Consumer Health Data Notice

This Notice applies to Consumer Health Data we collect, use, disclose, or process in connection with the Services.

For purposes of this Notice, “Consumer Health Data” means personal data that identifies or can reasonably be linked to you and that relates to your physical or mental health, fitness, exercise activity, bodily functions, health status, or health-related inferences, to the extent such data is treated as consumer health data under applicable law.

Crucible is not a HIPAA-covered entity, and the Services are not a HIPAA-covered service.

Depending on how you use the Services, your device, your permissions, and supported integrations, we may collect or process the following categories of Consumer Health Data:

• workout and exercise activity data;
• completed sessions and training history;
• selected exercises and training structure;
• logged sets, reps, load, and RPE;
• body weight and related fitness measurements;
• heart rate and related fitness metrics;
• active energy, calories, and similar activity measures;
• sleep-related data;
• fitness, workout, or recovery-related metrics made available by your device or operating system;
• health and fitness data imported from or exported to Apple Health or supported Android health-data frameworks;
• notes, comments, or other content you submit that describe injuries, pain, fatigue, recovery, physical capacity, limitations, or other health-related information;
• inferences or outputs generated from the above, such as workout suggestions, summaries, substitutions, or training-related explanations.

We collect only the categories you choose to provide, authorize, or connect, plus the outputs and records created through your use of the Services.

We may collect Consumer Health Data from the following sources:

• directly from you;
• from your use of the Services;
• from your device, wearable, or operating system when you grant permission;
• from Apple Health on iOS, where authorized by you;
• from supported Android health-data frameworks, where authorized by you;
• from workout logs, notes, and other content you create in the Services;
• from automated processing based on your inputs, training history, and connected data.

On Android, Crucible reads health and fitness data from Health Connect only after you grant permission, and only the types you choose. Crucible does not write any data to Health Connect.

Crucible may request permission to read the following Health Connect data types, and uses each as described:

• exercise sessions, with their distance, total calories burned, and steps — to show and import workouts you recorded in other apps and to count them toward your training load;
• heart rate — to show the effort of a workout and, for a ranked Crux attempt, to check that a heart rate was recorded across the attempt;
• heart rate variability and resting heart rate — to calculate your Training Readiness and Recovery scores;
• sleep — to calculate your sleep and Training Readiness scores;
• steps and active calories burned — to show your daily activity alongside your training;
• weight — to scale your Crucible Effort to your body mass;
• data recorded more than 30 days before you connected (“past data”), only if you start an import of older history — to import that history;
• data while Crucible is not open (“background”), only if you turn on the morning readiness alert — to calculate your readiness and send the alert once your sleep has synced.

Data read from Health Connect is processed and stored on your device, with two exceptions, both tied to a ranked Crux attempt. When you submit one, the heart-rate readings recorded during that attempt are sent to our servers so the attempt can be verified for the leaderboard. When Crucible Effort is added to a ranked attempt, your body mass, rounded to the nearest pound or half kilogram, and the loads you entered are sent so the server can recompute the score; neither is shown to anyone else.

The use of information received from Health Connect will adhere to the Health Connect Permissions policy, including the Limited Use requirements. We do not sell Health Connect data, use it for advertising, use it to determine credit-worthiness or for lending purposes, or transfer it to third parties except as needed to provide the features described above, for security purposes, or to comply with law. We do not allow people to read Health Connect data except with your consent, for security purposes, to comply with law, or where it has been aggregated and de-identified.

You can change or withdraw Crucible’s access at any time in the Health Connect app (App permissions › Crucible) or by disconnecting in Crucible under Settings › Health Data.

We collect and use Consumer Health Data to:

• provide the workout, logging, tracking, and training features of the Services;
• generate workouts, suggestions, substitutions, summaries, and explanations;
• save workout history, notes, and training records;
• read from and write to health and fitness frameworks when you authorize us to do so;
• personalize and improve the Services for your use;
• support account functionality, subscription restoration, troubleshooting, and customer support;
• maintain app reliability, security, and performance;
• detect misuse, fraud, abuse, or unauthorized activity;
• comply with legal obligations and enforce our terms.

We do not use Consumer Health Data to provide medical advice, diagnosis, treatment, or healthcare services.

We do not sell Consumer Health Data for money.

We may disclose Consumer Health Data:

• to service providers acting on our behalf and under appropriate contractual restrictions, such as cloud hosting, infrastructure, authentication, analytics, crash reporting, customer support, and messaging providers;
• to Apple Health or supported Android health-data frameworks when you direct or authorize data syncing;
• to platform providers where necessary for app functionality;
• when required by law, legal process, or regulatory request;
• to protect rights, safety, security, property, users, or the Services;
• in connection with a merger, financing, acquisition, restructuring, bankruptcy, or sale of assets;
• with your consent or at your direction.

We do not knowingly disclose Consumer Health Data to data brokers.

Where required by applicable law, we obtain your consent before collecting or sharing Consumer Health Data.

You may control Consumer Health Data permissions by:

• adjusting device or operating-system permissions;
• changing Apple Health permissions on iOS;
• changing permissions for supported Android health-data frameworks;
• discontinuing use of connected features;
• contacting us to request deletion, where applicable.

If you revoke permissions, some features may no longer function fully.

Depending on where you live and subject to applicable law, you may have the right to:

• confirm whether we collect, use, or share your Consumer Health Data;
• access certain Consumer Health Data;
• request deletion of certain Consumer Health Data;
• withdraw consent relating to certain collection or sharing activities;
• appeal a denial of your request, where required by law.

To exercise these rights, contact us through our website.

We may need to verify your identity before acting on a request. We may deny a request where permitted by law, including where we cannot verify identity or where an exception applies.

We retain Consumer Health Data for as long as reasonably necessary to provide the Services, maintain your account, support legitimate business operations, comply with legal obligations, resolve disputes, protect security, and enforce our agreements.

If you request deletion or delete your account, we will delete or de-identify Consumer Health Data within a reasonable period, except where retention is required or permitted by law for purposes such as legal compliance, fraud prevention, security, subscription recordkeeping, tax, accounting, audit, dispute resolution, or enforcement.

We may de-identify, aggregate, or otherwise process Consumer Health Data so that it no longer reasonably identifies you.

We may use or retain de-identified or aggregated data for lawful business purposes, including analytics, product improvement, research, performance reporting, and service development.

We do not attempt to re-identify de-identified data except where permitted by applicable law.

We use reasonable administrative, technical, and organizational safeguards designed to protect Consumer Health Data. No system is completely secure, and we cannot guarantee absolute security.

We may update this Notice from time to time. The updated version becomes effective when posted or otherwise communicated. Your continued use of the Services after the effective date means you acknowledge the updated Notice.

If you have questions about this Consumer Health Data Notice or our handling of Consumer Health Data, contact: