Privacy Policy

1. Who we are

Heala is operated by Heala Limited, company number 17430512, a company registered in England and Wales with registered office at Apartment 1219 Nobel Way, Uhaus Vita Living East, Manchester, England, M1 7FY. Heala Limited is the controller of the personal data described here: we decide what is collected and why. Heala is developed by Kerem Erol and Ege Yasayanlar.

Privacy contact: hello@heala.fit

Heala Limited is established in the United Kingdom and has no establishment anywhere else. The UK GDPR and the Data Protection Act 2018 are the laws we answer to first, and the Information Commissioner's Office is our supervisory authority.

If you are in the European Economic Area, the EU GDPR also applies to what we do, and you may complain to the supervisory authority in the country you live in rather than to the ICO. We have no establishment in the EEA, so under Article 27 of the EU GDPR we have appointed a representative in the Union. You can contact them directly, instead of us, about anything to do with your personal data — including a subject access request, a deletion request or any other GDPR enquiry:

Euverify Ltd (Ireland)

Unit 3D North Point House

North Point Business Park

New Mallow Road, Cork

T23 AT2P, Ireland

gdpr@euverify.com

Writing to the representative is an alternative to writing to us, not a step you have to take first. You can still reach us at hello@heala.fit, and you can still complain to your own supervisory authority without going through either of us.

If you are in California, Washington, Nevada or another US state with its own privacy law, see Your rights. Washington and Nevada consumer health data has its own notice at heala.fit/consumer-health-privacy.

2. Heala is for adults

You must be at least 18 years old to create an account or use Heala. There is no child, teen or supervised version of the service.

The age rating shown by an app marketplace is a content rating and does not change this. If a store, family account or parental-control setting lets someone under 18 install Heala, that person is still not eligible to use it.

We ask for your date of birth during setup. The age is worked out and recorded on our servers, and the date submitted for that check is not kept by it. What we keep is the answer: whether the account belongs to an adult, when that was established, and which version of these documents was on screen at the time.

Our servers enforce this independently of the app. An account that has not established adult eligibility is refused when it tries to store health information of any kind — training, nutrition, sleep, body, cycle, medication or habit records. Reading is deliberately not blocked, because someone who has not answered still has the right to export or delete information that is already theirs.

A date of birth you later enter in your profile is a separate thing, listed in the next section. It is kept because features such as heart-rate zones and your energy targets need your age.

We do not knowingly collect information from people under 18. If we learn that an account belongs to one, we may suspend or close it and delete the associated information, subject to anything we are required to retain. If you believe a person under 18 has created an account, contact hello@heala.fit.

3. What we collect, why, and on what basis

What Heala processes depends on which features you use. Each entry below gives the category, why we process it, the legal basis under UK and EU GDPR, and how long we keep it.

