Consumer Health Data Privacy Policy

1. Scope

This Consumer Health Data Privacy Policy applies to information that may qualify as consumer health data under applicable U.S. state laws, including information linked or reasonably linkable to your physical or mental health status when you use Emersus.

This page supplements our Privacy Policy. If there is a conflict between this page and our general Privacy Policy with respect to consumer health data, this page controls for that data.

2. Categories of Consumer Health Data We Collect

• Profile and onboarding data, such as your goals, experience level, dietary preferences, injuries or limitations, equipment access, available training time, preferred sports, sleep or stress context, and activity level.
• Body and wellness inputs, such as body weight, height, date of birth, biological sex used as a metabolic-calculation input, and similar health or wellness details you choose to provide.
• Training and nutrition records, such as workout plans, workout logs, meal plans, meal journal entries, food selections, supplement-related inputs, and progress views.
• Chat prompts, saved chat threads, generated outputs, and related inferences to the extent they reveal or are used to understand your health, wellness, fitness, nutrition, recovery, or performance status.
• Precise location and route data if you enable GPS-based workout tracking or route-based sharing features.

3. Sources of Consumer Health Data

We collect consumer health data directly from you, from your use of the Services, from device features you enable such as geolocation, and from service providers acting on our behalf to operate the product.

4. Why and How We Process Consumer Health Data

• To create, maintain, and update your account, profile, workout plans, meal plans, saved chats, and progress views.
• To personalize AI-assisted responses, recommendations, and evidence summaries based on the information relevant to your request.
• To store logs, support route sharing, and operate app features you request, including workout, nutrition, and GPS-enabled experiences.
• To secure, monitor, troubleshoot, and improve the Services, investigate abuse or incidents, and comply with law.

We process consumer health data using hosted database, authentication, model-inference, and mapping infrastructure that operates on our behalf.

5. Categories of Consumer Health Data We Share

We may share the following categories of consumer health data when necessary to provide a product or service you request:

• profile and onboarding fields relevant to your request;
• training, nutrition, and progress records needed to operate app features;
• chat context and generated output needed to answer prompts; and
• precise location or route data only when you enable GPS-based features or route-based sharing tools.

6. Third Parties and Affiliates With Whom We Share Consumer Health Data

We do not currently share consumer health data with any Emersus affiliates because we do not currently operate consumer-facing affiliate entities for this product.

We may share consumer health data with the following categories of third parties, and with the following specific providers where applicable to the feature you use:

• cloud hosting, database, and authentication providers, including Supabase;
• AI model and inference providers, including OpenAI;
• mapping and route-rendering providers, including Mapbox, when you use route-based features; and
• other processors or contractors acting solely on our behalf and under our instructions where necessary to provide the service you requested or comply with law.

7. Sale, Advertising, and Cross-Site Collection

We do not sell consumer health data.

We do not knowingly share consumer health data with third parties or affiliates for their own independent advertising purposes.

We do not knowingly permit third parties to collect consumer health data over time and across different websites or online services when you use Emersus for their own independent purposes.

We do not use geofencing around health care facilities to identify, collect from, or send messages to people based on seeking health care services.

8. Your Rights

Subject to applicable law, you may have the right to:

• confirm whether we are collecting, sharing, or selling consumer health data about you;
• access that data and receive a list of third parties and affiliates with whom we have shared it;
• withdraw consent from future collection or sharing of consumer health data where your consent is the legal basis for that processing;
• request deletion of consumer health data concerning you; and
• review and request correction or changes to consumer health data we maintain about you.

9. How to Exercise Rights

To exercise a consumer health data right, email info@emersus.ai from the email address associated with your account and include "Health Data Request" in the subject line. Please tell us whether you want to access, correct, withdraw consent, or delete your consumer health data.

We may request additional information reasonably necessary to authenticate your identity and request. We will not require you to create a new account to submit a request, although we may ask you to use an existing account if you already have one.

Where required by law, we will respond without undue delay and generally within 45 days, with one additional 45-day extension if reasonably necessary. Where required by law, information provided in response to a qualifying request will be provided free of charge up to twice annually per consumer.

If you request deletion, we will delete applicable consumer health data from our active systems and notify relevant processors and contractors. Deletion from archived or backup systems may be delayed where permitted by law, but we will handle those systems in accordance with applicable legal requirements.

10. Appeals

If we decline to take action on your request, you may appeal by emailing info@emersus.ai with "Health Data Appeal" in the subject line within a reasonable time after receiving our decision.

Where required by law, we will respond to an appeal in writing within 45 days. If we deny your appeal, we will provide information about how you may contact the applicable state attorney general or other regulator to submit a complaint.

11. Changes to This Policy

We may update this Consumer Health Data Privacy Policy from time to time. When we do, we will update the effective date above and provide additional notice where required by law.