Consumer Health Data Privacy Policy

This Consumer Health Data Privacy Policy explains how Highmoon Works Inc. ("Highmoon", "we", "us", or "our"), which operates Train Fondo, collects, uses, shares, and protects "consumer health data" as that term is defined under United States state consumer health privacy laws, including Washington's My Health My Data Act. It supplements our Privacy Policy and controls if the two ever conflict on the treatment of consumer health data.

We are a fitness and nutrition information service. We are not a healthcare provider, and we are not a covered entity or business associate under the Health Insurance Portability and Accountability Act (HIPAA). The data described here is nonetheless treated as consumer health data under state law, and we handle it accordingly.

1. What consumer health data we collect

We collect only the consumer health data needed to provide the training and nutrition service you ask us for:

• Body and profile data you enter: body weight, height, sex, and age.
• Activity and fitness data, either entered by you or derived from files you upload: duration, distance, elevation, grade, speed, power, heart rate, cadence, and computed training load. When you upload an activity file, we derive these values and discard the precise GPS coordinates; we do not store your location or routes.
• Training inputs and outputs: your goals, planned sessions, and the training recommendations our system generates for you.
• Nutrition inputs and outputs: your logged meals and fueling, dietary preferences and intolerances, and the nutrition targets our system generates.
• Daily and weekly check-ins: sleep, energy, soreness, stress, and how a session felt.
• Injury notes you choose to enter: the area, status, and any notes.

We do not collect or store reproductive or menstrual health data, and we do not collect or store blood-marker or laboratory values.

2. Where the data comes from

• Directly from you, when you complete onboarding, log activity or meals, or answer a check-in.
• From activity files you upload, from which we derive fitness metrics and then discard coordinates.
• In the future, and only with your separate consent, from connected apps or devices you choose to link.

3. Why we collect it

We collect and use consumer health data only to provide the service you requested and to operate it safely and lawfully:

• To generate, adjust, and display your individualized training and nutrition plan.
• To create and secure your account and process your subscription.
• To provide customer support you request.
• To comply with law and to protect the security and integrity of the service.

We do not use consumer health data for advertising, marketing profiling, or any purpose beyond providing the service.

4. How we share it, and how we do not

We do not sell your consumer health data, and we do not share it for advertising or cross-context behavioral advertising.

We share consumer health data only with service providers that process it on our behalf, under contracts that limit them to that purpose:

• Hosting and infrastructure provider (to store and serve your data).
• Payment processor (billing; this provider receives account and billing data, not your fitness or health inputs).
• Email provider (account and service emails).
• Error-monitoring and operational tooling where strictly necessary to keep the service running.

We may also disclose data if required by law, to respond to lawful requests, or to protect our legal rights, and in connection with a corporate transaction, in which case this policy continues to govern the data.

5. Your rights

You may, at any time:

• Withdraw your consent to our collection and use of your consumer health data.
• Confirm and access the consumer health data we hold about you.
• Delete your consumer health data. Deleting your account removes your data from our systems and instructs our service providers to delete it as well.

Withdrawing consent or deleting your health data will end our ability to provide the training and nutrition service, since the service depends on that data.

6. How to exercise your rights

• In the app: Settings, then Account, where you can export or delete your data.
• By email: privacy@highmoonworks.com.

We will respond within the time required by applicable law. We may need to verify your identity before acting on a request.

7. Appeals

If we decline a request, you may appeal by replying to our response or by writing to privacy@highmoonworks.com with the subject line "Consumer Health Data Appeal." If your appeal is denied, you may contact the Washington State Attorney General at atg.wa.gov/file-complaint or your state's consumer protection authority.

8. Changes

If we change this policy, we will post the updated version here with a new effective date and, for material changes, provide additional notice.

9. Contact

Highmoon Works Inc.
131 Continental Drive, Suite 305, Newark, DE 19713, United States
privacy@highmoonworks.com