• Account and profile — email address; name; the identifier Apple or Google returns when you sign in with them; date of birth or age; sex or gender where you give it; height; weight; goals and targets; experience; equipment; profile image; language; units; country; preferences. To create and operate your account. Contract. Kept for the life of the account.
• Training and movement — programs, workouts, exercises, sets, repetitions, weights, RPE, duration, distance, cardio sessions, notes, personal records, streaks, volume, strain, progression and the analytics drawn from them, including workouts imported from a connected service, and the route of an outdoor session you record. To provide the training features you use. Contract, and your explicit consent as health data. Kept while your account is active.
• Nutrition — food and water entries, meals, calories, macronutrients, food and nutrition-label photographs, barcode and text searches, saved and recent foods, serving information and goals, including food and water imported from Apple Health with the name of the app that wrote each entry. To log and analyse what you eat. Contract and explicit consent. Kept while your account is active; searches that matched nothing are deleted after 120 days.
• Sleep, recovery and connected health — sleep and its stages, bedtime and wake time, steps, distance, active and basal energy, heart rate, resting heart rate, heart-rate variability, respiratory rate, blood-oxygen saturation, blood pressure, VO2 max, wrist and skin temperature, body mass and body-fat percentage, and the sleep, recovery, strain and readiness scores derived from them. To produce your dashboard and your scores. Explicit consent. Kept while your account is active; hourly heart rate collected from a connected service is deleted after 90 days.
• Daily check-in — the soreness, stress, energy and mood you report each morning, each on a five-point scale. As the subjective input to your recovery score. Explicit consent. The last three weeks are kept.
• Body information — weight, body-fat estimates, circumference and other body measurements, body-scan photographs, estimated skin tone and body shape, generated 3D body files, scan history and scan-credit activity. To produce the measurements and body twins you ask for. Explicit consent. Kept while your account is active.
• Cycle and reproductive information — period dates, cycle length, flow, symptoms, mood, energy, notes, basal body temperature, ovulation-test results, cervical-mucus observations, intercourse where you record it, contraception and pill-adherence information, and pregnancy context including kick counts where you provide it. To provide cycle tracking and predictions. Explicit consent. Kept while your account is active.
• Habits and medications — habits and their logs; medication names, doses, schedules, reminders, adherence logs and notes. For logging and reminders. This is not a prescribing or clinical service. Explicit consent. Kept while your account is active.
• AI information — your prompts and conversations, voice transcripts, the photographs you submit to an AI feature, the account context that feature needs, the generated output, and the operational metadata of each request: feature, model, token count, cost and result status. To provide the AI feature you used, and to operate and cost the service. Explicit consent for the content; legitimate interests for the operational metadata. Content kept while your account is active; metadata for 400 days.
• Purchases and subscriptions — tier, product, billing platform, entitlement state, price and currency, trial status, transaction identifiers, renewal and expiry, offer eligibility, scan-credit balance and history, billing country and the customer identifiers our billing providers give us. To sell and run your subscription. Contract. Kept for the life of the account. We never receive your full payment-card number.
• App and website usage — which screens, onboarding steps and paywalls you saw, as named events with a small set of properties; a random installation identifier generated on the device; how long the app was open each day; and, on heala.fit, the records described in Website visitors. To see where Heala is confusing or broken. Legitimate interests. 400 days.
• Device and technical information — device type, operating-system and app version, build number, language, IP address received through ordinary network requests, push-notification token, integration and sync status, crash and diagnostic information, security events and session information. To deliver, secure and debug the service. Legitimate interests. Under our providers' own schedules, up to 12 months.
• Social — your profile card contents; friend requests, friendships, blocks and reports; messages you send and receive with their photographs, video clips and voice messages; reactions; challenge participation and daily progress; and location-sharing status and sampled points when you turn the friend map on. To operate the social features you chose to use. Contract, and explicit consent for the health figures inside them. See What other people can see.
• Support and feedback — email address, support messages, bug reports, screenshots and attachments, diagnostic details, correspondence history, and any star rating and comment you submit in the app with the screen it came from and the app version at the time. To answer you and to fix problems. Legitimate interests. Kept while we may still need them. Please do not send unnecessary health information in a support request.
• Consent and compliance records — what we asked, what you answered, when, and which document version was shown. To evidence consent and to handle privacy requests. Legal obligation. For the life of the account. The ledger is append-only, so withdrawing consent adds a record rather than removing one.

We rely on legitimate interests only for security, authentication, abuse and fraud prevention, rate limiting, diagnostics, reliability, food-catalogue quality and measurement of our own product. We never rely on it for health data, and never for advertising or attribution. You may object to any of it — see Your rights.

We do not carry out automated decision-making that produces legal or similarly significant effects. Your scores, targets and generated plans are guidance you can override or ignore.

4. Health data, your consent, and the advertising firewall

Most of what Heala holds is special-category health data. The Article 9 condition for all of it is your explicit consent, taken separately from your acceptance of these documents and separately for each area.

Consent is asked before the feature runs rather than afterwards, and each of these has its own gate: training; nutrition; sleep, recovery and strain; body measurements, scans and twins; cycle and reproductive information; medications; habits; the daily check-in; and any AI feature that reads your health information. Sending a cycle summary to our AI provider is a further, separate switch that starts off.

