Consumer Health Data Privacy Policy

1. Consumer health data FFM collects, and why

FFM keeps this data on your device to run the app. Section 3 lists how some of it can leave your device.

• Health records you allow FFM to read. With your permission, FFM reads from Apple Health on iPhone and iPad, including new sleep and heart-rate readings in the background: workouts and activity (steps, distance, energy burned, exercise and stand time, flights climbed), heart and breathing measurements (heart rate, resting heart rate, walking heart-rate average, heart-rate variability, VO2 max, respiratory rate and blood oxygen), sleep, body measurements (weight, lean body mass, height and body-fat percentage), and nutrition and water intake. On Android, FFM reads from Health Connect, including in the background if you allow it: workouts, distance, active calories, basal metabolic rate, weight, height, body fat, nutrition, hydration, sleep, heart-rate variability and resting heart rate. FFM uses this data to score your readiness and recovery, plan and adjust your training, and track your progress.
• Reproductive health data, only if you use cycle tracking. The cycle, period and luteal-phase lengths and period start dates you enter, and, on iPhone and iPad with your permission, menstrual flow and ovulation-test results from Apple Health. FFM uses them to add cycle context to your training and recovery guidance and, while "Use cycle in readiness score" is on (it is on by default), to adjust your readiness score for your cycle phase.
• Recovery check-ins, including mood and stress. The mood, energy, soreness and sleep-quality ratings you log in FFM's recovery journal or tap in the coach, the tags you add (such as poor sleep, high stress, illness or injury) and your notes; on Android, the hours you slept; and on Apple devices, a daily stress level with an optional note. FFM uses them to gauge your recovery and to adjust your training and coaching.
• Biometric data: your voice profile, only if you train your voice on iPhone, iPad or Mac. When you use "Train your voice" in FFM's wake-word settings on an Apple device, FFM records you saying your wake word three times and keeps a voice signature computed from those takes, not the recordings. While "Only respond to me" is on, FFM on that device compares the voice that says the wake word with that signature, so the wake word answers only you. FFM uses it only for that check. FFM for Android 2.3.13 and later keeps no voice profile, and the first time it opens it deletes one an earlier version saved; earlier Android versions stored the signature but never used it to check the speaker.
• Information you enter. Your profile (birthdate, sex, height, weight and body-fat percentage), body-composition measurements you take for a body-fat estimate (neck, waist, hip and abdomen circumference), fitness-test results you record (for tests such as the ACFT, PFT, CFT, PRT and CPAT), injuries you report, food allergies and intolerances, diet type and supplements, workouts and training history, nutrition logs, meal plans, hydration and targets, and what you type or say to FFM's coach. FFM uses it to personalize your workouts, meal plans and coaching.
• Information FFM calculates. Readiness and recovery scores, muscle freshness, one-rep-max estimates, body-fat estimates, fitness-test scores, performance percentiles and training trends, which FFM derives from the data above to plan and adjust your training.
• Feedback you choose to send. The message you type in Send Feedback, which can include health details if you write them. On Android you can also tick a box to attach your local debug log, and, only while "Share quality usage data" is on in Settings, rating a coach reply sends that exchange and any reason you type. We use feedback to read and act on it.

2. Sources of consumer health data

• You, through what you enter, tap, type or say in FFM.
• Your device's microphone, when you speak to FFM or use "Train your voice" on iPhone, iPad or Mac, which is where your voice profile comes from.
• Apple Health on iPhone and iPad, including what your Apple Watch records, and Health Connect on Android, only with your permission.
• Your device's location, with your permission, during live runs, to measure distance.
• FFM's own calculations, made on your device from the sources above.

3. Consumer health data we share, and with whom

Each item below lists the consumer health data that can leave your device and who receives it. None of it is shared until you turn on or use the feature the item names.

