Privacy Policy

1. Introduction and Scope

The Fit Lens LLC ("we," "us," or "our") operates The Fit Lens, a mobile application and related services (collectively, the "Services") that help users track body composition, nutrition, activity, sleep, and overall health progress. This Privacy Policy describes how we collect, use, disclose, and protect the personal data, including sensitive health and body composition data, of users of the Services.

By downloading, installing, or using the Services, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree, do not use the Services.

This Policy applies to:

• The Fit Lens mobile application (Android)
• Any associated websites, including thefitlens.com
• Any future iOS or web versions of the Services

2. Personal Data We Collect

We collect personal data, including sensitive health information, in the following ways:

2A. Data You Provide Directly

When you register for an account or use the Services, you may provide:

• Name, email address, and password
• Date of birth, biological sex, height, and starting/goal weight
• Food logs, meal entries, and nutritional information
• Manual body composition entries (weight, body fat percentage, etc.)
• Manual workout entries (activity type, duration, and optional effort or calorie estimates)
• GLP-1 medication and dosage information (if you use the GLP-1 tracking features)
• Self-reported GLP-1 side effect logs (symptom type, severity, date, and optional notes)
• Joint, injury, or physical limitation information you provide during onboarding or in your profile
• Feedback, survey responses, or support communications

2B. Data from Bluetooth-Connected Smart Scales and Devices

The Services support integration with Bluetooth Low Energy (BLE) smart scales and compatible hardware, including but not limited to Renpho, Etekcity, and Welland devices. When you connect such a device, we receive body composition measurements transmitted by that device, which may include:

• Weight
• Body fat percentage, lean body mass, muscle mass, bone mass, and water percentage
• Segmental body composition measurements (where supported by the connected device)

We receive this data directly from your device over Bluetooth. We do not control the device manufacturer’s own data collection practices. Please review the privacy policy of your scale or device manufacturer separately.

2C. Data from Android Health Connect

With your explicit permission, the Services access health and fitness data stored in Android Health Connect. Depending on the permissions you grant, this may include:

• Steps and distance
• Active and total calories burned
• Heart rate and heart rate variability (HRV)
• Blood oxygen saturation (SpO2)
• Respiratory rate
• Blood pressure
• VO2 max
• Body fat percentage and lean body mass (sourced from wearable devices via Health Connect)
• Sleep duration and sleep stage data

You control which Health Connect data types the Services may access through your Android device’s Health Connect settings. You may revoke permissions at any time.

2D. Inferences and Derived Data

We use your data to generate derived insights, including:

• Composite Body Score: a proprietary weighted score calculated from your body composition measurements, activity, nutrition, and sleep data
• AI coaching recommendations: structured recommendations in the areas of nutrition, activity, and sleep and recovery, generated by our AI coaching system, which may incorporate joint or physical limitation information you have provided alongside your logged activity
• Clinical threshold alerts: automated flags when your data crosses clinically referenced thresholds (e.g., body fat percentage, blood pressure, SpO2) that may warrant attention
• Health summary PDF: a shareable document summarizing your health data trends, intended for optional sharing with a healthcare provider

2E. Device and Technical Data

We automatically collect certain technical information when you use the Services, including:

• Device model and operating system version
• App version and build information
• IP address
• Crash reports and diagnostic logs
• Feature usage and screen interaction data

3. How We Use Your Personal Data

We use the personal data we collect to:

• Provide, operate, and maintain the Services, including body composition tracking, nutrition logging, AI coaching, and wearable integrations
• Generate your Composite Body Score, coaching recommendations, clinical threshold alerts, and health summary PDF
• Personalize your experience and coaching recommendations
• Send you account-related communications, including notifications and service updates
• Respond to your support requests
• Analyze how users interact with the Services to improve features and user experience
• Debug, troubleshoot, and ensure the security and integrity of the Services
• Detect and prevent fraud, unauthorized access, and other prohibited activity
• Comply with our legal obligations
• With your explicit consent: share your health summary or data with a healthcare provider of your choosing

We do not use your health or body composition data to serve you targeted advertising. We do not sell your personal data to third parties for monetary compensation.

4. How We Share Your Personal Data

We share personal data only in the following circumstances:

4A. Service Providers and Infrastructure

We use third-party service providers to operate the Services. These providers access personal data only to perform services on our behalf and are contractually prohibited from using your data for their own purposes, under Data Processing Agreements that require them to protect your data consistent with this Policy. These include:

• Cloud hosting and database infrastructure (Supabase)
• Mobile build and deployment infrastructure (Expo Application Services / EAS)
• AI and machine learning processing services (used for coaching recommendations and AI Chef features)
• Crash reporting and diagnostics services
• Payment processing (Google Play In-App Billing)

4B. Healthcare Provider Sharing (User-Initiated)

The Services offer a ‘Share with Doctor’ feature that allows you to generate and share a PDF health summary with a healthcare provider of your choice. This sharing occurs only upon your explicit, affirmative action and is solely your choice. We do not independently transmit your data to any healthcare provider.

