Consumer Health Data Privacy Policy

1. Who This Applies To

Builtbody, stylized as "BLTBDY" ("the Service"), is operated by Acentro Systems LLC ("we," "us," or "our"). This policy describes how we collect, use, and share consumer health data, and the rights you have over it.

It applies to residents of Washington and Nevada, and to residents of Connecticut with respect to consumer health data. We extend the rights described here to all of our users regardless of where they live, because drawing that line by state would mean treating the same data differently for no good reason.

2. What We Treat as Consumer Health Data

Consumer health data means personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status. In the Service, that includes:

• Body measurements: height, weight, and your weight history over time.
• Demographics used for health calculations: age and sex, which we use to compute nutrition targets.
• Dietary information: dietary preferences, restrictions, and allergies.
• Nutrition and activity data: meals you log (including photos), workouts you record, and the nutrition targets and plans derived from them.
• Health-related content you write: goals, notes you add for your coach, and any health information you mention in your coaching conversation.
• Inferences: conclusions we or our AI provider draw from the above in order to generate your coaching, such as calorie and macronutrient targets.

We do not collect precise geolocation, biometric identifiers, genetic data, prescription or medication records, diagnoses, or data from healthcare providers. If you connect Apple Health (HealthKit), we read only the daily metrics described in Section 10 of our Privacy Policy, and only after you grant permission in iOS.

3. Where It Comes From

All of the consumer health data we hold comes from one of three sources:

• You, when you complete setup, log a meal or workout, record a weight, write to your coach, or update your profile.
• Your device, if you choose to connect Apple Health. We read only the daily metrics listed in Section 10 of our Privacy Policy, and only after you grant permission.
• Our own processing, when we or our AI provider calculate targets or generate plans from what you provided.

We do not buy consumer health data, and we do not collect it from data brokers, advertising networks, public records, or other third-party sources.

4. How We Use It

We use consumer health data only to provide the coaching you asked for, and specifically to:

• Calculate your nutrition and activity targets.
• Generate meal plans, workout plans, and coaching messages.
• Track your logged meals, workouts, and weight over time and show you your history.
• Send check-ins and notifications you have opted into.
• Run safety screening on coaching content before you see it.
• Provide support when you contact us about your account.
• Keep the Service secure and comply with legal obligations.

We do not use consumer health data for advertising or marketing, and we do not use it to train AI models, whether our own or our providers'. Deriving your targets and plans is automated processing of your health data, but it is done solely to generate the coaching you requested; we do not profile you for any other purpose, and no automated decision produces a legal or similarly significant effect on you.

We process this data through the Service's automated systems. We store it with your account, use it as input to calculations such as nutrition targets, and assemble the relevant information into encrypted requests to OpenAI when you ask for coaching or when the Service generates a plan, check-in, or safety screening. OpenAI returns the result to us, and we store the coaching result in your account so you can access your history. Our support personnel may access consumer health data only when necessary to respond to a request from you, secure the Service, or comply with law.

5. Who We Share It With

We share consumer health data only with service providers who process it on our behalf, under contracts that limit them to our instructions. We have no affiliates or corporate parents, so no data is shared within a corporate family.

The categories of third parties, and named providers where applicable:

• AI processing: OpenAI. To generate your coach's responses, plans, check-ins, and safety screening, we send OpenAI your profile details, goals and activity level, nutrition targets, dietary preferences and allergies, logged meals and workouts, photos you attach to messages, notes you write for your coach, and your coaching conversation. OpenAI processes this as a service provider under its API terms. Data sent through the API is not used to train OpenAI's models unless we opt in, which we do not do, and we do not enable optional application-state retention. OpenAI may retain API inputs and outputs in abuse-monitoring logs for up to 30 days, or longer when required by law or reasonably necessary to protect its services or third parties from harm.
• Push notification delivery: Apple. If you enable push notifications, each notification's text is delivered through the Apple Push Notification service, and that text can reference your coaching (a check-in question or a nutrition reminder). We treat these delivery records as consumer health data: every record is deleted within about a week, and account-linked records are selected for immediate deletion when you delete your account. Turning notifications off in iOS Settings stops their presentation on your device.
• Cloud infrastructure and storage: Neon, Cloudflare R2, and Hatchbox. Our managed database, file and backup storage, and application hosting hold this data at rest so the app can function. They do not access it for their own purposes.

We do not share consumer health data with advertisers, data brokers, analytics providers, payment processors, our email provider, or our error-monitoring provider. Health and body fields are filtered out of logs and error reports before they leave our servers, and our product analytics record only how you move through the app.

We do not permit any third party to collect consumer health data through the Service over time and across unrelated websites or online services.

