Consumer Health Data Notice

Depending on what you choose to provide and which features you use, Aleen may collect or infer:

• body measurements, weight history, goal weight, body-composition information, and energy or macro estimates;
• diagnosed conditions and metabolic context, including PCOS, insulin resistance, prediabetes, type 2 diabetes, or hypothyroidism;
• GLP-1 or other weight-management medication status, supervision, and injection day — not prescription or dosing authority;
• pregnancy, postpartum, breastfeeding, menstrual and cycle information;
• symptoms, sleep, stress, injuries, limitations, medical restrictions, and health free text;
• nutrition choices, dietary restrictions, training history, exercise performance, adherence, recovery signals, and progress; and
• inferences derived from these data, including BMI, cycle phase, estimated strength, energy direction, plan safety holds, and longitudinal plan adjustments.

We collect health data directly from you during onboarding, check-ins, settings, coach conversations, and workout or meal logging; automatically from your use of Aleen; and by deriving estimates from those inputs. We do not currently import health records, HealthKit, Health Connect, or precise location.

• to provide the training, nutrition, coach, safety, progress, and adaptation features you request;
• to determine when a plan must pause, stay at maintenance, reduce or earn volume, or avoid an exercise;
• to prevent unsafe medical output and direct urgent or clinical questions to qualified care;
• to secure, debug, and audit the service and comply with law.

The app asks for affirmative consent before collecting and using this information. If consent is withdrawn, plan and coach processing stop until consent is given again. Account deletion is always available separately.

We do not sell consumer health data and do not share it for advertising. The processors necessary to deliver Aleen may receive limited health data:

• Supabase — authentication, database, and storage infrastructure;
• Railway — API hosting and operational security;
• Anthropic — coach responses, semantic safety checks, and internal structured plan review; and
• Expo, Apple, and Google — app delivery, optional notifications, or sign-in. We do not place health details in notification text or OAuth profile fields.

Processors are contractually limited to providing services to us. We may also disclose data when legally required or necessary to prevent fraud or serious harm. No data broker receives it.

Subject to applicable law and verification, you may:

• confirm whether we collect, share, or sell your consumer health data;
• access the data and obtain a list of relevant third parties or processors;
• withdraw consent for future collection or processing;
• request deletion from Aleen and notification of the deletion request to processors; and
• appeal a refusal by replying to our decision with “Appeal” and your reasons.

Use Settings in the app or email privacy@aleen.fit. We generally act within 45 days. We may extend once where law permits and will explain why. If an appeal is denied, Washington residents may contact the Washington Attorney General and Nevada residents may contact the Nevada Attorney General.

See the Delete Account page for the exact deletion steps.

Other websites or online services may collect consumer health data about your activity over time and across different websites. Aleen does not permit third-party advertising trackers to collect consumer health data through the mobile app or these legal pages. We will obtain any separate consent required before introducing such collection.

If we materially change the categories, purposes, sources, or recipients described here, we will provide notice and request new consent where required before the new processing begins.

Questions, requests, or appeals: privacy@aleen.fit.

Operator: KobasLabs LLC, 2093 Philadelphia Pike, Claymont, Delaware 19703, United States · +1 617 602 8027.