Consumer Health Data Privacy Policy

1. The consumer health data we collect

• Body measurements — age, sex, height, current and goal weight, body-composition self-assessment, and your weight history
• Activity and fitness — activity level, goal and pace, workouts (exercises, sets, weights, reps, how it felt, notes), lift records and goals
• Injuries — the areas, whether you saw a specialist, your rehab exercises, and how long you expect to be out
• Diet — allergies, diet type, food likes and dislikes, food logs, water and caffeine
• Health-related plans — your calorie and macro targets (calculated from the above), meal plan and training plan
• Images — progress photos, and meal photos you send for an estimate (not stored). Your progress photos leave the app only in our weekly encrypted backups, kept for up to 6 months, and in your own data download if you tick “Include my photos”.
• What you tell the coach — messages and the coach’s memory, which can include anything about your health you choose to type
• The health question — your yes or no, when you build your plan, to whether you are pregnant or breastfeeding or have a medical condition that affects what you eat or how you train (one answer: we don't ask or store which), with the date and the version of the question

We do not collect precise location or biometric identifiers, and we do not infer health information from anything other than what you enter. The only place we touch reproductive health is the health question above: a yes may mean you are pregnant or breastfeeding, and we store only that yes or no.

2. Where it comes from

Only from you, as you type, log or upload it in the Service. We do not buy it or receive it from anyone else, and there is no tracking pixel, advertising SDK or third-party analytics in the Service.

3. Why we collect and use it

Only to provide the Service you asked for: to calculate your targets; to build and adapt a meal plan around your allergies and preferences and a training plan around your injuries; to run the coach; to show you your progress; and to run the boards, friends and prizes you choose to join. We ask for your consent at signup, before any of it is collected, in a box separate from the Terms.

A yes to the health question keeps your pace gentle and tells the coach to point you to a doctor or registered dietitian for anything about the condition. If you ask about Charlie's coaching, or say yes when the coach asks whether you want to hear how it works, the coach uses what you've told it about your goals to explain how it would fit you. Its first question about coaching never uses your health information, and we record only your yes or no.

We do not use consumer health data for advertising, sell it, or use it to train AI models.

4. Who receives it

4.1 Our processors

These companies process it only on our instructions, under contract, to provide the Service, and may not use it for themselves:

• Railway Corp. — hosting and database: all of the above
• Anthropic, PBC (AI) — the coach: your messages plus your first name, weight, goal, targets, the week’s training, recent food, water and caffeine, goals, injuries and rehab, diet, dislikes and allergies, and the coach’s memory; meal photos you send. You agree to this on a separate screen before your first coach message or meal-photo estimate, and nothing is sent before you do. Anthropic says it does not train its models on data sent through its API and deletes it within 30 days, unless it is flagged for breaking Anthropic's usage policy (kept for up to 2 years) or the law requires it to be kept longer.
• Resend — email delivery: your email address and the message. Emails to you carry no health data; the note sent to Charlie when you ask him to reach out or claim a prize can include your goal, streak or winning gain.
• Cloudflare, Inc. — network delivery and security
• Apple Inc. (iCloud) and Google LLC (Google Drive) — storage for encrypted backup copies of the database (all of the above), encrypted before upload; neither holds the key
• GitHub, Inc. — the nightly backup job: the export (all of the above, its most sensitive fields already encrypted) exists unencrypted only inside the job for the seconds it takes to encrypt it, and only the encrypted file is stored

4.2 Other members — only with your separate consent

Showing your health data to other members is sharing, so it only happens when you choose it on a screen that says exactly what is shared, separately from your signup consent:

• Friends board — adding or accepting a friend shows your friends your streak and points, your weight, bench, squat and deadlift logs, and how many of your planned meals you checked off in the last 7 days.
• Global leaderboard — joining shows every member your board name, @username, streak and points. Joining also puts you on the category boards (weight change, bench, squat and deadlift), which show your gain in that category (the change, never the numbers you logged); you can leave any one of them from its tab.

You withdraw that consent by leaving the board in Settings (or removing the friend); it stops at once.

4.3 Nobody else

We have never sold consumer health data, will not sell it, and share it with no other third party or affiliate.

5. How long we keep it

• In your account — until you delete your account (or ask us to delete it)
• After deletion — gone from the live database immediately. Encrypted backups expire within 6 months.
• At Anthropic — up to 30 days

6. Your rights

You have the right to: confirm whether we collect, share or sell your consumer health data; access it, including the list of all third parties and affiliates it has been shared with or sold to (for us: the processors in 4.1 and the members you chose in 4.2, and no one else); withdraw consent to its collection and sharing; have it deleted; and not be discriminated against for exercising any of these.

Delete it yourself, now: sign in, open your account page, and use Delete account. That removes it from our database (hosted by Railway). Anthropic’s copies expire within 30 days. Resend keeps delivery logs of emails we sent you under its own retention; we ask it to delete them when you ask us to.

Access it yourself, now: on your account page, Your data → Download my data gives you a machine-readable copy of what your account holds (photos if you tick the box).

Everything else: email charlieplourde.va@gmail.com from the address on your account. We respond within 45 days of receiving the request, and may extend once by another 45 days when reasonably necessary — if so, we tell you within the first 45 days.

Appeals: if we refuse a request, reply with the subject line “Appeal.” Within 45 days we will tell you in writing what we did and why. If we deny your appeal you can complain to the Washington State Attorney General at atg.wa.gov/file-complaint, or to your own state’s Attorney General.

7. Access inside our company

Only the owner of CP Performance Group LLC and anyone working for us under a confidentiality obligation, only as needed to run the Service. The admin dashboard does not display your health data, photos, food logs or coach chats.

8. Changes

If we change how we collect, use or share consumer health data, we update this policy, tell you before it takes effect, and ask for your consent again before using your data in a new way.

New Debut is a trade name of CP Performance Group LLC.