Consumer Health Data Privacy Notice

1. Consumer health data we collect

Depending on the features and permissions you choose, Finn may collect:

• Body, fitness, and activity information: height, weight, goals, training experience, workout and mobility activity, schedule, exercise minutes, steps, active energy, and workout summaries.
• Recovery and physiological information: sleep duration, resting heart rate, heart-rate variability (SDNN), respiratory rate, soreness, injuries, symptoms, limitations, and recovery information you choose to provide.
• Nutrition information: dietary preferences, food intake, allergies you choose to identify, recipes, grocery information, and nutrition goals.
• Health-related inferences and outputs: plans, recommendations, classifications, and summaries generated from the information above. These are wellness outputs, not diagnoses.
• Data that identifies or can be linked to you: account identifiers and contact information associated with the health-related information.

2. Sources

• You: onboarding, chats, profile settings, logs, support messages, and other information you choose to enter.
• Apple Health: only the read categories you authorize. Raw HealthKit samples remain on-device; Finn uploads normalized daily and workout summaries.
• Our Services: health-related plans, summaries, and inferences created from your interactions and authorized information.

3. Why we collect and use it

• Provide and personalize the fitness, nutrition, mobility, planning, logging, and progress features you request.
• Display authorized Apple Health summaries and adapt your wellness plan when you ask Finn to use them.
• Generate requested AI coaching only after the applicable explicit permission.
• Maintain data quality, synchronize your history, troubleshoot, secure the Services, prevent abuse, and comply with law.

We will not collect or use additional categories of consumer health data, or use disclosed data for a materially different purpose, without first updating this Notice and obtaining affirmative consent when required.

4. Consumer health data we share and recipients

Google Gemini API is Finn's current AI service. OpenAI and Anthropic are supported alternatives and receive a request only if selected for it. Provider processing can include service operation, security and legally required retention; a fixed project-log period does not cap every provider copy. Finn has no affiliates with which it shares consumer health data as of this version. Auth0 and RevenueCat receive account or purchase information for authentication and subscription functions, not health data for those functions. Apple processes HealthKit and App Store information under your relationship with Apple. See the Privacy Policy for provider purposes and international processing.

Every third party with whom Finn shares consumer health data must process it only for authorized purposes and provide the same or equal protection of user data as stated in this Notice and required by Apple's App Review Guidelines.

5. Sale and advertising

Finn does not sell consumer health data. Finn does not use or disclose consumer health data for advertising, marketing, cross-context behavioral advertising, eligibility decisions, or unrelated data mining. We will not sell consumer health data without the separate, signed authorization required by applicable law.

6. Your rights

Subject to applicable law, you may:

• confirm whether Finn collects, shares, or sells your consumer health data;
• access the data and obtain a list of third parties and affiliates that received it;
• withdraw consent for future collection or sharing;
• delete consumer health data, including directing deletion by processors as required; and
• appeal our refusal to act on a request.

Submit a request or appeal to coachfinntech@gmail.com and identify the right you want to exercise and the email associated with your account. We may verify your identity and authority. If we deny a request, our response will explain why and how to appeal where required.

7. In-app controls and effect of withdrawal

• AI Data Sharing: withdrawing blocks future AI-backed coaching until you explicitly allow it again. It does not recall information already processed.
• Apple Health AI use: disabling it stops Apple Health summaries from being included in future requests to the selected AI provider without deleting imported summaries.
• Disconnect Apple Health: stops future imports and revokes Apple Health AI use but does not delete previously imported summaries.
• Delete imported health data: removes Finn's imported Apple Health observations, workouts, derived health contexts, and connection record from active systems.

8. Retention and deletion

Imported daily observations, workout summaries and value-free sync audit records remain stored for connected-health and coaching functions. Request deletion through the controls available in your app version or our privacy contact. Do not rely on automatic erasure after a fixed number of days for these imported records. Other health-related profile, plan, chat and log information is retained for your active account and the functions you request. Deletion requests may be subject to limited retention needed for legal, security, fraud-prevention and transaction-record purposes. Provider processing or technical failures can delay deletion; a request alone does not confirm that every copy has been erased. The production Render database can recover earlier states from the preceding seven days. That window is not a maximum for every provider record or other copy. See our Privacy Policy and contact us if you need help confirming deletion status.

9. Contact and changes

Contact coachfinntech@gmail.com or Ellison Software LLC, 1302 Bonnie Brae Street, Hermosa Beach, CA 90254, with questions or complaints. We will post changes here and update the date above. We will provide additional notice and obtain consent before materially expanding covered collection, use, or sharing when required.