Privacy Policy

This Privacy Policy applies to all information collected through our Service, including our website, mobile applications, and any related services, sales, marketing, or events. It does not apply to information collected by third parties, including any third-party websites, services, or applications that may be accessible through links on our Service.

iAM360 is the data controller responsible for your personal information. If you have questions or concerns about how we handle your data, please contact us using the information provided at the end of this policy.

When you create an account, we collect personal information including:

• Email address
• Name (first and last)
• Sign-in information managed through our account provider, Clerk
• Profile photo (optional)
• Basic demographic information (age, gender, height, weight)
• Billing information: your plan, billing period, payment status and history, and your card's brand and last four digits. Our payment processor, Stripe (through our account provider, Clerk), handles card numbers; we don't store them.

When an integration is available and you authorize it, we import health and fitness data from services such as WHOOP, Oura, Google Health and Dexcom. Depending on the provider, the records available in your account and the permissions you grant, this can include:

• Heart rate and heart rate variability (HRV)
• Sleep duration, stages, and quality metrics
• Activity levels and step counts
• Calories burned and energy expenditure
• Recovery scores and readiness indicators
• Respiratory rate and blood oxygen levels
• Strain scores and workout intensity metrics
• Body temperature variations
• Body measurements such as weight, body fat and height
• Cardio fitness estimates, such as VO2 max
• Exercise sessions, including type, duration, distance, pace, heart rate, active zone minutes and splits
• Food and water logs, including energy, carbohydrate, fat, protein and hydration totals
• Glucose readings and trends; events you log in Dexcom, such as carbohydrates, insulin, exercise, health events and fingerstick readings; calibrations; alerts; and device information, including alert settings

We also store provider account identifiers, authorized connection tokens and synchronization records to maintain the connection. For Google Health, profile information includes your age and membership start date; we import your history back to that start date, up to ten years. We also receive your Google Health settings, such as time zone, unit and language preferences and stride settings, and information about your paired devices, such as device name, type, software version, battery level and last sync time. These integrations read provider records; they do not change your records at Google Health or Dexcom. Availability of an integration does not mean every device, region or data type is supported.

When you use our meal tracking features, we collect information about:

• Foods and beverages consumed
• Meal times and eating patterns
• Caloric intake and macronutrient information
• Dietary preferences and restrictions
• Custom recipes and food entries

We collect workout and exercise data including:

• Exercise type and duration
• Workout intensity and heart rate zones
• Repetitions, sets, and weights (for strength training)
• Distance and pace (for cardio activities)
• Personal records and performance metrics
• Workout notes and custom entries

When you choose to use the Journal, we collect and store the free-form text you submit. When you describe your day to Coach AI, we may also store a journal entry created from the information you provide.

To organize your journal and personalize the Service, Coach AI may generate and store internal attributes, such as an approximate feeling score, descriptive tags, or an indication that an entry may reflect a difficult day. You do not enter these fields yourself, and these inferences may be incomplete or inaccurate.

Coach AI may use your journal entries and these inferred attributes alongside your fitness and wearable data to answer questions about your entries and personalize responses. These inferences are not medical or mental-health diagnoses.

We collect information about your fitness goals including:

• Weight and body composition goals
• Activity and exercise targets
• Nutritional and dietary objectives
• Sleep and recovery goals
• Custom milestones and achievements

When you access our Service, we automatically collect certain information:

• Device information (type, operating system, unique IDs)
• IP address and approximate location
• Browser type and version
• Usage patterns and feature interactions
• App crashes and performance data
• Cookies and similar tracking technologies

If you choose to share your data with a personal trainer or coach, we share your fitness and health data with that trainer, as Section 4.1 describes. We also keep records of which trainers have access to your data.

We use your information to:

• Create and manage your account
• Display your health and fitness data
• Track your meals, workouts, and goals
• Store and display your journal entries
• Generate insights and personalized recommendations
• Enable data sharing with authorized trainers
• Sync data across your devices

Coach AI can use relevant health and fitness records, your messages and your goals to answer questions, explain trends and personalize fitness guidance. Section 4.3 explains the service providers involved. Glucose and other wellness insights are not intended for diagnosis or treatment decisions.

We analyze usage data to:

• Identify and fix technical issues
• Develop new features and functionality
• Understand user preferences and behavior
• Optimize performance and user experience
• Conduct research and analytics

For Google Health data and information derived from it, these activities are limited by Section 4.9.

We may use your contact information to:

• Send service-related notifications and updates
• Respond to your inquiries and support requests
• Send promotional communications (with your consent, where required)
• Notify you of changes to our policies or services
• Send billing notices, such as free trial and renewal reminders, receipts, payment problems and price changes. We send these even if you turn off marketing emails.

