Consumer Health Data Privacy Policy
1. Who is responsible
- For individual users and for coaches' own data, LYFTR is the regulated entity.
- For data a client enters for their coach, or a coach enters about a client, the coach is the regulated entity and LYFTR processes that data on the coach's behalf. Clients should contact their coach first; we forward requests we receive and help coaches answer them.
2. Consumer health data we collect
- Weight, height, body measurements and body fat;
- progress photos and exercise videos;
- nutrition, supplement, calorie and water logs;
- training and recovery logs (load, reps, effort, sleep, energy, pain notes);
- injury and health notes, check-in answers and health-related answers in coaching applications;
- information derived from this data, such as calorie targets, load suggestions and progress charts.
We do not collect precise location, do not use biometric identifiers (no face or voice recognition) and do not ask for reproductive, sexual health or genetic data. Please do not enter such data in free-text notes.
3. Sources
Directly from you; from your coach, who may record measurements or notes about you; and automatically when you use the app (for example, the time a workout is logged).
4. How we use it
- To provide the tracking and coaching features you asked for, and (for clients) to show it to your coach;
- to store, sync across your devices and back up your data;
- to keep the service secure and fix problems.
We do not use consumer health data for advertising, do not sell it, and do not use geofencing.
5. Who we share it with
- Your coach, if you are a client.
- Processors that host and deliver the service on our instructions: Google LLC (Firebase: authentication, database, file storage) and Cloudflare, Inc. (hosting and security). Functional Software, Inc. (Sentry) receives technical error reports, not your health records.
- Authorities, only when required by law.
We have no affiliates that receive consumer health data. We do not share it with advertisers, data brokers or other coaches.
6. Consent
We collect and use consumer health data only with your consent, which the app asks for on first sign-in and records with the date and document version. You can withdraw consent at any time by emailing support@lyftr.co or, if you are a client, by asking your coach. After you withdraw, we stop collecting and using the data and delete it as described below.
7. Your rights
- Access: confirm whether we collect, share or sell your consumer health data, get a copy of it, and get a list of the third parties it was shared with and how to contact them.
- Deletion: have your consumer health data deleted, including from backups; we also tell our processors to delete it. You can delete your account and data yourself in the app (Terms and permissions > Delete my account and data); it takes effect right away.
- Withdraw consent as described above.
- No discrimination for exercising your rights.
How to make a request: email support@lyftr.co from the email address on your account with the subject "Health data request". We verify your identity through your account and respond within 45 days; if we need more time (up to 45 more days) we will tell you why. Requests are free of charge.
Appeal: if we decline your request, you can appeal by replying with the subject "Appeal" within 45 days. We answer appeals within 45 days. If your appeal is denied, you can contact your state Attorney General (in Washington: atg.wa.gov/file-complaint).
8. Retention and security
We keep consumer health data while your account or client profile is active. After deletion, it is removed from active systems within 30 days and from backups within 90 days. Data is encrypted in transit and at rest, access is restricted by account-level rules, and our team can view a coach's client data only if the coach grants support access, which is logged and shown to the coach.
9. Changes and contact
We will post changes here and ask for your consent again before any new collection or sharing of consumer health data. Questions: support@lyftr.co