4C. Business Transfers

In the event of a merger, acquisition, sale of assets, bankruptcy, or similar business transaction, your personal data may be transferred to a successor entity. We will provide notice of any such transfer as required by applicable law.

4D. Legal Obligations and Safety

We may disclose personal data if we believe in good faith that such disclosure is necessary to:

• Comply with a valid legal obligation, subpoena, court order, or government request
• Protect the rights, property, or safety of The Fit Lens LLC, our users, or the public
• Detect, investigate, or prevent fraud, security incidents, or illegal activity

4E. With Your Consent

We may share your personal data for any other purpose with your explicit prior consent.

4F. What We Do Not Do

We do not:

• Sell your personal data to third parties for monetary compensation
• Share your health, body composition, or biometric data with advertisers
• Use your health data to serve you targeted or behavioral advertising
• Disclose your data to your employer, insurer, or any party that could use it to make decisions about you

5. Sensitive Health and Body Composition Data

The Services are designed specifically for health and body composition tracking. As a result, the data you provide and that we collect is, by its nature, sensitive health information. We treat all health-related data with heightened care and protection.

Specifically:

• We collect body composition measurements, biometric data, and health metrics only to provide and improve the Services
• We do not use health data for advertising or marketing profiling
• We do not disclose health data to third parties except as described in Section 4 above
• We apply industry-standard technical and organizational safeguards to protect health data at rest and in transit

6. Data Retention

We retain your personal data for as long as necessary to:

• Maintain your account and provide the Services
• Comply with our legal obligations
• Resolve disputes and enforce our agreements
• Conduct internal analytics and improve the Services

When you delete your account, we will delete or anonymize your personal data within a commercially reasonable time, except where retention is required by law or legitimate business necessity (e.g., billing records, legal holds). We will retain de-identified or aggregated data, which can no longer be linked to you, for internal analytics and product improvement.

7. Security and Data Breach Notification

We implement commercially reasonable technical and organizational measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction. These include:

• Encryption of data in transit (TLS/HTTPS)
• Encryption of data at rest within our database infrastructure
• Role-based access controls limiting personnel access to personal data
• Authentication and session management controls within the Services

No method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

Breach Notification

In the event of a data security breach, we will notify affected users and applicable regulatory authorities as required by applicable law, including:

• The FTC Health Breach Notification Rule (16 C.F.R. Part 318, as amended effective July 29, 2024), which requires notification to affected individuals and the FTC within 60 calendar days of discovery of a breach affecting 500 or more individuals. For breaches affecting fewer than 500 individuals, we will notify affected individuals within 60 days of discovery. The Fit Lens almost certainly qualifies as a ‘vendor of personal health records’ or ‘PHR-related entity’ under the amended HBNR given that it draws health data from multiple sources (user input, BLE scales, and Android Health Connect).
• Arizona Data Breach Notification Law (A.R.S. § 18-552), which requires notification to affected Arizona residents in the most expedient manner possible and without unreasonable delay following discovery of a breach involving personal information.
• Other applicable state breach notification laws based on the location of affected users.

8. Third-Party Services and Integrations

The Services integrate with third-party platforms and devices. When you connect a third-party service or device to the Services, you are subject to that third party’s privacy policy and terms of service in addition to this Policy. We are not responsible for the privacy practices of third parties. Third-party integrations currently supported or planned include:

• Android Health Connect (Google): governs access to health data stored on your device
• Bluetooth smart scales (Renpho, Etekcity, Welland, and others), governed by respective manufacturer privacy policies
• Samsung Galaxy Watch / Samsung Health: governed by Samsung’s privacy policy
• Open Food Facts: open-source food database; no personal data is transmitted to Open Food Facts

9. Artificial Intelligence Features

The Services use artificial intelligence and machine learning to provide the following features:

• Coach recommendations (nutrition, activity, sleep and recovery recommendations tailored to your data)
• AI Chef (personalized recipe and meal suggestions based on your nutritional profile)
• Composite Body Score calculation
• Clinical threshold alert generation
• GLP-1 side effect education content: general informational summaries drawn from published clinical trial literature

These AI features process your personal data, including health and body composition data, to generate personalized recommendations. We use third-party AI/ML service providers to power certain features. These providers are contractually bound to use your data only to deliver the services to us and are not permitted to use your data for their own AI training without your consent.