We may use your information to:

• Detect and prevent fraud and abuse
• Enforce our Terms of Service
• Comply with legal obligations
• Protect the rights and safety of our users

If you are located in the European Economic Area (EEA), our legal bases for processing your personal data include:

• Contract: Processing necessary to perform our contract with you
• Consent: Processing based on your explicit consent, particularly for health data
• Legitimate Interests: Processing for our legitimate business interests that do not override your rights
• Legal Obligation: Processing required by applicable law

When you authorize sharing with a personal trainer or coach:

• Accepting a trainer's invite shares your fitness and health data with that trainer, including data imported from connected services such as WHOOP, Oura, Google Health and Dexcom, until you choose Stop sharing in Settings, under Friends & trainers
• Journal entries are not shared with trainers
• You can revoke access at any time
• Trainers are bound by confidentiality requirements in their agreements with us

When you use friends and group features, information can also be shared with participating members according to your sharing settings. Categories include workouts and activity, recovery and sleep, nutrition, body metrics, check-ins without notes, and challenges. Every category starts on; you can turn each off in Settings, under Friends & trainers, in What friends see. Glucose readings are not shared with friends. The coach can use shared information in group conversations. Review your sharing settings when using these features; Section 4.9 continues to apply to Google Health data.

With your authorization, available integrations receive data from these providers:

• Whoop: We receive health metrics from Whoop via their API with your authorization
• Oura: We receive sleep and activity data from Oura with your authorization
• Google Health: We receive activity, exercise, sleep, health measurements and supporting profile information to synchronize your history and provide wellness summaries, trends and coaching. We also receive authorized food and water logs, settings and selected paired-device information. These imported records are stored with your account data and included in your data export.
• Dexcom: We receive authorized glucose records and related events, calibrations, alerts and device information to provide glucose history, summaries and wellness context.

Your use of these third-party services is governed by their respective privacy policies.

We use service providers to operate the features you use. Vercel and Railway host application services, Supabase stores application records, and Upstash supports caching. These services can process health and fitness information needed for those features. Clerk handles account authentication, and Stripe through Clerk handles payment processing.

For AI coaching, relevant messages and health and fitness context are sent to AI processing services through Vercel AI Gateway, which routes each request to a provider that serves the model. The models we use and the providers that can serve them are:

• OpenAI GPT-6 Luna and GPT-6 Sol (text coaching, analysis, plans and photo reading): OpenAI, Microsoft Azure or Amazon Bedrock
• OpenAI GPT-6 Luna Fast and GPT-6.1 Terra Fast (coaching steps during voice conversations and deep coaching): OpenAI
• OpenAI GPT-Live and GPT-Realtime (voice conversations in the app and on the phone) and GPT-4o mini Transcribe (voice notes sent by text message): OpenAI
• OpenAI gpt-oss-120b (coaching steps during phone calls): Cerebras first, with failover to Baseten, Amazon Bedrock, Groq, Nebius, Parasail or Together AI
• Google Gemini 3.8 Flash (coaching steps during voice conversations in the app): Google or Google Cloud Vertex AI
• TypeSafe AI's Jev (decisions such as how to route a request or whether a browser task is done): TypeSafe AI, with zero data retention

This list reflects the providers available for each model as of this policy's Last Updated date. Voice features also process audio and transcripts. Using coaching through iMessage or phone also involves the communication service, including Apple and Photon's messaging infrastructure for iMessage and Twilio for phone calls, which processes the messages or audio delivered through that channel. Photon also receives the account details used to set up the messaging connection, including your name, email address and phone number.

We use Resend for email delivery and providers for service support. If you use browser assistance, Kernel's hosted browser processes the pages and inputs involved in your requested task. Google Health information shared with service providers remains subject to the restrictions in Section 4.9. Connecting an outside AI assistant is a separate choice described in Section 4.8.

We do not sell, rent, or trade your personal information to third parties for their marketing purposes. Your health and fitness data is never sold or used for advertising targeting.

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., a court or government agency). We will notify you of such disclosure when legally permitted.

If iAM360 is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have regarding your information. Transferring Google Health data or information derived from it in such a transaction requires your explicit consent beforehand.

We may share aggregated, anonymized data that cannot be used to identify you for research, analytics, and business purposes. This data helps us understand trends in fitness and health without compromising individual privacy. This general permission does not apply to Google Health data or information derived from it, including aggregated or anonymized information; Section 4.9 applies instead.

When you connect a third-party AI assistant through the Model Context Protocol (MCP), you authorize it on iAM360's consent screen. The screen identifies the assistant and the access it requests. The assistant can then request information from your iAM360 account and receive it in tool responses to answer your questions and carry out your requests.

