For residents of Washington, Nevada, and Connecticut
Washington's My Health My Data Act requires us to publish this notice separately from our general Privacy Policy. It describes how Lupora LLC handles "consumer health data" — information that identifies your past, present, or future physical or mental health status. Nevada (SB 370) and Connecticut provide similar protections, and we apply this notice to residents of all three states.
Everything here is consistent with our general Privacy Policy; this notice puts the health-specific parts in one place.
1. What consumer health data we collect
- Health signals from Apple Health, with your permission: sleep analysis, heart-rate variability, heart rate, resting heart rate, steps, active energy, body weight, and height.
- Bodily and fitness measurements: body weight you log, height, and your completed workouts, sets, weights, and reps.
- Weekly check-in information: how you report feeling, an optional menstrual-cycle phase, an optional free-text note, and optional progress photos of your body.
- Derived health information: your daily readiness score and the insights we generate from your check-ins.
- Profile information that bears on health context: birthday, and optionally gender.
We do not collect precise location data, and we do not use geofencing of any kind — including around health facilities.
2. Where it comes from
- Directly from you, when you enter profile details, log workouts, or submit a check-in.
- From Apple Health on your device, only after you grant permission and only for the categories you approve.
- Derived by us from the above, when we compute readiness or check-in insights.
3. Why we collect it
Solely to provide the features you asked for: computing your daily readiness, building and adjusting your training plans, analyzing progress photos you choose to submit, and showing your own history back to you. We also use it as needed to keep the Service secure and to comply with law.
We do not use consumer health data for advertising, marketing, or profiling you for anyone else's purposes.
4. Who we share it with
We share consumer health data only with processors who handle it on our instructions, under contract:
| Third party | What they receive | Purpose |
|---|---|---|
| Google LLC (Google Cloud, Firebase) | Encrypted health data, workouts, check-ins, photos | Hosting, database, storage |
| Google LLC (Vertex AI / Gemini) | Plan inputs, check-in content, photos at upload | Generating your plans and insights |
Under Google Cloud's terms, this data is not used to train Google's models.
We have no affiliates, and we share consumer health data with no other third parties. We may disclose data if legally compelled, or to protect someone's safety.
5. We do not sell your health data
Lupora does not sell consumer health data, and never has. Washington's law requires a separate, signed authorization before any such sale; we do not seek one because we do not sell this data.
6. Your rights
If you are a resident of Washington, Nevada, or Connecticut, you have the right to:
- Confirm whether we collect, share, or sell your consumer health data, and access it — including a list of the third parties it has been shared with;
- Withdraw consent to our collection and sharing of it;
- Delete your consumer health data.
How to exercise them. Most controls are built into the app:
- Revoke Health access at any time in the iOS Health app under Sharing → Apps.
- Delete individual check-ins — which deletes their photos and insights — in the app.
- Delete everything with Settings → Delete Account, which erases your profile, workouts, check-ins, photos, and readiness history from our servers.
For access requests, a copy of your data, or anything you can't do in the app, email privacy@lupora.com. We will respond within 45 days and may extend once by another 45 days where the law allows, telling you why.
If we deny your request, you may appeal by replying to our response or emailing privacy@lupora.com with "Appeal" in the subject. We will respond within 45 days. If we deny your appeal, you may complain to the Washington State Attorney General at atg.wa.gov/file-complaint, or to your state's Attorney General.
7. How long we keep it
- Readiness history is pruned automatically after 90 days.
- Other health data is kept until you delete it or delete your account.
- Health data you keep in Apple Health belongs to your device and Apple account; deleting your Lupora account does not affect it.
8. How we protect it
Consumer health data is encrypted in transit (TLS) and additionally encrypted at rest with AES-256-GCM by our application layer, on top of Google Cloud's storage encryption. Progress photos are stored as individually encrypted records. Access to production systems is restricted and authenticated, and every request from the app must pass an Apple App Attest integrity check.
Employees and contractors may access consumer health data only where necessary to operate or support the Service.
9. Changes
If we change this notice materially, we will update the date above and notify you in the app before the change takes effect.
10. Contact
privacy@lupora.com
Lupora LLC 8401 Mayland Dr, Ste A Richmond, VA 23294-4648 United States