This is a separate document from our privacy policy because Washington and Nevada law require health data to be addressed on its own. It covers the health information PersonaFit AI collects, and it applies to you wherever you live — we did not think it made sense to give people in one state better treatment than everyone else.
What counts as health data here
Not only medical records. Under these laws, information about your physical condition counts, including information you would not think of as medical:
- PAR-Q+ screening answers — including cardiac, blood pressure, dizziness and medication questions.
- Injuries you report, current or historic.
- Pain you report, including where it is, its character, and anything you say during a session.
- Movement restrictions derived from the above.
- Body measurements, if you choose to enter them.
- How you describe your build, if you answer that optional question.
- Training records that reflect your physical capability, such as loads lifted and sessions completed.
Why we collect it, and nothing else it is used for
There is one purpose: deciding what is safe to ask your body to do.
- A hard PAR-Q+ answer stops the intake and tells you to speak to a doctor. It does not produce a plan.
- Reported current pain removes that movement pattern from your programme entirely.
- Reported injuries make your starting loads and progression more conservative.
- Saying you are in pain during a session stops the session.
It is never used for advertising, never used to build a profile of you for any purpose other than your training, and never used to make decisions about you outside this product.
Where it comes from
- You, directly. Every piece of health data above is something you typed, tapped or said.
- Derived from your answers. Movement exclusions are computed from what you reported; they are not separately collected.
We do not buy health data, do not obtain it from data brokers, and do not infer it from your device, your location, or anything you do outside this product.
What is shared, and with whom
Your health data is stored with our infrastructure providers because the product runs on their systems. They process it on our instructions and may not use it for their own purposes.
- Supabase — database and authentication. Your health data is stored here, protected by row-level security so that only your account can read it.
- Vercel — application hosting. Processes data in transit; does not store your health data.
When the conversational coach is enabled, the training context needed to answer you — which can include injuries and restrictions — is sent to Anthropic to generate the coach’s reply. Your email and account identifiers are not sent.
Coach speech is produced either on your own device by your browser, in which case nothing leaves it, or by Google Cloud Text-to-Speech, which receives only the words the coach is about to say. Neither receives your health data.
We have never sold consumer health data, and we will not. Selling it would require your separate written authorization, which we do not intend to ask for.
Things we do not do
- No geofencing. We do not operate a geofence around any healthcare facility, and we do not track your location at all.
- No advertising use. Health data is never used to target, measure or personalize advertising.
- No sale, no trade, no brokers.
- No sharing with employers or insurers. Nobody who might make a decision about your life receives this.
Your rights
All of these are available from Profile in the app, and none of them cost you access to the rest of the product.
- Confirm and access. See exactly what health data we hold, and which third parties it has been shared with.
- Withdraw consent. Stop collection at any time. Withdrawing consent for optional collection, such as body measurements, does not end your subscription.
- Delete. Have your health data deleted, including from backups on their normal cycle, and we will notify any provider that received it to do the same.
- Appeal. If we refuse a request, we will tell you why, and how to appeal. If we refuse an appeal, you may complain to the Washington Attorney General.
We answer within 45 days, and will tell you if we need a permitted extension. To make a request without using the app, email privacy@personafitai.com.
One exception to deletion
Your PAR-Q+ answers are kept as a safety record for as long as your account exists, because they are the record of what you told us before we let you train. If you delete your account they go with it. If you want them deleted while keeping your account, we can do that — but you will be asked to complete the screening again before your next session, since we will no longer know whether it is safe for you to train.
What this product is not
PersonaFit AI is not a covered entity under HIPAA, is not a business associate of one, and is not a medical device. Your coach is artificial intelligence, not a clinician. Nothing here replaces medical advice — see the liability waiver.
Who to contact
Silverbridge Dynamics (Pty) Ltd is responsible for this data. For anything in this document, email privacy@personafitai.com. We will tell you what we hold, and we will delete it if you ask.