Consumer Health Data Privacy Policy
Version 1.0 · Effective 9 September 2026
This is a standalone policy. It is linked from our homepage and you do not need to read anything else to understand it. It deals only with health-related information — what we call consumer health data. Our Privacy Policy covers everything else, and our Cookie Policy covers cookies. Where those documents overlap with this one, this one controls for consumer health data.
1. Who we are
Nied Fitness is a web app for fitness tracking, planning and analysis, with an AI assistant called Virtual Coach. In this policy, "we", "us" and "our" mean the operator of Nied Fitness. "You" means the person using the app.
You can reach us about anything in this policy at support@niedfitness.com.
Nied Fitness is offered in and intended for the United States, and only for adults 18 and over.
2. What "consumer health data" means
Consumer health data means personal information that is linked to you and that identifies your past, present or future physical or mental health status.
The definition is broad — broader than most people expect. It is not limited to diagnoses, prescriptions or anything a doctor wrote down. Under Washington and Nevada law it can cover measurements about your body, information about bodily functions, information about how you use or seek health services or products, and information from which a health status can be inferred. In a fitness app, that means a great deal of what you log is consumer health data, even when it feels routine to you. A record that you weighed a certain amount on a certain day, or that you trained on a certain day, can fall inside the definition.
We take the broad reading. We treat the categories in section 3 as consumer health data and apply the protections in this policy to all of them, rather than arguing about the edges.
3. The consumer health data we collect
We collect the categories below and nothing beyond them.
Your date of birth and your biological sex are held on your account profile. They are facts about your body, so we cover them under this policy too.
Reports you send us. If you send us a report about a problem, we store what you write, any screenshot you attach yourself, and a fixed set of technical context. We never attach your workouts, body data or Virtual Coach messages to a report, and we never capture your screen on our own — but a screenshot shows whatever you chose to capture, so it can contain consumer health data.
Some information we hold is not consumer health data — your account and subscription data (email address, password hash, subscription status), your billing data, and your technical and usage data (such as IP address, browser and device type, and error diagnostics). The Privacy Policy covers those. They become relevant here only because they are linked to you, which is what makes the health data above identifiable in the first place.
What we never collect. We do not collect precise geolocation, so we never infer anything from your having visited a clinic, a pharmacy or any other location. We do not collect biometric identifiers such as fingerprint, face or voiceprint data. We do not collect government ID numbers, Social Security numbers, or information about your race or ethnicity, religion or sexual orientation. There is no food or nutrition logging in the app. We do not collect progress photos, and we do not connect to wearables, Apple Health, Google Health Connect or any other health platform.
4. Where this data comes from
There is only one source: you.
Every item in section 3 reaches us because you typed it or selected it in the app — when you log a workout, record a weight, note soreness, set a goal, or send a message to Virtual Coach.
We do not buy consumer health data. We do not receive it from data brokers, advertising networks, social networks, insurers, employers, health care providers, wearables or health platforms. Nothing about your health is inferred from your IP address or your browsing.
5. How we use each category
We also use consumer health data where we have to, to keep the service secure and working — for example, when a report you send includes a record that failed to save — and where the law requires us to disclose it. Those uses are limited to what is necessary.
What we do not use it for. We do not use consumer health data for advertising of any kind. We do not use it to build profiles about you for anyone else. We do not train AI models on your Virtual Coach conversations, and we do not give them to anyone else to do so. What we cannot yet tell you is what our AI provider does with what we send it — we have no agreement with it on that point, and section 13.3 says so plainly rather than implying one. We do not use consumer health data to make automated decisions that have a legal or similarly significant effect on you.
A note on what Virtual Coach is. Virtual Coach is an AI model. It is not a certified personal trainer, registered dietitian, physician, physical therapist or licensed health professional, and it is not supervised by one. It will not diagnose you and it does not advise on medication. You decide how much to tell it. The rest of the product works fully if you tell it nothing about your health. The Virtual Coach Terms & AI Disclosure and the Health & Safety Disclaimer set this out in full.
6. Who we share consumer health data with
We share consumer health data with a short list of service providers who process it on our behalf, for the purposes we set. This is our full list.
We do not name our AI provider in this policy. It is a service provider we can change, and which model vendor is behind Virtual Coach on a given day is an engineering choice; this policy applies whichever it is.
What that means for consumer health data specifically:
- •Neon stores it. Your workouts, body measurements, training status, goals and Virtual Coach conversations live in our Neon database.
- •Our AI provider receives the content of your Virtual Coach conversations, together with the training context needed to answer — your active goal, the gym or equipment set you train with, your units and effort scale, how many sessions you completed in the last seven days, the date of your last session, the muscles you have flagged as sore, and the records and sessions Virtual Coach looks up while answering you. This is how the feature works.
- •Vercel hosts the web app, so your data passes through its infrastructure in transit. What Vercel stores is technical data and request logs, not your health records.
