Consumer Health Data Notice

Depending on what you choose to provide and which features you use, Aleen may collect or infer:

• body measurements, weight history, goal weight, body-composition information, and energy or macro estimates;
• diagnosed conditions and metabolic context, including PCOS, insulin resistance, prediabetes, type 2 diabetes, or hypothyroidism;
• GLP-1 or other weight-management medication status, supervision, and injection day — not prescription or dosing authority;
• pregnancy, postpartum, breastfeeding, menstrual and cycle information;
• symptoms, sleep, stress, injuries, limitations, medical restrictions, and health free text;
• nutrition choices, dietary restrictions, training history, exercise performance, adherence, recovery signals, progress, and your optional answer about whether the current week fits your life; and
• if Connected Health is available and you separately enable it, read-only daily summaries for source categories you approve: steps, active energy, workout count and total duration, sleep duration, body weight, and resting heart rate; and
• inferences derived from these data, including BMI, cycle phase, estimated strength, energy direction, plan safety holds, and longitudinal plan adjustments.

Connected Health processes permitted source records into daily summaries on your device. Aleen does not receive minute-by-minute heart-rate samples, exercise routes, device identifiers, clinical records, medication records, or blood-glucose records through this feature.

We collect health data directly from you during onboarding, check-ins, settings, coach conversations, and workout or meal logging; automatically from your use of Aleen; and by deriving estimates from those inputs. In supported builds, and only after separate explicit consent, Aleen may also receive the daily summaries described above from the connected health service you choose to authorize. You may approve only some categories. Refusing, narrowing, or revoking Connected Health does not block the rest of Aleen. Aleen does not collect precise location.

• to provide the training, nutrition, coach, safety, progress, and adaptation features you request;
• to determine when a plan must pause, stay at maintenance, reduce or earn volume, or avoid an exercise;
• to prevent unsafe medical output and direct urgent or clinical questions to qualified care;
• to secure, debug, and audit the service and comply with law.

In supported builds, after renewed disclosure and your separate choice to use connected context for training, Aleen may use recent sleep summaries in its rules-based weekly review and optional pre-session check. Repeated short-sleep context can hold weekly workload increases or support about 15% fewer baseline sets alongside your completed training and check-in. Before a session, today’s sleep can prompt a check on how you feel, but cannot reduce the workout on its own. Your answer after warming up can keep the session, modestly reduce its set targets for today, or recommend rest if you feel worse. Aleen records your optional answers, any reason you provide for finishing early and the resulting session decision; recovery-adjusted effort is not treated as failed strength performance. WHOOP sleep takes priority when the same day is available from more than one source; Apple Health and Health Connect are fallbacks, not extra votes. Wearable data alone cannot prescribe a deload, diagnose a condition, establish recovery, or change nutrition targets. Imported workouts do not count as completed Aleen sessions. You can disable training use without disconnecting Apple Health or Health Connect. Existing Aleen training decisions and brief explanations remain in your plan history until account deletion; imported summaries can be removed with Disconnect and delete imported data.

The app asks for affirmative consent before collecting and using this information. If consent is withdrawn, plan and coach processing stop until consent is given again. Account deletion is always available separately.

We do not sell consumer health data and do not share it for advertising. The processors necessary to deliver Aleen may receive limited health data:

• Supabase — authentication, database, and storage infrastructure;
• Railway — API hosting and operational security;
• Anthropic (Claude API) — coach responses, semantic safety checks, and internal structured plan review. Coach requests may include your messages and recent conversation, name, goals, preferences, local date and time zone, relevant conditions, medication and reproductive or cycle information, sleep, stress, injuries, supplements, free-text notes, current training and nutrition plan, and recent workout and weigh-in summaries. Safety checks use message or reply text and relevant conditions. Internal plan review uses structured profile and plan summaries without your name or free-text notes. The app describes this sharing and requests explicit consent before sending data; and
• Mobile delivery and identity providers — app delivery, optional notifications, or sign-in. We do not place health details in notification text or identity profile fields.

Processors are contractually limited to providing services to us. We require them, including our AI provider, to provide the same or an equivalent level of protection as described in this notice and our Privacy Policy, with confidentiality, security, and data-protection obligations. These safeguards do not replace your prior consent or expand the purposes for which your data may be used. See the Privacy Policy for the Anthropic Data Processing Addendum and further details.

We may also disclose data when legally required or necessary to prevent fraud or serious harm. No data broker receives it.

