OptimalFit Consumer Health Data Privacy Policy

Scope and contact

OPFIT, LLC operates OptimalFit and handles consumer health data for its fitness, nutrition, progress, cycle-tracking, and AI features. This notice supplements our general Privacy Policy at /privacy. It controls any conflict about consumer health data. Contact support@optimalfit.com or OPFIT, LLC, 2932 BETHANY PL, CLEARWATER, FL 33759, United States.

Categories and sources

We collect health-related profile information such as height, biological sex, activity level, injuries and limitations; weight, body-fat percentage and lean body mass; workout and activity records; food logs, targets, restrictions and meal images; progress photos; health information in messages and notes; and inferences and plans generated from those records. When optional cycle tracking is enabled, we also collect contraception type, cycle settings, menstrual flow, energy, symptoms, and notes. Account identifiers link these records to you.

Sources include information you enter or upload, your activity in OptimalFit, authorized Apple Health and Google Health Connect imports, and information derived from those records. Health imports are read-only and cover the body/activity categories listed in the main Privacy Policy; menstrual flow has a separate permission. Information posted in the community is supplied by the member who shares it. We do not collect GPS or precise device location.

Purposes and permissions

We use the information to provide the health and fitness features you request, including progress tracking, cycle features, workout selection and adaptation, nutrition planning, and Olli responses. Retained messages and AI action records support continued personalization of your own plans. Relevant support access may be needed to resolve a request or investigate a safety/security issue.

We obtain the consent required for collection and sharing before the relevant processing. Where law permits processing necessary to provide a requested service without separate consent, we limit that processing to its permitted purpose. Any legally required sharing consent is separate from collection consent. Accepting the Terms is not a substitute.

Cycle tracking is off by default. Structured cycle records are not automatically sent to OpenAI, but anything you type into Olli or include in an uploaded image may be sent with your AI permission. Progress photos are stored in private storage visible only to you, are not available in our admin tools or the community, and are never sent to OpenAI or any AI feature. You may withdraw AI-sharing permission in settings to stop future requests containing your information. Disconnecting a health source stops future imports but does not automatically delete records already imported.

Recipients and data disclosed

Supabase stores health records, images, cycle information, and retained AI action records. Fly.io hosts Olli transcripts and services supporting processing and synchronization, including operational logs that currently contain short excerpts of generated coaching content. Vercel processes relevant API requests. Cloudflare provides the authorized synchronization proxy and may process data passing through it. OpenAI receives the messages, images, and selected health/fitness context authorized for AI features. Expo and downstream push services process notification payloads.

Open Food Facts receives scanned food barcodes and the device's IP address through direct requests. Other signed-in members see health information and photos you choose to post in the community. The automated community-moderation provider will process community content, including health information it contains.

The team confirms that PostHog analytics and Sentry diagnostics do not receive health information or Olli conversation content.

We do not share information with advertisers or use health information for advertising. Any marketing use of your images or testimonials requires separate explicit permission. Legally required disclosures and business transfers occur only where permitted by applicable consumer health law.

We do not allow third parties to collect consumer health data about you over time or across other websites or apps.

Retention and deletion

Health records and retained AI history are kept while an account is active unless you exercise an applicable deletion right. Starting a new chat does not clear retained user messages, action records, or personalization. Request their deletion through support@optimalfit.com without closing your account. Account data is automatically deleted three months after subscription expiration unless you re-subscribe, with warning emails seven and three days before deletion.

Account deletion removes associated health records, images, conversation streams, retained AI messages/action records, and personalization and triggers applicable provider deletion. Backups expire within seven calendar days of active-system deletion; deletion is reapplied after restoration. Narrowly limited records may remain under a valid legal exception. The main policy explains support processing and operational retention.

Your rights and requests

Where applicable, you can ask whether we collect or share your consumer health data, access it, withdraw consent to collection or sharing, and request deletion. For Washington requests, you can also obtain a list of third parties and affiliates with whom we shared or sold your consumer health data and an active means of contacting them, even if no sale occurred.

Send requests to support@optimalfit.com. You do not need to create an account or reinstall the app. We verify identity using proportionate methods and securely provide data copies through support. You may request correction and deletion of retained health information without automatically closing your account. We explain any feature limitations caused by removal of required information.

For Washington requests, we respond without undue delay and within 45 days of receipt, with one permitted additional 45-day extension when reasonably necessary and explained within the initial period. Verification does not extend that statutory timetable. Other requests follow the applicable legal period. Our shorter operational target for support-requested account deletion is seven business days after verification.

If we deny a request, we explain the basis and applicable appeal rights. Send a Privacy Appeal to support@optimalfit.com. For Washington appeals, we respond within 45 days; if denied, we explain how to contact the Washington Attorney General at https://www.atg.wa.gov/file-complaint. Community moderation appeals are a separate process and do not replace privacy appeals. We do not unlawfully discriminate against you for exercising rights.

Changes

We provide required notices and obtain any required additional consent before new categories, recipients, or purposes are introduced. The version number and effective date at the top of this notice identify the current version. We notify you of material changes by email and provide any additional notice required by law.