- •Vercel Blob stores our own exercise demonstration media, which is not about you. It also stores any screenshot you attach to a report, which can contain whatever you captured.
- •Stripe receives billing data only. It receives no consumer health data.
- •PostHog receives usage events tied to an opaque account identifier — for example, that a workout session started, and that one completed with its length and how many blocks it contained. Event names describe the action, never the content: no workout detail, body measurement, goal text or Virtual Coach content reaches it. An event named after a health feature can still support an inference about you, which is why PostHog is listed here.
- •Resend sends the only emails we send: password resets, email verification and updates about a report you sent. Those emails contain no consumer health data.
- •Google is involved only if you sign in with Google. It receives no consumer health data.
Contacting them. Washington law gives you the right to a list of the third parties we have shared your consumer health data with, and a way to contact each of them. The list is above, and each of these companies publishes its own privacy contact. If you send us a request that belongs with one of them, we will pass it on and tell you that we did. If you ask us for this list under section 10, we will send it in current form, including any provider added after the date of this policy.
Other disclosures. Apart from the providers above, we disclose consumer health data only where a subpoena, court order, warrant or other lawful demand requires it; where we reasonably believe disclosure is necessary to protect someone's safety or to investigate fraud or abuse of the service; to our lawyers, accountants and auditors under a duty of confidentiality; or as part of a merger, acquisition, financing or sale of assets, in which case we will tell you before your data becomes subject to a different policy.
7. We do not sell consumer health data
We do not sell consumer health data. We have never sold it. We do not exchange it for money or for any other valuable consideration.
Because we do not sell it, there is no sale for you to authorise. We do not ask you to sign an authorisation for the sale of consumer health data, and we do not operate any process for doing so. If we ever proposed to sell consumer health data, we would have to obtain your separate, signed authorisation first, and we would have to change this policy and tell you before anything happened. We have no plan to do this.
There is no advertising in the product, no advertising SDK, and no ad-tech in our stack. Selling your health data is not a revenue line we have or want.
8. What you control
8.1 Nothing is collected in the background. Every category in section 3 reaches us because you entered it. We do not read sensors, we do not connect to other health apps, and we do not infer health facts from your browsing.
8.2 Using a feature is what starts collection. If you never log a workout, we hold no workout data. If you never record a weight, we hold no body measurements. If you never open Virtual Coach, we hold no conversation. What you enter is what we hold.
8.3 Using Virtual Coach means sharing with our AI provider. Its conversation content, and the training context described in section 6, is sent to our AI provider to generate a reply. There is no way to use Virtual Coach without that.
8.4 You can remove what we hold. In the app you can delete a workout session, a goal, a saved exercise, an equipment context and a Virtual Coach conversation. Some records have no delete control of their own: a recorded body weight, a training-status note, and a report you have already sent. Email us and we will remove them, or delete your account, which removes all of it — see section 13.
9. Your rights
If you live in Washington or Nevada, the following rights are yours under those states' consumer health data laws — the Washington My Health My Data Act and Nevada SB 370.
We extend the same rights to every user in the United States, as a matter of policy. You do not have to live in a particular state, and we will not ask you to prove where you live before we act on a request.
About withdrawing. There is no consent switch in the app, and we want to be plain about why: we do not ask you for a separate consent to collect health data today, so there is none to toggle. That does not take the right away. Email us and we will stop — which in practice means we stop the Virtual Coach for your account, stop recording new workouts, body metrics and goals, and stop sending anything to the providers in section 6. Almost everything Nied Fitness does is built on that data, so withdrawing leaves very little of the product working; most people who ask for this want deletion as well, and you can ask for both in the same message. Withdrawing does not by itself delete what we already hold — say so if you want that too.
There is no export button in the app. A copy of your data is something we put together by hand when you ask for it, on the timeline in section 10.
You can correct some of your own details in the app — your preferred name, your timezone and your display settings. Your legal name, email address, date of birth and biological sex are not editable in the app; you can file a correction request from your account menu under Settings → About you → Request a change, or email us, and we will handle it.
We will not discriminate against you for exercising any of these rights. We will not charge you more, give you a worse service, or close your account because you made a request. The one honest exception is functional: if you delete your data, the features that depend on that data stop working.
10. How to make a request, and what happens next
10.1 How to make a request. Email support@niedfitness.com. Put the right you want in the subject line — for example "Delete my consumer health data", "Withdraw consent" or "List of third parties" — and send it from the email address on your account.
You do not need to use particular words or a particular form. If we can tell what you are asking for, we will treat it as a request.
10.2 How we confirm it is you. We verify a request by confirming it from the email address on your account. If you email us from that address, that is usually enough. If you email from a different address, we will write to the address on your account to confirm before we act. We do this because acting on an unverified deletion request would be worse than delaying a real one. If we cannot verify you, we will tell you why and what we still need.
10.3 What we send back.
- •Confirm — a written answer stating whether we collect, share or sell your consumer health data.