You can withdraw any of them under Profile → Account & Privacy → Privacy choices. Withdrawal stops that processing going forward, and we do not fall back to another legal basis to keep it running. It does not make lawful past processing unlawful, and it does not delete what you logged — deletion is a separate control in the same place.

Device permissions are consents too: the health store, location, camera, microphone, photo library and notifications are granted and revoked in your operating-system settings, and refusing one disables that feature rather than the app.

We never use health information for advertising. Heala does not intentionally provide health, fitness or other sensitive Heala content to Meta, to Google, to TikTok, to Apple's advertising and attribution frameworks, or to any other advertising partner, for advertising, marketing, or other use-based data mining, including audience creation and profiling.

That covers HealthKit information; wearable health information; heart rate; HRV; sleep, recovery, readiness and strain; weight and body-fat information; body measurements; calories and macros; meal contents and food photographs; workout content, exercise history and performance; cycle, reproductive and contraception information; pregnancy-related information; medication information; body-scan images and 3D body-twin information; precise outdoor routes and GPS coordinates; AI prompts, conversation content and voice transcripts; health-related photographs; and symptoms or medical information you supply.

This is a firewall rather than a preference. Allowing advertising tracking does not change it. Opting in to marketing email never changes this either. It is enforced in the code, not only stated here: the events that may leave the app for an advertising partner are a closed list, so are the parameters each may carry, and a final check drops an entire event — rather than stripping it and sending the remainder — if a parameter name reads like health, food, body, cycle, medication, location or conversation content. Heala's own product analytics have no route out to advertising; the handful of commercial steps that do are mapped across one at a time by hand.

We also do not use body imagery for face recognition or to identify you, and we do not display third-party advertisements inside Heala.

5. Connected apps, devices and platform features

Apple Health. Apple Health and HealthKit refer to the same data in this policy: HealthKit is the Apple framework Heala uses to read from and write to it. With your permission, Heala reads the categories you allow: activity and energy, heart rate and variability, sleep, body measurements, temperature, blood oxygen, respiratory rate, VO2 max, blood pressure and, if you ask for the food import, the dietary entries and water other apps have written there. Where you turn write-back on, Heala writes your weight, and the meals and water you log, back into the health store. What you allow is set in the Health app and can be changed or revoked there at any time. Health-store information is never used for advertising, is never sold, and is never provided for advertising, marketing, or other use-based data mining. Where write-back is on, Heala writes only what you actually logged — we do not write false or inaccurate data into your health store.

Connected services. You may connect WHOOP, or Fitbit through Google Health. Support for Oura is built but not currently enabled, so it cannot be authorised and nothing is read from it. Heala then stores the authorisation and refresh tokens and reads the supported records: sleep and its stages, heart-rate variability, resting and average heart rate, steps, energy, blood-oxygen saturation, respiratory rate, skin temperature and VO2 max. A Fitbit connection also runs without you: once an hour our servers read the last few hours of heart rate and store one average per hour, whether or not you have opened the app, and that hourly series is what all-day strain and recovery are built from.

Disconnecting deletes the connection and its tokens and stops all further reading, including that hourly collection. It does not delete what has already been imported, and corrections you make in Heala do not reach back into Apple Health. To remove imported days, use Profile → Account & Privacy → Reset Data → Delete a date range and choose Wearable data, or delete your account.

Bluetooth heart-rate monitors. Heala reads heart rate directly over Bluetooth while a session is running and stops when it ends. Nothing is sent to the device maker.

Location. GPS is used for an outdoor session you start yourself, and for the friend map while you have it turned on. Routes are stored with the session exactly as recorded, start to finish — Heala does not trim its ends, so a session that begins or ends at home shows that. Friend-map points are visible only to the friends you choose, no point older than 24 hours is ever shown, older points are deleted as new ones arrive, and turning sharing off deletes every stored point of yours in the same moment. Map tiles under a route are served by Mapbox and Esri, and the map surface itself by Apple.

