Consumer Health Data Privacy Policy

Who this policy is for

This policy is for people who live in Washington, Nevada or Connecticut, and for anyone whose consumer health data is collected in Washington or Nevada. It explains how Harda handles consumer health data under Washington's My Health My Data Act, Nevada's consumer health data law (SB 370) and Connecticut's consumer health data provisions. Everything else is in our Privacy Policy.

Who we are

Harda is an iPhone and Apple Watch app provided by Roman Tkhoruk, an individual ("we", "us").

Address: Kyrylivska 20, 42, Kyiv, Ukraine
Email: twoja.xata@gmail.com

We have no affiliates.

The consumer health data we collect, and how we use it

We treat everything below as consumer health data, including your training log, because your health can be inferred from how you train. Some of it may fall outside the legal definition. We protect all of it the same way.

Category	What it is	Why we collect it and how we use it
Body measurements	Weight, body fat, waist, chest and biceps that you log, and the weight you give during onboarding	To chart them over time in Progress, and to show your weight in a widget if you add one
Body profile	Height, sex (or "prefer not to say") and age, kept as a birth year, with the training goal and experience you choose in onboarding	To keep your profile. Seryozha, the app's mascot, speaks to you according to the sex you chose, and some of his lines need a minimum age. Your age also decides the under-16 rule below
Apple Watch heart rate and calories	Your heart rate during a workout on the Watch, and each Watch workout's average heart rate and active calories	To show your heart rate on the Watch during the workout, and the average and calories on that workout afterwards
Progress photos	Photos you take or choose in Progress	To show you how you've changed. Each photo is encrypted on your iPhone with a key kept in your iCloud Keychain, so we can't open it. If iCloud Keychain is off and you lose your iPhone, nobody can recover the photos
Data read from Apple Health	If you turn Apple Health on: workouts other apps saved (type, time, active calories and the app's name), plus weight, body fat and waist	To show them in Harda. Another app's workout appears on its day and counts toward your calendar, streak and widgets. Harda reads this data on your iPhone each time it needs it. It never stores it, never sends it to our servers, and never shares it
Training log	Workouts (title, times, notes), exercises including ones you create, sets (weight, reps, warm-up, effort, duration, distance), and routines and folders with their notes	To keep your log and history, and to run the training features: the live workout, statistics, records, plans, the Watch and the widgets
What we derive from your training	Statistics, personal bests, muscle distribution, and a summary of your recent training (such as sets per muscle, sessions per week, and which lifts are going up or have stalled)	To show your progress, and to give Adjust with AI the context of a request you make
AI requests	For Adjust with AI: the change you ask for, typed or dictated. It may mention pain, an injury or another health condition. The workout's exercises, set counts, reps and rests, and the summary above, go with it. For Bring in my program: photos of a program, stripped of their metadata, or what you dictate	To answer that request. It goes through our server to the AI provider listed below. We don't keep it on our servers
Limits you give the plan builder	Any pain or limitation you mention in Build a plan	To leave out the exercises your note names. This stays on your iPhone and is never sent to us

Where it comes from

You: what you log, type, dictate or photograph in Harda.
Your Apple Watch: your heart rate and calories, measured during a Harda workout under the Watch's Health permission.
Apple Health on your iPhone: only if you turn it on, and only the types you allow.
ChatGPT: if you connect it, the routines, folders, custom exercises and workouts you save or change there with a tap on Harda's card.
Harda itself: the statistics and summaries it derives from your training.

Siri and Shortcuts

If you ask Siri or run a shortcut that uses Harda, Apple handles what you say or type under Apple's own privacy policy. Harda receives only the result, for example the weight you said, and keeps it on your device like any other entry. Harda sends nothing new to its servers because you used Siri or Shortcuts.

On your iPhone. Logging a set, a measurement or a photo is a request to use that feature, and Harda handles the data to provide it.
Your training log is stored in your account. That's how Harda keeps it safe and brings it back when you sign in on another iPhone.
Before health data leaves your iPhone, we ask. This covers body measurements, your body profile, progress photos, and the Watch's heart rate and calories. Harda asks the first time you save a measurement, add a progress photo, or store a Watch workout with heart rate or calories. Allow keeps them in your account. This iPhone only keeps them on this iPhone, and in your iPhone's own backups if you make them, and the app still works fully. Until you answer, none of this data leaves your iPhone.
Under 16. If the age you gave Harda is under 16, this data stays on your iPhone. We don't ask, and it never goes to our servers. Harda is for people 13 and older.
Change your answer anytime in Profile › Data & Privacy › Health data in your account. Turning it off withdraws your consent. We then delete the copy on our servers, and the data stays on your iPhone.
Sharing is a separate choice. We share consumer health data only when you choose to: when you send it, link it or connect a service yourself (see below). Our processors aren't third parties. They work for us, only to provide Harda.
Usage statistics include counts and durations from your training (see PostHog below). They stay on until you turn off Share usage data in Profile › Data & Privacy.

Who receives it

Our processors

Processors handle data only on our instructions and under contract, to run Harda.

