Your health data

Consumer Health Data Privacy Policy

Effective October 13, 2026

Our promise

• We ask for your consent before collecting or processing your health information. We use it only for the purposes described here and disclose it only as described here, including to provide features you request or when the law requires. Where applicable law requires a separate choice to share, we ask first.
• We never sell your health information.
• We never use it for advertising or marketing.
• Koydo Life is for adults 18 and older.

Health information we collect, and why

Koydo Life asks for your explicit consent before it collects or processes health information, including your setup answers. That consent covers diet choices that may reveal your beliefs, and Care self-test results, which include your age and sex. If you don't agree, we don't save new health information. Until you've agreed, runs and other recordings on your Apple Watch stay on the watch and aren't uploaded.

Sharing with people is always a separate choice you make in Circles, Care or live sharing, and AI help asks for its own OK first.

The consent you give at setup covers only what's needed to run the tracker you sign up for. Each optional use asks for its own separate OK when you first use it, and you can turn each one off on its own: AI help, Circles and Care, live sharing, connecting a wearable, Apple Health or Health Connect access, and cycle tracking.

Here is what it can collect:

• Body details: your age, sex, height, weight and body composition (body-fat percentage and lean body mass).
• Activity: steps, active energy, workouts (exercises, sets, reps and weights), and runs and rides you record, plus walks and hikes on iPhone.
• From Apple Health or Health Connect, if you allow it: on iPhone, steps, active energy, weight, body-fat percentage, lean body mass, heart rate and heart rate variability; for runs, Apple Health also provides distance and your date of birth, which stays on your phone. On Android: steps, weight, body fat and lean body mass.
• Heart data: heart rate and heart rate variability, if you allow it from Apple Health, record a workout with your Apple Watch, or connect a service that sends it.
• Location during workouts: your precise location only while recording an outdoor run or ride (or, on iPhone, a walk or hike) or while planning a route on iPhone: the route of each session you record, and your live position during a run if you turn on live sharing.
• Food and diet: meals and drinks, water, fasting, recipes, and diet choices such as allergies or a halal or kosher diet. Some diet choices can reveal your beliefs.
• Medicines: names, doses, injection sites, side effects, notes and reminders.
• Lab results you import and confirm, on iPhone.
• Cycle tracking on iPhone, if you turn it on: the date your last period started and your usual cycle length.
• Care: check-ins (how you're feeling and an optional note) and self-test results, which include your age and sex, if you use Care.
• Sleep and soreness for the readiness check: if you enter them, they're sent once to our server to calculate your readiness score. We don't store them, on your phone or in your account.
• Data from a service you connect, such as a smart ring, a smart scale or a glucose monitor. For example: steps, sleep, readiness, heart rate, heart rate variability, weight, body composition or glucose.
• Photos of meals, nutrition labels and documents, when you use AI help with them. Your phone removes hidden details such as location first, and the photo is sent once in the request. Koydo Life doesn't store it in your account; OpenAI may retain the request for up to 30 days for abuse monitoring, subject to the exceptions described below under 'Companies that may receive it.'
• Voice recordings, when you log a meal by voice. We don't store them.
• Coach conversations: what you ask the AI coach, and the short notes it keeps to remember your conversation.
• What we work out from the above, such as your daily calorie and protein targets, your trends, and AI estimates of what's in a meal.

We use it to:

• run the features you use: your targets, dashboard, plans, history and coach;
• keep your data in sync across your devices;
• answer your requests with AI help, only when you've turned AI help on;
• share what you choose with the people you choose, in Circles, Care and live sharing;
• keep Koydo Life secure, apply usage limits and fix problems;
• meet our legal obligations.

Koydo Life is not a medical device and doesn't diagnose or treat any condition.

Where it comes from

• You: what you type, log, say or photograph in the app.
• Your phone and Apple Watch: your location while you record a workout, your heart rate when your Apple Watch records it, and the camera or microphone when you use them in the app.
• Apple Health and Health Connect, for the types of data you allow.
• Services you connect, for the data you allow them to send.
• Our own calculations, based on the information above.

Counting reps and checking your form use your camera on your phone. Those images never leave your phone.

Health information we share, and who receives it

We share it with service providers that run the features you use, with people or services you choose to share or sync it with, and when the law requires it. Here are the details.

People you choose

• Circle members see the updates you choose to post, such as a streak milestone or a check-in, and your progress in Circle challenges.
• Someone you ask to look out for you in Care sees what you choose: your daily check-in, whether you've taken your medicines (counts only, never the names), and your self-test results, which include your age and sex.
• The one person you pick for live sharing sees your position during that run, for up to 3 hours.

