Consumer Health Data Privacy Policy

Effective date: September 3, 2026

This policy applies to consumer health data as that term is defined by the Washington My Health My Data Act, Nevada Senate Bill 370, and the consumer health data provisions of the Connecticut Data Privacy Act. It explains what health data Zenith: Fitness & Nutrition collects, where it comes from, what we do with it, who we share it with, and how you exercise your rights over it. It is a separate policy so that it covers this subject and nothing else; our general practices are in our Privacy Policy, and this policy controls where the two differ on consumer health data.

Zenith is operated by J&O Sales LLC, 10153 E Branch Rd, Rochelle, IL 61068, USA. Questions and requests: support@josalesllc.net.

1. Categories of consumer health data we collect

We collect only what you enter, what you connect, and what the features you use require:

Body measurements and status: age, biological sex, height, current body weight, target body weight, weight history over time, and your stated fitness goal.
Nutrition and diet: the foods and meals you log, calories and macronutrients, your daily calorie and macro targets, saved meals, recipes and meal plans, grocery and pantry lists, food scans, and photographs of meals you choose to take or upload.
Exercise and activity: the workouts and exercises you log, including sets, repetitions, weights, distances, durations, calories burned, personal records, exercise history, workout photographs, and — for outdoor activities you choose to record — the GPS route of that activity.
Bodily functions and vital signs: water intake, intermittent-fasting start and end times, steps, sleep hours, resting heart rate, and average and maximum heart rate recorded during a workout.
Diagnoses, conditions, and related information you choose to give us: food allergies, food intolerances, medical conditions, personal health notes, and the supplements you track.
Progress photographs: photographs of your body that you choose to take or upload to track physical change, together with the date, the angle you label them with, and the body weight you record alongside them.
Health data from Apple Health, where you have granted permission: steps, active energy, sleep, workouts, and body weight. Where you record a body-weight value in Zenith, we write that value back to Apple Health so the two stay in sync.
Health-related information you write to another person inside the app: check-in answers, notes and messages you send to a coach or a private community you have joined.

We do not collect biometric identifiers. Zenith performs no facial recognition, no fingerprint or voiceprint matching, and no biometric identification of any kind. We do not collect precise health data about reproductive or sexual health, gender-affirming care, or any other category beyond what is listed above, and we do not infer them.

2. Where this data comes from

Directly from you, when you type it, photograph it, or record a workout in the app.
From your device, with your permission, through Apple Health (which you grant and can revoke in iOS Settings → Privacy & Security → Health) and through your device's location services during an outdoor workout you have started (revocable in iOS Settings → Privacy & Security → Location Services).
From a coach or private community owner you have joined, where they set targets for you or record a note about your training or nutrition.

We do not buy consumer health data, we do not obtain it from data brokers, and we do not collect it from other applications or websites you use.

3. Why we collect it, and what we do with it

We use consumer health data only to operate the features you have asked for:

to calculate and display your calorie and macronutrient targets, and to keep them tracking your weight as it changes;
to log, display, and chart your nutrition, training, weight, and progress over time;
to generate meal plans, grocery lists, workout suggestions, and AI-assisted answers from the inputs you submit;
to identify a food, meal, or barcode you photograph or scan;
to map an outdoor workout you record and calculate its distance, pace, and elevation;
to run challenges, streaks, and badges you opt into;
to share the fitness and nutrition information you log with a coach or private community owner you have chosen to join, so they can coach you;
to send notifications you have turned on;
to keep the Service secure, to detect and fix failures, and to comply with the law.

We do not use consumer health data for advertising, for advertising measurement, for building an advertising profile, or to make any decision about you that produces a legal or similarly significant effect.

