Consumer Health Data Privacy Policy

1. About This Policy

This policy supplements the Swull Privacy Policy. It applies to personal information that is "consumer health data" under U.S. state consumer health privacy laws, including Washington's My Health My Data Act and Nevada's consumer health data law. Swull is operated by Swull Strength LLC, an Arizona limited liability company ("Swull," "we," "us").

Swull is a strength and running training app, not a medical service. But these laws define consumer health data broadly, so some of the fitness and training information Swull uses to build your workouts can fall within it. This policy explains which information that is, why we collect it, who receives it, and the rights you have.

2. Consumer Health Data We Collect

Depending on the features you use, the following information may be consumer health data:

• Body measurements and characteristics: body weight and body-weight history, goal weight, height, sex, and age or birthday.
• Exercise and performance information: workouts, exercises, sets, reps, weights, durations, estimated one-rep maxes, and exercise preferences (such as movements you mark to do less often or avoid).
• Cardio and heart rate: cardio sessions (type, duration, distance) and average or maximum heart rate when you enter it or it is included in a workout file you upload.
• Race and recovery information: the races you plan for, your goals, target times, paces, results, race-day checklist progress, fueling amounts you record, and the optional post-race check-in about muscle soreness.
• Estimates our software makes: estimates derived from the information above, such as your training level, estimated strength, run paces, fatigue, and recovery status.

Swull does not ask you to provide diagnoses, medical records, medications, injuries, illnesses, or other clinical medical information. It does not collect precise location or GPS data, biometric identifiers (such as fingerprints or face scans), or genetic data.

3. Sources of Consumer Health Data

• You: information you enter in the app, such as your profile, workouts, body weight, cardio sessions, and race details.
• Files you upload: workout files (such as Garmin .fit files) that you choose to import.
• Our software: estimates calculated from the information above, as described in Section 2.

We do not obtain consumer health data from data brokers, advertisers, or other third parties.

4. Why We Collect and Use Consumer Health Data

We collect and use consumer health data only as necessary to provide the Swull service you request, including to:

• generate, adjust, and personalize your workouts, running and race plans, and fueling suggestions;
• show your training history, progress, and trends;
• keep the service secure and reliable, and troubleshoot problems;
• respond to support requests you send us; and
• comply with legal obligations.

We do not use consumer health data for advertising or marketing, we do not sell it, and we do not use it for research. If we ever want to collect or use consumer health data for a purpose that is not necessary to provide the service you requested, we will first ask for your consent, as the law requires.

5. How We Share Consumer Health Data

We do not sell consumer health data, and we do not share it with advertisers, data brokers, or business partners. We share it only as necessary to provide the service you requested, or as required by law, with the following categories of recipients:

• Service providers (processors): companies that host and operate Swull on our behalf under contract and may use the data only to provide their services to us. These are Google (Firebase Authentication, Cloud Firestore, Cloud Functions, Firebase Hosting, and Firebase App Check with reCAPTCHA Enterprise) and Resend (email delivery; health information reaches Resend only if you include it in a support request).
• Parties to a corporate transaction: a buyer or successor if Swull Strength LLC is involved in a merger, acquisition, or sale of assets, subject to this policy.
• Government authorities: when we are required to by law, court order, or valid legal process.

We have no affiliates that receive consumer health data.

6. Keeping and Deleting Consumer Health Data

We keep consumer health data while your account exists. You can delete individual workouts in the app, and you can delete your account and data at any time from Profile settings. When you delete your account, we delete your consumer health data as described in the Data Retention section of our Privacy Policy.

7. Your Rights

Depending on where you live, you may have the right to:

• confirm whether we collect, share, or sell your consumer health data, and access that data, including a list of the third parties and affiliates with which we have shared it;
• delete your consumer health data; and
• withdraw consent you have given for the collection or sharing of your consumer health data.

We offer these rights to all users. To make a request, use the in-app options described above or email support@swullstrength.com from the email address on your account with "Health Data Request" in the subject line. We may need to confirm that the request comes from the account owner. You may also have an authorized agent make a request on your behalf; we may ask for your written, signed permission and confirm your identity directly. We will respond within 45 days, or tell you within that time if we need up to 45 more days. We will not treat you differently for exercising these rights.

8. Appeals

If we decline your request, we will explain why. You may appeal by emailing support@swullstrength.com with "Appeal" in the subject line, and we will respond to your appeal in writing, including the reasons for our decision. If your appeal is denied, you may contact the Washington State Attorney General at www.atg.wa.gov/file-complaint, the Nevada Attorney General at ag.nv.gov/complaints/file_complaint, or another applicable regulator.

9. Changes to This Policy

We may update this policy as Swull changes. When we make material changes, we will email the address on your account at least 14 days before the changes take effect and update the effective date at the top of this page. If a change would collect or share consumer health data in a way that requires your consent, we will ask for that consent first.

10. Contact

Questions about this policy or your consumer health data? Email support@swullstrength.com.