Consumer Health Data Privacy Policy

1. Introduction

QBod LLC ("QBod," "we," "us," or "our") provides a mobile fitness and wellness application that collects and processes consumer health data to deliver personalized fitness coaching, nutrition tracking, and wellness insights.

This Consumer Health Data Privacy Policy describes how QBod collects, uses, shares, and protects your health data as required by the Washington My Health My Data Act (RCW 19.373) and other applicable laws.

This policy applies to all QBod users. Washington state residents have specific additional rights described in Section 6 of this policy.

2. Categories of Health Data Collected

QBod collects the following categories of consumer health data:

Body Measurements

Weight, height, body mass index (BMI), body fat percentage, muscle mass, body water percentage, and waist/hip measurements. This data is entered directly by you or synced from connected devices.

Nutrition Data

Meal logs, food items consumed, calorie intake, macronutrient tracking (protein, carbohydrates, fat), micronutrient data, dietary restrictions, and dietary preferences. This data is entered by you through the meal logging features.

Fitness Data

Workout history, exercise types and duration, sets, repetitions, and weight for strength training, cardio metrics (distance, pace, heart rate zones), and personal records. This data is entered by you or synced from connected platforms.

Recovery and Vitals

Heart rate, heart rate variability (HRV), resting heart rate, respiratory rate, blood oxygen saturation, and sleep duration and quality. This data is collected via Apple Health (HealthKit) integration on iOS or Health Connect on Android, only when you grant device-level permission.

Health Device Data

Screenshots and photographs from glucose meters, DEXA scan results, and smart scale readings that you voluntarily submit for AI-powered data extraction. QBod uses AI to read and extract health metrics from these images.

AI Coaching Conversations

Messages you exchange with the QBod AI health coach, including health-related questions you ask and the AI-generated responses. This includes any health information you voluntarily share during coaching conversations.

Goal and Progress Data

Fitness goals you set, target weights, body composition targets, progress photographs (if voluntarily submitted), and milestone tracking data.

3. Sources of Health Data Collection

QBod collects consumer health data from the following categories of sources:

Direct User Entry

Health data you manually enter into the app, including body measurements, meal logs, workout details, mental health scores, sleep times, and fitness goals.

Apple Health (HealthKit) and Google Health Connect

With your explicit permission, QBod reads health data from your device's health platform, including heart rate, heart rate variability (HRV), resting heart rate, respiratory rate, blood oxygen saturation, sleep data, and workout summaries.

User-Uploaded Images

Screenshots and photographs you voluntarily submit from health devices such as glucose meters, DEXA scan results, and smart scales. QBod uses AI to extract health metrics from these images.

AI Coaching Interactions

Health-related information you share in conversations with QBod's AI coach, including questions about fitness, nutrition, and wellness.

Derived and Calculated Data

Health metrics that QBod calculates from your input data, including BMI, TDEE estimates, macro targets, strength ratios, progress trends, and Q-Scores.

4. Purposes for Collecting Each Category of Health Data

QBod uses each category of health data for the following specific purposes:

Body Measurements

• Track your body composition progress over time
• Inform AI coaching recommendations
• Calculate fitness and health metrics (BMI, body fat trends, lean mass changes)
• Generate progress visualizations and analytics

Nutrition Data

• Track your daily dietary intake against nutritional targets
• Inform meal planning and recipe recommendations
• Provide AI coaching context for nutrition guidance
• Calculate nutrition scores and adherence metrics

Fitness Data

• Track workout progress and performance trends
• Generate personalized workout recommendations
• Calculate strength metrics, cardio metrics, and personal records
• Inform AI coaching on training volume, intensity, and recovery needs

Recovery and Vitals

• Monitor recovery status between workouts
• Inform training intensity recommendations based on readiness
• Provide health trend insights (resting heart rate trends, HRV trends)
• Generate recovery scores and wellness assessments

Health Device Data

• Extract health metrics from user-submitted images (glucose readings, body composition data, weight readings)
• Add extracted metrics to your health tracking history
• Provide context for AI coaching recommendations

AI Coaching Conversations

• Provide personalized fitness and nutrition guidance
• Maintain conversation context for continuity across coaching sessions
• Generate relevant follow-up recommendations

Goal and Progress Data

• Track progress toward your stated fitness and health goals
• Generate milestone celebrations and achievement badges
• Inform AI coaching on goal-specific recommendations
• Adjust training and nutrition plans based on progress

5. Third Parties Who Receive Your Health Data

QBod shares your health data with the following third parties, each for a specific and limited purpose:

Google LLC (Gemini AI)

When you use AI coaching features, anonymized summaries of your fitness and health data are sent to Google Gemini for processing. Personal identifiers (your name, email address, and account details) are removed before transmission. Google does not use this data to train AI models under our paid API agreement. Data sent includes: fitness goals, workout summaries, nutrition summaries, body composition trends, health device images (for metric extraction), and coaching conversation messages.

Supabase Inc.

Supabase provides our cloud database infrastructure. All categories of your health data are stored in Supabase-hosted databases. Data is encrypted at rest with AES-256 encryption. Supabase acts as a data processor and processes your data only on our instructions.

Amazon Web Services (AWS)

AWS provides cloud file storage for health device screenshots and images you submit. Files are encrypted at rest with AES-256 encryption using AWS Key Management Service (KMS). AWS acts as a data processor.

Google LLC (Firebase)

Firebase provides app interaction analytics and crash reporting. Firebase analytics collects screen views and interaction events but does not receive health-specific data values (such as your weight, calorie counts, or workout details). Crash reports may contain error context from health-related screens, which is used solely for debugging app stability.

RevenueCat Inc.

RevenueCat manages subscription billing. RevenueCat receives subscription status and transaction data only. No health data is shared with RevenueCat.

