Consumer Health Data Privacy Policy

1. Who this policy is for

This policy applies to consumers in Washington (My Health My Data Act), Nevada (SB 370), Connecticut and any other US state whose law protects consumer health data. It supplements our privacy policy, which covers everything else. We collect and share consumer health data only with your consent, which the app asks for separately before you can start.

2. Consumer health data we collect

• Workouts you log: exercises, sets, weights, repetitions and how often you train.
• Body information: date of birth, sex, height, weight, body measurements and progress photos you upload.
• Rank-attempt proof photos you submit for review.
• Health and safety information: injuries or limitations you enter and your answers to the PAR-Q readiness questions.
• Nutrition: meals, water and the nutrition goals you set or we calculate for you.
• What you tell our AI coach or support chat about your body, health or training, and exercise videos you upload for form recognition.

3. Why we collect it

• To provide the app: track your training and nutrition, build workout plans and calculate targets.
• To keep you safe: flag PAR-Q answers that suggest seeing a doctor and avoid exercises that conflict with injuries you entered.
• To answer your questions in the AI coach and support chat.

4. Where it comes from

Directly from you, when you enter it in the app, and from the app itself when it derives figures from what you entered (for example, calorie targets from your weight and goal). We do not buy health data and do not collect it from other companies.

5. Who we share it with

• Service providers that process it for us under contract: Hetzner (hosting, Germany); Google (Gemini API, USA) for the text you send to AI features; Sentry (crash diagnostics, USA), which can incidentally include what was on screen.
• PostHog (analytics, EU), only if you opt in to usage analytics: sex, goal, activity level and planned training days, never your logs or measurements.
• The GymiaFit team, which runs the only gym in the app: it sees how often you train, and the result, notes and proof photos of each rank attempt you send for review; the photos are deleted as soon as the attempt is decided. It sees your fitness profile (goal, height, weight, date of birth, injuries, PAR-Q completion) only if you choose to share it, which is optional and separate from your consent to collect. You can stop sharing at any time in Settings → Privacy. We do not share consumer health data with any outside gym.
• Other members, only what you choose to share: squad sessions, leaderboards and posts.

We have no affiliates that receive consumer health data. You can ask us for the list of every third party that received yours (see below).

6. What we never do

• We never sell consumer health data.
• We never use it for advertising or share it with advertisers or data brokers.
• We never set up geofences around places where people receive health care.

7. Your rights

• Confirm whether we collect, share or sell your consumer health data, and get a copy of it together with a list of every third party it was shared with.
• Withdraw your consent at any time, including your consent to share your fitness profile with the GymiaFit team (“your gym” in the app), which you can switch off in Settings → Privacy.
• Have it deleted, including copies held by our service providers. Backups are overwritten within 35 days.
• Not be treated differently for exercising these rights.

In the app, Settings lets you export your data and delete your account. You can also write to support@gymia.fit from the email address on your account. We answer within 45 days and may extend that once by 45 more days, telling you why.

If we refuse your request, you can appeal by replying with the word Appeal within 45 days; we decide within 45 days and explain our decision. If the appeal is denied, you can complain to the Washington State Attorney General at atg.wa.gov or to the attorney general of your state.

8. Changes and contact

If this policy changes, we update this page and its date and ask for your consent again before using your data in a new way. The controller is Gymia (Adelin Lucca Gugescu, an individual based in Italy). Read our privacy policy for everything else.