Consumer Health Privacy Notice

1. What is consumer health data?

Consumer health data generally includes personal information that is linked or reasonably linkable to a person and identifies or can be used to infer that person's past, present, or future physical or mental health condition. In the context of Mass in Motion, this may include:

• Workout logs and exercise history;
• Body weight, body composition measurements, and related biometrics;
• Heart-rate data and heart-rate-zone training data;
• Recovery scores, readiness information, fatigue information, and training-load metrics;
• Nutrition and dietary intake data, including foods, calories, macronutrients, micronutrients, exact meal timestamps, and nutrition goals;
• Sleep duration, timing, or schedule information;
• Injury, pain, soreness, or limitation information you voluntarily record;
• GPS running routes and GPS-derived workout data;
• Health or fitness data synchronized from Apple Health/HealthKit, Google Health Connect, WHOOP, Strava, or another integration you authorize;
• Stimulant tracking data you voluntarily log; and
• Derived health or fitness measurements, trends, estimates, scores, and model outputs generated from the preceding categories, including nutrition-response patterns, meal-timing responses, individualized training-response estimates, recovery characteristics, sleep/performance relationships, individual response curves, and individualized statistical outputs.

2. How we collect consumer health data

We may collect consumer health data:

• Directly from you. For example, when you log training, nutrition, body measurements, recovery information, pain or injury information, or other fitness information.
• Automatically when you use a feature. For example, when a running feature records GPS or calculates training metrics from activity data.
• From integrations you authorize. If you connect Apple Health/HealthKit, Google Health Connect, WHOOP, Strava, or a similar service, we receive only the categories that the integration and your permissions allow.
• By derivation. We may calculate training load, readiness, estimated strength, performance trends, recovery trends, individualized response curves, or similar fitness measures from data you provide or authorize.

We collect and use consumer health data to the extent necessary to provide features you request or with consent as required by applicable law. Personalized Coaching (individualized response modeling) and optional population machine-learning research (Help Improve Algorithms) are governed by separate affirmative consents where required by applicable law.

3. How we use consumer health data

We use consumer health data for the following disclosed purposes:

• Providing the Service. To display training history, calculate training load, readiness or recovery information, generate deterministic training programs and adjustments, provide nutrition and running features, synchronize data, and provide other user-facing fitness functionality.
• Personalized Coaching (Individual Response Modeling). With your affirmative consent, to analyze your training, nutrition timing, sleep, and recovery history to identify your individual response patterns, estimate response ranges, and deliver personalized findings and contextual Coach's Notes back to you. See our Personalized Coaching and Data Use Notice.
• Personalizing your experience. To apply your goals, equipment, experience, training history, recent performance, and recovery information to features you request.
• Improving the Service using de-identified or aggregated data. To measure performance, identify broad trends, test algorithm behavior, improve rules and thresholds, and evaluate reliability where the data no longer reasonably identifies an individual.
• Optional population research and statistical model development (Help Improve Algorithms). With separate affirmative consent where required, to train, test, validate, calibrate, or evaluate internal models intended to identify plateau trends, estimate athlete state, recovery or fatigue trends, evaluate progression and training-load responses across the athlete population, and generate research signals that may inform Mass in Motion's deterministic algorithms.
• Safety, security, and error correction. To investigate technical problems, protect accounts and systems, validate data quality, and maintain app reliability.

Unless we provide a different disclosure in the future, machine learning may estimate athlete state or produce research signals, but it does not independently generate your workout program. Mass in Motion's deterministic programming algorithms remain authoritative.

We do not use consumer health data for third-party targeted advertising, sell it to data brokers, or use it to determine eligibility for employment, credit, housing, or insurance.

4. Personalized Coaching and Optional Research ML

Mass in Motion maintains two independent permissions for advanced data use:

• Permission A — Personalized Coaching: Authorizes Mass in Motion to analyze your data exclusively to discover within-athlete response patterns (such as pre-workout meal timing and carbohydrate ranges) and deliver coaching insights back to your Coach Learning Profile and Coach's Notes. For full details, see the Personalized Coaching and Data Use Notice.
• Permission B — Help Improve Algorithms: A separate, optional opt-in that allows eligible data to be used for population-level research, validation, and algorithm improvement. Declining this research consent does not affect your access to Personalized Coaching or core features.

For optional model development, we seek to use aggregated, de-identified, anonymized, or pseudonymized data instead of directly identifying information whenever reasonably practical. Pseudonymized data remains protected when it is still reasonably linkable to your account.

