Consumer Health Data Privacy Policy

Last updated: October 26, 2026

This policy applies to residents of Washington, Nevada, and any other U.S. State with a consumer health data law. It supplements our Privacy Policy and is provided by OPALLOO INOVACOES LTDA, the company that operates Fitless.

Health data we collect and why

  • Health profile: injuries, health conditions, and medications, if you give them to us; height, weight, body fat, and age.
  • Body scan results: body composition estimates from the body scan, if you use it.
  • Menstrual cycle: cycle settings, period dates, symptoms, and daily check-ins, only if you turn on cycle tracking.
  • Health apps: data you allow us to read from Apple Health or Health Connect (weight, height, body fat, workouts, heart rate, and steps).
  • Plugin pain regions: the regions from a closed list that you pick in the Fitless plugin card in ChatGPT or Claude, received and stored only after your consent in that card. They are used only to adapt that plan and never go to your account: we delete them within 30 days, or as soon as the plan is saved to an account.
  • Inferences: conclusions about your fitness drawn from this data, such as your training level.

We use this data only to generate and adjust your workouts, show your progress, and run the features you turn on. We do not use it for advertising.

Sources

  • You.
  • The health app on your device (Apple Health or Health Connect) and your Garmin watch, if you connect them.
  • ChatGPT or Claude, when you use the Fitless plugin (only the plan request answers; the pain region comes from the Fitless card).

Who receives it

We do not sell health data and we do not share it with third parties for their own purposes. These processors handle it on our behalf:

  • Contabo: hosting of our servers and database, in the United States.
  • Cloudflare: storage of encrypted backups, in Europe.
  • OpenRouter, Anthropic, OpenAI and Google: AI analysis to generate workouts, body scan results, imports and the coach. Body scan analysis and workout generation use Anthropic and OpenAI models through OpenRouter's zero-data-retention routing; workout and check-in imports and the coach are processed directly by Anthropic, which may keep the data for up to 30 days to detect abuse; video imports and Cheer Squad stickers are processed directly by Google.

We have no affiliates. Meta's tools load on our website only if you choose "Accept all", and we never send Meta your answers to health questions, your health profile, body scan data, or cycle data. We do not send the pain regions to OpenAI or Anthropic. We do not use geofences around places where people receive health care.

Consent

We collect health data with your consent: a checkbox of its own in the quiz, separate from accepting the Terms; a notice on the screen where you connect Apple Health or Health Connect; a dedicated opt-in before the body scan; a card of its own in the ChatGPT and Claude plugin, before we receive and store the pain regions; and cycle tracking only if you turn it on. We share health data only with the processors listed above. You can withdraw your consent at any time by writing to privacy@fitless.ai, and you can turn off cycle tracking and delete your cycle data in the app's Settings.

Your rights

You can confirm whether we hold your health data, get a copy of it and the list of processors that received it, and have it deleted. Deletion also reaches our encrypted backups, which are replaced on a rolling basis within 6 months. We respond within 45 days and never discriminate against you for using these rights.

Appeals

If we deny your request, reply to our answer with the subject "Appeal". We decide within 45 days and explain our decision in writing. If we deny your appeal, you can contact your State Attorney General (in Washington, atg.wa.gov).

Contact

Write to privacy@fitless.ai with any question about this policy.