Consumer Health Data Privacy Policy

Effective date: October 14, 2026 · Last updated: October 15, 2026 · For residents of Washington and Nevada

This Consumer Health Data Privacy Policy explains how KKC Labs (케이케이씨 랩스; "GYMKC" or the "Operator") collects, uses, shares, and processes consumer health data as defined by the Washington My Health My Data Act (RCW 19.373) and Nevada law (NRS 603A.400 to 603A.550), and how you can exercise your rights. It supplements our Privacy Policy, which also applies.

1. Consumer health data we collect and how we use it

We collect consumer health data only to the extent necessary to provide the features you request in the App, and we use it only for the purposes described below.

• Advance health check (optional): the items you select during onboarding (chest pain, dizziness or fainting, a diagnosis of heart disease or high blood pressure or taking medication for it, other chronic conditions, and recent bone, joint, or muscle problems) and, only if you select female as your gender, whether you are pregnant or postpartum and the stage of pregnancy. We use it only to make exercise intensity more conservative and to choose exercises (for example, replacing exercises done lying down or face down during pregnancy or after childbirth). It is used only by the App's internal rules and is never sent to AI providers. The App asks for your separate consent before storing these items and records the time of your consent. Postpartum information is not used for prescriptions after 12 weeks.
• Injury and caution areas (muscles and joints) in your profile: used to choose exercises and adjust intensity, and sent to our AI providers as part of your profile when you request AI coaching.
• Condition check-ins (sleep, motivation, pain, and stiffness by body part): used to adjust session intensity automatically and to manage recovery, and sent to our AI providers when you request AI coaching.
• Body records (height, weight, body composition, and chest, arm, and thigh circumferences): used to show your body change trends and to calculate prescriptions, and sent to our AI providers when you request AI coaching. Progress photos are stored only on your device and are never sent to our server.
• Fitness self-assessment (optional): your strength self-rating, chair stand time and repetitions, push-up level, sit-and-reach distance, and whether you can stand on one leg. Used only to decide the first week's difficulty and starting movements; never sent to AI providers.
• Data from Health Connect or Apple Health (only the types you permit): exercise sessions, heart rate, active calories, sleep, exercise distance, and calories burned. Processed only on your device to suggest your readiness at the start of a session and to show activity and analysis screens. In workouts where you enter distance and time, such as cardio, the App automatically fills empty distance and time fields with the values of a workout session recorded at the same time, tells you where they came from, and lets you undo it; tapping Import does the same. When you complete the set, only the distance and time become part of that workout record on our server. Values you undo or delete are not stored, and heart rate and active calories are never sent.

The App's prescriptions (weights, repetitions, and rest) and readiness suggestions are derived from the data above. We do not use consumer health data for advertising or marketing, and the advance health check, body composition, and progress photos are excluded from the statistics we use to improve the service.

2. Sources

• You, when you enter it in the App.
• Health Connect or Apple Health on your device, only for the data types you permit.
• The App itself, which derives prescriptions and readiness suggestions from the data above.

3. Sharing

We do not sell consumer health data, and we do not share it with third parties or affiliates (we have no affiliates), except that, if you choose to, we show it to the coach of a crew you join (see ‘Crew coach’ below). To provide the features you request, the following service providers process it on our behalf, only for that purpose:

• Cloudflare: hosting, database, and AI coaching (Workers AI)
• Google: AI coaching (Gemini)
• Google (Firebase Cloud Messaging) and Apple (Apple Push Notification service): delivering notifications. If you show your workouts to a crew coach, notifications sent to that coach can include your nickname, how many days you have gone without training, and figures from the previous week's crew summary

Crew coach. If you join a crew and turn on ‘Show my workouts to the coach’ (and, separately, ‘Also show body weight and measurements’), the Member who created that crew can see your workout records (and body weight) in the App, as described under ‘What a crew coach can see’ in Section 1 of the Privacy Policy. This is a separate choice you make for each crew. You can turn it off anytime under ‘My sharing’ on the Crews screen, and the coach then can no longer see it (notifications already delivered to the coach stay in the coach's inbox and are deleted within 7 days). Workout notes, pain logs (and adjustments made because of pain), condition check-ins, and the health pre-screening are never shown to a coach, and workout volume is shown only if you also show your body weight.

At your direction, the App also records your completed strength sessions and their calories in Health Connect on your device. We do not send consumer health data to AppsFlyer or to advertising media, and no third party collects consumer health data over time or across websites or apps when you use our App or website.

4. How we process and protect it

Consumer health data is stored on our server (Cloudflare D1), separated by account, with a copy on your device so that you can work out offline. All communication is encrypted with HTTPS. Within GYMKC, only the Operator can access it, and only to provide and support the service, except the records you choose to show the coach of a crew (Section 3). We keep it while your account exists. When you delete your account, it is deleted from our server immediately, and copies remaining in backups for disaster recovery are deleted in sequence within 30 days (Section 6 of the Privacy Policy).

5. Your rights

• Confirm whether we collect, share, or sell consumer health data about you, and access it, including a list of the third parties and affiliates with whom we have shared or sold it.
• Withdraw your consent, and ask us to stop collecting or sharing consumer health data about you. Some features need this data and may not be available if you do so.
• Ask us to delete consumer health data about you. We delete it from our records and notify our service providers of your request.
• Review and correct it. You can change most of it yourself in the App, and you can export your workout records in Settings › Data & sync.

6. How to make a request

Email support@gymkc.org from the email address of your GYMKC account, with the subject "Consumer health data request". If we cannot verify that the request comes from you, we may ask for the information needed to verify it. We respond without undue delay and within 45 days of receiving your request. If reasonably necessary, we may extend this by up to 45 more days, and we will tell you so, with the reason, within the first 45 days. Responses are free of charge up to twice a year. You can also delete your account yourself in the App (Settings → Delete account) or at gymkc.org/delete-account.

7. Appeals

If we decline to act on your request, you may appeal by replying to our decision or by emailing support@gymkc.org with the subject "Consumer health data appeal". Within 45 days of receiving your appeal, we will tell you in writing what action we took or did not take and why. If we deny your appeal, we will also give you the contact information of your state's Attorney General: Washington residents may file a complaint with the Washington State Office of the Attorney General at atg.wa.gov/file-complaint, and Nevada residents may contact the Nevada Office of the Attorney General.

8. No discrimination

We will not discriminate against you for exercising these rights.

9. Changes

If we change this policy, we post the changes and the effective date on this page and also announce significant changes in the App (Section 10 of the Privacy Policy). We will not collect, use, or share consumer health data in categories or for purposes not described here without telling you and obtaining your consent.

10. Contact