This policy supplements the Global Privacy Notice for US consumer health data, including where Washington's My Health My Data Act, Nevada consumer-health law or a similar state law applies.
Categories and sources
Depending on the features you choose, consumer health data may include fitness goals and training history; workouts, performance, effort and recovery; body measurements; injuries, pain, symptoms, fatigue and limitations; pregnancy/postpartum or other health context entered in free text; heart rate, sleep, steps, distance and activity from a connected source; precise workout routes; progress media; Coach conversations containing health information; and training, recovery or progression inferences.
Sources are you, your use of workouts and Coach, your device and sensors, Apple Health or Health Connect, and a supported activity provider you connect. GRITFIT does not obtain consumer health data from data brokers.
Why it is collected and used
GRITFIT uses consumer health data to provide the optional feature you request; personalise or adapt fitness training; display progress and recovery context; apply disclosed safety limits; answer an enabled Coach request; secure the service; respond to your request; and meet legal obligations. Collection and sharing that requires consent occurs only after the relevant choice.
GRITFIT does not sell consumer health data and does not use it for targeted advertising. If a sale were proposed in the future, GRITFIT would first provide the separate authorisation required by applicable law.
Sharing and processors
Depending on the feature, the minimum necessary information may be processed by GRITFIT's cloud hosting, database/storage, authentication/security, protected language-model, connected-platform and app-store service categories. Apple, Google or a connected activity provider also receives information you direct to its platform. The Service Provider and Subprocessor List identifies current categories. GRITFIT does not give a guardian, advertiser or data broker access to consumer health data.
GRITFIT may disclose information where you direct it, where law requires it, or where necessary to prevent serious harm. A current request for third-party or affiliate information can be made through the route below.
Consent and withdrawal
Optional GRITFIT health personalisation, connected-health/cloud processing and language-model sharing use separate controls. Device permission alone does not authorise every GRITFIT purpose. Withdrawal stops new collection/use for the withdrawn purpose and removes supported health-personalisation records from active GRITFIT systems. It does not automatically delete ordinary workouts, media or records that must lawfully be retained; use deletion for those.
Rights and appeals
Where applicable, you may request access to consumer health data; confirmation of collection or sharing; a list of relevant third parties/affiliates; withdrawal of consent; correction; or deletion. Email dpo@gritfit-ai.com or use the in-app controls. We verify requests proportionately.
For an applicable Washington request, GRITFIT generally responds within 45 days and may take one permitted additional 45-day period with notice. If GRITFIT rejects the request, appeal by emailing dpo@gritfit-ai.com. We generally decide an applicable Washington appeal within 45 days and explain any Attorney General complaint route.
Deletion is sent to relevant processors where required. Live application records can be deleted through the account workflow; provider logs and archived/backed-up copies follow the applicable provider or backup cycle and are not restored to ordinary use merely to avoid a deletion request.
Contact
GRITFIT.AI LIMITED, 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. Email dpo@gritfit-ai.com. A formal complaint can use this route. The backup privacy route is support@gritfit-ai.com.