This information can include sleep, recovery, heart rate variability, glucose, nutrition, workouts, progress, challenges, patterns and private journal entries. The fitness authorization includes both read and write access. It allows tools to log or change meals, workouts, routines, life events and journal content, manage challenges, and delete meals, workouts or life events. Information submitted through these tools is saved in your iAM360 account and handled under this policy. The assistant does not receive your password or your wearable provider sign-in credentials through MCP.

We store the assistant's identifier and name, when the connection was first and last used, and whether you have turned access off. We use these records to show and manage your connected assistants and enforce your access choices. Our account provider handles the OAuth authorization and tokens used to authenticate the connection.

The connected assistant is operated by a third party. Its processing and retention of information it receives are subject to that provider's terms, privacy policy and your settings with it. Review those before connecting, especially when sharing health data or journal entries. Turning access off stops future iAM360 tool calls; it does not erase information the assistant already received. Deleting your iAM360 account also does not automatically delete copies held by that provider. Use the provider's controls or contact it to manage those copies.

Authorization to connect an assistant does not permit otherwise prohibited uses of Google Health information. Section 4.9 also applies to that information when shared through an assistant.

See our connected-assistant data controls guide for instructions to turn access off, export your data and delete your iAM360 account. Our retention and deletion practices are described in Section 9.

The use of information received from Google Health API and/or Developer Tools will adhere to the Google Health API Developer and User Data Policy, including the Limited Use requirements. This covers imported records and information derived from them, including aggregated, anonymized data and AI-generated summaries.

We use this information for the health and fitness features described in the Service. Transfers are limited to providing or improving those features with your consent, necessary security purposes, legal requirements, or a business transfer with your explicit prior consent. We do not use it for advertising, sell it, provide it to data brokers, or use it for credit or lending decisions. We also do not use it with a product that may qualify as a medical device to perform that device's regulated function, for medical or other human-subjects research, or in any manner involving protected health information under HIPAA. General research and business-use permissions elsewhere in this policy do not override these limits.

Human access is limited to specific data you explicitly permit us to read, necessary security or legal purposes, or aggregated and anonymized information used for permitted internal operations. These restrictions continue after you disconnect.

Our security practices include:

• HTTPS connections for the app and provider API requests
• Authentication and access checks on protected application data
• Server-side handling of wearable connection tokens
• Encryption of health data stored in our shared application cache
• Encryption in transit (TLS 1.2 or later) for connections to our database provider
• Encryption of stored data at rest (AES-256) by our database provider

Health records are stored in our hosted application database and processed by the providers described in Section 4.3.

Your data is primarily stored on secure servers located in the United States. If we transfer data internationally, we ensure appropriate safeguards are in place as described in Section 10.

While we implement industry-standard security measures, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security but will notify you of any breach affecting your personal information as required by law.

You have the right to request a copy of the personal information we hold about you. You can access most of your data directly through your account settings, or you can contact us for a comprehensive data export.

You have the right to correct any inaccurate or incomplete personal information. You can update most information through your account settings, or contact us for assistance.

You have the right to request deletion of your personal information. In Settings, open Account, then Your data, and choose Delete account. Complete the deletion confirmation in the account window's Security section. You can also contact us for help. Note that we may retain certain information as required by law or for legitimate business purposes. We keep records of payments, and of your agreement to automatic renewal, for as long as the law requires (in California, at least three years, or one year after your plan ends if that is longer), even after you delete your account.

You have the right to receive your personal data in a structured, commonly used, and machine-readable format. We provide data export functionality in Settings, Account, Your data: choose Export data (JSON), or Daily metrics (CSV) for your daily numbers.

In certain circumstances, you have the right to request that we restrict the processing of your personal information. Contact us to exercise this right.

You have the right to object to certain types of processing, including processing for direct marketing purposes. You can manage your communication preferences in your account settings.

If you are located in the European Economic Area, you have additional rights under GDPR, including the right to withdraw consent at any time and the right to lodge a complaint with your local data protection authority.

California residents have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to know what personal information is collected
• Right to know whether personal information is sold
• Right to opt out of the sale of personal information
• Right to non-discrimination for exercising privacy rights
• Right to correct inaccurate personal information
• Right to limit use of sensitive personal information

As stated above, we do not sell your personal information.

Our Service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately.

We comply with the Children's Online Privacy Protection Act (COPPA). If we discover that we have collected personal information from a child under 13, we will delete that information as quickly as possible.

Parents or guardians may contact us to review, delete, or stop the collection of their child's personal information. We will verify the identity of the requester before taking action.

