Your data, your rights, our commitments.

• Account information — email address, name (optional).
• Health data — HRV, sleep hours, resting heart rate. Collected only with your explicit permission via Apple HealthKit or Google Health Connect.
• Practice data — protocol completion times, self-reported ratings, body location logs.
• Score data — your Recovery Score and Expansion Score calculations.
• Outcome data — the 11 Signal Performance dimensions (energy, recovery, strength, sleep, stress, focus, nutrition, fitness, wealth, business, relationships). This data is self-reported by users. It is not medical data. It is not used for clinical assessment. It reflects how the user reports their body felt on a given day.
• Device data — device type, OS version, timezone. Used only for notification scheduling.

• To calculate your Recovery Score and Expansion Score.
• To generate personalised intelligence via the Claude API (Anthropic). Your data is sent to Anthropic for analysis, processed, and not retained by Anthropic beyond the API call.
• To send your morning signal, weekly report, and pattern alerts.
• Never to train AI models. Never to sell to third parties. Never to share with advertisers.

• Health data never leaves your device without your explicit permission.
• You can revoke health data access at any time in device settings.
• Health data is stored encrypted in Supabase (AWS infrastructure, encrypted at rest).
• Health data is never used for advertising, insurance, or employment purposes.
• We comply with Apple HealthKit guidelines and Google Health Connect policies.

• All data stored in Supabase (PostgreSQL, AWS us-east-1).
• Encrypted at rest (AES-256) and in transit (TLS 1.3).
• Row Level Security: each user can only access their own data.
• No employee has routine access to individual user health data.
• Automated daily backups retained for 30 days.

• Export your data — download everything in JSON format from Settings.
• Delete your account — permanently removes all personal data within 30 days.
• Correct your data — update any information from Settings.
• Withdraw consent — revoke health data access or delete your account at any time.
• GDPR (EU users) — access, rectification, erasure, portability, and objection rights.
• CASL (Canadian users) — unsubscribe from any email at any time.

We rely on a small set of trusted services. Each operates under its own privacy policy:

• Supabase (database)
• Anthropic Claude API (AI analysis)
• Resend (email)
• RevenueCat (mobile subscriptions)
• Stripe (web payments)
• Cloudflare (hosting + CDN)

We do not knowingly collect data from users under 18.

We will notify you by email of material changes to this policy.

For privacy questions or requests, write to privacy@restoremindset.com.