Legal
Consumer Health Data Privacy Policy
This policy explains how [LEGAL ENTITY NAME] ("Alzor", "we", "us") collects, uses and shares consumer health data in the Alzor app, and the rights you have over it. It is written for the Washington My Health My Data Act and similar laws, such as Nevada's consumer health data law, and it applies to every user, wherever you live.
It supplements our Privacy Policy, which covers all the other data the app handles. Contact: soporte@alzor.app · [LEGAL ENTITY NAME], [ADDRESS].
1. Consumer health data we collect
"Consumer health data" means personal information that is linked or reasonably linkable to you and that identifies your past, present or future physical health status. In Alzor that is:
- Body measurements: your weight (and its history of weigh-ins), your height, the body mass index we compute from them, and the sex you choose during onboarding.
- Injuries and physical restrictions you declare so routines can avoid them.
- Exercise and fitness data: workouts, exercises, sets, reps, weights lifted, training days and minutes, personal records and 1RM estimates.
- Nutrition data: your meal log (foods, grams, calories, protein, carbohydrates and fat), your macro goals, the foods you create, and the meal descriptions you send to the AI estimate.
- Inferences we derive from the data above: your rank, per-muscle progress, stats, your companion's condition, which muscles you have been neglecting, suggested weights and calorie and macro targets.
We do not collect precise location, biometric data, genetic data, reproductive or sexual health data, or information about health care services you seek. We do not use geofencing.
2. Sources
- You, when you enter it in the app.
- Our own calculations, for the inferences listed above.
- OpenAI, which returns the routines and meal estimates generated from what we send it (section 4).
3. Why we collect and use it
- To build and adjust your workouts, suggest weights and avoid exercises that conflict with your declared injuries.
- To show your progress: weight trend, records, ranks, per-muscle progress and your companion.
- To run your meal diary and macro goals.
- To understand where people drop off during onboarding (usage analytics).
- To keep the service secure and prevent abuse.
We never use consumer health data for advertising, we never sell it, and we never use it to decide eligibility for insurance, credit, employment or housing.
4. Who receives it
We do not share consumer health data with third parties for their own purposes. It is processed only by these service providers (processors), under contract and only on our instructions:
| Processor | Consumer health data it processes |
|---|---|
| Supabase (database, USA) | All the data in section 1 except sex. |
| Railway (API hosting, USA) | Passes through our server while the app is in use; no separate copy is kept. |
| OpenAI (AI provider, USA) | Only if you accept the AI consent: goal, weight, height, body mass index, declared injuries, equipment, training history, records, streak and rank for routines; only the meal description you type for meal estimates. |
| PostHog (product analytics, USA) | Your goal and experience level, attached to onboarding events. Height, weight and sex are not sent. |
Other users never see your weight, injuries or meal log. They can see your rank, level and companion in leaderboards, guilds, duels and battles. We may also disclose data when the law requires it.
5. Your consent
- Collection. When you create an account, you agree, with an unchecked box that you must tick yourself, to Alzor using your health data to build your routines and goals.
- AI processing. A separate, optional consent screen names OpenAI and the data sent. If you say no, routines come from our own templates and nothing is sent to OpenAI. You can revoke it at any time in Profile → Settings.
- Withdrawing consent. You can withdraw consent at any time by revoking the AI consent, clearing the fields you entered, or deleting your account. We will stop collecting and processing the data covered by that consent, except what we must keep by law.
If we ever wanted to share consumer health data with a third party other than the processors above, or use it for a purpose not listed here, we would ask for your separate consent first. We will never sell it.
6. Your rights
- Confirm and access. Ask us to confirm whether we collect, share or sell your consumer health data, get a copy of it, and get a list of every third party and processor that has received it, with their contact information.
- Delete. Delete your account in the app (Profile → Settings → Delete account) or ask us by email. We erase the data from our database immediately, instruct our processors to delete it (including PostHog analytics events), and it is removed from backups as they rotate, within six months at most.
- Withdraw consent, as described in section 5.
- Non-discrimination. We will not treat you differently for exercising these rights.
7. How to make a request and how to appeal
Write to soporte@alzor.app from the email on your account, with the subject "Health data request". We may ask you to confirm your identity in a reasonable way. We respond within 45 days; if we need more time (up to 45 more days), we will tell you why. Requests are free, up to twice a year.
If we decline your request, you can appeal by replying with the subject "Appeal" within a reasonable time. We will answer within 45 days and explain our decision in writing. If your appeal is denied, you can contact the Washington State Attorney General at atg.wa.gov/file-complaint, or the attorney general of your state.
8. Security
Access to consumer health data is limited to the people who operate the service and need it to do so. Data travels encrypted over HTTPS and passwords are stored only as hashes. More detail is in section 8 of the Privacy Policy.
9. Changes
If we change this policy we will update the date at the top. If a change would allow a new use or new recipients of your consumer health data, we will ask for your consent before it applies to you.