Data obtained from Apple Health/HealthKit, Google Health Connect, or another third-party health platform remains subject to that platform's developer rules and permitted-use restrictions. Your consent to Mass in Motion does not override those restrictions. We will exclude such data from a model-development use if the applicable platform rules, permissions, or legal requirements do not permit that use.

We do not authorize a third-party AI or machine-learning provider to use identifiable Mass in Motion health or fitness data to train that provider's own general-purpose, foundation, or customer-shared models.

5. How we share consumer health data

We do not sell consumer health data and do not share it with advertisers or data brokers.

We may disclose consumer health data only as permitted by applicable law and for disclosed purposes, including:

• Service providers and processors acting on our behalf. Providers such as Firebase/Google Cloud may host, store, secure, or process data according to our instructions. A provider used for model infrastructure or analysis may process eligible data only for the Mass in Motion purpose for which it was engaged and subject to applicable contractual, security, consent, and platform requirements.
• With your separate consent. When applicable law requires separate consent for sharing, we will request that consent before the sharing occurs.
• Legal obligations and protection. When disclosure is required by law or reasonably necessary to protect rights, safety, security, or investigate fraud or abuse, subject to applicable limitations.
• Business transactions. Consumer health data may be transferred as part of a merger, acquisition, reorganization, financing, or sale of assets where legally permitted and subject to applicable protections.

6. Your consumer health privacy rights

Depending on where you live, including if you are covered by the Washington My Health My Data Act, you may have rights including:

• Confirm and access. To confirm whether we collect, use, or share covered consumer health data and obtain access where required.
• Withdraw consent. To withdraw consent for future collection, use, or sharing that relies on consent, including separate optional ML/model-development consent.
• Delete. To request deletion of covered consumer health data, subject to applicable exceptions and legally permitted retention.
• Information about sharing. To obtain information about third parties or affiliates with whom covered data has been shared where required by law.
• Appeal. To appeal a denial of a covered privacy request where applicable law provides an appeal right.
• Non-discrimination. We will not unlawfully discriminate against you for exercising applicable privacy rights.

Disconnecting an integration in device settings stops future access through that integration but may not, by itself, delete copies previously imported into Mass in Motion. Use the deletion process below if you also want eligible stored copies deleted.

7. How to exercise your rights

Contact us using either method below:

Email: brandon@massinmotionapp.com
Mail: Mass in Motion LLC, 6545 Market Ave. North Suite 100, Canton, Ohio 44721

Include enough information to identify the account and the right you wish to exercise. We may verify your identity before completing a request. We will respond within the period required by applicable law and provide any legally required appeal instructions if a request is denied.

8. ML consent withdrawal, deletion, and trained models

After a valid withdrawal of optional ML consent is processed, we will stop adding identifiable or reasonably linkable data covered by that consent to new optional model-development processing, except where continued processing is permitted or required by law. Where reasonably feasible and legally required, we will remove or exclude account-linked source records from active model-development datasets that remain linkable to you.

Data that has already been lawfully and irreversibly de-identified or aggregated may no longer be capable of being associated with you. Completed trained models generally contain learned statistical parameters rather than a retrievable copy of each person's records, so it may not be technically possible to isolate or reverse the mathematical effect of one person's lawfully processed de-identified data. We may retain de-identified data, aggregate statistics, validation results, and trained model parameters where permitted by law.

We will not use this provision to retain identifiable or reasonably linkable source data when applicable law requires that source data to be deleted.

9. Users under 18

We do not knowingly include data from users under 18 in optional general ML/model-development datasets unless we have implemented any additional parental or guardian consent, age-assurance, platform, and legal safeguards required for that processing. Until those safeguards are in place, known users under 18 are excluded from optional model-development datasets.

10. Data security

We use reasonable technical and organizational safeguards designed to protect consumer health data, which may include encryption in transit and at rest, authentication, access controls, logging, and restricted processor access. No system can be guaranteed to be completely secure.

11. Data retention

We retain identifiable or reasonably linkable consumer health data for as long as reasonably necessary for the disclosed purpose, to provide requested features, maintain security, resolve disputes, or satisfy legal obligations. Account deletion and consumer-health deletion requests are handled according to applicable law and our Account Deletion and Data Deletion Policy.

12. Changes to this notice

We may update this notice as our practices or legal requirements change. We will update the date above and provide additional notice where required. If a change would add a new category of consumer health data or a new purpose for which affirmative consent is required, continued use alone will not substitute for that required consent; we will obtain consent before the new covered processing begins.

13. Contact us

Mass in Motion LLC
Registered Agent Address: 6545 Market Ave. North Suite 100, Canton, Ohio 44721
Email: brandon@massinmotionapp.com
Website: massinmotionapp.com