Widgets, Live Activities and Apple Watch. These draw from a snapshot of your own data shared between the app and its extensions on your device, together with step and heart-rate figures read from the health store at the moment of drawing. A widget on your home screen or a watch face may be visible to anyone who can see your screen. Nothing extra is sent to us because a widget or a watch is displaying it.

6. AI features, body scans and body twins

AI features run only when you use them, and only with your separate permission. Heala sends the request to OpenAI through our own server, which attaches the context that feature needs and nothing more. When you are in an AI feature you are interacting with a system, not a person, and nothing it writes is reviewed by anyone at Heala before it reaches you.

Where AI is used: the assistant and coach; workout and program generation and auditing; meal, nutrition-label and restaurant-menu photographs and typed food descriptions; body photographs for measurements and 3D generation; a quality check on foods you type by hand; and the safety screening of photographs, video captions and voice messages sent in a conversation. Screening is how the service is kept safe, so it runs whatever your other AI settings say.

What the coach is told. Heala assembles a summary of your account and sends it with your message: your name in Heala, age, sex and height; your goal, target weight and pace; your daily nutrition targets and today's totals; recent weight and its trend; body-fat percentage and saved measurements; your recent and scheduled workouts; your best lifts; this week's cardio; last night's sleep and your average; today's recovery score; your streaks; today's steps and recent heart rate; and your plan, units and language. Your email address is not part of it. Where the conversation calls for it the assistant can also look up your medications and doses, your habits, and your step, heart-rate and variability series. A module you have switched off is left out of all of it.

Cycle information is a separate decision. The cycle tracker's data is not sent to OpenAI unless you accept a separate disclosure naming OpenAI — offered once when you first open the tracker, after the tracker's own permission, and switchable at any time in Cycle settings. It starts off, and accepting the cycle tracker's own disclosure does not turn it on. When it is on, a summary rides with every message: your cycle day and phase, whether you are on your period, days until the next one and its predicted date, your fertile window, and up to six recent symptoms. Nothing else from the tracker is sent — not intercourse logs, ovulation tests, cervical mucus, basal body temperature, contraceptive adherence or kick counts.

Your information is not used to train third-party models, and we do not train our own on it. Requests go through Heala's own account under terms that exclude training. Retention at the provider differs by request: some carry an instruction not to store, and the requests that upload photographs do not, so those images are held under the provider's terms rather than under an instruction from us.

Body scans. Both body features sit behind a permission of their own, asked before the first photograph of your body leaves your phone and separately from general AI permission. A measurement scan sends two photographs, your height, and your sex and weight where given, to OpenAI, which estimates circumferences, a body-fat percentage and the dominant skin tone used to colour your 3D body; you can edit every number before it is saved. A 3D twin sends four photographs to OpenAI for one narrow check — reading back which side each photograph shows, so a body is not built from mislabelled views — and then to Tripo (VAST AI Research), which builds the model with a texture made from your own photographs. Clad can build a body from numbers alone and never receives a photograph.

The finished file and your scan photographs are kept in private storage only your account can read, served to your device through links that expire after an hour. If you choose to share a body twin, Heala places a copy in storage anyone can read, protected only by a random code in the link — treat a shared twin as published, and assume anyone it is forwarded to can open it. Sharing a newer body replaces and removes the older shared copy; deleting your account removes it; and hello@heala.fit will remove it on request. Deleting the scan inside Heala removes your private copy but not the shared one, and neither does Delete a date range. Nothing can recall a copy someone has already downloaded.

Dictation may be processed by Apple's or Google's speech recognition rather than on your device, under their terms; only the resulting text goes on to the AI provider.

AI output can be wrong, incomplete or unsuitable for you. It is not medical advice — see the Terms.

7. What other people can see

Everything in this section happens because you chose a feature that shares.

