For residents of Washington, Nevada, and Connecticut
Washington's My Health My Data Act requires us to publish this notice separately from our general Privacy Policy. It describes how Lupora LLC handles "consumer health data" — information that identifies your past, present, or future physical or mental health status. Nevada (SB 370) and Connecticut provide similar protections, and we apply this notice to residents of all three states.
Everything here is consistent with our general Privacy Policy; this notice puts the health-specific parts in one place.
1. What consumer health data we collect
- Health signals from Apple Health, with your permission: sleep analysis, heart-rate variability, heart rate, resting heart rate, steps, active energy, body weight, and height.
- Bodily and fitness measurements: body weight you log, height, and your completed workouts, sets, weights, and reps.
- Weekly check-in information: how you report feeling, an optional menstrual-cycle phase, an optional free-text note, and optional progress photos of your body.
- Derived health information: your daily readiness score and the insights we generate from your check-ins.
- Profile information that bears on health context: birthday, and optionally gender.
We do not collect precise location data, and we do not use geofencing of any kind — including around health facilities.
2. Where it comes from
- Directly from you, when you enter profile details, log workouts, or submit a check-in.
- From Apple Health on your device, only after you grant permission and only for the categories you approve.
- Derived by us from the above, when we compute readiness or check-in insights.
3. Why we collect it
Solely to provide the features you asked for: computing your daily readiness, building and adjusting your training plans, analyzing progress photos you choose to submit, showing your own history back to you, and, when you connect an AI assistant, sharing the data you allow with it (section 4). We also use it as needed to keep the Service secure and to comply with law.
We do not use consumer health data for advertising, marketing, or profiling you for anyone else's purposes.
4. Who we share it with
We share consumer health data with processors who handle it on our instructions, under contract, and, only when you direct us to, with an AI assistant you connect:
| Third party | What they receive | Purpose |
|---|---|---|
| Google LLC (Google Cloud, Firebase) | Encrypted health data, workouts, check-ins, photos | Hosting, database, storage |
| Google LLC (Vertex AI / Gemini) | Plan inputs, check-in content, photos at upload | Generating your plans and insights |
| GitHub (Microsoft) | Feedback reports, when one you send, or one an assistant you connect sends for you, describes consumer health data | Tracking the problems and requests reported, in a private repository |
Under Google Cloud's terms, this data is not used to train Google's models.
AI assistants you connect. If you connect an AI assistant to Lupora, such as ChatGPT or Claude, we share with its provider the consumer health data you allow on Lupora's connection screen. That screen asks for your consent separately from your consent to our collection, and for each connection:
| What the assistant's provider receives | When |
|---|---|
| Your planned workouts and their titles, whether each was started or completed, and their exercises, sets, reps, and loads | Always, with any connection |
| Your training log: the sets and exercises you completed, with reps, loads, effort ratings, and completion times, and the totals calculated from them | Only if you check that box |
- Purpose: so the assistant you chose can review your training and, if you allow it, suggest or make changes to your plan.
- Recipient: the provider of the assistant you connect (for example OpenAI or Anthropic), a third party you choose. It is not our processor, and its own privacy policy governs the data once we send it.
- Withdrawing consent: disconnect the assistant in Settings → Connected assistants. Sharing stops immediately, but we cannot recall what was already shared.
- No connection ever receives your Apple Health signals, readiness, check-ins, photos, body weight, or height.
Feedback reports. Feedback reports are for problems and requests about Lupora, not a health feature, and we ask connected assistants to leave health details out of them. A report can still describe consumer health data, such as a workout's sets and loads, if you write it into a report you send, or if an AI assistant you allowed to send feedback reports writes it into one. An assistant's report reaches us as the assistant wrote it, without a review step on your phone. We store a report's text encrypted and copy it into an issue in our private GitHub repository. Disconnecting the assistant stops new reports but does not take back reports it already sent.
We have no affiliates, and apart from the assistants you connect, we share consumer health data with no other third parties. We may disclose data if legally compelled, or to protect someone's safety.
5. We do not sell your health data
Lupora does not sell consumer health data, and never has. Washington's law requires a separate, signed authorization before any such sale; we do not seek one because we do not sell this data.
6. Your rights
If you are a resident of Washington, Nevada, or Connecticut, you have the right to:
- Confirm whether we collect, share, or sell your consumer health data, and access it — including a list of the third parties it has been shared with;
- Withdraw consent to our collection and sharing of it;
- Delete your consumer health data.
How to exercise them. Most controls are built into the app:
- Revoke Health access at any time in the iOS Health app under Sharing → Apps.
- Delete individual check-ins — which deletes their photos and insights — in the app.
- Disconnect an AI assistant, or all of them, in Settings → Connected assistants, which stops further sharing with it immediately.
- Delete everything with Settings → Delete Account, which erases your profile, workouts, check-ins, photos, and readiness history from our servers and ends every AI assistant connection.
For access requests, a copy of your data, or anything you can't do in the app, email privacy@lupora.com. We will respond within 45 days and may extend once by another 45 days where the law allows, telling you why.
Assistants you connected. Settings → Connected assistants lists every AI assistant you have connected, including ones you have since disconnected (under History), identified by its web address. We keep that list until you delete your account so we can answer an access request. When you ask for the third parties we shared your data with, we include each assistant's provider and how to contact it. Deleting your data in Lupora, or your account, cannot delete what a provider already received: to delete that, use the provider's own privacy controls or contact it directly.
If we deny your request, you may appeal by replying to our response or emailing privacy@lupora.com with "Appeal" in the subject. We will respond within 45 days. If we deny your appeal, you may complain to the Washington State Attorney General at atg.wa.gov/file-complaint, or to your state's Attorney General.
7. How long we keep it
- Readiness history is pruned automatically after 90 days.
- Other health data is kept until you delete it or delete your account.
- The record of which AI assistants you connected is kept until you delete your account. It contains no workout content.
- Feedback reports, including those an assistant sends for you, are kept until you delete your account. The GitHub issue created from a report follows our repository retention and is not deleted with your account; to have one deleted, email privacy@lupora.com with the report's reference.
- Health data you keep in Apple Health belongs to your device and Apple account; deleting your Lupora account does not affect it.
8. How we protect it
Consumer health data is encrypted in transit (TLS) and additionally encrypted at rest with AES-256-GCM by our application layer, on top of Google Cloud's storage encryption. Progress photos are stored as individually encrypted records. Access to production systems is restricted and authenticated. Every request from the iPhone app must pass an Apple App Attest integrity check, and every request from the web companion a Google reCAPTCHA Enterprise check. A connected AI assistant instead uses short-lived access tokens that work only for that one connection and the permissions you granted, and stop working as soon as you disconnect it.
Employees and contractors may access consumer health data only where necessary to operate or support the Service.
9. Changes
If we change this notice materially, we will update the date above and notify you in the app before the change takes effect.
10. Contact
privacy@lupora.com
Lupora LLC 8401 Mayland Dr, Ste A Richmond, VA 23294-4648 United States