Privacy policy

Humos Pro is operated by HumOS Inc., 251 Little Falls Dr, Wilmington, DE 19808 ("Humos", "we", "us"). This policy explains what we collect when you use Humos Pro on the web, desktop or iPhone, how we use it, and the choices you have.

Humos Pro is separate from the Humos consumer app. It has its own accounts and its own data, and nothing is shared between the two unless you connect them yourself (Pending: a future feature.

1. Who uses Humos Pro

• Pros: coaches and practitioners who plan training for their clients, and the staff of their practice.
• Athletes: the people they coach, who follow their plans and log their training.
• Practices: the business a pro works in. A solo coach is a practice of one.

Humos Pro is a wellness and training tool. It is not a medical device, and it does not diagnose, treat, cure or prevent any disease. Pending: Adapt the Humos wellness disclaimer.

Humos Pro isn't designed for HIPAA covered entities. Every pro confirms at signup that they don't bill health insurance or conduct HIPAA standard electronic transactions.

2. Information we collect

From everyone:

• Account details: name, email, sign-in method.
• Usage and diagnostics: device and app version, errors, and how features are used. Pending: Analytics provider. We don't use advertising pixels or trackers on screens that show health information.

From pros:

• Profile: role, credentials and certifications, an optional NPI number, and your signup attestation.
• Practice details: practice name, staff and roles, plans, templates and library content you create.
• Payment setup: handled by Stripe. We store account identifiers and status, never full card numbers.

From athletes, and from pros about athletes:

• Training plans, logged sessions, effort ratings, pain ratings, comments on sessions and goals.
• Restrictions and injuries. These are usually recorded as training tags (for example "no running impact"), and a description is optional.
• Supplements, medications, peptides and GLP-1 protocols, where you or a verified prescriber add them.
• Strength estimates, thresholds and training zones.
• Your life calendar: travel, busy periods, illness, races and notes you choose to share with your coach.
• Videos you record, such as form checks and skill attempts, and videos your coach records for you.
• Messages between you and your coach.
• Intake answers and signed waivers you submit through your coach's signup link.
• Pending: Phase 1.x: lab, VO2, DEXA, sweat and metabolic test reports you upload.

From devices you connect: workouts, heart rate, sleep, heart rate variability and similar data from the services you connect: Garmin, COROS, Wahoo, Suunto, Apple Health, and others as we add them. We record which service each piece of data came from, because each service has its own rules (see section 6).

From files you import: spreadsheets, PDFs, text, and Google Sheets or Google Drive files a pro chooses to import.

3. How we use information

• To provide Humos Pro: building and delivering plans, logging, messaging, video review, analytics and billing.
• To keep it secure: access controls, fraud prevention, and audit logs of who accessed health information.
• To support and improve the service, using diagnostics and aggregated usage. We don't use your health information to train AI models, and we don't sell it or use it for advertising.
• To meet legal obligations.

4. Automated processing and AI

See Part C for the full AI transparency statement. In short:

• Deterministic engines (fixed rules, not AI) calculate things like where an athlete is in their season, suggested weight progressions and training load, and check plans for conflicts with restrictions.
• The AI copilot drafts sessions and weeks only when a pro asks. Every draft is a proposal: a pro reviews and approves it before an athlete sees it, and the reason for each suggestion is available to the pro.
• AI is also used, when a pro asks, to convert imported files into plans, and (phase 1.x) to read values from uploaded test reports.
• Our AI provider is Anthropic, under terms that don't allow your data to be used to train its models. We send only what each task needs.
• Garmin data is used by AI only if you explicitly agree (section 6). Suunto data isn't used by AI.

5. Sharing with your coach and practice

• Athletes control their data. When you join a coach's practice, you give that practice access to your training information. Inside the practice, access depends on each staff member's role.
• You can see everything about yourself in the app, export it at any time, and choose what each practice can see. Pending: Confirm per-domain controls at launch.
• Coaches can keep private notes about you that aren't shown in the app. Pending: Counsel: access and deletion rights for these notes.
• If you leave a practice, you keep your full history. The practice keeps a record of the coaching it provided up to the day you left, and can't see anything after that. Pending: Counsel: interaction with deletion requests.
• If you work with more than one practice, each one sees only its own work with you.

5.1 AI tools your coach uses

Your coach may connect their own AI assistant (such as Claude or ChatGPT) to Humos Pro, or use their own AI account inside Humos Pro, to help draft your plans. When they do:

• That assistant receives only de-identified training information: an anonymous code instead of your name, your sport and level, an age range, dates counted from today, training totals and targets, restrictions as training tags, equipment and availability.
• It never receives your name, contact details, date of birth, location, notes, messages, videos, medications, test results or billing details. It never receives data from Garmin or Suunto.
• Anything it drafts is only a suggestion until your coach approves it in Humos Pro.
• This is on by default. You can turn it off for any coach in You → Data & privacy. Pending: Counsel: default-on vs. opt-in.
• Your coach's AI provider handles that information under the coach's agreement with them, not ours.

6. Connected devices and services

You choose which services to connect, and you can disconnect them at any time in You → Devices. When you disconnect, we stop collecting new data from that service. Pending: State what happens to data already collected.