Your profile. Choosing a username publishes a card at heala.fit/u/yourusername that anyone holding the link can open, signed in or not. It carries your username, display name, profile picture, bio, the month you joined, a plan badge and your friend count, and — where the matching flag is set — a training summary: total workouts; workouts and volume over the last 30 days; your goal streak; habit days over 90; workouts per week for 12 weeks; your three strongest free-weight lifts with weight, repetitions and estimated one-rep max; body parts trained over 90 days; an 84-day training grid; and challenges entered and won. Two further flags govern published program counts and a 90-day cardio summary.

The card never carries your email address, your date of birth, or any single workout, meal, night or weigh-in. Nutrition, body, recovery and sleep figures are never returned to a visitor who is not signed in; inside Heala each has its own switch under Friends → Privacy, and each starts off. Cycle information can never appear on a profile at all — there is no switch for it and the server refuses that domain outright.

A new profile starts public. You can close it yourself at any time under Friends → Privacy: turning discoverability off means anyone who is not an accepted friend stops being able to reach your profile card at all, and the heala.fit link stops resolving for them. The change applies immediately, to everyone.

Two things are not switchable in the app yet. Which individual blocks appear on a public card is set for you rather than by you, and giving up a username entirely is a request to hello@heala.fit — a username can otherwise be changed in the app, subject to a cooldown between changes.

Friends and messages. Friendships require mutual acceptance. What you send in a conversation — text, photographs, video clips, voice messages and shared workout content — is visible to the other participant, delivered through our servers and stored until deleted. Photographs, video clips and voice messages are screened automatically before the other person can open them; message text is not. Deleting a message for everyone puts a marker in its place rather than erasing it: the text stays in the row, and the media stays in storage where neither of you can open it.

Stories. A story is visible only to friends you have accepted — not the public, not a friend of a friend, and not anyone either of you has blocked. Twenty-four hours after posting it stops being readable by anyone including you, and is then deleted. Watching one tells its author, who can see everyone who watched, when, and whether they liked it; there is no way to watch without leaving that mark. Stories are not screened and have no report control — write to hello@heala.fit.

Challenges. A challenge is private to the people in it, but every member sees your figure for its metric, your rank, and your day-by-day figures for the whole run, and those results are kept when it ends. Steps, body weight, medication and cycle information can never be a challenge metric. An invitation identifies you to the person you invite.

Leaderboards. A friends board ranks the friends who have their summary flag on, by workout, calorie or mindfulness streak. Someone with that flag off is absent from it rather than shown as a zero.

Published programs. Publishing a program to Heala's library publishes its full contents under your display name, username and profile picture, for every signed-in user to browse, upvote and download, with running counts shown. A download becomes that person's own program at the moment they take it, which is why unpublishing yours does not reach theirs.

Sharing outside Heala. Cards and links you deliberately share out — workouts, body progress, routes, challenges, body twins — leave our control. Recipients may save, copy, forward or republish them, and we cannot recall a copy that has already gone.

8. Advertising, attribution, email and notifications

What we measure. We measure whether our own advertising works: which campaign or link brought someone to heala.fit or to an install, whether they signed up, and whether they subscribed. The providers are Meta, Google — through Google Analytics for Firebase — and Apple's own frameworks in the app, and Meta and TikTok on the website. There is no TikTok component in either app, and no third-party advertisements are shown inside Heala.

What may leave. A closed list of events — install, first open, registration, onboarding completed, paywall viewed, trial started, subscription purchased, renewed or cancelled, and other purchases — carrying only the product, category, billing interval, currency, amount, store, platform and app version. Nothing else is permitted, and no health information of any kind is included. Apple's SKAdNetwork reports only how far down the purchase funnel an install reached, as one number from a fixed ladder with no rung for any health action. That number is sent for every install, whatever your answer to the advertising questions below: Apple passes it to the advertising network only for an install that came from an advertisement, delayed and without any identifier, so it cannot be linked to you or to your account.

Google Analytics for Firebase is in the app for the same purpose and receives the same closed list of events, with the same parameters and no health information. It measures nothing until you allow advertising measurement: collection is switched off in the build itself, so a launch before you have answered collects nothing at all rather than collecting and discarding. Google's own consent signals for advertising and personalisation stay denied unless you also allow tracking. Withdrawing resets the identifier Google holds for that install, so the history is detached rather than paused.