Health apps on your phone, if you allow it

• Apple Health (iPhone) receives dietary energy, water, weight, body composition and workouts, including a run's distance, energy and route.
• Health Connect (Android) receives weight, body composition and water.

Companies that may receive it

This is the full list of companies that may receive health information from Koydo Life, and how to contact each one about privacy. We keep it up to date, and the effective date at the top changes when it does. You can also ask us.

Service providers that process it for us

• Supabase: hosting, database, sign-in and file storage, in the United States. It holds your Koydo Life account and everything in it. Privacy contact: privacy@supabase.com · privacy policy.
• Cloudflare: runs our hourly clean-up job. The job holds a key to our database but only asks it to delete expired live-sharing positions and to retry queued deletion requests; what comes back is counts and statuses, not health information. Cloudflare also delivers coach audio and exercise images from our file storage, so it receives your device's internet address when the app downloads them. Privacy contact: Cloudflare privacy policy.
• OpenAI: AI features, only when AI help is on. It's our only AI provider. It receives what a feature needs, such as a photo, a voice recording, your message to the coach, or a short summary like today's calories or steps, with a scrambled code instead of your account ID. We don't add your account name or email to AI requests. Your message, photo or notes may include them if you provide them. We send text and photo requests with the setting that tells OpenAI not to store the request or its answer. OpenAI keeps them for up to 30 days to detect abuse, then deletes them, unless the law requires it to keep them longer or it needs them to protect its services or others from harm. It may also keep encrypted working data from a request for up to 24 hours to speed up similar requests. Voice recordings go to OpenAI's speech-to-text service; OpenAI says it doesn't retain voice recordings after transcription. OpenAI doesn't use API data to train its models. Privacy contact: dsar@openai.com · OpenAI privacy center.
• Apple: Sign in with Apple (if you choose it), App Store payments, Apple Health, and Apple Maps directions on iPhone (it receives the route points you tap). Privacy contact: Apple privacy contact.
• Google: Google sign-in (if you choose it), Google Play payments, Health Connect, and ML Kit on Android, which reads barcodes, text and body poses and finds faces to blur in training videos you record, on your phone. ML Kit may send Google basic usage information about these features, such as device model, app version and performance, and the face-finding model is downloaded from Google the first time you use it. Privacy contact: Google privacy requests · privacy policy.
• RevenueCat: your subscription status only, linked to a random account ID. It receives no health data, but it does show that you use Koydo Life. Privacy contact: compliance@revenuecat.com · privacy policy.

Others, when you use a feature

• Open Food Facts, a public food database: a barcode number only, on iPhone and Android, when our own food database doesn't know it. Privacy contact: privacy@openfoodfacts.org · privacy policy.
• YouTube (Google): plays the videos in Watch & Learn in its privacy-enhanced mode. It may still use cookies or collect information when you play a video. Privacy contact: Google privacy requests · privacy policy.

Connected services, only if you connect it

A service you connect receives what's needed to link your account, then sends us the data you allow.

• Oura. Privacy contact: dataprotection@ouraring.com · privacy policy.
• WHOOP. Privacy contact: privacy@whoop.com · privacy policy.
• Fitbit (Google). Privacy contact: data-protection-office@fitbit.com · privacy policy.
• Polar. Privacy contact: privacy@polar.com · privacy policy.
• Withings. Privacy contact: privacy@withings.com · privacy policy.
• Dexcom. Privacy contact: privacy@dexcom.com · privacy policy.
• Garmin. Privacy contact: privacy@garmin.com · Garmin privacy rights.
• Strava (listed on Android). Privacy contact: DPO@strava.com · privacy policy.

Affiliates

We have no affiliates that receive your health information.

When the law requires it

We may disclose health information when the law requires it, for example to comply with a valid court order.

