Consumer Health Data Privacy

1. Health-data contact and scope

Symbiote Fitness Ltd, company number 16649354, provides an AI-assisted fitness coaching platform. Our registered office is 3rd Floor, 86-90 Paul Street, London, England, EC2A 4NE. This policy describes consumer health data, including information inferred about health, collected through the service. It is separate from our general Privacy Policy.

For health-data questions, requests or an appeal, email support@symbiotefitness.com. To contact our appointed Data Protection Officer, mark your message for the DPO. A coach normally controls their clients' coaching records and Symbiote processes those records for the coach. Symbiote also has its own responsibilities for platform operation and any health data it controls. We will assist with a request and coordinate with the coach where needed.

2. Categories of consumer health data

Information linked or reasonably linkable to you can include:

• Physical characteristics and measurements: age or date of birth used in coaching, height, weight, body measurements, progress photos and physique-analysis results.
• Nutrition and activity: food and meal records, food photos, calories and nutrients, exercise, workout performance, goals, supplements and check-ins.
• Health information you or your authorised coach provide: injuries, allergies, health conditions, symptoms, restrictions, and physical or mental health information disclosed in coaching conversations, notes or uploaded material.
• Derived information: estimates, summaries, trends and AI-generated inferences about your fitness, nutrition, progress, wellbeing or coaching needs. These can be inaccurate and are not medical diagnoses.
• Identifiers and communications associated with these records, including your account identifier and messages with your coach or AI coach. A product-image request can also associate your IP address with a requested food-product image.

3. Sources and purposes

Sources are you; your coach or coaching business where authorised; information generated from your use of coaching features; and AI and knowledge-retrieval results generated from those inputs. Food-product nutrition data can come from Open Food Facts and be associated with a meal you choose to log.

We collect and use this information to deliver the coaching and tracking features you request: personalise AI coaching using your coach's methodology, answer messages, retrieve relevant knowledge, analyse permitted photos, maintain activity and nutrition records, and provide requested reminders or check-ins. We also use necessary records to secure these features, respond to rights requests, investigate misuse or incidents, and meet applicable legal duties.

Health-data consent is requested separately from agreement to the Terms. Progress-photo processing has an additional permission control. Where consent is required for collection or sharing, it must be given before that activity. We do not treat acceptance of a general privacy policy as permission for unrelated health-data use.

4. Sharing and recipients

Health data is made available to your selected coach or authorised coaching business to provide the service. Necessary information is processed by service providers supporting those features:

• Amazon Web Services: hosting, databases, object storage, authentication, operational logs, email and Bedrock or AgentCore AI processing.
• OpenAI: the inputs needed for AI features using its API, including relevant text or images and knowledge embeddings.
• Pinecone: coach-scoped knowledge text, metadata and embeddings used for retrieval; private coaching material can contain health information if it was included in the material.
• Cohere through AWS Bedrock: relevant search queries and passages when reranking is used.

Open Food Facts receives the barcode number from our server for product lookup, not your private coaching records or uploaded food photos. When its product images are displayed, your browser sends that service your IP address, browser and device headers, and the product-image path. A no-referrer setting does not conceal these details. Manual food entry does not require this lookup or image request.

We may disclose relevant health data to a recipient you direct us to use, or where legally required or permitted for a rights request, legal proceeding, incident or protection of people. We do not routinely share health data with affiliated companies for their own use. We do not sell consumer health data or use it for targeted advertising. We do not use private health information to train public foundation models.

5. Your health-data rights and choices

Subject to the law applicable to your request, you can ask whether we collect or share your consumer health data; obtain access or a copy; correct inaccurate information; withdraw consent; and request deletion. Where required, you may also request the list of third parties and affiliates receiving your health data and their contact information. We will not unlawfully discriminate against you for exercising these rights.

You can withdraw or restore health-data consent in Settings. Withdrawal stops new consent-based health processing and health-dependent features; it does not itself erase historical records or cancel a subscription. Account billing and cancellation controls remain available. Use Settings or contact support@symbiotefitness.com to request an export, correction or deletion, including a request limited to health information.

We verify requests using information proportionate to the request and its risk. Do not email identity documents, medical records or passwords unless a secure and necessary verification process has been agreed. We coordinate applicable deletion instructions with processors and other recipients as required, including records held in backups, subject only to legally permitted timing and exceptions.

If we deny a request, you can appeal by emailing support@symbiotefitness.com with the subject Health Data Appeal. Our response will explain the decision and any further complaint route available under applicable law. You can also contact your state's attorney general or other relevant privacy regulator.