Tracking, and your choices. On iPhone, Heala requests the required system permission before engaging in activity that Apple defines as tracking. That is the App Tracking Transparency prompt, and it governs the Identifier for Advertisers (IDFA). Refusing tracking permission does not prevent you from using any part of Heala — no feature, no content and no level of service depends on it. You can change the answer at any time in your device settings. If Heala ever begins any further activity Apple defines as tracking, we will request permission through that prompt first.

Separately from the platform's question, Heala has its own advertising-measurement switch under Profile → Account & Privacy → Privacy choices, shown as Cookies & advertising. It is never pre-selected for you, and it is asked in the app and on heala.fit. In the United States, until you answer, Meta's component in the app runs in its limited mode: it may report the events listed above, such as the app being opened, without the Identifier for Advertisers and with no health information. Turning it off shuts the advertising component down there and then and stops the events above, whatever the platform's answer was, and it stays off on that device; only Apple's anonymous SKAdNetwork number, described above, is not covered by it. Advertising measurement is never required to use Heala.

On heala.fit the same choice governs the Meta Pixel and the TikTok Pixel, which load only where you have allowed it. Neither app ships a TikTok component.

Email. Service email — confirmations, receipts, security and account notices, and answers to your requests — is part of the service and is not marketing. Marketing email is sent only if you opt in, the box is never pre-selected for you, and it is asked in the app and on heala.fit. Every marketing message carries an unsubscribe link that works immediately. Delivery is by Resend.

What marketing is NOT based on. We do not segment, target or time marketing on your health information. That means HealthKit information, wearable readings, sleep, recovery or strain, weight and body composition, nutrition and meal contents, workout content, cycle or reproductive information, body-scan imagery, medication logs and AI conversations. Marketing is sent on the basis of your plan, your language and your country, and nothing else.

Notifications. Reminders are built and scheduled on your own device, and their contents are not sent to us or to anyone else. Push notifications are written by our servers and delivered through Expo, then through Apple's push service. Most have a switch in Profile → Notifications, and turning one off means the notification is never written at all. Promotional push and in-app messages may be sent to a group we choose; there is no separate switch for them, so turn Heala's notifications off in your device settings if you do not want them.

A push about a direct message carries the sender's name and a short preview of the text; photographs, videos, voice messages and shared items send a short phrase instead, never the content. Nothing is sent for a conversation you are reading at that moment. When you allow notifications we store a push token for that device, and delete it when you sign out there or when Expo reports the device is gone. Cycle reminders use neutral wording by default; the contraceptive-pill reminder says what it is, because a reminder that does not is not acted on.

Internal alerts. When somebody starts a trial, buys something, or joins the waiting list, Heala administrators receive a push on their own devices carrying the email address and the purchase or signup details. The recipient is Heala, not a third party.

9. Who else receives your information

We disclose information only where necessary to provide, protect or operate Heala, to comply with law, or because you asked for the feature.

Acting on our instructions. These providers process your information for Heala's purposes only; ask us, and we deal with them. Supabase — database, authentication, functions and file storage. OpenAI — AI features and safety screening. Tripo (VAST AI Research) — 3D body generation from photographs. Clad — body generation from numbers, no photographs. RevenueCat — subscription products and entitlements. Expo — app infrastructure, updates and the push relay. Resend — service and opted-in marketing email delivery. Cloudflare — website delivery, protection and cookieless measurement. Mapbox and Esri — map tiles.

Acting partly for themselves. These also decide things for their own purposes — platform security, fraud prevention, tax records and their own measurement — and for that part they answer to you directly under their own policies. Apple — Sign in with Apple, Apple Health, App Store purchases and receipts, push delivery, maps, dictation, and Search Ads and SKAdNetwork attribution. Google — Sign in with Google, Fitbit records through Google Health, dictation, and Google Analytics for Firebase where you have allowed advertising measurement. Stripe — web checkout, billing, invoices and fraud prevention. Stripe processes and stores card details; we never receive your full card number. Meta and TikTok — advertising measurement.

