HuviFit Privacy Policy

This Privacy Policy explains what information HuviFit collects, why we collect it, who we share it with, and what control you have over it. It applies to the HuviFit website at huvifit.com, the HuviFit mobile experience, the Pace assistant, and related features (together, the "Platform"), operated by [LEGAL ENTITY NAME] ("HuviFit," "we," "us," or "our").

Please read it alongside our Terms of Service.

1. Information you give us

• Account information. If you create an account, we collect your email address and a password (stored only as a cryptographic hash, never in readable form). If you sign in through a third-party provider, we receive the basic identifiers that provider sends us.
• Profile and intake information. To generate a plan, the Platform asks for things like age or age range, sex, height, weight, training experience, goals, available equipment, gym or facility, session length, and how many days a week you train.
• Training and nutrition data. Workout logs, exercises, weights, reps, sets, session dates, body measurements, foods, nutrition targets, custom exercises, custom equipment entries, and any notes you write.
• Health and injury information. If you tell the Platform about an injury, limitation, or restricted movement so it can adjust your exercises, we collect that. See Section 4, which covers this separately.
• Messages to Pace. What you type to the Pace assistant, and what Pace responds. See Section 5.
• Communications with us. If you email us for support, send feedback, or report a bug, we keep that correspondence.
• Updates list. If you opt in to product updates, we store your email address for that purpose in a separate list from your account.

2. Information collected automatically

• Device and connection information. IP address, browser type and version, operating system, device type, screen size, language, and referring page. IP addresses are used for security, abuse prevention, and coarse region detection, and are not used to build an advertising profile.
• Usage information. Which pages and features are opened, when, and in what sequence. This is described in detail in Section 6.
• Local storage. The Platform stores data in your browser or on your device so it can work without an account and so your session persists. See Section 10.
• Error and performance logs. When something breaks, our infrastructure records diagnostic information, which may incidentally include an IP address or account identifier.

3. Information from third parties

We do not buy personal information about you, and we do not obtain profile information from data brokers or advertising networks.

We do receive limited information from the service providers that operate parts of the Platform, such as our hosting and authentication providers. If you sign in through a third-party account, we receive only what that provider gives us at sign-in.

4. Health and injury information

Some of what you enter, such as injuries, limitations, body measurements, and weight, is treated as sensitive information under several U.S. state privacy laws.

We handle it this way:

• It is used solely to generate and adjust your plan and to display your own history back to you.
• It is not sold, and it is not shared with advertisers or marketing partners under any circumstance.
• It is not used to build a profile of you for any purpose other than operating the Platform for you.
• It is stored under the same access controls as the rest of your account data and is accessible to you at any time.

HuviFit is not a healthcare provider, and this information is not a medical record. We are not a covered entity under HIPAA, and HIPAA does not apply to data you enter here. Consider that before entering anything you would not want stored on a consumer fitness platform.

Entering injury information is optional. The Platform works without it; it just produces less specific accommodations.

5. The Pace assistant

Pace is an automated assistant. Your messages to Pace, and its responses, are processed to produce an answer and may be retained to operate the feature, diagnose problems, improve quality, and enforce our Terms.

Pace may be powered in part by a third-party AI provider. Where it is, your message is transmitted to that provider for processing under a contract that restricts what they may do with it. We do not authorize providers to use your Pace conversations to train their general-purpose models.

Do not enter sensitive personal information, medical records, financial details, or another person's private information into Pace. It is not a secure channel for that, and it is not a substitute for a professional. See the Terms for what Pace is and is not.

To answer questions about topics it does not already cover, Pace can run a web lookup through DuckDuckGo's public Instant Answer service. When that happens, the only thing sent is a short search phrase about the subject, composed on our server and limited by Pace's instructions to the topic itself. Your profile, body statistics, health details, and the text of your message are not sent to that service, and because the request is made by our server rather than your browser, your IP address and browser are not disclosed to it either. We do not keep a record of the search phrases used.

6. Anonymous usage analytics

We keep product analytics deliberately separate from account data. The Platform records anonymous usage events keyed only to a random identifier generated on your device. That identifier is not linked to your name, email address, or account record, and the analytics system is architecturally separated from the database that stores your personal data.

These events tell us things like which features are opened, how often intake is completed, which gym presets and equipment categories are selected, how many custom equipment entries are added (a count, never the names you gave them), and which goal, experience level, and age range are chosen. When you send a message to Pace, we record that a question was asked and one broad subject label chosen on your device from a fixed list: training, nutrition, recovery, sleep, supplements, injury, app help, or other. The wording of your question never leaves your device for this purpose. We do not store the question, a summary of it, or any part of its text in analytics.

We use this to understand what people actually use, to decide what to build, and to publish or share aggregate statistics about how the Platform is used. Aggregate statistics describe groups of users. They do not identify anyone, and we do not attempt to re-identify them.

7. Optional research contributions

The Platform may offer you the option to contribute anonymized training data to a research dataset.

This is off by default and entirely optional. Participation is never required to use the Platform or any feature of it, and declining costs you nothing.

If you opt in, the contributed records are stripped of identifying fields by design. We may use the dataset to study training patterns, to improve the Platform's plan generation, and to publish or share aggregate findings. We may not always be able to remove an individual past contribution once it has been anonymized and merged, because by then it is no longer linked to you. You can withdraw at any time, which stops future contributions.

