ZYREP

Consumer Health Data Privacy Policy

Strength Training App

Effective Date: October 9, 2026 | Version 2.4

This Consumer Health Data Privacy Policy explains how ZyRep LLC ("ZyRep," "we," "us," or "our") handles consumer health data through the ZyRep iPhone app and related websites. It applies in addition to the general ZyRep Privacy Policy and is limited to consumer health data.

Health questions are optional. You may skip them and, if your plan includes generated workouts, receive workouts personalized from your non-health information without personalization based on optional health data.

1. Consumer Health Data We Collect

Depending on context, consumer health data may include:

2. Sources of Consumer Health Data

3. Why and How We Process Consumer Health Data

ZyRep stores consumer health data with its cloud service provider and, after your separate disclosure consent, sends selected consumer health data to Anthropic's commercial API only when generating a workout, plan, or post-workout suggestion you requested. The generated workout, plan, or post-workout suggestion is returned to ZyRep and stored with your account. Authorized personnel may access relevant information only when reasonably needed for support, safety, or troubleshooting.

4. Collection and Sharing Choices

ZyRep obtains affirmative consent before collecting optional consumer health data and separate consent before disclosing that data to Anthropic. These are two independent consents, and Trainer Notes are governed by both, as is all other optional health information. You may decline or skip either at onboarding and withdraw either at any time in Settings. The request for consent identifies the data, purpose, recipient category, and withdrawal method.

The collection consent covers optional health information you choose to provide, including Trainer Notes, injuries, physical limitations, surgical history and restrictions, chronic conditions affecting training, body measurements, fitness level, training history, recovery information such as sleep and stress, nutrition, other activity, and workout feedback. ZyRep otherwise processes exercise selections, sets, repetitions, weights, workout logs, generated workouts, AI prompts and outputs, personal records, performance trends, recovery feedback, related inferences, and health-revealing community content only as needed to provide a feature you request or when you affirmatively submit, publish, or share it.

Goals, experience, equipment access, optional gym location, and trainer and workout preferences may be used as non-health inputs to generate a workout you request to the extent they do not reveal health information. Health information entered in these fields remains consumer health data; the field label does not make it non-health information. All Trainer Notes are treated as consumer health data regardless of their content.

If you withdraw collection consent, ZyRep stops saving new Trainer Notes and stops the affected future health data collection. Withdrawal of disclosure consent stops the affected health data from being sent with future workout-generation requests. Previously generated workouts are unaffected by withdrawal. If your plan includes generated workouts, ZyRep continues to provide workouts personalized from your non-health information without the affected health processing. Withdrawal does not by itself delete information already held; you may separately request deletion as described below.

5. Disclosures of Consumer Health Data

ZyRep discloses consumer health data only as follows:

On the free tier, which does not include generated workouts, plans, or post-workout suggestions, Trainer Notes and all other consumer health data are stored with your account and are not disclosed to Anthropic.

Apart from the processor services described in this section, ZyRep does not share Trainer Notes with any third party, affiliate, analytics provider, advertiser, or data broker.

As of the Effective Date, ZyRep uses Anthropic's standard commercial API retention. Anthropic states that it automatically deletes API inputs and outputs from its backend within 30 days after receipt or generation, except when a feature has a different retention setting, ZyRep and Anthropic agree otherwise, or longer retention is needed to enforce Anthropic's Usage Policy or comply with law. Anthropic does not offer ad hoc deletion of individual API submissions. These provider retention practices do not limit your deletion rights or ZyRep's obligations under applicable law. ZyRep separately retains the source information and generated outputs described in Section 7.

ZyRep does not currently share consumer health data with any affiliate. ZyRep does not sell consumer health data, use it for targeted advertising or marketing, or upload it to advertising audiences. As of the Effective Date, ZyRep does not use consumer health data, AI inputs, AI outputs, or user feedback to train, fine-tune, evaluate for improvement, benchmark, or otherwise improve a ZyRep or third-party artificial intelligence or machine learning model. ZyRep does not submit API inputs or outputs as model feedback, participate in an Anthropic model improvement program, or authorize Anthropic to use them for model training or improvement. This restriction does not prevent limited processing needed to provide or secure the API service, enforce Anthropic's Usage Policy, or comply with law.

