Consumer Health Data Privacy Policy

1. Consumer health data we collect

PUMPD is a strength-training app. The information you give us about your body and your training is consumer health data, and we treat it that way:

• Body measurements — your height and weight.
• Fitness and exercise data — the workouts, exercises, sets, reps, weights, durations, and effort ratings you log; the plans we generate for you; and your training history over time.
• Training profile — your training experience, goals, available equipment, and scheduling preferences.
• Information you volunteer to the AI coach — anything you choose to tell the coach in a message, including injuries, pain, physical limitations, or how you are feeling, plus any photos you attach.
• Inferences we derive — readiness, recovery, and progression estimates we calculate from the data above in order to set your next targets.

We do not collect precise location data, and we do not use geofencing of any kind — including around healthcare facilities.

PUMPD does not require medical diagnoses, prescriptions, medical records, insurance information, or genetic information. Do not upload medical records or another person's health information. If you voluntarily mention an injury, symptom, or limitation, we process that information as consumer health data.

AVAD Technologies LLC generally is not a HIPAA covered entity or business associate when providing PUMPD directly to consumers, so information in PUMPD generally is not protected by HIPAA — although other federal and state privacy laws may protect it.

2. Where it comes from

We collect consumer health data directly from information you enter or upload — during onboarding, as you log training, and in what you send the AI coach — automatically from your use of fitness-related features, and through inferences we derive from your training information. We do not buy consumer health data, and we do not receive it from data brokers, advertising networks, or other apps.

PUMPD does not connect to Apple Health, Google Fit, or any other health platform, so we receive no data from them.

3. Why we collect it

We collect consumer health data for these purposes and no others:

• to build your training program and calculate your target weights, repetitions, and progression;
• to adapt that program as you log training and as your performance changes;
• to show you your own training history, statistics, and personal records;
• to generate AI coach replies in response to what you ask;
• to debug and fix problems you report, and to keep the Service working;
• to understand how the app’s fitness features are used, through the product analytics described in Section 4; and
• to comply with legal obligations.

4. Who we share it with

We share consumer health data only with vendors who process it on our behalf, under contracts that limit them to providing services to us. We have never sold consumer health data, and we do not plan to.

• Supabase — hosts the database in which your account, profile, and training history are stored, in the United States.
• OpenAI — the AI provider whose models generate coach replies. When you send a coach message, that message, any attached photos, and relevant profile and training context (including any coach memories) are sent to OpenAI, which processes it on our behalf under business terms that prohibit using it to train OpenAI's models without our express agreement. OpenAI may retain content for a limited period for abuse and safety monitoring. If we add or change providers, we will update this Policy promptly and provide any notice or obtain any consent required by law.
• PostHog — receives product-usage events that can reflect training activity (for example, that you started or completed a workout), together with your account identifier. It does not receive your messages, photos, or the contents of your logs.
• Sentry — receives crash reports, performance data, error logs, and session replays. We configure Sentry to mask all text, images, and vector graphics in replays, and we do not attach error screenshots or view-hierarchy snapshots. Replays may still show which screens and fitness features were used, their layout, and the timing of interactions.

We do not share consumer health data with corporate affiliates, and we do not authorize any third party to collect consumer health data from PUMPD over time and across unaffiliated applications or websites.

We may also disclose consumer health data where the law requires it, in response to valid legal process, to protect someone's safety, or in connection with a merger, acquisition, or sale of assets — in which case we will require the recipient to honor this Policy or give you notice and a choice.

5. Your rights

Depending on the law that applies to you, you may have some or all of the following rights:

• confirm whether we collect, share, or sell your consumer health data, and access it;
• obtain a list of all third parties and affiliates with whom we have shared your consumer health data, and a way to contact each of them;
• correct inaccurate consumer health data;
• withdraw your consent to our collection and sharing of your consumer health data; and
• have your consumer health data deleted.

The specific rights, exceptions, verification requirements, and response procedures available to you depend on applicable law.

To exercise any of these rights, contact us at support@getpumpd.com or write to us at 5900 Balcones Dr, Ste 100, Austin, TX 78731. We will verify your request through your existing account or a one-time code, and respond within 45 days — and we will tell you if we need a further 45 days. Deletion of consumer health data follows the faster schedule described in Section 7. We will not charge you for a request or treat you differently for making one.

What withdrawing consent means depends on what you withdraw. Stopping use of the AI coach — or asking us to stop coach processing — ends future AI processing without affecting the rest of your account. Disabling coach memory turns memory off and deletes your stored memories. Withdrawing consent to our collection of your core training data ends the training service itself, because the program cannot be generated or adapted without it; in that case we delete your consumer health data, which deletes your account. You can also delete your account yourself at any time in the app — see /data-deletion.

6. How we get your consent

Before we collect or use the consumer health data needed to provide your training program, we ask for your affirmative consent to process the categories described in Section 1 for the purposes described in Section 3. You may withdraw that consent as described in Section 5. We collect only the consumer health data needed to provide the features you use.

Before you first use the AI coach, we ask for your consent to send your coach messages, selected photos, and relevant profile, training, conversation, and enabled memory context to OpenAI to generate replies. The AI coach is optional, and you may withdraw this consent without deleting your PUMPD account — you can use the rest of the app without ever using the coach.

Some collection is optional and separately controlled by you: photo attachments and voice input each require an iOS permission you grant, and you can revoke either at any time in the Settings app. Voice input is transcribed on your device — the audio itself is never sent to us or to any third party.

7. How long we keep it

We keep consumer health data for as long as your account is active, because your training history is what the program adapts against. When you delete your account, we delete it, except where we must briefly retain limited information to comply with law, resolve a dispute, or prevent abuse.

After authenticating a deletion request, we delete consumer health data from our active systems within 30 days and notify applicable processors, contractors, and other recipients to delete it. Consumer health data in archived or backup systems is deleted or rendered irretrievable within six months, except where applicable law specifically requires limited retention.

8. Changes to this Policy

We will provide notice or obtain consent for changes to how we collect, use, or share consumer health data when required by applicable law.

9. How to appeal

If we deny your request, we will tell you why. You may appeal by replying to our response with the word "appeal" and any additional information you want us to consider. We will review the appeal and give you a written decision, with our reasoning, within 45 days.

If we deny your appeal, you may complain to your state Attorney General: Washington residents at www.atg.wa.gov/file-complaint, Nevada residents to the Nevada Attorney General's Bureau of Consumer Protection, and Connecticut residents to the Connecticut Attorney General at portal.ct.gov/ag.

10. Contact us

Questions about this Policy or your consumer health data? Contact AVAD Technologies LLC at support@getpumpd.com, or write to us at 5900 Balcones Dr, Ste 100, Austin, TX 78731.