Connected-health summaries are processed only by Aleen and the API and database providers required to deliver the feature. They are not sent to AI or large-language-model providers, Prism, product analytics, crash reporting, advertising, marketing, data brokers, or model-training systems.

In supported builds, you may separately consent to send an equipment photo through Aleen’s API to Anthropic (Claude API) for identification. This image request does not include your health profile, conditions, connected-health summaries, account identity, messages, or workout history. Exercise eligibility is checked separately by Aleen using your existing permissions and limits.

Photograph equipment only, without people, body images, medical documents or personal details. Aleen removes image metadata and does not store the photo. Anthropic’s standard API retention is generally up to 30 days, subject to limited safety, legal, or separately agreed exceptions; inputs and outputs are not used for model training by default. Declining the photo feature leaves manual exercise search and your saved plan available. See the Privacy Policy for the full flow, operational records and deletion details.

Subject to applicable law and verification, you may:

• confirm whether we collect, share, or sell your consumer health data;
• access the data and obtain a list of relevant third parties or processors;
• withdraw consent for future collection or processing;
• request deletion from Aleen and notification of the deletion request to processors; and
• appeal a refusal by replying to our decision with “Appeal” and your reasons.

Use Settings in the app or email privacy@aleen.fit. We generally act within 45 days. We may extend once where law permits and will explain why. If an appeal is denied, Washington residents may contact the Washington Attorney General and Nevada residents may contact the Nevada Attorney General.

For Connected Health, revoking source access stops future imports. Aleen’s separate Disconnect and delete imported data control removes stored daily summaries, connection metadata, and Connected Health consent records without deleting records held by the source service. Deleting your Aleen account also deletes these Connected Health records, subject to the backup schedule in the Privacy Policy.

See the Delete Account page for the exact deletion steps.

Other websites or online services may collect consumer health data about your activity over time and across different websites. Aleen does not permit third-party advertising trackers to collect consumer health data through the mobile app or these legal pages. We will obtain any separate consent required before introducing such collection.

If we materially change the categories, purposes, sources, or recipients described here, we will provide notice and request new consent where required before the new processing begins.

Questions, requests, or appeals: privacy@aleen.fit.

Operator: Kobas Labs LLC, 2093 Philadelphia Pike, Claymont, Delaware 19703, United States · +1 617 602 8027.

In supported builds and for accounts included in the staged rollout, you can separately authorize a read-only WHOOP connection. When you request a read, WHOOP sends Aleen the latest seven days of sleep duration, recovery score, RMSSD heart-rate variability, resting heart rate, physiological-cycle strain, and workout strain and duration, with record timestamps and scoring status. This is separate from Apple Health and Health Connect; “cycle” here means a WHOOP activity/recovery cycle, not menstrual-cycle data.

With the updated session-and-weekly WHOOP training consent, preparing a workout authorizes one bounded server read of recent sleep and recovery to find today’s scored records. Short sleep or low recovery can prompt an optional check, never an automatic reduction. Your report after warming up determines whether today’s session stays as planned, becomes lighter, or gives way to rest. Submitting a weekly check-in also authorizes a read for the previous calendar week, within the last 14 days. Repeated low recovery or short sleep can hold weekly workload increases or support a lighter week alongside your training and check-in. The server processes WHOOP measurements in memory: raw records and displayed summaries are not stored in Aleen databases, backups, logs, or analytics. Your answers, resulting Aleen training decision and a brief explanation are retained in your history, not WHOOP scores or a longitudinal archive of WHOOP measurements. The mobile display clears when closed or when the app leaves the foreground. WHOOP measurements are not sent to AI providers, advertising, or model-training systems. There is no scheduled background health-data synchronization. Disconnecting WHOOP stops future reads and use; existing Aleen plans remain until account deletion.

We store encrypted connection tokens, the Aleen account identifier, granted permissions, consent version, and connection/read timestamps in our server-controlled infrastructure, including Railway and Supabase. Tokens never go to the mobile client. These connection records allow the requested read and renewal of authorization; they contain no WHOOP health measurements. Our service providers process the connection on our behalf under the protections described in this policy.

You may decline WHOOP without affecting the rest of Aleen. Disconnect WHOOP removes active-service tokens and pending authorization records and requests revocation at WHOOP; if remote revocation cannot be confirmed, the app says so and you can remove Aleen in WHOOP’s connected-app settings. Account deletion removes associated connection records. Encrypted connection metadata may remain in restricted infrastructure backups for the backup period described in the Privacy Policy; it is not used for further reads. Records held by WHOOP are not deleted by Aleen. Contact privacy@aleen.fit for access or deletion questions.