ZyRep does not permit third parties to collect consumer health data over time across unrelated websites or online services when you use ZyRep.

Processor protections. ZyRep contractually requires processors that handle consumer health data on its behalf to follow documented instructions, use the data only for the contracted services, provide the same or an equivalent level of privacy protection required by this Policy and applicable law, use appropriate safeguards, assist with consumer rights and deletion, and notify ZyRep of relevant security incidents. ZyRep remains responsible for instructing and overseeing those processors.

6. Your Consumer Health Data Rights

Subject to authentication of your identity and applicable exceptions, you may:

Submit a request through Privacy Settings, our Privacy Request page (https://www.zyrep.com/privacy-request), or by email at privacy@zyrep.app. You may use any of these methods to submit an appeal.

ZyRep will promptly take reasonable steps to authenticate your request and may ask for information reasonably necessary to do so. Subject to authentication and applicable exceptions, ZyRep will respond without undue delay and no later than 45 days after receiving the request, unless a state-specific rule below provides otherwise. ZyRep may take a legally permitted extension after notifying you within the initial response period and explaining why. ZyRep will delete covered consumer health data unless a narrow legal exception applies. To appeal, reply to the decision or use any request method listed above and identify the submission as a "Privacy Appeal." ZyRep will inform you in writing of the action taken or not taken, explain the reasons, and, if it denies the appeal, provide the method for contacting the applicable Attorney General, within the period required by applicable law.

7. Retention and Deletion

ZyRep temporarily assembles AI prompts for processing and does not save a separate copy of the assembled prompt in its application database. This does not change ZyRep's retention of the underlying health inputs or generated outputs described below. Anthropic's separate retention of API inputs and outputs is described in Section 5.

ZyRep keeps consumer health inputs, workout records, generated outputs (including workouts and training plans), and inferences about health or physical capability only as long as reasonably necessary for the purposes described in this Policy or until you delete the information or your account, whichever occurs first, subject to narrow exceptions permitted by law. Withdrawing collection or sharing stops the affected future processing but does not itself delete information already held; you may separately request deletion.

Trainer Notes are included in the JSON export of your health information and are deleted in full by the "Delete My Health Information" action in Settings, by account deletion in Settings, or by an authenticated request through https://www.zyrep.com/privacy-request or privacy@zyrep.app.

A request to delete all consumer health data covers health information in underlying inputs, generated outputs, retained workout records, and related health inferences, subject to the exceptions permitted by applicable law. Retaining workout history does not exclude the health information in those records from your deletion request.

Within 30 days after you complete an available in-product deletion, initiate account deletion through your authenticated account, or ZyRep authenticates another deletion request, ZyRep deletes the covered consumer health data from active production systems, while also complying with any shorter independently running state deadline below, and notifies applicable processors and other recipients of the request and takes the steps required by applicable law to secure deletion. Anthropic handles API deletion under the practices described in Section 5, rather than individual on-demand deletion. Those practices do not replace any notice, assistance, or deletion obligation imposed by applicable law. Information in archived or backup systems is deleted as required by applicable law, including within any state-specific maximum below; if a backup is restored, deletion controls are reapplied.

To the extent permitted by applicable law, ZyRep may retain only limited, segregated records reasonably necessary for security, fraud prevention, legal compliance, or proof of consent and withdrawal. Public screenshots, reshares, and independent search engine caches may remain outside ZyRep's control. Anthropic's separate standard commercial API retention is described in Section 5.

8. Security

ZyRep uses reasonable administrative, technical, and physical safeguards appropriate to the sensitivity of consumer health data and limits access to personnel and service providers that need the information for the purposes described above.

