Privacy Policy

When you scan your posture and mobility or run an AI-guided workout, your camera feed is processed on your phone. Raw video is never uploaded to our servers. We store only the outputs of that processing: joint landmark positions, rep counts, and form scores.

Joint landmark positions and body-measurement estimates can be considered biometric or special-category data under laws such as the GDPR, Illinois’ BIPA, and Washington’s My Health My Data Act. We ask for your explicit, separate consent before your first scan, explain what is collected and why, and let you decline and use trainer-led sessions instead.

• Account details: name, email, date-of-birth confirmation, role (client or trainer).
• Health-screen answers (PAR-Q+) and questionnaire responses used to build your plan.
• Scan outputs: joint positions, posture/mobility scores — never raw video.
• Workout activity: sessions completed, reps, form-fault flags, progress over time.
• Wearable data you connect (heart rate, steps, sleep), where you opt in.
• Messages with trainers and booking/payment records, for clients who use the marketplace.

Live video calls with a trainer are not recorded by default. Recording a session requires both participants’ consent.

You can request a copy of your data or request that we delete your account and associated data at any time from Settings, or by contacting us. We aim to complete deletion requests within 30 days, except for records we are legally required to keep (e.g. payment records for tax purposes).

Nothing is shared with a trainer until you choose. For each trainer you work with, you decide which of your posture scans, workout history and form reports, training plan, and questionnaire answers they can see, and you can stop sharing at any time. Your PAR-Q+ answers are never shared. Payment processors (Stripe) and infrastructure providers (Supabase) process data on our behalf under their own security commitments. We do not sell your personal data.

Optional AI plan summary. If you have given your health-data consent, our server asks Anthropic, an AI provider acting as our processor, to write the short plain-English summary of your training plan. It sends only an outline: your goals, your lifestyle profile result (profile names and focus areas), whether your health screen recommends medical clearance (yes or no, never your answers), and your weekly plan (session days, titles, focus, length and exercise names). It never sends your name, email, date of birth or age, sex, height, weight, injuries, other questionnaire answers, PAR-Q+ answers, scan data or joint positions, or any account identifier. Your plan works without this summary, and withdrawing your health-data consent stops it.

Questions or requests: privacy@workout.example (placeholder).