This Privacy Policy explains how Long Road Fitness LLC ("Long Road Fitness," "we," "us," or "our") collects, uses, discloses, and protects personal information when you use the Long Road Fitness mobile application, web services, and related support services (the "Services").
Health and wellness information receives additional treatment described in our Consumer Health Data Privacy Notice. That notice is part of this Privacy Policy.
1. Information We Collect
Account and contact information
- Name, email address, authentication records, account identifiers, and account status.
- Support requests, feedback, food or equipment submissions, and other messages you send us.
Profile, fitness, nutrition, and wellness information
- Age, biological sex, height, weight, body-fat percentage, body measurements, goals, target dates, and progress history.
- Workouts, exercises, equipment, sets, repetitions, load, effort, substitutions, completion history, schedule, and training preferences.
- Foods, recipes, meal plans, calories, nutrients, dietary preferences or restrictions, foods to avoid, hydration, and barcode searches.
- Sleep, steps, energy, stress, heart-rate variability, resting heart rate, and weekly check-in responses.
- Optional medications, supplements, adherence, side effects, medical conditions, laboratory values, movement limitations, and professional restrictions.
- Long Road Coach conversations, plan feedback, generated plans, recommendations, and actions you approve or dismiss.
Photos and media
- Optional avatar and progress photos, including the date and pose labels you assign.
- Camera or photo-library access only when you choose a feature that needs it and grant device permission.
Progress photos are stored in private storage and delivered through time-limited authenticated links. They are not sent to our AI provider. We do not use progress photos to create face geometry, biometric templates, or facial-recognition identifiers.
Device and service information
- Device platform, app version, push-notification token, notification preferences, IP address, request metadata, and security or diagnostic logs.
- Session and authentication tokens. On supported mobile devices, local session material is protected using operating-system secure storage.
2. How We Collect Information
We collect information directly from you, from your activity in the Services, from calculations and inferences needed to provide coaching features, and from service providers that support the Services. If we later add a device-health integration, we will request device permission and provide any additional disclosure required before collecting that data.
3. How We Use Information
- Authenticate accounts and provide, maintain, secure, and troubleshoot the Services.
- Calculate targets and create, explain, and adapt workout and meal plans.
- Track progress, display history, deliver reminders, and support weekly coaching reviews.
- Personalize AI-powered Long Road Coach responses using information relevant to your request and goals.
- Respond to support, enforce our Terms, prevent fraud or misuse, and comply with law.
- Improve reliability and product quality using operational data. We do not use health data for advertising.
4. AI Processing
Long Road Fitness uses Anthropic's Claude API to generate coaching conversations, workout and meal plans, plan explanations, and related insights. With your explicit permission, we may send Anthropic the profile, goals, training, nutrition, medication, supplement, condition, lab, limitation, check-in, and conversation information relevant to the feature you request. We do not send progress photos to Anthropic.
AI output can be inaccurate or incomplete and is not medical advice. Plan-changing recommendations use product safeguards and, where indicated in the App, require your action or approval.
5. When We Disclose Information
We disclose information only as described here and in the Consumer Health Data Privacy Notice:
- Supabase provides authentication, database, and file-storage infrastructure.
- Anthropic processes the information described above to provide AI features after you consent.
- Vercel hosts server-side application services and may process request and diagnostic data.
- Resend processes email addresses and message content for transactional and support email.
- FatSecret receives food, barcode, and recipe queries to return nutrition data. We do not intentionally include your identity or account health profile in those queries.
- Expo, Apple, and Google may process device tokens and delivery metadata for push notifications and platform services.
- Professional advisers, authorities, or transaction parties when reasonably necessary for legal compliance, security, protecting rights, or a corporate transaction, subject to applicable law.
We do not sell personal information or consumer health data. We do not share it for cross-context behavioral advertising or targeted advertising, and we do not use health information to build advertising profiles.
6. Retention and Deletion
We generally retain account information and user content while your account is active. Operational and security logs are retained only as reasonably necessary for security, debugging, and legal compliance. Service providers may retain encrypted backups for a limited period under their standard recovery cycles.
You can initiate account deletion in the App. Your account is deactivated immediately and scheduled for permanent deletion after a 30-day recovery period. If you do not cancel during that period, active account data and associated progress photos are deleted. We may retain limited records when required to establish, exercise, or defend legal claims, comply with law, or document a completed privacy request.
7. Security
We use authentication, access controls, row-level database policies, encrypted transport, private photo storage, short-lived photo links, and other administrative and technical safeguards appropriate to the information we process. No system is completely secure. If a qualifying breach occurs, we will provide notices required by applicable law, including the FTC Health Breach Notification Rule where applicable.
8. Your Choices and Rights
- Review and correct profile information through the App.
- Choose whether to upload photos or enable camera, photo, or notification permissions.
- Withdraw future AI-processing or consumer-health-data consent by contacting us. Some personalized features cannot operate without the processing they require.
- Request access, correction, deletion, or a copy of personal information by contacting us.
- Delete your account through the App. We will not unlawfully discriminate against you for exercising privacy rights.
We may need to verify your identity before completing a request. Authorized agents may submit requests where permitted by law, subject to verification of their authority. You may appeal a denied consumer health data request by replying to our decision and writing "Privacy Appeal" in the subject line.
9. HIPAA and Health Information
Long Road Fitness is a consumer wellness service, not a healthcare provider, health plan, or medical-record system. Information you enter is generally not protected by HIPAA unless we are acting on behalf of a HIPAA covered entity under a separate written arrangement. Other consumer-protection, health-data, security, and breach-notification laws may still apply.
10. Children
The Services are not directed to children under 13. We do not knowingly collect personal information from a child under 13 without legally valid authorization. Contact us if you believe a child has provided information in violation of this policy.
11. U.S. Processing and Changes
Long Road Fitness is based in the United States. Our providers may process information in the United States and other locations where they operate. We may update this Policy as the Services or law changes. We will provide additional notice and request new consent when a material change requires it.
12. Contact Us
Long Road Fitness LLC
Email: privacy@longroadfitness.com