Consumer Health Data Privacy Policy

Draft, not in force. This document is still being prepared and has not been reviewed. It does not govern anything. The version and date above are provisional.

This policy applies to consumer health data as defined by Washington's My Health My Data Act, Nevada's SB370, and Connecticut law. It describes what health data NovaZero collects, where it comes from, why we collect it, who we share it with, and how you exercise your rights over it. It supplements our general Privacy Policy, and where the two differ for health data, this one governs. Blue Window LLC, a Kentucky limited liability company at 212 N. 2nd St., Suite 100, Richmond, KY 40475, United States, is the regulated entity responsible for this data. Contact privacy@novazero.app.

1 · The categories of consumer health data we collect

Bodily functions, vital signs and measurements.

Body weight; body-fat percentage; lean body mass; resting heart rate; heart rate during exercise; heart-rate variability; sleep duration and sleep analysis; active energy expenditure; exercise minutes; step count; and distance travelled.

Physical and bodily condition you report to us.

Pain you flag during a workout: the body areas affected, the severity you selected, any note you wrote, and when you flagged it. The body areas you mark as ones to train around. Exercises you have chosen to avoid. The food allergies you tick when you generate a meal plan.

Health-related self-assessments.

Your own 1–5 ratings, recorded in a check-in, of sleep quality, energy, hunger, stress, training quality, and motivation. And, when you rate your recovery on a goal's screen, your 1–5 ratings of sleep quality, energy and muscle soreness, together with hours slept, for each day.

Health-related interventions and goals.

Your training plans, your daily cardio minutes, target body weight, and your goal's date, phases, and, for a competition, its division; your meal plans (the foods, amounts and times you plan to eat, with any protein, carbs and fat you give, and any meal you mark as eaten or skipped), the foods you save to add again, the meal plans you save to use later (imported, generated, or kept when another meal plan replaced them), your daily calorie and macro goal, and, if your goal is to lose weight, how fast you want to lose it. If you generate a meal plan: your diet style, the foods you say you don't eat, the foods you star, the plan itself until you save it or throw it away, and a record of each time you agreed to the generator's statements, with the target and choices that plan was built from (section 8).

Bodily characteristics.

Biological sex, if you give it. Your height and date of birth (the app works out your age from it). How much you move on a normal day, leaving out your workouts.

Precise location associated with a health activity.

Your GPS route during an outdoor cardio workout you started, used to calculate distance and pace. The full-precision route is written to Apple Health on your device when the workout is saved there. A simplified outline of it (smoothed to roughly 10 metres and capped at 500 points) is also stored in your NovaZero account so the app can draw your route map, alongside the session summary. Tracking runs only while a session you started is active, including when your phone is locked, and stops when you finish it.

Inferences.

Figures NovaZero calculates from the above: readiness and recovery trends, adherence percentages, estimated calories burned, the calories you burn in a typical day and the daily calorie and macro goal suggested from them, personal records, and progression suggestions.

2 · Where this data comes from

Directly from you, when you enter it as you create your account or during onboarding, fill in your Training profile, log a workout, complete a check-in, flag pain, plan your meals, or mark a body area to train around.

From your device, with your permission: Apple Health, when you connect it and approve individual data types, and your device's GPS when you start an outdoor cardio workout.

Copied from Apple Health into your account: your morning body weight and body-fat percentage, while Apple Health is connected and a plan of yours has a goal or you have set a target weight. NovaZero copies one morning reading of each per day, from the last 35 days, into your account when you sign in, each time you open the app, and when you set a goal. A weight you enter yourself for a day takes the place of the Apple Health one. Deleting a copied entry in NovaZero does not stop the copy: the next one writes it again. To stop it, remove the goal and the target weight, or turn off NovaZero's access to body weight and body fat in the Health app.

Generated by us, when NovaZero calculates an inference from the data above.

We do not buy consumer health data, and we do not obtain it from data brokers, advertising networks, social networks, or any other third-party source.

3 · Why we collect it, and how we use it

We collect and use consumer health data only to provide NovaZero to you, specifically to:

Generate and adapt your training plans, cardio prescriptions and macronutrient targets, and add up your planned meals against your daily goal.
Work out how many calories you burn in a day from your weight, height, age, sex, how much you move and the workouts you log, and suggest a daily calorie and macro goal from that.
Record what you actually did and show you your progress, personal records and adherence.
Avoid programming exercises you have flagged as painful or asked to avoid, and suggest substitutes.
Pre-fill screens with figures you or your devices already have, so you retype as little as possible.
Calculate recovery, readiness and check-in review views.
Send you only the reminders you have switched on.

We do not use consumer health data for advertising, marketing, profiling for third parties, research, training AI models, or any purpose unrelated to providing you the app.

4 · Who we share it with, and who we do not

We share consumer health data only with the service providers that operate the app on our behalf, under contracts that limit them to that purpose:

Google LLC: Firebase Authentication, Cloud Firestore, Cloud Functions, App Check and Cloud Messaging, which store and synchronise your data and deliver notifications.
Google LLC (Gemini via Firebase AI Logic): only if you use AI Import, and only the training programme or meal plan you choose to submit: the text you paste, or the image or document you pick. Your saved foods and your other meals are not sent, and nothing that identifies your account (no account ID, email address, or sign-in token) is sent with it. If you generate a meal plan, Google receives only your daily calorie and macro target, your meal names and times, and the kinds of meal on our list that the foods fitting your choices can make, each with those foods, and which of those foods you starred. Your allergies, diet style, the foods you don't eat and your weight are never sent to Google.
Apple Inc.: Apple Health data stays on your device under Apple's control and your permission, except the morning body weight and body fat NovaZero copies into your account (section 2), which are then stored with Google as above. Apple also handles push delivery and subscriptions.