- •Access — a copy of your consumer health data, covering the categories in section 3.
- •List of third parties — the current version of the list in section 6.
- •Delete — written confirmation of what was deleted and when (see section 13).
10.4 How long we take. We acknowledge your request within 10 calendar days and complete it within 45 calendar days of receiving it. Where a request is complex we may extend once, by up to a further 45 days; if we do, we will tell you why before the first 45 days run out. There is no charge for a request.
10.5 If we refuse. We will not refuse a request without a reason. If we do refuse — for example because we cannot verify you, or because a law requires us to keep something — we will tell you in writing, tell you why, and tell you how to appeal.
11. Appeals and complaints
11.1 How to appeal. If we deny a request, you may appeal. Email support@niedfitness.com with "Appeal" in the subject line. Tell us which request you are appealing; you do not have to explain why.
11.2 How long an appeal takes. We respond to an appeal within 45 calendar days of receiving it. Our response tells you in writing whether we changed the decision, and the reasons.
11.3 If the appeal is denied. If we deny your appeal, we will tell you in the same written response how to complain to a regulator.
If you are a Washington resident, you may submit a complaint to the Washington State Attorney General's Office through its consumer complaint process. Washington law also gives residents a route to bring their own claim under the state's consumer protection law; we mention this so you know the option exists, not to advise you on it.
If you are a Nevada resident, you may submit a complaint to the Office of the Nevada Attorney General.
12. How long we keep consumer health data
We keep most of your consumer health data for as long as your account exists, because the product's purpose is to show you your history over time. There is no timer on it: it goes when you delete the record, or when you delete your account.
Two records about Virtual Coach outlive the conversation itself, and neither holds conversation content: a log of what the Coach did on your behalf — the tool it used, the outcome, and a fingerprint of the arguments, never the text — kept for 365 days, and a usage ledger of message and token counts, kept for 180 days.
A screenshot you attached to a report is kept while the report is open, and deleted 365 days after the report is settled.
We do not keep consumer health data for longer than we need it for the purposes in section 5, except where a law requires us to keep it.
13. Deletion, and what it reaches
This section describes what actually happens when you ask us to delete consumer health data.
13.1 What we delete. We delete the data from the live database that runs the app. Deleting your account — from the account menu, under Account — removes your profile, your workouts and sessions, your body measurements, your training status, your goals and personal records, your saved exercises and equipment contexts, your Virtual Coach conversations and the Coach ledgers above, your notifications, and the reports you sent us together with their attachments. Deleting your account also cancels any active subscription immediately; the Subscription, Billing & Auto-Renewal Terms explain what that costs you.
13.2 Backups. Our database keeps a rolling restore history of no more than 7 days. Data you deleted can remain in that history until it rolls off. We do not use it to bring back records you deleted.
13.3 What deletion reaches at our providers.
- •Neon — deleting the records removes them from the live database; the copies inside the restore history above age out with it.
- •Our AI provider — we stop sending your conversation content, and we delete our own copy. We do not have an agreement with that provider requiring it to delete the copy it already received, and we will not tell you we do.
- •Vercel — its request logs are technical records of requests, not your health records, and we do not use them to rebuild anything you deleted.
13.4 What we may keep. If you ask us to delete by email, we keep the request and our reply, so we can show we honoured it — the date, what you asked for, and the account it concerned, with no consumer health data in it. If you delete your account yourself in the app, nothing is written at all: no log entry records that you asked or that we did it. Our internal operations log, which records what our staff did in the admin tools, is kept for six years. If a report you sent became a support ticket, that ticket stays with your name removed from it. Billing records held by Stripe survive for its own financial and legal purposes; that is billing data, not consumer health data.
13.5 Confirmation. Where you asked us by email, we confirm in writing what was deleted and when, within the timeline in section 10.4. A deletion you perform yourself in the app is confirmed on screen at the moment it happens — we have no way to write to you afterwards, because the account and its email address are gone.
Your Data gives the step-by-step route for making a deletion request and what to expect at each stage.
14. Changes to this policy
We may update this policy. When we do, we publish a new version with a new effective date at the same link from our homepage, and we mark whether the change is a material one. Every earlier version stays available at that link, so you can read the exact text that was in force on a given date.
If we change the categories of consumer health data we collect, the purposes we use them for, or the providers we share them with, we will publish the new version before the change takes effect.
15. Contact us
Consumer health data questions, requests, appeals and support all go to one address: support@niedfitness.com.
We aim to acknowledge email about anything in this policy within 10 calendar days, alongside the response timelines in section 10.4.
Versions
Every version we have published, newest first. You can read any of them.
- Version 1.0 · Effective 9 September 2026 · currentMaterial change. First published version — the provider list now matches the software we actually run, retention and deletion describe what the code does, and every claim about a consent step, an export feature or an AI-provider deletion contract that does not exist has been removed.