AI-generated coaching recommendations and health summaries are informational only and do not constitute medical advice. Always consult a qualified healthcare professional before making changes to your health, nutrition, or fitness regimen. GLP-1 side effect education content is general informational material and is not personalized to you; it does not diagnose any condition, suggest medication dosing changes, or compare the relative merits of different medications.

10. Your Rights and Choices

10A. Access, Correction, and Deletion

You may access and update certain personal data directly within the Services through your account settings. You may also request that we:

• Provide you with a copy of the personal data we hold about you
• Correct inaccurate personal data
• Delete your personal data (subject to legal retention obligations)

To submit a request, contact us at support@thefitlens.com.

10B. Data Portability

Where technically feasible, we will provide your personal data in a machine-readable, portable format upon request.

10C. Withdrawal of Health Connect Permissions

You may revoke the Services’ access to Health Connect data at any time through your Android device’s Health Connect settings. Revoking permissions will limit certain features of the Services that depend on that data.

10D. Account Deletion

You may delete your account at any time by contacting us at support@thefitlens.com or through account settings within the Services. Upon deletion, we will remove your personal data subject to our retention obligations described in Section 6.

10E. Marketing Communications

If we send marketing emails, you may unsubscribe via the opt-out link in any such email. We will continue to send transactional and service-related communications.

11. State-Specific Privacy Rights

11A. California Residents (CCPA/CPRA)

California residents have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know: request disclosure of the categories and specific pieces of personal information we have collected, used, disclosed, or sold
• Right to Delete: request deletion of personal information we have collected, subject to exceptions
• Right to Correct: request correction of inaccurate personal information
• Right to Opt-Out of Sale or Sharing: we do not sell personal data or share it for cross-contextual behavioral advertising
• Right to Limit Use of Sensitive Personal Information: you may request that we limit use of your sensitive personal information (including health data) to purposes necessary to provide the Services
• Right to Non-Discrimination: we will not discriminate against you for exercising your CCPA rights

To submit a CCPA request, contact us at support@thefitlens.com. We will respond within 45 days. We may need to verify your identity before processing your request.

11B. Washington Residents (My Health My Data Act)

Washington State’s My Health My Data Act (RCW Chapter 19.373, effective March 31, 2024) provides Washington residents with rights specific to consumer health data, including body composition, biometric, and activity data collected by the Services. The Act applies to any entity that processes consumer health data about Washington residents, regardless of company size or revenue thresholds.

Washington residents have the following rights:

• Right to confirm whether we collect, share, or sell your consumer health data
• Right to access your consumer health data, including a list of all third parties with whom it has been shared
• Right to delete your consumer health data
• Right to withdraw consent to the collection or sharing of consumer health data

To exercise your Washington consumer health data rights, contact us at support@thefitlens.com.

Important: The Washington MHMD Act requires affirmative opt-in consent, separate from any general terms of use acceptance, before we may collect or share consumer health data beyond what is strictly necessary to provide the Services you request. This consent must be obtained prior to collection and must clearly disclose the categories of data collected, the purpose, and how consent may be withdrawn.

11C. Nevada Residents (Consumer Health Data Privacy Act)

Nevada’s Consumer Health Data Privacy Act (NRS Chapter 603C, effective March 31, 2024) provides Nevada residents with rights regarding consumer health data.

• Right to confirm whether we have collected, disclosed, or sold your consumer health data
• Right to delete your consumer health data
• Right to withdraw consent

To exercise your Nevada consumer health data rights, contact us at support@thefitlens.com.

11D. Other State Residents

Residents of Colorado, Connecticut, Virginia, Texas, Oregon, and other states with comprehensive privacy laws may have rights to access, correct, delete, and opt out of certain processing of their personal data. Contact us at support@thefitlens.com to exercise applicable rights.

12. Children’s Privacy

The Services are not directed to individuals under the age of 18. We do not knowingly collect personal data from anyone under 18. If we become aware that we have collected personal data from a minor without verifiable parental consent, we will take steps to delete that information promptly.

If you believe we have inadvertently collected data from a minor, please contact us at support@thefitlens.com.

13. Data Transfer and Storage

The Services are operated in the United States. If you access the Services from outside the United States, your personal data will be transferred to and processed in the United States, where data protection laws may differ from those in your jurisdiction. By using the Services, you consent to this transfer and processing.

14. Changes to This Privacy Policy

We reserve the right to update this Privacy Policy at any time. When we make material changes, we will update the effective date at the top of this Policy and notify you through the Services or via email. Your continued use of the Services after the effective date of the updated Policy constitutes your acceptance of the changes.