6. How We Obtain Your Consent

QBod obtains your consent for health data collection through the following mechanisms:

Account Creation Consent

During account creation, you provide explicit opt-in consent to QBod's collection and processing of your health data by agreeing to the Terms of Service and Privacy Policy. This consent covers the core health data categories: body measurements, nutrition data, fitness data, and goal/progress data.

AI Features Consent

AI coaching features require a separate consent checkbox ("I consent to AI features") during onboarding. This consent authorizes QBod to send your anonymized health data to Google Gemini for AI processing. You may use QBod's core tracking features without enabling AI features.

HealthKit / Health Connect Permission

Recovery and vitals data (heart rate, HRV, sleep, etc.) is collected only when you grant device-level permission through iOS Settings (Apple Health) or Android Settings (Health Connect). This is a separate system-level consent managed by your device operating system.

Health Device Screenshot Submission

Submission of health device screenshots (glucose meters, DEXA scans, smart scales) is entirely voluntary and initiated by you each time. Each submission constitutes consent for that specific image to be processed by AI for data extraction.

Withdrawing Consent

You may withdraw any of these consents at any time. See Section 7 for step-by-step withdrawal instructions.

7. Your Rights

You have the following rights regarding your health data:

Right to Know

You have the right to know what health data we collect about you, why we collect it, and who receives it. This policy serves as our primary disclosure. You may also request a personalized summary of your health data processing.

Right to Access

You have the right to request a copy of all health data we hold about you. You can export your data at any time through the app (Settings > Privacy & Data > Export Data), or by contacting us.

Right to Delete

You have the right to request deletion of your health data. You may delete specific data categories within the app, or request complete deletion of all health data by contacting us or deleting your account.

Right to Withdraw Consent

You have the right to withdraw your consent for health data processing at any time. You may disable AI features, revoke HealthKit or Health Connect access, or delete your account entirely. See Section 7 for instructions.

Right to Opt-Out of Sharing

You have the right to opt out of health data sharing with third parties. You can disable AI coaching to stop health data from being sent to Google Gemini for AI processing. Core tracking features remain available without AI sharing.

How to Exercise Your Rights

To exercise any of these rights, email support@qbod.fit Copy with the subject line "Health Data Request." We will respond within 45 days of receiving your request.

Washington State Residents

If you are a Washington state resident, you have additional rights under the Washington My Health My Data Act (RCW 19.373), including the right to bring a private action for violations of this policy. Washington residents may also file complaints with the Washington State Attorney General.

8. How to Withdraw Consent or Delete Your Health Data

You can withdraw consent or delete your health data using any of the following methods:

Disable AI Coaching

Navigate to Settings > AI Features and toggle AI coaching off. This immediately stops all health data from being sent to Google Gemini. Your existing health data and tracking features remain intact.

Revoke HealthKit Access (iOS)

Navigate to iOS Settings > Privacy & Security > Health > QBod and toggle off the data categories you wish to revoke. This stops QBod from receiving new recovery and vitals data from Apple Health.

Revoke Health Connect Access (Android)

Navigate to Android Settings > Health Connect > QBod and revoke the data permissions. This stops QBod from receiving new health data from Health Connect.

Delete AI Conversation History

Navigate to Settings > Privacy & Data > Delete Chat History to delete your AI coaching conversation history.

Delete Your Account Entirely

Navigate to Settings > Account > Delete Account. This permanently deletes your account and all associated health data. All health data is purged within 30 days of the deletion request. Backup copies are purged within 90 days.

9. Data Retention

QBod retains your health data according to the following schedule:

• Active Account: All health data is retained for as long as your account is active and you continue using the Services.
• AI Coaching Conversations: Retained for conversation history while your account is active.
• AI Processing Logs: Technical processing logs are retained for 90 days for debugging and service quality purposes, then automatically deleted.
• Deleted Accounts: All health data is permanently purged within 30 days of an account deletion request. Backup copies are purged from backup systems within 90 days.
• Google Gemini Retention: Google Gemini deletes processing data within 30 days after processing per our Data Processing Agreement.

10. Data Security

QBod implements the following security measures to protect your health data:

• Encryption at Rest: All health data stored in our databases and file storage is encrypted using AES-256 encryption.
• Encryption in Transit: All data transmitted between your device and our servers uses TLS 1.3 encryption.
• Anonymization: Personal identifiers (name, email) are removed from health data before it is sent to Google Gemini for AI processing.
• Access Controls: Role-based access controls restrict who within QBod can access health data, limited to those with a legitimate business need.
• Security Assessments: We conduct regular security assessments of our systems and third-party service providers.
• Breach Notification: In the event of a data breach affecting your health data, we will notify affected individuals and applicable authorities in accordance with the FTC Health Breach Notification Rule (16 CFR Part 318) and applicable state laws.

11. Changes to This Policy

QBod may update this Consumer Health Data Privacy Policy from time to time. When we make material changes, we will:

• Notify you via in-app notification or email before the changes take effect
• Update the "Effective Date" and version number at the top of this policy
• Provide a summary of what changed

Continued use of QBod after changes take effect constitutes your acceptance of the updated policy. Previous versions of this policy are available upon request by emailing support@qbod.fit.

12. Contact Us

For questions or concerns about this Consumer Health Data Privacy Policy or your health data:

Email: support@qbod.fit Copy

Mailing Address: QBod LLC, 539 W. Commerce St #2754, Dallas, TX 75208

Subject Line Guidelines:

• For general inquiries about this policy: Use subject line "Health Data Privacy"
• For rights requests (access, deletion, opt-out): Use subject line "Health Data Request"
• For Washington state-specific inquiries: Use subject line "Washington Health Data Request"