Privacy Policy

Last updated: July 18, 2026

This Privacy Policy explains how Healthy Coach / Signal Coach (“we,” “our,” or “the app”) collects, uses, stores, and shares information when you use our personal nutrition, fitness, recovery, and health-coaching tools.

This policy is written for the current private beta / personal MVP. Before public launch, this policy should be reviewed by qualified privacy/legal counsel and updated with the final company name, contact email, hosting providers, subprocessors, and jurisdiction-specific terms.

1. What the app does

The app provides wellness-oriented nutrition, training, recovery, and habit coaching. It may connect to WHOOP and other data sources to generate personalized daily guidance, including macro targets, workout suggestions, recovery adjustments, progress summaries, and coaching messages.

The app is not a medical device, doctor, registered dietitian, emergency service, or substitute for professional medical advice. Do not use the app for emergencies, diagnosis, medication changes, or treatment decisions.

2. Information we collect

We collect only the information needed to provide the coaching experience you choose to use.

Information you provide directly

You may provide:

• - name or preferred name
• - age, sex, height, weight, and goal information
• - nutrition preferences, allergies, foods to avoid, and usual meals
• - workout preferences, equipment, injuries, limitations, and training history
• - food logs, meal descriptions, food photos, and optional voice notes
• - workout logs, including exercises, sets, reps, loads, RPE, and notes
• - daily check-ins, such as hunger, energy, soreness, stress, sleep notes, travel, alcohol, illness, or restaurant meals
• - progress photos, if you explicitly enable and submit them
• - annual physicals, lab reports, or similar documents, if later enabled and explicitly submitted
• - support messages and other communications with us

WHOOP data

If you connect WHOOP, we request your authorization through WHOOP OAuth before accessing your WHOOP data.

Depending on the scopes you approve, we may collect:

• - basic WHOOP profile information
• - body measurements, such as body weight and related measurements available through WHOOP
• - recovery data, including recovery score, HRV, resting heart rate, and related recovery metrics
• - sleep data, including sleep timing, sleep performance, sleep need, and sleep-stage-related information available through WHOOP
• - cycle/strain data, including strain and physiological context available through WHOOP
• - workout data, including sport/activity type, workout timing, strain, heart rate summaries, kilojoules/energy estimates, distance where available, and heart-rate zone data
• - WHOOP webhook event notifications indicating that workout, sleep, or recovery data changed

We may request offline access so the app can refresh WHOOP data after you connect, without asking you to re-authorize every time.

Technical information

We may collect:

• - authentication tokens needed to connect your accounts
• - message delivery metadata
• - app logs and error logs
• - device/browser/network metadata when using a web flow
• - timestamps and usage events needed to operate the service

3. How we use information

We use your information to:

• - generate personalized macro, nutrition, workout, and recovery guidance
• - estimate your true maintenance calories over time
• - adapt recommendations based on WHOOP recovery, sleep, strain, workouts, food logs, weight trends, check-ins, and preferences
• - maintain workout progression memory
• - track confirmed food intake and calculate macro gaps
• - produce daily and weekly summaries
• - respond to your chat/SMS/WhatsApp messages
• - improve data quality with confirmation prompts and confidence scores
• - detect safety situations where normal coaching should stop and professional help may be appropriate
• - provide account, support, security, and debugging functions
• - comply with applicable law and enforce our terms/policies

We do not use WHOOP data to sell advertising. We do not sell, rent, or lease WHOOP data or your personal health information.

4. How recommendations are generated

The app combines:

• - your personal profile and preferences
• - WHOOP data, if connected
• - your food, workout, weight, progress, and check-in logs
• - evidence-based wellness principles
• - safety guardrails
• - confidence scoring

The app treats all data as imperfect. Food logs, wearable calorie estimates, body weight, and photos can all contain noise. Recommendations should be interpreted as wellness coaching suggestions, not medical conclusions.

5. How we share information

We do not sell your personal information.

We may share limited information with service providers only as needed to operate the app, such as:

• - cloud hosting and database providers
• - secure file/object storage providers
• - AI providers used to generate coaching messages, analyze food photos, or summarize logs
• - messaging providers, such as SMS or WhatsApp delivery providers
• - payment providers, if subscriptions are enabled
• - security, logging, and support tools

These providers may process information on our behalf to provide their services. They are not permitted by us to use your information for their own unrelated purposes.

We may also disclose information:

• - if you direct us to share it
• - to comply with law, legal process, or enforceable government request
• - to protect rights, safety, security, and fraud prevention
• - in connection with a business transfer, subject to appropriate protections

We will not expose your WHOOP data to another user or third party without your explicit opt-in consent.

6. WHOOP data controls

You control whether to connect WHOOP.

You may disconnect WHOOP by:

• - revoking access through your WHOOP account / WHOOP settings where available
• - contacting us and asking us to delete stored WHOOP data and tokens

If you disconnect WHOOP, we will stop future WHOOP syncs. Some previously generated coaching reports or logs may remain until deleted according to your deletion request and our retention practices.

7. Progress photos and sensitive uploads

Progress photos, annual physicals, labs, and similar documents can be sensitive.

We will process these only if the feature is enabled and you submit them. For progress photos, the app should be used to track visual trends and estimated ranges, not exact body-fat percentages.

You may request deletion of submitted photos or documents.

8. Data retention

For the private/local MVP, data may be stored locally in project files unless or until a cloud backend is enabled.

For a hosted version, we will retain information for as long as needed to provide the service, maintain your account, comply with legal obligations, resolve disputes, and enforce agreements.

You may request deletion of your account data, including stored WHOOP tokens and stored WHOOP-derived data, subject to legal or security retention obligations.

9. Security

We use reasonable administrative, technical, and physical safeguards designed to protect personal information.

For production use, WHOOP data and other sensitive health information should be:

• - transmitted over secure encrypted channels, such as HTTPS
• - encrypted at rest
• - stored with access controls
• - protected from unauthorized access, disclosure, alteration, or destruction
• - handled using least-privilege access

No system is perfectly secure. If we discover a security incident involving your information, we will provide notice as required by applicable law and, where required, notify WHOOP.

10. Your choices and rights

Depending on your location, you may have rights to:

• - access information we hold about you
• - correct inaccurate information
• - delete information
• - export information
• - withdraw consent
• - object to certain processing
• - opt out of certain communications

You can also stop using the app or disconnect WHOOP at any time.

11. Messaging and communications

If you enable SMS or WhatsApp coaching, we may send:

• - morning plans
• - evening macro-gap checks
• - workout prompts
• - food confirmation prompts
• - weekly summaries
• - replies to your messages

You can opt out of non-essential messages. Message and data rates may apply.

12. Children

The app is not intended for children under 13, and it is not designed for use by minors without appropriate consent. We do not knowingly collect personal information from children under 13.

13. International users

The app may be operated from the United States or other locations. If you use the app from outside your country, your information may be processed in countries with different privacy laws than where you live.

14. Changes to this policy

We may update this Privacy Policy from time to time. If changes are material, we will provide notice as appropriate.

15. Contact

For privacy requests, support, data access, deletion, or security concerns, contact:

```text

Privacy contact: [ADD CONTACT EMAIL]

Company/legal name: [ADD COMPANY NAME]

Mailing address: [ADD ADDRESS IF REQUIRED]

```

16. WHOOP disclaimer

WHOOP is a trademark of Whoop, Inc. This app is not endorsed by WHOOP unless explicitly stated in a separate written agreement. WHOOP data is accessed only with your authorization through WHOOP’s OAuth process and used according to this Privacy Policy and applicable WHOOP developer terms.