• Garmin: we use Garmin data to show your training, keep your plan accurate and send workouts to your Garmin device. Garmin data is never used to train, evaluate or improve AI models. Our AI copilot uses Garmin data only if you turn on "Use my Garmin data with AI" (see Part C). Garmin data is never shared with your coach's own AI tools.
• Suunto: Suunto data is used to show your training and send workouts to your Suunto device. It isn't used by any AI feature. Suunto compatible. Pending: Logo and link per the Suunto agreement.
• COROS, Wahoo: Pending: Add once their terms are confirmed.
• Apple Health and Apple Watch: with your permission, we read workouts and health data from Apple Health and can schedule workouts on your Apple Watch. Apple Health data isn't used for advertising or sold, and isn't shared with third parties except to provide Humos Pro. Pending: Align with Apple's HealthKit rules.
• Google Sheets / Google Drive (pros): used only to import files the pro selects. Pending: Add the Google API Services User Data Policy "Limited Use" disclosure if Google APIs are used.
• YouTube / Vimeo: coaches may link demo videos hosted there. Watching them is subject to those services' policies. Pending: Use privacy-enhanced embeds.

7. How we share information

We don't sell personal information. We share it only:

• with the people you work with in Humos Pro (section 5)
• with service providers that run Humos Pro for us under contract: Supabase (database and storage), Vercel (hosting), Anthropic (AI), Stripe (payments), Sentry (error monitoring, configured without personal details), Pending: video storage provider, Pending: email and push provider, Pending: analytics provider
• with device makers, when you connect them (to send workouts back to your device)
• when the law requires it, or to protect people's safety or our rights
• in a merger or acquisition, with notice to you.

8. How we protect information

• encryption in transit and at rest
• per-row access controls in our database
• pros can reach athlete information only through an audited server layer
• private, expiring links for videos
• access logs for health information

No system is perfectly secure. We'll notify you and the authorities as the law requires if a breach affects your information.

9. Your choices and rights

• In the app: view, correct, export (JSON, CSV, FIT) and delete your data; disconnect devices; turn off coach AI access per coach; manage notifications.
• By email: privacy@joinhumos.com. We respond within 30 days (45 for California), or sooner where the law requires.
• California: rights to know, delete, correct and limit use of sensitive personal information. We don't sell or share personal information as the CPRA defines those terms.
• Washington, Nevada, Connecticut and other states with consumer health data laws: see Part B.
• EU, EEA, UK and Switzerland: Pending: Confirm whether phase 1 serves these users; if so, add the GDPR rights and legal bases.

10. Data retention

• We keep your data while your account is active.
• Form-check videos are archived at reduced quality after 90 days. Skill-evidence videos are kept until you or your coach delete them.
• When you delete your account, your data is removed from the live service right away, and encrypted backups age out on a rolling schedule Pending: period. Audit logs of who accessed health information are kept after deletion, for security and legal reasons.
• A practice's record of the coaching it provided may be kept as described in section 5. Pending: Counsel.
• Error diagnostics are kept 90 days.

11. Children and minors

Humos Pro is for people 18 and older. Athletes and pros confirm their age at signup. We don't knowingly collect information from anyone under 18, and we'll delete it if we learn we have. If you believe a minor is using Humos Pro, contact privacy@joinhumos.com. Pending: Revise when minor athletes are supported, with guardian accounts and consent.

12. Changes to this policy

We'll post changes here and update the date above. For material changes, we'll notify you in the app or by email before they take effect.

13. Contact

HumOS Inc., 251 Little Falls Dr, Wilmington, DE 19808 · privacy@joinhumos.com

Consumer health data privacy policy

Pending: Counsel to confirm the scope and that it should be a separate page, linked from the homepage, as MHMDA requires.

This policy covers consumer health data as defined by the Washington My Health My Data Act and similar laws.

Categories we collect:

• training and activity data
• heart rate, heart rate variability and sleep
• pain ratings
• injuries and restrictions
• supplements, medications, peptides and GLP-1 protocols
• body measurements
• videos of training
• Pending: test results (phase 1.x)
• information inferred from these, such as training load and readiness

Sources: you, your coach or practitioner, devices and services you connect, and files you or your coach upload.

Purposes: to deliver and personalize your training through your coach, to log and analyze your progress, to send workouts to your devices, and, when your coach asks, to draft plan suggestions with AI (Part C).

Who we share it with:

• the practices you join (section 5 of Part A)
• service providers acting for us (section 7 of Part A)
• device makers you connect
• in de-identified form, your coach's own AI tools, unless you turn that off (section 5.1 of Part A)

Consent: we collect consumer health data with your consent when you create your account and connect services, and we share it with a practice only after you join it. Pending: Counsel: separate consent for collection and for sharing; the default-on setting for coach AI tools.

Your rights: confirm whether we hold your consumer health data, access it, get a list of the third parties and affiliates it was shared with (and their contact details), withdraw consent, and have it deleted. Use You → Data & privacy, or email privacy@joinhumos.com. Pending: Appeal process.

We don't sell consumer health data, and we don't use geofencing around health care facilities.