Your own accounts elsewhere. WHOOP and the Google health service behind a Fitbit connection hold your account, not ours, and Oura would if that connection were enabled. We read from them only while you keep the connection open, and what they do with your data is between you and them.

Receiving nothing about you. USDA FoodData Central, FatSecret and Open Food Facts receive a search term or a barcode and nothing else at all.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We may disclose information where required by law, in response to a valid legal request, or to establish or defend legal claims. If Heala is involved in a merger or acquisition, information may transfer with the business, and this policy or a successor notice continues to govern it.

International transfers. Some providers process information outside the United Kingdom or the EEA. Where a restricted transfer is subject to UK or EU requirements, we rely on an applicable safeguard — adequacy regulations or decisions, Standard Contractual Clauses, the UK Addendum, an International Data Transfer Agreement, or another legally recognised mechanism. Write to hello@heala.fit for details.

10. Security, retention and deletion

Security. Reaching your account requires authentication. Information is encrypted in transit and, by our infrastructure providers, at rest. Private files — body scans, progress photographs and chat media — are stored so that only your own account, and in a conversation the intended recipient, can retrieve them, and are served through links that expire. Access to production systems is restricted and logged. No service can promise perfect security.

Breaches. Where a personal-data breach is likely to result in a high risk to your rights, we will tell you without undue delay, and we will notify the ICO where required within 72 hours of becoming aware of it.

How long we keep things. Section 3 gives the period for each category of information. Beyond it: stories and their photographs, 24 hours; friend-map points, 24 hours; rate-limit counters used to stop abuse, 7 days; the one-time code linking a wearable connection, cleared as soon as the connection completes or fails; the download links inside an export, one hour; moderation records, removed with your account and in any case 180 days after a report is closed — a report nobody has reviewed yet is a backlog rather than a stale record and is never deleted by age; deleted private media inside our database provider's encrypted backup cycle, targeted for removal within 35 days; and records relevant to legal claims or regulatory matters, for as long as the matter reasonably requires.

Deleting your account removes your live account data, subject to the limited retention above. Deleting your account does not cancel a subscription — cancel that with whoever billed you, before you delete. Apple, Google and Stripe keep their own transaction records under their own tax and accounting obligations, and deleting your Heala account does not reach those. You can also delete a chosen date range rather than the whole account, under Profile → Account & Privacy → Reset Data.

What deletion cannot reach, because it belongs to somebody else:

• Messages you sent are removed from the other person's conversation as well as yours, with the media you sent. Media the other person sent you is their record and stays.
• A challenge you created is deleted with your account, and that takes every member's participation and final standings with it. A challenge you only joined loses your participation and nothing else.
• Friendships, blocks and reports you filed are removed, and notifications other people received about you are removed from their inboxes.
• A report somebody else filed naming you is kept. It is their record of what happened and our evidence for a decision we made.
• A food you submitted that was approved into the shared catalogue stays there. It was never published under your name — the entry carries no username and no account identifier — and the submission itself goes with your account.

11. Your rights

Everyone. Whatever law applies where you live, you can ask us for a copy of your information, ask us to correct it, ask us to delete it, or ask us to stop a particular use. The first three you can do yourself in the app under Profile → Account & Privacy, which is usually faster. For anything else write to hello@heala.fit. We answer within one month, extendable by two months for complex requests, and we will tell you if we need the extension. We do not charge, and we do not treat you differently for asking.

United Kingdom and EEA. You have the rights of access, rectification, erasure, restriction of processing, data portability and objection; the right to withdraw consent at any time, without affecting processing already carried out; and the right not to be subject to a decision based solely on automated processing with legal or similarly significant effects, which we do not carry out. You may complain to the Information Commissioner's Office at ico.org.uk, or to your own supervisory authority if you are in the EEA. We would appreciate the chance to put things right first.

