Privacy Policy

Information We Collect

• Health & activity data, read-only, only with your permission: sleep, heart rate variability, resting heart rate, heart rate, step count, active energy, and exercise time from Apple Health; recovery, strain, and sleep data from Whoop; readiness, sleep, and stress data from Oura. Workouts recorded by Apple Health or a connected wearable are also stored so your history persists across devices.
• Information you give us during onboarding and in your profile: sex, date of birth, current and target weight, training goals and pace, how often you train, whether you work with a trainer, how you heard about us, what gets in your way, diet preference, available equipment, training experience, what you want to accomplish in your own words, and any injuries you choose to note (including free-text notes and a pain level).
• Pregnancy, and the week if you provide it, only if you choose to tell us. This is never assumed or inferred, and is entirely optional. It is used to adjust the workouts and intensity we generate for you to your pregnancy stage -- it is never used to withhold a workout outright. You can clear it at any time in your profile.
• Menstrual cycle information, only if you choose to provide it: the start date of your last period and your typical cycle length. This is optional, is used only to adjust training guidance, and is not a fertility or ovulation tracker. You can clear it at any time.
• Photographs you take of gym or workout equipment, if you use the gym-photo feature. These are sent for equipment recognition and are NOT stored by us -- we keep only the resulting list of equipment after you confirm it.
• Photographs you choose to add of your current body and goal body, if you use that optional feature. Unlike gym-equipment photos, these ARE stored (so you can view your history and compare over time) in a private storage location only your account can access. You can delete them at any time in your profile.
• A photograph of a written training assignment, if you choose to add a custom goal by photographing it. It is read for its text and is not stored by us.
• Workouts you mark as complete, any feedback you write about them, and any note you add to a session.
• Nutrition information you enter: free-text descriptions of what you ate (typed or dictated), the ingredients and kitchen equipment you list when asking for a meal suggestion, and the resulting meal log.
• Daily affirmations shown to you, and any you keep or write yourself.
• Your daily mood check-in, if you use it.
• Account information depending on how you sign in: with Apple, a unique ID (and your email only if Apple shares it and you allow it); with Google, a unique ID and the email associated with your Google account; with email and password, the email address and password you choose. Passwords are never visible to us in plain text -- they are handled entirely by our authentication provider, Supabase.
• Your notification wake-time preference and marketing preference.
• Your subscription status and purchase history, handled by Apple and our paywall provider. We never receive your payment card details.
• App usage and interaction events (e.g. which screens you view and actions you take in the app), collected via our analytics providers, to understand how the app is used and to improve it. These are linked to your account so we can see how the app performs for a returning user over time; they never carry your email address or anything you have written.

How We Use Your Information

Your health and activity data is used to compute your daily training recommendation ("Rest", "Light Movement", "Moderate", or "Push Hard"), which is chosen by a fixed set of rules and involves no AI. It is also used, together with your profile, to generate the personalized workout plans, meal suggestions, and affirmations you request in the app, which do involve AI providers -- see the next section. We do not use your health data for advertising, do not sell it, and do not share it with anyone except the service providers listed below, solely to operate the app.

AI Processing and Your Consent

Some features work by sending your information to third-party AI providers, which process it on our behalf and return the generated text. We ask for your explicit consent before anything is sent to them for the first time, and we ask separately before any photograph is sent.

The two providers are Anthropic and OpenAI. Depending on the feature, what we send can include: your training goals and what you want to accomplish in your own words, sex, age, current and target weight, training experience and equipment, noted injuries including your free-text notes, pregnancy status and week, menstrual cycle phase, that day's health metrics (such as sleep, heart rate variability, resting heart rate, recovery or readiness), your recent workout history and the feedback you wrote about it, your meal descriptions, nutrition targets and what you have eaten today, your listed ingredients and kitchen equipment, your affirmation history, and the photographs described above.

We do not send your name, email address, postal address, or account identifier to either provider. Your data is not used to train their models.

If you decline, or later withdraw consent in your profile, we stop sending your data to these providers and the AI-powered features become unavailable. The rest of the app -- your daily training recommendation, your history, your dashboard, and workout tracking -- keeps working.

Where Your Data Is Stored

Recommendation data and connection tokens are stored with our backend provider, Supabase, using industry-standard encryption in transit (HTTPS) and access controls that restrict every record to your own account. Whoop and Oura access tokens are never exposed to the app itself.

Third-Party Services

The app relies on the following providers, each of which processes some of your data on our behalf:

• Apple (Sign in with Apple, HealthKit, subscription billing)
• Google (Sign in with Google, if you choose it)
• Whoop and Oura, if you connect them
• Supabase -- backend, database, and hosting
• Open-Meteo -- if you have entered a city, it receives that city and country name (and the coordinates they resolve to) so we can warn you about heat or cold before an outdoor session. It receives nothing else: no account identifier, no health data, and no device location -- only the place name you typed into your profile
• Anthropic -- generates workout plans, workout suggestions, meal suggestions, nutrition estimates from what you describe, and daily affirmations, from the context described above
• OpenAI -- recognizes equipment in gym photos, reads a photographed training assignment, writes exercise instructions, and, only if you've added both a goal-body and current-body photo, compares those already-stored photos to suggest which training emphasis may help close the gap between them. That comparison returns only a category-level suggestion -- never a numeric or clinical-sounding score.
• Superwall -- presents our subscription screens. It receives your account identifier, your subscription and trial status, and a small set of profile attributes (training goals, experience level, weekly session target, number of goals completed, and how much equipment you have).
• Firebase (Google) -- analytics on how the app is used
• PostHog -- a second analytics service processing the same app-usage events as Firebase, above

Each provider's use of data they process is governed by their own privacy policy in addition to this one.

Data Retention & Deletion

You can disconnect a wearable at any time from within the app, and delete your body photographs at any time from your profile. You can delete your account, and the data associated with it, from within the app; you can also contact us at the address below.

Children's Privacy

Soma is not directed at children under 14, and we do not knowingly collect data from children under 14.

Your Rights

Depending on where you live, you may have rights to access, correct, or delete your personal data. Contact us to exercise these rights.

Changes to This Policy

We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date above.

Contact Us

team@soma4health.com