We do not share consumer health data with any other category of third party. We do not share it with advertisers, advertising networks, data brokers, social networks, analytics providers, insurers, employers, or researchers. NovaZero contains no analytics, tracking, or advertising software of any kind.

Other NovaZero users never see your consumer health data. Social features share only your handle, display name, the highlights of workouts you finished while sharing was on, the full workout (every exercise and set) of workouts you finished while "Workouts friends see" was on Full workout, for as long as it stays on Full workout, and your stats card while stats sharing is on. Your body data, pain reports, check-ins, meals, macronutrient targets and the body areas you train around are never visible to anyone else.

5 · We do not sell consumer health data

We do not sell consumer health data, and we will not. We have never sold it.

Washington law requires your separate, signed, revocable authorisation before any sale of consumer health data, distinct from your consent to collection. We do not seek such an authorisation because we do not sell this data. If that ever changed, we would have to obtain a valid authorisation from you first, and you could refuse or revoke it without losing access to NovaZero.

6 · Consent, and how to withdraw it

We collect consumer health data only with your consent, and only the categories needed to provide the features you use. Consent is given at account creation and again, specifically, at the point each source is enabled. iOS asks you to approve each Apple Health data type individually, and asks separately for location.

You can withdraw consent at any time, and doing so does not require contacting us:

Apple Health: revoke any or all data types in the Health app under Sharing ▸ Apps ▸ NovaZero.
Location: turn off location access for NovaZero in iOS Settings, or simply do not start a GPS workout.
Check-ins, pain reports, meals and body areas: these are optional; leave them blank, or delete what you have entered.
Everything: delete your account in the app or, if you have declined updated terms and the app is locked, email support@novazero.app.

Withdrawing consent stops future collection. To remove data already collected, use the deletion right below.

7 · Your rights over this data

You have the right to:

Know and access.

Confirm whether we collect, share or sell your consumer health data (we collect and share as described above, and never sell) and get a list of all third parties we have shared it with, together with contact details for each.

Delete.

Have your consumer health data deleted from our records. Deletion is immediate in our live systems, and copies already in our backups are erased automatically within 98 days.

Withdraw consent to collection and to sharing, as described in Section 6.

Not be discriminated against for exercising any of these rights. Nothing you do here affects your price, your access, or the features available to you.

How to exercise them.

Deletion is built into the app (Settings ▸ Delete account) and is immediate. The in-app export covers your training history, your meals, saved foods and saved meal plans; for a copy of your check-ins, body composition data, recovery ratings, pain reports, and the body areas you train around, or for anything else, email privacy@novazero.app with the subject "Consumer Health Data Request".

We will verify the request comes from you, normally by confirming control of the account email address. We respond within 45 days, and may extend once by a further 45 days where the law permits, telling you why. An authorised agent may act on your behalf with written proof of authority. There is no charge.

Appeals.

If we decline, we will explain why in writing and tell you how to appeal. Reply with "Appeal" in the subject line and we will respond within 45 days. If you are still unsatisfied you may complain to the Washington State Attorney General at https://www.atg.wa.gov/file-complaint, or to the Attorney General of your own state.

8 · Deletion: what actually happens

When you delete your account, we permanently erase the consumer health data this account owns: your profile body data and the body areas you train around, workouts and cardio sessions, measurements, personal records, plans with their meals and goals, your saved foods and saved meal plans, goal check-ins, peak-week records, daily recovery ratings, and pain reports. Deletion is immediate in our live database, and copies already in our backups are erased automatically within 98 days.

Apple Health data that stayed on your device is under your control in the Health app, and deleting your NovaZero account does not remove it from there, nor does it remove workouts NovaZero previously wrote into Apple Health, which are yours to keep or delete in the Health app.

Three things outlast the deletion. The record that an account accepted or declined a version of our legal documents on a date, kept for 7 years after the account is deleted; it contains no health data. The record of each meal plan you generated: the date, a fingerprint of the exact statements you agreed to, your daily calorie and macro target, your diet style, the allergies you ticked and the foods you said you don't eat. It does contain health data, and we keep it permanently, including after your account is deleted, as the record of what you agreed to and what the plan was built from (section 9). And, if you used AI Import in the last 30 days, the text you pasted and the plan Google's model returned, which stay in our service logs until they are deleted automatically 30 days after each import (section 9).

9 · How long we keep it

We keep consumer health data only while your account exists and you continue to use the features that produce it, and we delete it when you delete your account or the specific data. We do not retain it for any secondary purpose.

One exception is permanent: the record of each meal plan you generated, with the target, diet style, allergies and foods you don't eat it was built from (section 8). We keep it for as long as we may need to show what you agreed to, which has no end date, and it is not deleted with your account. We use it for nothing else.

One more exception: when you use AI Import, the text you paste and the training programme or meal plan Google's model returns are kept in our Firebase service logs for 30 days so that we can find out why an import failed or came back wrong, and are then deleted automatically, whether or not your account still exists. Those log entries are not linked to your account: they hold no account ID, email address, or sign-in token. Photos and documents you pick are not kept in them.

10 · Security

Consumer health data is stored by Google Cloud, encrypted in transit and at rest, and protected by per-user access rules that permit only your authenticated account to read or write it. Requests are attested by Firebase App Check. Access by us is limited to what is necessary to operate and support the service.

11 · Changes to this policy

We will not collect, use or share consumer health data for a materially new purpose without first obtaining your consent. If we change this policy we will bump the version, publish the change here, and notify you in the app. The version and effective date are at the top.

12 · Contact

Blue Window LLC
212 N. 2nd St., Suite 100, Richmond, KY 40475, United States
privacy@novazero.app

For consumer health data requests, put "Consumer Health Data Request" in the subject line.