How long we keep it

• We keep your health information for as long as you have a Koydo Life account, unless you withdraw your consent first. AI answers are cached for about 5 minutes; an expired cached copy is deleted the next time you use AI help.
• When you delete an entry in the app, we erase its contents from your Koydo Life account as soon as your phone syncs the change. A blank marker stays so your other devices know it was deleted. On your phone, the entry disappears at once, and its copy may stay in the app's storage until the app next refreshes that day, you withdraw your consent, you delete your account, or you delete the app. Deleted entries don't count toward your readiness score or insights, and your data export leaves them out.
• When you withdraw your consent or delete your account, we erase health information from your Koydo Life account and your phone right away, including any photos and documents stored by earlier versions of the app.
• Earlier versions of the app saved photos used with AI help in your private storage. Photos saved by earlier versions are deleted when you withdraw consent or delete your account. Some photos associated with accounts deleted before the cleanup fix remain in storage; write to privacy@koydo.app to ask us to remove them. If you still use an earlier version, it keeps saving photos that way until you update.
• This doesn't delete information already sent to OpenAI, which retains it for the periods and subject to the exceptions described under "Companies that may receive it", or copies in backups, which are removed within 7 days.
• Your Apple Watch deletes any recordings it's still holding the next time the Koydo Life app on it runs.
• Data you already wrote to Apple Health or Health Connect stays there, under your control. So do training videos you saved to your Android phone's Movies folder.
• We don't store voice recordings. The app deletes each one from your phone when its request is finished.
• The last position is deleted when you stop sharing or finish your run. If the 3-hour limit is reached first, the person can no longer see it, and we delete the stored position within an hour after the 3-hour limit.

Your rights, and how to use them

You can use these rights wherever you live, free of charge.

See it and get a copy

• In the app, go to Settings → Export my data. You get a JSON file and a CSV file with what your account holds about you.
• For photos stored by earlier versions of the app, or anything you think is missing, email privacy@koydo.app.
• You can also ask us whether we collect or share your health information. The companies that may receive it, and how to contact each one, are listed above under "Companies that may receive it". You can also ask us for that list.

Correct it

• You can change your profile and most of what you've logged in the app.
• To correct anything else, email privacy@koydo.app.

Delete it

• In the app, go to Settings → Delete my account. It takes effect right away and can't be undone. Your phone erases its copy too, and then signs you out.
• If you can't use the app, email privacy@koydo.app from the address on your account.
• When you delete your account, we ask RevenueCat, our subscription provider, to delete its record of you. If that request fails, we retry it automatically.
• We can't ask OpenAI to delete requests already sent. OpenAI retains them for the periods and subject to the exceptions described above under "Companies that may receive it", then deletes them.
• Data the app wrote to Apple Health or Health Connect stays there, under your control.
• Purchase records stay with Apple or Google under their own policies.

Withdraw your consent

• In the app, go to Settings → Health information consent and choose Withdraw health-data consent at any time. We'll stop processing health information based on your consent and delete it from your account. You don't have to delete your account.
• We erase it from your account and your phone: everything you've logged or synced, your coach memory notes, your records of AI use, the live shares you started, your posts and challenge progress in Circles, any photos and documents stored by earlier versions of the app, and the health details in your profile. We stop any Care sharing and disconnect any connected services.
• We keep your account and sign-in, your subscription, the record of your consent choices, your family plan and the Circles you belong to.
• The app asks for your consent again before you can save anything new.
• You can also email privacy@koydo.app.
• You can stop a single use at any time:
  • turn off AI help in Settings;
  • change Apple Health or Health Connect access in their own settings;
  • disconnect a wearable or other connected service in Koydo Life;
  • turn off cycle tracking (iPhone), which deletes your cycle details;
  • stop live sharing;
  • remove someone's Care access;
  • leave a Circle, which deletes your posts there.

How we handle your request

• We check that the request is really yours, usually by asking you to write from the email address on your account.
• We respond without undue delay and within the deadline that applies to your request.
• Where GDPR or UK GDPR applies, we respond within one month; where the law permits, we may extend by up to two further months and will explain why within the first month.
• For requests under Washington, Nevada or Connecticut law, we respond within 45 days; where the law permits, we may extend once by up to 45 days and will tell you within the first 45 days.

Appeal a decision

• If we turn down your request, we'll tell you why.
• You can appeal by writing to privacy@koydo.app with "Appeal" in the subject line.
• We'll answer your appeal in writing within 45 days and explain what we decided.
• If we still say no, you can contact your state's Attorney General: Washington, Nevada or Connecticut.

Washington, Nevada and Connecticut

• Washington: this page is our Consumer Health Data Privacy Policy under the My Health My Data Act.
• Nevada: this page is our consumer health data privacy policy under Nevada law. Google ML Kit may send Google basic usage information about barcode, text, body-pose and face-detection features. YouTube may use cookies or collect information when you play a video, as described above. We do not sell your health information or use it for advertising.
• Connecticut: We process your consumer health data only with your consent, for the purposes described above, and disclose it as described above or when the law requires.

Changes to this policy

When we change this page, we update the effective date at the top. If a change is material, we tell you in advance, as Section 12 of the Koydo Privacy Policy describes.

Contact

Email privacy@koydo.app. Koydo Life is provided by KOYDO LLC.