4. Who we share it with

We share consumer health data only with the service providers that make these features work, only for those purposes, and only under contracts that forbid them from using it for anything else:

Base44 — our application hosting and database provider. Your health data is stored in this system. It is the processor that holds it.
Google (Gemini API) — receives the inputs you submit when you ask for a meal plan, a food or photograph analysis, a workout suggestion, or an AI-coach answer, and returns the result. It receives what the request contains and does not receive your account history.
Apple and Google (App Store / Google Play) and RevenueCat — subscription and purchase status only. They do not receive your health data.
Stripe — payment processing. Stripe does not receive your health data.
OneSignal — push notification delivery. It receives the device identifier and the notification content you have opted into, not your logs.
PostHog — product analytics and session recording, only with your consent. Typed input is masked in the browser before it is sent and is never transmitted.
Sentry — technical error reports so we can fix failures. Error reports do not contain your health data.
A private community owner or coach you have joined — can view the fitness and nutrition information you log so they can coach you. They cannot see your login credentials, your password, or your payment details. You choose whether to join, and you can leave at any time, which stops the sharing.

We may also disclose consumer health data where the law requires it, where it is necessary to protect someone's safety or our legal rights, or in connection with a merger or sale of the business — in which case the recipient is bound by this policy or you will be notified before your data becomes subject to a different one.

5. We do not sell your consumer health data

Zenith does not sell consumer health data, and has never sold consumer health data. We do not exchange it for money or for anything else of value, to anyone, for any purpose. Because we do not sell it, we do not seek, and you will never be asked for, the separate written authorization that Washington law requires before such a sale.

6. We do not use geofencing

Zenith does not operate a geofence around any health care facility. We do not use any geofence to identify or track you, to collect consumer health data from you, or to send you a notification, message, or advertisement relating to your consumer health data or your health care. Location data is collected only while an outdoor workout you started is actively recording, and it stops when you end the workout.

7. Your rights over consumer health data

You have the right to:

Confirm whether we are collecting, sharing, or selling your consumer health data, and to access it, including a list of the third parties with whom we have shared it;
Withdraw your consent to our collection and sharing of it;
Delete your consumer health data.

How to exercise these rights.

In the app, at any time and immediately: edit or delete any individual entry; revoke Apple Health access in iOS Settings → Privacy & Security → Health; revoke location access in iOS Settings → Privacy & Security → Location Services; leave a private community to stop sharing with its owner; export a copy of your data at Profile → Export My Data; delete your account and its data at Profile → Settings → Delete Account.
By email, from the address on your account, to support@josalesllc.net. Put Consumer Health Data Request in the subject line and say which right you are exercising. We verify the request by confirming it comes from the account's own email address; we may ask one follow-up question if we cannot match it. We will respond within 45 days, and will tell you in writing if we need a further 45 days and why.
On deletion, we delete your consumer health data from our live systems and instruct every service provider holding it on our behalf to do the same. Backups are overwritten on a rolling basis and fully purged within 90 days.

You may use an authorized agent to make a request on your behalf; we will ask for written proof of their authority and may ask you to confirm it directly.

8. If we say no — how to appeal

If we decline your request, we will tell you why in writing and explain how to appeal. To appeal, reply to that decision or write to support@josalesllc.net with Consumer Health Data Appeal in the subject line. A person who did not make the original decision will review it, and we will respond in writing within 45 days, with our reasons. If we deny the appeal, we will give you a working link or contact for submitting a complaint to your Attorney General:

Washington: Office of the Attorney General, Consumer Protection Division — www.atg.wa.gov/file-complaint
Nevada: Office of the Attorney General, Bureau of Consumer Protection — ag.nv.gov/Complaints
Connecticut: Office of the Attorney General — portal.ct.gov/ag

9. How long we keep it, and how it is protected

We keep consumer health data for as long as your account exists, because it is the content of the account. You can delete any entry at any time, and deleting your account deletes it all. Access is restricted: our systems permit each account to read only its own records, except that a member of our staff acting as an administrator can access records where it is necessary to provide support, investigate a problem, or comply with the law, and a coach or community owner you have joined can see the fitness and nutrition information you log. Data is encrypted in transit.

10. Changes

If we change this policy we will revise the effective date above and, for a material change, give you additional notice before it applies to data we have already collected.

11. Contact

J&O Sales LLC, 10153 E Branch Rd, Rochelle, IL 61068, USA — support@josalesllc.net

J&O Sales LLC — 10153 E Branch Rd, Rochelle, IL 61068, USA — support@josalesllc.net