Processor	What it receives	Why
Supabase, on Amazon Web Services servers in Ireland	Your account: your training log, and the health data you allow	To store your account and run our servers
OpenRouter (United States), and the company it chooses to run the AI model	An AI request you make (see above)	To answer it. Our settings tell them to keep no copy and not to train on it. DeepSeek's own servers are never used
Apple	Notifications to your friends: your name or nickname, the title of a workout you sent them, and reminders about your shared streak. Speech you dictate, when your iPhone can't turn it into text on the device	To deliver push notifications, and to transcribe dictation
PostHog (United States)	Counts and durations, under a one-way code made from your account ID. For example: that a workout started or finished, how long it took, how many exercises, sets and new bests it had, how many fields a measurement entry had, and which screens you opened. It never receives a weight, a measurement value, heart rate, calories, an exercise name or anything you type	Usage statistics, to improve Harda. Kept for one year. Turn it off with Share usage data
Vercel (United States), our website host	The ChatGPT connection's traffic, on its way between ChatGPT and our servers	To carry that traffic

Others, only when you choose

Friends you send a workout to. They get its title, finish time and duration, and each exercise's name with its completed sets (weight × reps, and which sets were warm-ups). They never get your notes, body measurements, body profile, photos, heart rate or calories. Your shared streak counts the workouts you send each other. A friend keeps what you sent, even after the friendship ends or one of you blocks the other.
OpenAI, through ChatGPT, if you subscribe and connect Harda to ChatGPT. You confirm what it can do on a consent page first. It can read what's in your account: your workouts (titles, dates, notes, sets and effort) and the statistics and personal bests worked out from them, your folders and routines with their notes, exercises including ones you created, and your goal, experience and units. If you allow changes there, it can prepare new routines, plans, folders, custom exercises and workouts you describe, and changes or deletions of routines, folders, workouts and custom exercises. Each one is saved only when you tap the button on Harda's card in ChatGPT. It never gets your body measurements, heart rate, calories, progress photos, height, sex, age or anything from Community, and it can't add or change body measurements. OpenAI handles what it receives under its own privacy policy. You can disconnect anytime at harda.xata.agency/oauth/connections.
Anyone you send a link or a card to. A link to a routine or folder shows its name, schedule, rest times and planned sets, but never notes or history. Anyone who has the link can see it, even without signing in. A link can't be withdrawn once you send it, and it works until you delete your account. A workout card is an image you send yourself. It never shows heart rate or calories.
Apple Health, if you turn it on. Harda saves your finished workouts there, and the Watch app saves its workouts with heart rate and calories. Apple Health lives on your devices and follows Apple's privacy policy and your Health settings.

If you ask, we send you each recipient's contact details (see "Your rights").

What we never do

We never sell consumer health data.
We never use it for advertising, and Harda shows no ads.
No third party collects consumer health data about you over time and across other websites or apps through Harda.
We don't use geofencing. We don't collect your precise location, and we don't draw virtual boundaries around health care facilities or any other place.

Your rights

Confirm and access. Ask us whether we collect, share or sell your consumer health data, and get a copy of it. The copy includes a list of every third party and affiliate we've shared it with, with an email address or web form for each one. We have no affiliates.
Review and correct. You can see most of your data in the app and change much of it there: log a new value, delete an entry or a workout, edit a routine. For anything else, email us and we'll correct it.
Withdraw consent. Turn off Profile › Data & Privacy › Health data in your account. We delete the copy on our servers, and new health data stays on your iPhone. To stop sharing, stop sending workouts and links, and disconnect ChatGPT.
Delete. Use Profile › Delete Account (you can also reach it from the subscription screen without paying), or email us. Deleting your account deletes everything it holds on our servers, photo storage included, and erases Harda's data on your iPhone. To delete only part of your data, email us and say what. When you delete a single item in the app, it disappears at once but stays on our servers until you delete your account. Email us to have it removed sooner.

We won't treat you differently for using any of these rights.

How to ask

Email twoja.xata@gmail.com. We confirm that the request comes from you, usually by writing to the email address on your Harda account.

We answer within 45 days. If we need more time, we can extend that once by another 45 days. If we do, we tell you within the first 45 days, with the reason. Requests are free, up to twice in any 12 months.

Appeals

If we decline all or part of a request, we tell you why. To appeal, email twoja.xata@gmail.com with "Appeal" in the subject line. We answer in writing within 45 days of receiving it, and explain what we did and why.

If we deny your appeal, you can file a complaint with your state's Attorney General:

Washington: the Attorney General's Office, through its "File a Complaint" page at atg.wa.gov/file-complaint
Nevada: the Office of the Attorney General's Bureau of Consumer Protection, through the complaint form at ag.nv.gov
Connecticut: the Office of the Attorney General, through its complaint form at portal.ct.gov/ag/common/complaint-form-landing-page (choose "Consumer Data Privacy" as the subject)

How deletion reaches everyone who has your data

When we delete your data, whether because you withdrew consent, deleted your account or asked us to:

Our servers (Supabase): it is deleted from the database and from file storage. Copies in our database backups are replaced as the backups roll over, within six months at most.
OpenRouter and the AI model host: they keep no copy, so there is nothing to delete.
Apple: deleting your account removes the push tokens Apple uses to reach your phone.
PostHog: your usage events are deleted after one year. If you email us to delete your data, we also delete them at PostHog.
OpenAI: if you connected ChatGPT, we pass your deletion request on to OpenAI. You can also delete those chats in ChatGPT yourself.
Friends: deleting your account removes the workouts you sent from our servers. A copy already on a friend's phone may stay there.
Your devices: the Watch app keeps its own copy until you delete Harda from your Watch. What Harda saved to Apple Health stays there until you delete it in the Health app. Backups of your iPhone keep what they already hold.

Changes to this policy

When we change this policy, we post the new version here with a new effective date. A material change means collecting a new category of consumer health data, using it for a new purpose, or sharing it with a new kind of recipient. Before one takes effect, we tell you in the app or by email, and we ask for your consent where the law requires it.