• Paid Cloud AI (off by default, requires Full Access: Standard, Premium or Lifetime). Shared: your workout request, including the energy level you set for it; health-derived numbers your device calculated (readiness score, which includes your cycle-phase adjustment while you use cycle tracking with "Use cycle in readiness score" on; sleep hours last night and on average, heart-rate variability, resting heart rate, muscle freshness, performance percentiles, training trends, one-rep-max figures, and recent session and exercise history); your recent recovery check-in ratings for mood, energy, soreness and sleep quality; your AI preferences, which can include injuries you reported, food allergies and intolerances, diet type, supplements and notes you gave the coach; your conversation with the coach, including check-in ratings you tap there; in nutrition coaching, today's calorie, macro and water intake, your targets and goal, and your current weight (on Apple devices, also its 7-day trend); and the transcript of a spoken command if on-device planning of it fails. Recipient: Amazon Web Services (AWS), our processor, which hosts RoxyKovu's service and runs Amazon Bedrock to generate the response.
• Private Cloud Compute (FFM 2.3.13 and later on supported Apple devices; separate opt-in). Shared: the messages you send the coach, including check-in ratings you tap there, workout selections and notes, selected lift one-rep-max numbers, nutrition totals and targets, and selected sleep, heart-rate variability and resting-heart-rate numbers. Recipient: Apple's Private Cloud Compute, some of whose workloads run on Google Cloud infrastructure.
• Apple Health and Health Connect (with your permission). Shared: while "Write workouts to Apple Health" is on (it is on by default), each workout you finish in FFM on iPhone and iPad, with its title, notes, energy burned and distance; each workout you record in FFM on Apple Watch, with its heart rate, energy burned, distance and, for an outdoor run, its route; and, while "Write workouts to Health Connect" is on (it is on by default), each time you finish a workout on Android, the past day's completed workouts and the weight, food entries (calories, protein, carbohydrates, fat and the entry's note) and sleep hours with their recovery notes that you logged in FFM. Recipient: Apple Health on your device, or Health Connect on your Android device, where other apps you allow can read it.
• Feedback you send. Shared: the feedback described in Section 1, sent when you tap send or, on Android while "Share quality usage data" is on, when you rate a coach reply. Recipient: AWS, our processor, which hosts RoxyKovu's feedback service.
• iCloud backups. Shared: if you turn on FFM's optional iCloud Backup (off by default), an encrypted copy of your FFM data, including cycle entries, recovery check-ins, body-composition measurements, your voice profile, health-derived metrics you have logged, and the workouts and period start dates FFM added to your history from Apple Health, but not the other readings FFM reads from Apple Health; and, on iPhone and iPad, if you use your device's own iCloud Backup, all of FFM's data as part of that backup, including your voice profile and the Apple Health readings FFM keeps. Recipient: Apple, which stores both in your own iCloud account.
• Backup files you export on Android (you start it). Shared: when you tap "Export Encrypted Backup" in Settings, Backup & Restore, an encrypted copy of all your FFM data, sealed with a passphrase you choose, including cycle entries, recovery check-ins, body-composition measurements, your coach chat history, and the workouts, weight, nutrition, sleep and other health readings FFM imported from Health Connect. A file exported by a version before 2.3.13 also holds your voice profile if you trained one. Recipient: the place you choose to save the file, such as your device's Files app or a cloud drive.
• Speech recognition. Shared: the audio of what you say, if you use FFM's microphone features. Recipient: your device's speech service, Apple's or the one you selected on Android, which can process that audio on its servers.
• Online food search. Shared: the food name you type and your IP address. Recipient: the U.S. Department of Agriculture's FoodData Central service.
• Nearby workout sharing (you start it). Shared: the custom workout you choose to send and, on Android, the display name you enter. Recipient: the nearby device you pick, over a direct local connection.
• Workout files and shopping lists you share (you start it). Shared: a custom workout you choose to share, as an .ffmworkout file holding its name, notes, exercises, sets, reps, weights and rest times (on Android, with a text summary of the same), or a meal plan's shopping list, as text. Recipient: the app or person you pick in your device's share sheet.
• Performance Card (you start it). Shared: the card image you choose to share or save, which shows your name and age if you entered them, a progress photo if you add one, and your fitness scores: capability score, best one-rep maxes, average run pace, population percentiles, consistency and program. Recipient: the app or person you pick in your device's share sheet or, on iPhone and iPad, your photo library.
• Affiliates: none. We share FFM consumer health data with no affiliates.

4. Your rights, and how to use them

• Your rights: you can ask us to confirm whether we collect, share or sell your consumer health data and to give you access to it, including a list of the third parties and affiliates it was shared with and a way to contact them; to delete it; and to withdraw your consent to its collection and sharing.
• On your device: you can turn off Paid Cloud AI, withdraw Private Cloud Compute consent, and turn off "Share quality usage data", cycle tracking, "Use cycle in readiness score", "Write workouts to Apple Health", "Write workouts to Health Connect" and iCloud Backup in FFM at any time. On iPhone, iPad and Mac, "Clear", beside the "Trained" date under "Retrain your voice" in FFM's Wake Word settings (shown while Wake Word is on), deletes your voice profile; FFM for Android 2.3.13 and later deletes any voice profile an earlier version saved. You can revoke Apple Health or Health Connect access in your device settings, and leave FFM out of your device's iCloud Backup in iOS settings. Reset Profile Data and Clear Workout Data in FFM's Settings delete that data from your device, as does deleting the app; delete the app's data from your iCloud to remove an iCloud Backup copy, and delete a backup file you exported wherever you saved it. Workouts and other records FFM saved to Apple Health or Health Connect stay there after you delete FFM or its data; delete them in Apple Health or Health Connect.
• Requests to us: email Support@roxykovu.com or use our contact page. FFM has no account, so include any submission, receipt or install identifier the app shows you; if it shows none, include the approximate time you sent feedback, its category and its opening words, so we can find your records. We respond within 45 days, which we may extend once by 45 days when reasonably necessary, and we tell you if we do. After we delete a record at your request, a copy can remain in our continuous backup for up to 35 more days, and then it ages out on its own.
• Appeals: if we decline a request, you can appeal by emailing Support@roxykovu.com with the subject line "Privacy Appeal". We answer an appeal in writing, with our reasons, within 45 days. If we deny your appeal, you can submit a complaint to the Washington State Attorney General at atg.wa.gov/file-complaint.