8. How we use information

We use the information described above to:

• Create, deliver, and adjust your training and nutrition plans;
• Store and display your history, progress, and records;
• Operate your account, including sign-in, sync, and recovery;
• Respond to your support requests and feedback;
• Send service messages, such as security notices, account alerts, or changes to these policies;
• Send product updates, if you have opted in;
• Diagnose bugs, monitor performance, and keep the Platform running;
• Detect, investigate, and prevent fraud, abuse, and security incidents;
• Understand aggregate usage patterns, as described in Section 6;
• Comply with legal obligations and enforce our Terms.

We do not use your personal information to serve you targeted advertising, and we do not allow third parties to collect information through the Platform for that purpose.

9. How we share information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under U.S. state privacy laws.

We share information only in these circumstances:

• Service providers. Companies that host our infrastructure, handle authentication, deliver email, provide AI processing for Pace, or supply error monitoring. They may access information only to perform those services for us, under contract, and may not use it for their own purposes.
• Legal requirements. When we are required by law, subpoena, court order, or other valid legal process, or when we believe in good faith that disclosure is necessary to protect the safety of any person, to investigate fraud, or to protect our legal rights.
• Business transfer. If HuviFit is involved in a merger, acquisition, financing, or sale of assets, information may transfer as part of that transaction. If that happens, we will provide notice before your information becomes subject to a materially different privacy policy.
• With your direction. If you explicitly ask us to share something, or export your data yourself.
• Aggregate and anonymized information. As described in Sections 6 and 7. This is not personal information because it does not identify anyone.

10. Cookies and local storage

The Platform uses cookies and browser local storage for a small number of purposes:

• Necessary. Keeping you signed in, remembering your preferences, storing your plan and history when you use the Platform without an account, and basic security functions. The Platform does not work correctly without these.
• Analytics. The anonymous usage measurement described in Section 6.

We do not use advertising cookies, retargeting pixels, or third-party ad network trackers.

You can block or clear cookies through your browser settings. If you block necessary cookies or clear local storage while using the Platform without an account, any data stored only on your device will be lost and cannot be recovered by us.

Global Privacy Control. Where required by applicable law, we honor recognized browser-level opt-out signals, including Global Privacy Control.

11. How long we keep information

• Account data is kept as long as your account is active. If you delete your account, we delete the associated personal data from our production systems within [30/60/90] days, except where we are required to keep it longer by law.
• Data stored only on your device, if you use the Platform without an account, exists only there. We do not have a copy and cannot restore it.
• Backups may retain deleted data for a limited additional period as part of routine disaster-recovery practice, after which they are overwritten.
• Anonymous analytics and anonymized research contributions are retained indefinitely, because they are not linked to you and cannot be traced back to your account.
• Support correspondence is kept as long as needed to resolve the matter and maintain a service record.

12. Security

We use reasonable technical and organizational measures appropriate to the size of our operation, including encryption in transit, hashed password storage, access controls limiting who can reach production data, and separation between the systems holding personal data and those holding anonymous analytics.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you as required by applicable law.

Protect your own account by using a unique password and not reusing one from another service.

13. Your choices and rights

Regardless of where you live, you can:

• Access your data through the Platform at any time;
• Correct anything inaccurate by editing it directly;
• Export your training history where an export function is available;
• Delete your account and its associated data;
• Opt out of product update emails using the unsubscribe link. Service messages related to your account cannot be opted out of while you have an account;
• Decline or withdraw from research contributions at any time.

U.S. state privacy rights. Depending on your state, you may have additional rights to know what categories of personal information we collect and disclose, to request access in a portable format, to request correction or deletion, to opt out of sale, sharing, or targeted advertising (we do none of these), to limit use of sensitive personal information, and to not be discriminated against for exercising any of these rights.

To exercise any of these, submit a request through the Platform. We will verify your request, typically by confirming control of the account, and respond within the timeframe required by law, generally 45 days, with an extension where permitted and where we notify you. If we deny a request, we will explain why, and you may explain why and ask us to review it again.

An authorized agent may submit a request on your behalf with proof of authorization.

14. Children

The Platform is intended for users 18 and older and is not directed to children. We do not knowingly collect personal information from anyone under 13.

We do not verify age and cannot control who accesses the Platform. If we learn that we have collected information from a child under 13, or that an account belongs to someone under 18, we will delete it. If you believe a minor has provided us information, let us know through the Platform and we will remove it.

15. Links to other sites

The Platform may link to websites we do not operate. This policy does not cover them. We do not control their content or practices and are not responsible for them. Review their policies before providing information.

16. Where your information is processed

HuviFit is operated from the United States, and information is stored and processed on servers in the United States.

The Platform is intended for users located in the United States. If you access it from another country, you understand that your information will be transferred to and processed in the United States, where privacy laws may differ from those where you live, and you consent to that transfer by using the Platform.

If you are in the European Economic Area or the United Kingdom, note that we have not established a European representative and do not currently offer the full set of GDPR request mechanisms. If you want your data removed, request deletion through the Platform and we will delete it.

17. Changes to this policy

We may update this policy as the Platform changes. When we do, we will update the "Last updated" date above. If a change materially affects how we use your information, we will provide notice through the Platform or by email before it takes effect. Continued use after that means you accept the updated policy.

huvifit.com

Human · Vitality · Fitness