Consumer Health Data Privacy Policy

What counts as consumer health data

Information that is linked to you and that says something about your past, present or future physical or mental health. In Climb Kaizen that is the data listed in the next section, and nothing else we hold.

What we collect, and why

Everything here is off until you switch it on, and each item is separate. We collect it for one purpose: to store it and show it back to you, in the daily check-in, in charts, and in your export. The only processing beyond storing and displaying it is arithmetic — a trend line, a cycle length, a predicted window labelled as an estimate. It is not used to advertise to you, to make decisions about you, to build a profile of you, or to infer anything about your health beyond what you entered.

• Body measurements, if you switch them on and agree once, in a sentence we keep in your record: weight, sleep, steps, resting heart rate, heart-rate variability, blood pressure, waist, hydration, calories, and one-to-five ratings for soreness, stress and motivation.
• Cycle tracking, if you switch it on: the days you record, an optional flow level, symptoms from a short list, and any symptom you name yourself. Whether your cycle is natural or on hormonal contraception, because it changes how the days are drawn.
• Readings from your phone’s health app — Apple Health on an iPhone, Health Connect on an Android phone — if you connect it: only the body measurements above that you have switched on, read from that app and stored as check-in rows.
• Whatever you write in session notes, workout notes and similar free text. We do not ask for health information there, but if you record an injury or how you feel, we hold it as you wrote it and treat it as health data.
• Physical characteristics in your profile: height and wingspan, used only to draw your ape index.

Where it comes from

• You. Everything above is typed by you, in the app.
• Apple Health, or Health Connect on Android, only if you connect it, only for the measurements you switched on, and only while the app is open. Today we read and do not write. Disconnecting stops further reading; what was already imported stays until you delete it.

No other source. We do not buy health data, receive it from other apps, or infer it from anything you do outside Climb Kaizen.

Who we share it with

Nobody. We have no affiliates, and we do not share, sell, rent or license consumer health data to any third party. It is not used for advertising, and no third party collects it across other websites or apps through us.

The one thing that could ever send it anywhere is you. If we add a way to write a reading back to your own phone’s health app, or to send a summary to another service you use, it will be something you switch on and something you press, described here before it ships. We will not do it quietly and we will not do it by default.

We use service providers to run the app, under contracts that limit them to our instructions. The law does not treat that as sharing, and here is who touches what:

• Supabase stores it, in a database in the United States, encrypted at rest and in transit.
• Vercel hosts the web app but does not handle health data: the app reads it from the database straight into your browser.
• PostHog, our analytics provider, receives none of it. The events we send are a fixed list that the code refuses to build outside of, and we checked the real events on record on 4 September 2026: no health value, no health screen name, and no flag saying whether a health feature is on.
• Apple is a source of readings if you connect Health, not a recipient. Nothing goes back.

We do not use geofencing anywhere, and we never record where you are.

How we protect it

• Only you can read your rows. Access is enforced by the database for every request, not by the app.
• Our internal support tool cannot reach body measurements or cycle data at all. An automated check fails our build if anyone tries to add that access. Anything you wrote takes a deliberate action and is logged when read.
• On the phone you can keep your body measurements, or your cycle, on the device only, off our servers entirely.

Your rights

Whoever you are and wherever you live, you can:

• See it, and confirm what we hold. Everything is on screen in the app, and Preferences exports all of it as CSV or JSON. Cycle data rides along when its export switch is on.
• Correct it. Every reading and every cycle day is editable in place.
• Withdraw consent. Switch a measurement off, turn cycle tracking off, or disconnect your phone’s health app, in Preferences. Withdrawing is the same switch as agreeing.
• Delete it. Preferences has separate buttons for body measurements and cycle data, and a Delete account control that removes everything. Deletion takes effect immediately in our live systems. Our database provider keeps daily backups for seven days, after which they are gone; a backup is only ever used to recover from a disaster, and if one were restored we would apply your deletion again. No processor needs notifying, because none of them had it.

If you cannot sign in, or would rather ask a person, email privacy@climbkaizen.com. We will confirm the request came from the email address on the account and act within 45 days. If a request is complicated we may take up to 45 more, and we will tell you why.

If we refuse a request we will say why. You can appeal by replying with “Appeal” in the subject line; a person will answer in writing within 45 days. If the appeal fails, you can complain to the Washington State Attorney General or the Nevada Attorney General, and we will include those links in our answer.

Changes

If we ever collect a new category of consumer health data, we will ask for your consent before collecting it, not after. Other material changes update the effective date above and are announced in the app. The current version is always at this address.

Contact

privacy@climbkaizen.com for anything about this policy or your data.