California. In the last twelve months we have collected the categories set out in section 3, which in California's vocabulary are identifiers; customer records; protected classifications; commercial information; internet and application activity; geolocation; audio, electronic and visual information; and inferences. We collect them for the purposes given there, from you and from the services you choose to connect, and we disclose them to the recipients in section 9. We do not sell personal information and we do not share it for cross-context behavioural advertising, including for anyone under 16. Sensitive personal information — health data, precise geolocation, and sex and reproductive information where you provide it — is used only to provide the features you asked for and never to infer characteristics about you, so the right to limit its use does not arise. You may request access, deletion, correction and portability, know what we collect and disclose, and be free from discrimination for exercising any of it. Because we neither sell nor share personal information, the Do Not Sell or Share My Personal Information right has nothing to act on; the Cookies & advertising switch is where you turn advertising measurement off regardless. An authorised agent may act for you with proof of authority.

Other US states. Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana and other states with comparable laws give you rights of access, correction, deletion and portability, the right to opt out of targeted advertising and of sale, and the right to appeal a refusal. Health information is processed on your consent. To appeal, reply to our answer or write to hello@heala.fit with "Appeal" in the subject line, and we will reconsider and give you our reasons.

Washington and Nevada. Consumer health data is covered by its own notice at heala.fit/consumer-health-privacy, which sets out those rights and how to use them.

12. Website visitors

This section is about heala.fit and applies whether or not you have an account. None of these records is attached to a Heala account, which is why in-app deletion does not reach them — write to hello@heala.fit instead.

Every visit. The site receives ordinary connection information, including your IP address, your browser's user agent, the page you asked for and the site you came from. Cloudflare Web Analytics runs on every page: a cookieless beacon that counts visits, sets nothing on your device and identifies nobody.

Where you are. Cloudflare stamps what it knows about the connection onto the records below. The onboarding records carry the most — country, region, city, postcode, timezone, the network you are connected through and its operator, and estimated coordinates. A waiting-list entry keeps country, city and coordinates; a share-link visit keeps country, region and city. That is a good deal more specific than a country, which is why it is written out here rather than called approximate. Your IP address itself is not stored in these records.

The onboarding flow at /start. If you begin it, we record your answers — sex, age, height, weight, target weight and pace, activity, goal, training days, cardio preferences, split, rep style and coaching style — together with the step you reached, your language, timezone, screen size, landing page, any campaign parameters, the referring site, any Heala share link you came through, your user agent, a random session identifier held in your browser, and the geography above. The record carries no name, no email address and no account identifier. Your unfinished plan is also kept in your own browser's storage so you can come back to it.

The free training week at /program. Your goal, experience, equipment, training days and cardio preference go to OpenAI, which writes the week; nothing else about you goes with them. Receiving it means joining the waiting list, because email is how it reaches you.

The waiting list. We store your email address, the form you used, your language, the referring page, any campaign parameters, the username you asked to reserve, the discount code the list earns you, and your country, city and approximate coordinates. One email follows immediately and we intend to write once more when Heala launches. Each new signup is emailed to a Heala administrator; a repeat signup from an address already on the list sends neither email. The homepage map is built from these rows in aggregate and withholds any city with fewer than three signups behind it. Ask at any time to be taken off.

Share links. A /j/ link records that a visit happened, the country, region and city it came from, and whether it looked like a person or a robot, so that reach can be counted. Visitors are counted once per day using a hash that rolls at midnight and identifies nobody.

Website measurement records are kept for 400 days. A waiting-list entry is kept until the list is used, because that is what it is for.

13. Changes, and how to reach us

We update this policy when features change, when a provider changes, or when the law changes. The version and date at the top change with it, and a material change re-opens acceptance in the app. Where a change needs new consent or additional notice, we ask or tell you before the affected processing begins, not afterwards.

Questions, requests, complaints and appeals: hello@heala.fit

Heala Limited

Company number 17430512

Registered in England and Wales

Apartment 1219 Nobel Way, Uhaus Vita Living East, Manchester, England, M1 7FY

The Terms of Service and the consumer health data notice sit alongside this policy, in the app under Profile → Account & Privacy and at heala.fit.