Consumer Health Data Privacy Policy

Effective October 19, 2026 · Last updated: October 19, 2026

Some of what you log in EchoFit is "consumer health data" under the Washington My Health My Data Act, Nevada's consumer health data law (SB 370) and Connecticut's data privacy law. This page explains what that data is, where it comes from, who receives it and how to use your rights. It adds to our Privacy Policy; it doesn't replace it.

We collect consumer health data only with your consent, or when it is needed to provide a feature you asked for.
We share it only with your consent or with service providers that process it for us.
We never sell consumer health data, and we never use it for advertising.

1. Who we are

Alra Intelligence LLC ("EchoFit", "we"), 30 N Gould St, Ste N, Sheridan, WY 82801, USA. Contact: privacy@echofit.app.

2. The consumer health data we collect, why, and where it comes from

Each category below lists what it includes, why we use it, where it comes from, who can see it and how long we keep it.

Profile and body details

Includes: Age, sex, height, experience level, training goal, units, language, time zone, weekly target and app settings
Why: Personalise your plan, loads and insights
Comes from: You, Your coach
Who can see it: You, Your coach, while you are connected, Authorised EchoFit staff
Kept for: Until you delete your account

Body weight

Includes: The weigh-ins you enter, and your body-weight goal
Why: Show your trend and scale bodyweight exercises and loads
Comes from: You
Who can see it: You, Your coach, only if you turn it on
Kept for: Until you delete the entry or your account, or withdraw health consent (then deleted)

Training log and plan

Includes: Exercises, sets, reps, loads, effort (RPE), notes, dates, your programme and its progress, warm-up routine, recovery copies of workouts you delete
Why: Keep your history, build your plan, compute insights, and show friends and your coach what you share with them
Comes from: You, Your coach, Your device
Who can see it: You, Your friends, Your coach, while you are connected, Authorised EchoFit staff
Kept for: Until you delete it or your account. Recovery copies of deleted workouts are kept until you delete your account

Workout text you say or type

Includes: The words of a voice or typed log, what the app read from them, whether the reading was right, and the device type
Why: Turn what you said into sets, and fix mistakes in that reading
Comes from: You, Your device
Who can see it: You, Authorised EchoFit staff
Kept for: 730 days, then deleted automatically, or sooner when you delete your account

Voice recordings

Includes: English: turned into text by your device (Apple on iPhone, your browser on the web). Arabic, if you allowed AI features: the recording is sent through our server to OpenAI Whisper; otherwise your device turns it into text
Why: Turn speech into workout text
Comes from: You, Your device
Who can see it: Our service providers (section 6)
Kept for: Not kept: EchoFit doesn't store the recording, and OpenAI keeps no copy and no log of a transcription after returning the text

Training profile (questionnaire)

Includes: Main and second goal, training age, days per week, session length, sleep hours, stress level, injuries or areas to protect, equipment, weak points
Why: Choose and adapt your programme safely
Comes from: You, Your coach
Who can see it: You, Your coach, while you are connected, Authorised EchoFit staff
Kept for: Until you change it or delete your account

Health check result

Includes: Only whether medical clearance was advised, and when. Your answers to the questions are never stored
Why: Keep cardio easy and offer walking first when clearance was advised
Comes from: You, Calculated from your data
Who can see it: You, Your coach, while you are connected, Authorised EchoFit staff
Kept for: Until you retake the check or delete your account

Injury and life-stage notes

Includes: An area to protect (for example knee or lower back), movements to avoid, pregnancy or postpartum, a short note; set by you or your coach
Why: Swap exercises your plan would otherwise pick
Comes from: You, Your coach
Who can see it: You, Your coach, while you are connected
Kept for: Until it is cleared or you delete your account. Notes you set are deleted when you withdraw health consent; notes your coach set stay in their record but stop shaping your plan and are not sent to an AI

Progress photos

Includes: Photos you add to a coach check-in (18 or older only)
Why: Let you and your coach see change over time
Comes from: You
Who can see it: You, Your coach, only if you turn it on
Kept for: Deleted 7 days after you leave the coach or turn sharing off, after 365 days, or when you delete your account

Check-ins and nutrition

Includes: Your answers to a coach's check-in, nutrition targets your coach sets, and the daily ticks you record
Why: Coaching by your coach
Comes from: You, Your coach
Who can see it: You, Your coach, while you are connected
Kept for: Daily nutrition ticks: 400 days. The rest until you or your coach delete it, or you delete your account

Insights we compute

Includes: Digital Twin scores, muscle recovery, training load and lighter-week signals, estimated maxes, the coaching reading; and, when you have a coach, the summary of these the app sends them
Why: Adapt your training and explain it
Comes from: Calculated from your data
Who can see it: You, Your coach, while you are connected
Kept for: On your device; the coach's daily summaries 180 days, and all of it is deleted when you leave the coach or delete your account

