Consumer Health Data Privacy Policy

Effective 2026-07-15. This policy supplements our general Privacy Policy.

This policy explains how BolderFit.AI ("we," "us") handles consumer health data - data that identifies your past, present, or future physical or mental health status, including the body measurements and fitness activity you track in the app. We provide it to comply with consumer health data laws such as Washington's My Health My Data Act, Nevada's SB 370, and the Connecticut Data Privacy Act. We ask for your separate, opt-in consent to collect and process this data, distinct from your acceptance of our general Privacy Policy.

1. Categories of consumer health data we collect, and why

We collect only what you choose to enter, to provide the tracking and coaching service you requested:

• Body measurements - body weight, body-fat percentage, and (if you opt in to advanced metrics) extended body-composition values such as BMI, fat-free weight, muscle mass, skeletal muscle, visceral fat, subcutaneous fat, body water, bone mass, protein percentage, BMR, and metabolic age.
• Fitness & training activity - your workouts, exercises, sets, reps, weights, RPE, and any health-related notes you add.
• Diet/nutrition context you choose to enter (such as calorie or protein targets and phase notes).
• Coaching conversations that may reference your health, training, or body data.

Purpose: we use this data solely to operate the service for you - to store and display your data, track your progress over time, and generate personalized coaching. We do not use it for advertising or any unrelated purpose.

2. Categories of sources

• Directly from you - you enter all of this data into the app yourself.
• From a scale or device reading you enter - if you use a compatible body-composition scale, you choose which readings to record; we do not connect to or pull data from devices automatically.
• From a screenshot you choose to upload - you may upload a screenshot of your scale app's results and we extract the values to prefill the check-in form for your confirmation. You select the image yourself; nothing is captured automatically. The image is processed transiently and never stored - only the values you then choose to save become part of your data.
• We do not buy or obtain your consumer health data from any third party.

3. Categories of consumer health data we share

To run the app and generate coaching, we share the categories above (your body measurements, training/diet data, and coaching messages) with the service providers listed below, strictly to operate the service on our behalf. We do not share your consumer health data for any third party's own purposes, we do not use it for targeted advertising, and we do not sell it.

4. Third parties and affiliates we share with

We share consumer health data only with these specific service providers, acting as our processors to deliver the service:

• Anthropic, PBC - processes your training and body data and your messages to generate AI coaching responses; also transiently processes screenshots you upload for the check-in import (the image is used only to read the values and is not retained by us).
• Render - application hosting.
• Turso - encrypted database storage.
• Resend - delivers transactional account emails (verification and password-reset links) to your email address. These messages contain no consumer health data; Resend receives only your email address and the account message itself.
• Formspree - processes only the content you voluntarily submit through the in-app feedback form (please avoid including health data in feedback).

We have no corporate affiliates with whom we share consumer health data. We do not share it with advertisers or data brokers.

5. Your rights and how to exercise them

You have the right to:

• Confirm and access - confirm whether we collect, share, or sell your consumer health data, and access that data.
• Withdraw consent - withdraw your consent to our collection and sharing of your consumer health data.
• Delete - have your consumer health data deleted.
• Appeal - appeal any decision we make in response to a rights request.

How: You can view and edit your data in the app at any time, and permanently delete all of it by deleting your account in Account Settings. To withdraw consent, confirm collection, or make a deletion or access request, delete your account or email us at noah@romboldlabs.com. We will respond within 45 days, as required by applicable law (extendable by an additional 45 days with notice when reasonably necessary). Because the app's core function depends on this data, withdrawing consent or deleting your data generally means you will no longer be able to use BolderFit.AI.

You may designate an authorized agent to submit a request on your behalf. We will require reasonable verification before honoring agent-submitted requests.

We will not discriminate against you for exercising any of these rights.

6. No sale; no geofencing

We do not sell consumer health data and have not collected any authorization to do so. We do not use geofencing around health care or similar facilities. We do not sell or share the consumer health data of individuals under 16 years of age.

7. Data retention

We retain your consumer health data for as long as your account is active. When you delete your account, your body measurements, fitness activity, diet context, and coaching conversations are removed from our active database. Some data may remain in encrypted backups for a short period before being overwritten. AI token-usage logs (which record request volume but not the content of your health data) may be retained after account deletion for cost accounting purposes.

8. International data processing

Your consumer health data is processed in the United States. The service providers listed in Section 4 (Anthropic, Render, Turso) may store or process data on infrastructure located in countries other than where you reside. By consenting to this policy and using the app, you acknowledge this transfer. We require each provider to handle your data solely to provide their services to us and not for their own purposes.

8a. Breach notification

If a security breach affects your consumer health data, we will notify you and, where required, the FTC, within the timelines of the FTC Health Breach Notification Rule (60 days of discovery) and any applicable state breach notification law.

9. Contact

Questions about your consumer health data? Contact us at noah@romboldlabs.com.
Rombold Labs LLC  ·  Butler County, Pennsylvania