Consumer Health Data Privacy Policy

1. Who this policy concerns

This Consumer Health Data Privacy Policy explains FORUFIT LLC’s handling of consumer health information for 4UFit, including the rights provided by Washington’s My Health My Data Act. It is separate from our general Privacy Policy.

FORUFIT LLC
Issaquah, Washington, United States
info@forufit.com

2. Categories we collect and their purposes

• Health and wellness details: height, weight, health-questionnaire responses, reported movement restrictions, pain or fatigue, sleep and recovery information. These support relevant fitness guidance and movement restrictions.
• Fitness, nutrition and progress records: your fitness goals and selected program, activity, exercise sets and weights, meal and nutrition entries, measurements and progress. These support your program, history and requested coaching.
• Connected-health summaries: supported activity, steps, sleep, energy, heart-rate and body-measurement information read from Apple Health or Health Connect with permission, including their sources.
• Selected photos and derived information: body, progress and meal images, related file metadata, suitability and consistency-check results, and fitness or food assessments. These support the photo feature you request and can generate fitness-related inferences; they do not authenticate identity or establish a medical diagnosis.
• Health information in conversations or support: health-related messages, relevant context and replies, and a microphone recording if you choose to speak. These are used to provide the requested coaching, transcription or support.
• Related fitness-service activity: purchase and access records, exercise-video requests and reminder information when they relate to your fitness program. These enable purchased access, video playback and enabled reminders.

3. Sources

We receive this information from you, from the health platforms you authorize, and from your interactions with the app. Related assessments and fitness inferences are generated from those inputs by 4UFit and the AI processing used for your requested feature.

4. Shared information and recipients

Relevant categories above can be processed with Supabase for the private database, file storage and server functions, and with OpenAI for the AI image, text or speech feature you request. Authorized company support staff can access information relevant to resolving a request. If you email health information to us, Hostinger’s email service processes that correspondence. A device speech service can process reply text when it reads a response aloud.

For related service interactions, Apple, Google and RevenueCat receive purchase and access information; Cloudflare Stream receives exercise-video playback requests; and Expo and device notification services receive the delivery information and message content needed for enabled reminders. These are feature-specific transfers, rather than access to your entire health history.

We can also disclose information when required by law to a competent public authority or as necessary to handle a valid legal request. We do not sell consumer health information, use it for advertising profiles or make customer health records and body photos available to influencers.

The app asks for the health, AI and photo choices relevant to the feature. A new category or purpose requiring consent must be disclosed before the corresponding collection or sharing. A policy update or a purchase is not a substitute for that choice.

5. Your rights and how to request them

Where Washington’s My Health My Data Act applies, you can ask whether we collect, share or sell health information about you; access that information and the required recipient information; withdraw consent; and request deletion. You do not need a new account to make a request.

Use the app’s data-permission and data-rights screens, or email info@forufit.com with the subject Health data request. Describe the request without including passwords, sign-in codes, full tax identifiers or unnecessary health documents. We may need to verify your identity.

If you believe a refusal is incorrect, email the same address with the subject Health data appeal and identify the decision. Applicable response periods, extensions and deletion obligations govern the request and appeal. You can also contact the Washington Attorney General about a complaint.

Device disconnection, withdrawal of permission and deletion of information already held are separate actions. A deletion request can include information held by recipients and in archives or backups as required by applicable law; it is not limited to hiding an account in the app.