Consumer Health Data Privacy Policy

GLP Fitness by Demitry Davidson is operated by S2S LLC, a New Mexico limited liability company (“we,” “us,” or “our”). This policy describes how we collect, use, share, and protect consumer health data, and how you exercise your rights.

It is provided under the Washington My Health My Data Act (RCW 19.373), Nevada SB 370, and the Connecticut Data Privacy Act. It applies to every user, not only residents of those states. Our general Privacy Policy governs all other information.

1. Categories of consumer health data we collect

• Medication schedule. The day of the week you take your injection. We do not ask which medication you take, and we do not store its name.
• Bodily functions and physical characteristics. Training inputs you report, such as appetite, energy, soreness, sleep, completed sessions, and the loads you lift.
• Health goals. The outcome you select during onboarding, such as preserving muscle while losing weight.
• Health-related inferences. Signals our system derives from the above, such as an estimated recovery state or a strength-retention trend.

We do not collect, and ask you never to send us, the name of your medication, your diagnoses, lab results, genetic information, prescription dosage, precise geolocation, or biometric identifiers.

2. How we collect it, and the sources

• Directly from you, through onboarding, check-ins, and in-app inputs.
• Generated by the Service, as inferences computed from what you report.

We do not purchase consumer health data, and we do not collect it from data brokers, advertising networks, or other third-party sources.

3. Why we collect it

• To build and adapt your training program around your reported injection day and recovery.
• To show you your own strength-retention and training history.
• To provide support when you contact us.
• To meet legal obligations.

We do not use consumer health data for advertising, and we do not use it to profile you for any purpose other than delivering the training program you asked for.

4. Consent

We ask for your opt-in consent before we collect consumer health data, at the point of collection. Consent is never bundled with our Terms of Service and is never pre-selected. You may withdraw it at any time (see Section 8), and withdrawal does not affect processing that already occurred.

5. Categories of consumer health data we share

We share the categories listed in Section 1 only where necessary to operate the Service, and only with the categories of recipients below, under contracts that bar them from using it for their own purposes.

• Cloud hosting and database providers — Supabase, Inc.; Vercel, Inc.
• Payment processing — Stripe, Inc. (Stripe does not receive your health data.)
• Automated recommendation processing — Anthropic, PBC. Inputs are not used to train models.
• Legal and safety — where required by law, or to protect against imminent harm.

We share consumer health data with these processors only when it is necessary to provide the Service you requested, or with your separate consent.

6. We do not sell your consumer health data

We have never sold consumer health data and we do not sell it. Under the My Health My Data Act, a sale would require your signed, standalone authorization that is separate from this policy and from your consent to collection. We do not seek one.

7. No geofencing

We do not use geofences around any health care facility, and we do not use location data to identify, track, or advertise to you based on proximity to one.

8. Your rights

You have the right to:

• Confirm whether we are collecting, sharing, or selling your consumer health data, and access it.
• Obtain a list of all third parties and affiliates with whom we have shared it, and a contact for each.
• Withdraw your consent to its collection and sharing.
• Have it deleted. On a valid request we delete it from our records and our backups, and we notify every processor and affiliate that received it, directing them to do the same.

Exercising these rights is free, and we will not deny you the Service, charge you a different price, or degrade your experience for doing so.

How to make a request

Email privacy@glp.fitness with the subject line “Consumer Health Data Request.” Tell us which right you are exercising and the email address on your account. We may ask for information sufficient to verify that the account is yours; we will not use it for any other purpose.

We respond within 45 days. If we need more time we will tell you why within those 45 days and may take up to 45 additional days.

If we deny your request

You may appeal by replying to our decision, or by emailing privacy@glp.fitness with the subject line “Appeal.” We will respond in writing within 45 days and explain our reasoning. If we deny the appeal, you may submit a complaint to the Washington State Attorney General at atg.wa.gov/file-complaint, or to the Attorney General of your state.

9. How long we keep it

We retain consumer health data for as long as your account is active, and delete it within 90 days of account closure, unless a longer period is required by law. Proof of your consent is retained separately for as long as required to demonstrate compliance.

10. Changes to this policy

If we materially change how we collect, use, or share consumer health data, we will update this policy, revise the effective date above, and obtain your consent again before the change applies to data we have already collected.

11. Contact

S2S LLC
3126 Tess Ct NE, Rio Rancho, NM 87144
privacy@glp.fitness