Consumer Health Data Privacy Policy

This policy is provided under Washington's My Health My Data Act, Nevada's SB370 and the consumer health data provisions of the Connecticut Data Privacy Act. It describes the consumer health data that GreyMatter Labs LDN LTD collects through the Coach application, and how you can exercise your rights over it.

It is separate from our Privacy Policy, which describes our processing of all personal information. This policy addresses consumer health data alone.

"Consumer health data" means personal information that is linked or reasonably linkable to you and that identifies your past, present or future physical or mental health status. It includes bodily measurements and functions, health conditions and symptoms, your use of health-related services, and health information that is derived or inferred from other data.

If anything in this policy is unclear, contact privacy@coach-app.ai.

---

1. Categories of consumer health data we collect

• Bodily measurements — your date of birth, sex, height, and your bodyweight and body-fat percentage over time.
• Reported conditions and exertion — the injuries you report (including the body area, its status, and any note you add), and the effort and difficulty you record for your training.
• Health screening — the outcome of a pre-exercise physical-activity readiness screening. We retain only that the screening was completed and that you are proceeding.
• Derived health-related information — estimates and trends we calculate from the information above, and written notes we generate to personalise your coaching, some of which relate to your health and may include inferences as well as things you have told us.
• Use of a health-related service — your use of Coach, an exercise-programming service, including your training plans and the sessions and sets you complete.

2. Categories of sources

• From you, through the app — onboarding questions, injury reporting, the health screening, the measurements you enter, the sets you log, and what you say to Coach in conversation.
• From your device, with your permission — bodyweight and body-fat percentage read from Apple Health, where you connect it. Coach's access is read-only and scoped to those two measurements.
• Derived by us — calculations our software performs on the above, and notes generated to personalise your coaching.

3. Purposes of collection and use

We collect and use consumer health data solely to provide the Coach service to you — specifically, to generate and adapt your training plan; to determine the loads, repetitions, rest and progression in each session; to account for a part of your body you have reported as injured; to generate the coaching and progress content shown in the app; to display your progress; to personalise your coaching; to verify that you meet the minimum age of 18; and to respond to your requests and comply with law.

4. Consumer health data we share, and with whom

We share consumer health data with service providers that process it on our instructions to operate Coach, each acting under a written data-processing agreement, and none may use consumer health data for its own purposes:

We will identify each of these providers individually, and give you a means of contacting each, on request to privacy@coach-app.ai.

We share consumer health data with no affiliates: GreyMatter Labs LDN LTD has no parent, subsidiary or commonly controlled entity. We may disclose consumer health data where required by law, or to establish or defend legal claims.

5. Sale of consumer health data

We do not sell consumer health data. A sale would require your separate, valid written authorisation, which we do not seek.

6. Tracking

Coach contains no advertising and no cross-site tracking, and we do not use geofencing. No third party collects information about your activities over time and across other websites or services through Coach or coach-app.ai.

7. Your rights, and how to exercise them

If you are resident in Washington, Nevada or Connecticut, you have the right to:

• confirm and access your consumer health data, including a list of the third parties with whom we have shared it, named individually, and a means of contacting each;
• withdraw your consent to our collection and to our sharing of your consumer health data;
• delete your consumer health data; and
• appeal a refusal of any of these requests.

You can exercise the main rights in the app:

Confirm and appeal requests, and any request made in writing, go to privacy@coach-app.ai.

Deleting your account deletes the active copies of your consumer health data from our systems, including any measurements imported from Apple Health. Because Coach cannot generate or adapt a training plan without this data, withdrawing consent and deleting your account are the same act.

We pass the deletion on. We instruct each provider in Section 4 that holds your consumer health data to delete it, save for the copies below, and each is required to comply. If you ask, we will tell you which were instructed. Two copies are held on terms we do not set: content sent to our AI provider is retained for a limited period (currently up to 30 days) for abuse monitoring and then deleted; and any feedback message you sent remains with our workplace messaging provider under its retention settings, with the link to your account and your email address removed from our records. A further copy may persist in an encrypted disaster-recovery backup for a limited period until it is overwritten. None of this material is used to provide the service to you after deletion.

We respond to requests within 45 days, extendable once by a further 45 days where the law permits and we notify you of the reason.

Verification. Before acting on a request that does not come from within your signed-in account, we need to be satisfied it comes from you. Write from the email address on your account and give your name and, if you have it, the approximate date of your last session or subscription. Where we cannot match a request to an account, or hold no matching data, we will tell you.

Authorised agents. You may appoint someone to make a request for you. We will ask for written authority signed by you and may contact you to confirm the appointment.

Appeals. Reply to our response, or write to privacy@coach-app.ai with "Appeal" in the subject line. We will reconsider and notify you of the outcome, with reasons, within 45 days. If we maintain the refusal, you may contact:

• Washington — Office of the Attorney General, www.atg.wa.gov/file-complaint
• Nevada — Office of the Attorney General, ag.nv.gov
• Connecticut — Office of the Attorney General, portal.ct.gov/ag

We will not discriminate against you for exercising any of these rights.

8. Changes to this policy

Where we amend this policy we will update the effective date above. Where we change the categories of consumer health data we collect, the purposes for which we use it, or the categories of third party with whom we share it, we will obtain your consent again before the change applies to data we already hold.

9. Contact

GreyMatter Labs LDN LTD 128 City Road, London EC1V 2NX, United Kingdom privacy@coach-app.ai