We retain your personal information for as long as necessary to:

• Provide the Service to you
• Comply with legal obligations
• Resolve disputes and enforce agreements
• Support business operations

Imported health and fitness records are stored to provide your history, trends and coaching while you use the Service. Google Health information, including derived information, remains subject to Section 4.9 throughout retention. The general business purposes above do not expand its permitted uses.

Disconnect WHOOP, Oura, Google Health or Dexcom in Devices to stop future imports. The disconnect process removes the saved connection, imported records for that provider and its synchronization records from our active application database. For WHOOP, Oura and Google Health, we also ask the provider to revoke our access. Dexcom authorization can be removed in the Permissions section of your Dexcom account. Disconnecting does not delete your records at the original provider.

Previously saved conversations, journal entries or generated insights can contain information derived from imported records and may remain after a provider is disconnected. Daily summaries, such as steps, sleep and readiness, are recalculated for the last 90 days after you disconnect; older daily summaries keep values calculated from that provider's data. You can delete available items through their controls, request deletion by contacting us, or delete your account. Google Health protections continue to apply to retained derived information.

You can export your data before deleting your account. Account deletion is available in Settings under Account and Your data. After identity confirmation, account deletion initiates removal of associated application records. This includes the data imported from connected services and the connection tokens we hold. Account deletion also asks WHOOP, Oura and Google Health to revoke our access; for Dexcom, remove iAM360 under Permissions in your Dexcom account. Encrypted cached copies expire within 24 hours. Records subject to a legal retention requirement, such as billing records, are handled separately. Backup copies may remain until the applicable backup retention cycle ends. Account deletion does not automatically remove copies already received by an outside assistant or other independent provider; use that provider's controls or contact it to request deletion.

• See your connected services: open Devices from the top navigation (on a phone, from the menu under your profile picture). Each connected service shows when it last synced. For Google Health, a Not shared row lists any data types you left unticked on Google's consent screen.
• Change what Google Health shares: to share data types you left out, choose Reconnect on Google Health in Devices. To share less, remove iAM360's access in your Google Account, or disconnect and connect again with fewer types selected.
• Stop syncing and delete a service's data: in Devices, choose Disconnect on the service and confirm. iAM360 stops syncing, deletes the data imported from that service and, for WHOOP, Oura and Google Health, asks the provider to revoke our access. For Dexcom, also remove iAM360 under Permissions in your Dexcom account.
• Stop sharing with a trainer: in Settings, open Friends & trainers and choose Stop sharing next to the trainer.
• Choose what friends see: in Settings, open Friends & trainers and use What friends see.
• Stop an AI assistant's access: in Settings, open AI agents and choose Turn off next to the assistant.
• Export your data: in Settings, open Account, then Your data, and choose Export data (JSON) for your account data, including data imported from connected services, or Daily metrics (CSV) for your daily numbers.
• Delete your account: in the same Your data section, choose Delete account and complete the confirmation in the account window's Security section. This deletes the data imported from connected services and asks WHOOP, Oura and Google Health to revoke our access; for Dexcom, also remove iAM360 under Permissions in your Dexcom account. Section 9.2 describes what is deleted and what is kept.

If we transfer your personal data outside of your country of residence, we will ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission, or other legally recognized transfer mechanisms.

Regardless of where your data is processed, we apply the same protections described in this Privacy Policy. We require our service providers to maintain equivalent levels of data protection through contractual obligations.

We use the following types of cookies:

• Essential Cookies: Required for the Service to function properly
• Functional Cookies: Remember your preferences and settings
• Analytics Cookies: Help us understand how you use the Service
• Performance Cookies: Monitor and improve Service performance

Most web browsers allow you to control cookies through their settings. You can typically set your browser to block or delete cookies. However, disabling certain cookies may affect the functionality of our Service.

We currently do not respond to "Do Not Track" browser signals, as there is no industry-standard interpretation of this signal. However, you can manage your tracking preferences through your browser settings and our cookie preferences.

Our Service processes health and fitness data and may process your journal entries and attributes inferred from them. This information may be considered sensitive personal data under privacy laws. We only collect and process this data with your explicit consent and implement additional safeguards to protect it, including access controls on health records and encryption of cached health data.

For California residents, the following categories of personal information may be collected:

• Identifiers (name, email, IP address)
• Personal information categories (physical characteristics)
• Internet or network activity information
• Geolocation data (approximate)
• Inferences drawn from the above to create a profile

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.

iAM360 is not a covered entity under the Health Insurance Portability and Accountability Act (HIPAA). While we implement strong security measures to protect your health information, HIPAA regulations do not apply to our Service. If you have specific healthcare-related privacy concerns, please consult with your healthcare provider.