We may disclose consumer health data if required by law or valid legal process, or to protect against fraud or harm to our users. If we are ever party to a merger or acquisition, we will notify you before your data becomes subject to a different privacy policy.

6. We Do Not Sell Your Consumer Health Data

We have never sold consumer health data and we do not sell it, as "sell" is defined by the My Health My Data Act and Nevada SB 370. Because we do not sell it, we do not seek the signed authorization those laws require before a sale. If that ever changes, we will obtain your valid written authorization first (a separate document, distinct from any other permission we request), and we will not condition your use of the Service on signing it.

7. Processing Necessary to Provide the Service

Collecting, using, and sharing the consumer health data described in Sections 2 through 5 is necessary to provide the AI coaching Service you request. We rely on the requested-service provisions of applicable consumer health data laws for that processing, rather than on consent as its legal basis. Separately, before you create an account, we ask for explicit permission to share the categories of information shown on the sign-up screen with OpenAI, and we send nothing to OpenAI before you give that permission. That permission does not authorize us to use the data for advertising, AI model training, or any purpose outside this policy.

We will ask for affirmative consent, separately where required, before collecting or sharing consumer health data for any category or purpose not described in this policy. AI coaching cannot function without the processing described here. If you no longer want us to collect or share data to provide your coaching, you can close your account in Settings or ask us to close it for you. Closing your account stops future coaching processing and deletes your data as described in Section 8.

8. Your Rights

You have the right to:

• Confirm and access. Learn whether we hold consumer health data about you and obtain a copy of it.
• Review and correct. Review the consumer health data associated with your account and request that inaccurate information be changed.
• Know who has it. Receive a list of all third parties with whom we have shared your consumer health data, along with contact information for each.
• Cease collection and sharing. Ask us to stop collecting or sharing your consumer health data. Because that processing is necessary to provide AI coaching, you can exercise this right by closing your account in Settings or asking us to close it for you.
• Delete. Have your consumer health data deleted, including from our backup systems.
• Not be discriminated against. We will not deny you service, charge you a different price, or give you a lower quality of service because you exercised any of these rights.

How to exercise them

You can review your profile, nutrition targets, plans, logged meals and workouts, weight history, and coaching conversation in the corresponding areas of the Service. You can correct editable body, goal, nutrition, dietary, allergy, and coach-context information from Profile. To request a change to anything you cannot edit directly, email [email protected].

You can delete your account and its data yourself, at any time, in Settings. Deletion from our active production systems is immediate and permanent: your profile, coaching conversation, meals, workouts, plans, weight history, and photos are erased, and we stop sending your information to OpenAI. Our encrypted backups run on a rolling 30-day schedule, so residual copies age out of them within 30 days, sooner than the six months the My Health My Data Act allows for archived and backup systems. Account deletion does not immediately erase any transient copies OpenAI may hold in its abuse-monitoring logs. OpenAI does not provide us with an API for deleting an individual end user's entries from those logs; they age out under the retention period and exceptions described in Section 5.

For any other request, email [email protected]. We verify requests by confirming control of the email address on your account. We respond within 45 days, and may extend once by another 45 days where the law permits, with notice to you. There is no charge for these requests.

Appeals

If we decline a request, we will tell you why and how to appeal. To appeal, reply to our decision or email [email protected] with "Health Data Appeal" in the subject line. We will respond in writing within 45 days. If we deny your appeal, you may complain to the Washington State Attorney General at atg.wa.gov/file-complaint, the Nevada Attorney General, or your own state's attorney general.

9. Security, Retention, and Geofencing

If a breach occurs that puts your consumer health data at risk, we will notify you and any authority we are required to notify, without undue delay after we become aware of it.

We protect consumer health data with encryption in transit (TLS) and at rest, and we limit access within our organization to the people who need it to operate the Service. We keep this data for as long as your account is active and delete it as described in Section 8.

Some of it is also encrypted at the application level, before it is written to the database, and is stored as ciphertext rather than readable text: your coaching conversation, the summaries your coach keeps of earlier conversations, your dietary restrictions and allergies, and the notes you write for your coach. Your logged meals and workouts, your weight history, and the targets and plans derived from them are protected by the encryption at rest and the access controls above rather than by that second layer. Our Privacy Policy describes this in more detail.

We do not use geofencing around any healthcare facility, and we do not use geofencing to identify or track anyone seeking healthcare services, to send health-related advertising, or to collect health data. We do not collect precise geolocation at all.

10. Changes to This Policy

If we make material changes to this policy, we will notify you in the app or by email before they take effect, and we will obtain your consent before collecting or sharing consumer health data in any way this policy does not already describe.

11. Contact

Questions about this policy or your consumer health data: email [email protected] or write to Acentro Systems LLC, 309 Jamestown St., Sugar Grove, PA 16350.