Privacy Policy

1. Scope and who controls your information

Holifit LLC (“Holifit,” “we,” “us,” or “our”) controls the personal information described in this policy. This policy applies to Holifit services that link to it. It does not govern a third party’s independent service or website.

Holifit is a consumer fitness and wellness service. It is not a healthcare provider, health plan, or healthcare clearinghouse, and generally is not subject to the Health Insurance Portability and Accountability Act (“HIPAA”). Other privacy and consumer health laws may still apply.

See our additional Consumer Health Data Policy for consumer health data disclosures and rights, including information relevant to Washington residents.

2. Information we collect

Account and profile information

We collect identifiers and profile information such as your account ID, email address, name, authentication provider, birthday, sex, height, gyms, equipment, fitness experience, goals, training preferences, unit settings, and other preferences you choose to provide.

Fitness, health, and wellness information

With your permission, Holifit reads selected information from the Apple Health app. Depending on the features and permissions you enable, this may include workouts, activity, heart rate and heart-rate variability, resting heart rate, respiratory rate, sleep, energy burned, body measurements, cardio fitness, routes, and related timestamps or source metadata.

Holifit also creates or stores workout plans and history, exercises, sets, repetitions, loads, ratings, notes, recovery and strain estimates, sleep and stress summaries, readiness and trend scores, muscle recovery, achievements, body composition, journal entries and factors, nutrition-related information, and inferences generated from this information.

AI conversations, voice, images, and generated content

If you use AI features, we process prompts, conversation history and summaries, relevant fitness and wellness context, tool results, generated plans and coaching content, and any images you choose to submit for equipment, food, or other analysis. If you use dictation or voice features, Apple’s speech services may process audio or transcripts according to your device settings and Apple’s terms; Holifit processes the resulting transcript and related conversation content.

Feedback and support information

We process feature requests, votes, comments, problem reports, support messages, and attachments. Feature-board posts and comments are intended to be visible to other users, so do not include private health information there. If you opt to include diagnostics in a problem report, they can include app and operating-system versions, device model, recent sanitized app events, and Apple-provided crash, hang, launch, CPU, and disk-write summary information.

Technical and usage information

Our systems and service providers may process IP address, request time, device and app version, language, operating system, authentication events, service response codes, feature interactions, usage limits, and diagnostic logs. We do not currently include third-party advertising SDKs in the Holifit app.

3. Sources of information

We receive information:

• directly from you when you create an account, configure Holifit, or submit content;
• from your device and the Apple Health app when you grant permission;
• from Sign in with Apple or Google Sign-In when you choose that method;
• from Holifit’s calculations and AI features, which derive wellness and training insights; and
• automatically from app, server, security, and support interactions.

4. How we use information

We use information to:

• authenticate you and provide, synchronize, personalize, and maintain Holifit;
• display health, fitness, workout, sleep, recovery, and trend information to you;
• generate AI coaching, summaries, plans, suggestions, and image-based analysis you request;
• remember preferences and maintain continuity across devices and conversations;
• operate the feature board and respond to support or problem reports;
• secure the service, prevent abuse, enforce limits, debug errors, and maintain reliability;
• analyze service performance and improve Holifit’s health and fitness features; and
• comply with law and protect users, Holifit, and others.

We do not use information from Apple Health for advertising, marketing, or data brokerage. We do not sell personal information or consumer health data.

5. How we disclose information

We disclose only information reasonably necessary for the purposes described above to the following categories of recipients:

• Cloud database and authentication: Supabase processes account, authentication, synchronized app, AI conversation, journal, workout, and derived health information.
• Cloud hosting: Google Cloud hosts Holifit’s backend and may process authenticated requests, technical logs, and the information required for requested AI features.
• AI processing: OpenAI currently processes prompts, relevant conversation and wellness context, tool results, and submitted images to generate requested AI output. We may change or add AI providers and will update this policy when that materially changes our data practices.
• Authentication: Apple and Google process information when you use their sign-in services.
• Feedback: Fider hosts Holifit’s feature board and processes an account-linked board identity, email address, feature requests, votes, and comments.
• Content delivery and site hosting: Cloudflare hosts public exercise media and Holifit web properties and processes ordinary network request information.
• Support: your selected email provider and our support systems process information you choose to send in a problem report or support message.

We may also disclose information when required by law; to protect rights, safety, and security; with your direction or consent; or in connection with a financing, merger, acquisition, reorganization, or sale of assets. Any successor remains subject to applicable law and the commitments in the policy in effect at the time of transfer.

We require service providers to process information for contracted purposes and to apply protections appropriate to the sensitivity of the information.

6. Public and user-directed disclosures

Feature requests and comments are public within the feedback experience. Display names may be pseudonymous, but the content you submit can identify you. Other information is disclosed when you direct Holifit to export, share, or send it. Review content before sharing because recipients control their own copies.

7. Retention and deletion

We retain account and synchronized service information while your account is active and as reasonably necessary to provide Holifit. We may retain limited records longer when needed for security, fraud prevention, dispute resolution, legal obligations, financial records, or enforcing agreements. Backups and logs are deleted or de-identified on their normal cycles unless preservation is required.

You can delete local information by removing it in the app where supported or by deleting the app, but deleting the app does not delete cloud information. To request deletion of your account and associated cloud information, email support@holifit.ai from your account email. We may need to verify your identity. We will delete or de-identify covered information unless retention is permitted or required by law.

8. Your choices and rights

• Apple Health: review or revoke individual permissions in Apple Health or system settings. Revocation stops future access but does not automatically delete information already synchronized.
• Camera, microphone, speech, and notifications: control these permissions in system settings.
• Account information: update available profile fields in Holifit or contact us for access, correction, export, or deletion.
• AI and feedback features: choose whether to submit prompts, images, feature requests, comments, or optional diagnostics.

Depending on where you live, you may have rights to know, access, correct, delete, restrict, object to, or obtain a portable copy of personal information; to withdraw consent; and to appeal a denied request. You may exercise these rights at support@holifit.ai. We will not discriminate against you for exercising a privacy right.

Authorized agents may submit requests where permitted by law. We may ask for proof of authorization and identity. If we deny a request, you may appeal by replying with “Privacy Appeal” in the subject line.

9. Security

We use administrative, technical, and organizational safeguards designed for the sensitivity of the information, including authenticated access, transport encryption, access controls, and database row-level authorization. No system is perfectly secure, and we cannot guarantee that unauthorized access, loss, or misuse will never occur.

If a breach triggers notification duties, we will notify affected individuals and regulators as required by applicable law.

10. International processing

Holifit and its providers may process information in the United States and other countries where they operate. These countries may have different privacy laws. Where required, we use recognized safeguards for cross-border transfers.

11. Children

Holifit is not directed to children under 13, and we do not knowingly collect personal information from a child under 13. If you believe a child has provided information without appropriate authorization, contact us so we can investigate and delete it. Users under the age of legal majority must have a parent or guardian agree to the Terms and should not enable sensitive features without their involvement.

12. Changes and contact

We may update this policy as Holifit, our providers, or legal requirements change. We will post the updated version and date. We will provide additional notice or seek consent before materially expanding collection, use, or disclosure when required.

Privacy questions and requests: support@holifit.ai
Holifit LLC