AI coach conversations

Includes: Your messages to the AI coach and its replies
Why: Answer you, and show you your conversation
Comes from: You, Calculated from your data
Who can see it: You
Kept for: Until you clear the conversation or delete your account

Apple Watch heart rate and energy

Includes: Heart rate and active energy read during a session on Apple Watch, and the workout the Watch saves to Apple Health
Why: Show your heart rate on the Watch and record the workout in Apple Health
Comes from: Your device
Who can see it: You
Kept for: Not kept by EchoFit; Apple Health keeps it under your control

Your health check answers are never stored — only whether medical clearance was advised. Heart rate and active energy from Apple Watch stay on your Watch and in Apple Health; we never receive them.

Before you first tell the app about an injury, answer the health check, set a pregnancy or postpartum stage, or enter your body weight, sleep or stress, it asks for your consent in plain words, with a clear "Not now". Before a feature first sends data to an AI provider, it asks separately. A progress photo goes to a coach only after you turn photos on for that coach and confirm you are 18 or older, and your body weight reaches a coach only if you turn it on for that coach. You can withdraw any of these at any time in the app — the two consents in Settings → Data → Privacy, a coach's switches where you manage that coach — or by writing to us. Withdrawing stops future collection and sharing that relied on it; you can also ask us to delete what was already collected. Withdrawing the health consent also deletes your health answers, body weight, weigh-ins, sleep and stress, and the injury and life-stage notes you added, and the app stops using any injury note to shape your plan or sending one to an AI — including notes your coach added, which stay in your coach's record until they clear them.

EchoFit is for people 16 and over (18 in Saudi Arabia, the United Arab Emirates, Kuwait, Qatar, Oman and Bahrain, decided by where your phone is when you create your account), so each of these consents is given by the member themselves.

Your body weight, sleep and stress answers are covered by the same health consent. Without it the app does not collect them and your plan uses standard values instead.

People you choose. A coach you connect with sees what the consent screen showed you before you connected (body weight and progress photos only if you turn them on for that coach). Friends see your training log. No one else sees your consumer health data except as this page lists.

Companies that receive it. Each one below receives only what a feature you use needs. Those that process it for us work under contracts that limit them to our instructions; a company marked so also applies its own privacy policy. Their contact details and terms are in our Privacy Policy, section 6:

Supabase — Accounts and sign-in, the database that stores your synced data, file storage (profile and progress photos) and our server functions.
Google (Gemini API) — The AI coach, explanations of your numbers, the daily brief, reading the exercise and sets from what you say or type, Perfect Sync, and a coach's AI programme draft.
OpenAI (Whisper API) — Turns an Arabic voice log into text.
Resend — Sends our email.
Apple — App Store purchases and refunds, Sign in with Apple, push notifications to iPhone (APNs), speech recognition for English voice logs on iPhone, and Apple Health on Apple Watch. Its own privacy policy also applies.

Before anything reaches an AI company, our server removes your name, email and phone number, your coach's and friends' names, links, handles, account ids and birth dates (Privacy Policy, section 5). The health details that make the answer safe stay, and only with your health consent.

Authorised EchoFit staff can view it through our admin tool only to support you, keep the service secure and fix problems.

We have no affiliates that receive consumer health data. We do not sell it, we do not use geofencing around health care facilities, and we do not let third parties collect your health data across other apps or websites over time.

5. Your rights

Wherever you live, you can:

Confirm and access: ask whether we collect, share or sell your consumer health data (we do not sell it), get a copy, and get the list of every third party and affiliate we shared it with, with how to contact them. In the app, Settings → Data → Export gives you a copy at any time.
Delete: delete your account in Settings → Account → Delete Account, or ask us. We delete it from our systems straight away, and backups expire within 7 days. Data already sent to Google to answer a request is kept by Google only as long as its API terms allow.
Withdraw consent: in Settings → Data → Privacy, or by email.
Correct it in the app or by asking us.

Send requests to privacy@echofit.app, from your account's email address if you can, so we can confirm it is you. We answer within 30 days. Requests are free, and we will never treat you differently for making one.

Appeals. If we decline your request, our answer says why. Reply with "Appeal" and we will review the decision and reply in writing. If you are not satisfied, you can contact your state attorney general — in Washington, the Attorney General's Office (atg.wa.gov); in Nevada, the Office of the Attorney General; in Connecticut, the Office of the Attorney General.

6. Changes

We publish any change here with a new date. Before a material change — such as a new category of consumer health data, a new purpose or a new kind of recipient — we tell you in the app and ask for your consent where the law requires it.

7. Contact

privacy@echofit.app (requests answered within 30 days) · help with the app: support@echofit.app (we reply within 2 business days) · Alra Intelligence LLC, 30 N Gould St, Ste N, Sheridan, WY 82801, USA