9. Changes to This Policy

ZyRep will post the revised policy with a new effective date and version. Before a material change takes effect, ZyRep will notify users through a prominent in-app notice and may also use email. Before collecting, using, or disclosing a new consumer health data category, using health data for a new purpose, or disclosing it to a new recipient, ZyRep will update this policy and obtain fresh affirmative consent where required.

10. Contact

Consumer health data questions, requests, withdrawals, and appeals: privacy@zyrep.app

11. State-Specific Request Supplement

The provisions below supplement the request, deletion, and appeal procedures in Sections 6 and 7. They apply when the identified state law covers the request. If a provision below conflicts with another timing statement in this Policy, the provision that gives you greater protection controls. ZyRep may respond or act sooner.

11.1 Connecticut Customers

For a request covered by Connecticut law, ZyRep will respond without undue delay and no later than 45 days after receiving the request. ZyRep may extend that period once by up to 45 additional days when reasonably necessary. If ZyRep takes an extension, it will notify you within the first 45 days and explain the reason. If ZyRep declines to act, it will explain the reason and provide appeal instructions without undue delay and no later than 45 days after receiving the request. Within 60 days after receiving an appeal, ZyRep will inform you in writing of any action taken or not taken and explain the reasons for the decision. If ZyRep denies the appeal, it will provide a method for contacting the Connecticut Attorney General to submit a complaint. If you withdraw consent to processing covered by Connecticut law, the withdrawal method will be at least as easy as the method used to give consent, and ZyRep will stop the affected processing as soon as practicable and no later than 15 days after receiving the withdrawal.

11.2 Nevada Customers

For a request concerning consumer health data covered by Nevada law, ZyRep will respond without undue delay and no later than 45 days after authenticating the request. ZyRep may extend that period once by up to 45 additional days when reasonably necessary. If ZyRep takes an extension, it will notify you within the first 45 days after authentication and explain the reason. Subject to lawful exceptions, ZyRep will, within 30 days after authenticating a deletion request, delete the covered consumer health data from its active records and network and notify each affiliate, processor, contractor, or other third party with which ZyRep shared the data. Those recipients must delete the covered data within 30 days after receiving ZyRep's notice. Deletion from archived or backup systems may be delayed only as needed to restore those systems and for no longer than two years after authentication. You may appeal a refusal through any request method listed above; the appeal process will be conspicuously available and similar to the request process. Within 45 days after receiving an appeal, ZyRep will inform you in writing of any action taken or not taken and explain the reasons for the decision. If ZyRep denies the appeal, it will provide contact information for the Nevada Attorney General.

11.3 Virginia Customers

For an authenticated request covered by Virginia law, ZyRep will respond without undue delay and no later than 45 days after receiving the request. ZyRep may extend that period once by up to 45 additional days when reasonably necessary. If ZyRep takes an extension, it will notify you within the first 45 days and explain the reason. If ZyRep refuses to act, it will explain why and provide appeal instructions no later than 45 days after receiving the request. Within 60 days after receiving an appeal, ZyRep will inform you in writing of any action taken or not taken and explain the reasons for the decision. If ZyRep denies the appeal, it will provide a method for contacting the Virginia Attorney General to submit a complaint.

11.4 Washington Customers

For a consumer health data request covered by Washington law, ZyRep will act without undue delay and within 45 days after receipt. Authentication does not pause or extend that period. ZyRep may extend once by up to 45 additional days when reasonably necessary if it notifies you within the initial period and explains why. Subject to lawful exceptions, ZyRep will delete the covered data from its records and network and notify the recipients with which it shared the data so they can delete it. Backup deletion may be delayed only as needed for restoration and no more than six months after authentication. Within 45 days after receiving an appeal, ZyRep will inform you in writing of any action taken or not taken and explain the reasons for the decision. If ZyRep denies the appeal, it will provide an available online mechanism or another method for submitting a complaint to the Washington Attorney General.