coachh account. You can turn off future optional reporting in Settings and contact us about an access or deletion request.

Usage analytics and crash reports are on by default; one switch, Settings › Share anonymous usage data, turns them all off.

Your consent

We ask for agreement to the AI data disclosure before sending your data to the named AI providers. Health access has separate OS permissions, and sensitive remembered health notes require explicit confirmation. You can turn off optional Health permissions or memory, stop using voice, request deletion of particular data, or delete your account. Withdrawing an OS permission stops future access; it does not automatically erase previously saved records. Contact us to withdraw health-data consent or ask for deletion while keeping the account.

Retention and deletion

A successful in-app deletion removes your account, account-linked records and private uploaded photos from active Coachh storage. We request deletion from messaging and subscription providers separately. Those requests can take longer or need another attempt if a provider is unavailable; account deletion does not mean that every provider copy or backup disappears immediately.

Deleted data may remain in restricted, rolling backups until those backups expire under the hosting provider's configured retention period. Backups are for recovery, not active coaching. Security and operational logs have separate retention based on security, troubleshooting and legal requirements. Contact us for the retention applicable to your request.

A restricted cleanup queue can temporarily retain your account ID and messaging-app identifiers so we can retry provider deletion and reconcile previously issued login credentials. It contains no chat, health records or email content. Providers may separately retain records they are legally required to keep. Purchase records held by Apple or Google remain subject to their policies.

Your rights

You can confirm whether we collect your consumer health data, access it (Settings › Export my data), ask for a list of the processors we share it with, withdraw consent, and delete it (Settings › Delete account, or without the app). To make a request or appeal a decision, email hello@peopleintech.io. We’ll respond within 45 days. If we deny an appeal, you can contact the Washington State Attorney General at atg.wa.gov/file-complaint.