15. How to Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

The Fit Lens LLC

Email: support@thefitlens.com

Website: thefitlens.com

16. Data Collection and Use Summary Table

The following table summarizes the categories of personal data we collect, our purposes for collection, and the categories of third parties to whom such data may be disclosed. This table is provided to satisfy disclosure requirements under the CCPA, Washington MHMD Act, and other applicable state privacy laws.

17. Washington Consumer Health Data Privacy Notice

Updated: June 27, 2026

This Washington Consumer Health Data Privacy Notice supplements the information in the The Fit Lens Privacy Policy. It applies solely to Washington State consumers and applies only to personal information defined as "consumer health data" subject to the Washington My Health My Data Act (RCW Chapter 19.373).

What Does This Notice Cover?

This Notice describes what consumer health data we collect, how we use and share it, and the rights you have regarding your consumer health data. Consumer health data is a subset of personal information that identifies your past, present, or future physical or mental health status.

What Categories of Consumer Health Data Do We Collect?

We may collect the following categories of consumer health data:

• Body composition measurements (weight, body fat percentage, lean body mass, muscle mass, bone mass, water percentage, segmental measurements)
• Biometric information from wearable devices (heart rate, HRV, SpO2, respiratory rate, blood pressure, VO2 max)
• Activity and fitness data (steps, calories, sleep duration and stages)
• Nutritional data (food logs, macro and calorie intake)
• Self-reported GLP-1 medication, dosage, and side effect information
• Self-reported joint, injury, or physical limitation information
• Information derived or inferred from the above data, including your Composite Body Score, AI coaching recommendations, and clinical threshold alert history

Purposes for Collecting Consumer Health Data

We collect and use consumer health data to:

• Provide body composition tracking, nutrition logging, AI coaching, and wearable integrations
• Generate your Composite Body Score, coaching recommendations, clinical threshold alerts, and health summaries
• Exchange data with connected devices and Android Health Connect
• Provide customer support
• Fulfill legal functions and obligations
• Ensure security and integrity of our systems
• For other purposes with your explicit consent

Who Do We Share Consumer Health Data With?

We share consumer health data only with:

• Infrastructure and hosting providers (Supabase) who process data solely to operate the Services
• AI/ML service providers who process data to generate coaching recommendations and AI Chef features, subject to Data Processing Agreements prohibiting use for their own purposes
• Healthcare providers: only upon your explicit, user-initiated request via the Share with Doctor feature
• Government agencies or legal bodies as required by law

We Do Not Sell Consumer Health Data

The Fit Lens LLC does not sell consumer health data as defined by the Washington My Health My Data Act.

Your Washington Consumer Health Data Rights

If you are a Washington State resident, you have the right to:

• Confirm whether we are collecting, sharing, or selling consumer health data about you
• Access your consumer health data, including a list of all third parties and affiliates with whom we have shared or sold it
• Delete your consumer health data
• Withdraw your consent to the collection or sharing of consumer health data

To exercise these rights, contact us at: support@thefitlens.com

Consent

We obtain your affirmative, opt-in consent before collecting consumer health data beyond what is strictly necessary to provide the Services you request. Consent for collection and consent for sharing are obtained separately. Consent may not be bundled with acceptance of our Terms of Service or this Privacy Policy.

How to Appeal

You may appeal our decision with respect to a request by contacting us at: support@thefitlens.com.

Changes to This Notice

We will notify you of significant changes to this Notice. Please check this Notice periodically for updates.

18. Nevada Consumer Health Data Privacy Notice

This Nevada Consumer Health Data Privacy Notice supplements the information in the The Fit Lens Privacy Policy. It applies solely to Nevada consumers and applies only to personal information defined as "consumer health data" subject to the Nevada Consumer Health Data Privacy Act (NRS Chapter 603C).

What Categories of Consumer Health Data Do We Collect?

We may collect or receive the following categories of consumer health data:

• Body composition measurements and biometric data
• Health and fitness data from wearable devices and Android Health Connect
• Nutritional and food log data
• Self-reported GLP-1 medication, dosage, and side effect information, and joint/injury or physical limitation information
• Data derived or inferred from the above, including your Composite Body Score and AI coaching recommendations

Purposes for Collecting Consumer Health Data

We collect and use consumer health data to provide The Fit Lens Services, exchange data with connected devices, provide customer support, fulfill legal obligations, ensure system security, and for other purposes with your consent.

Who Do We Share Consumer Health Data With?

We share consumer health data only with service providers operating under Data Processing Agreements, healthcare providers upon your explicit request, and government agencies as required by law. We do not sell consumer health data.

Your Nevada Consumer Health Data Rights

Nevada residents have the right to: (1) confirm whether we have collected your consumer health data; (2) confirm whether we have disclosed or sold your consumer health data; (3) delete your consumer health data; and (4) withdraw your consent.

Contact us at: support@thefitlens.com