Consumer Health Data Privacy Policy

1. Scope

This Consumer Health Data Privacy Policy is separate from Wera’s general Privacy Policy. It applies to consumer health data Wera controls and is intended to provide the disclosures and rights required by consumer health privacy laws, including Washington’s My Health My Data Act and Nevada’s consumer health data law.

Wera is the controller of the consumer health data described here. Contact Wera at team@wera.run with a question or request.

2. Consumer health data Wera collects

• Profile and goals: birthdate, age, sex, preferred units, target event and date, target time, current fitness and training state, training history, recent and peak weekly distance, available training days, and strength-training preferences.
• Activity and workout data: activity type, date and time, duration, distance, pace or speed, calories, elevation, training load, source device, workout details, and outdoor workout routes or GPS coordinates.
• Cardiovascular and fitness data: heart-rate summaries and samples, resting heart rate, heart-rate variability, VO₂ max, zones, fitness estimates, and related timestamps.
• Recovery and sleep data: sleep timing and duration, sleep summaries, recovery indicators, and data used to calculate Wera Body Score.
• Inferences and generated data: Body Scores, training readiness and load calculations, generated plans, paces, adaptations, adherence, and other fitness-related inferences produced from the information above.
• Optional health-related support information: health or training details and screenshots you choose to include in feedback or support requests.

Some of these categories—including routes, precise location, biological measurements, and health inferences—may be considered sensitive data under applicable law.

3. Sources

• information you enter during onboarding, account use, or support;
• Apple Health data you authorize Wera to read from your device;
• Garmin, COROS, or Amazfit/Zepp data you authorize Terra to retrieve and provide to Wera;
• supported wearable devices and services acting at your direction; and
• calculations and inferences Wera generates from those sources.

4. Why Wera collects and uses it

• create, save, display, and adapt your training plan;
• calculate training paces, fitness estimates, load, recovery indicators, and Body Score;
• import, organize, and display workouts and activity history;
• connect and maintain the wearable services you request;
• provide support, investigate errors, secure the Service, and honor your privacy requests; and
• comply with applicable law and valid legal process.

Wera does not use consumer health data for advertising, profiling unrelated to the requested fitness service, employment, credit, insurance, healthcare eligibility, or data-broker activity.

5. Consumer health data Wera shares

Wera shares data only as reasonably necessary to provide the feature you request, with processors acting under Wera’s instructions, or when required by law:

• Terra: Garmin, COROS, or Zepp account identifiers, authorization status, and the health and fitness categories you approve. Terra facilitates authorization, retrieves and normalizes the data, delivers it to Wera, and processes deletion or deauthentication requests. Review Terra’s End User Privacy Policy.
• Supabase: the consumer health categories Wera stores, together with the account identifier needed for authentication, database hosting, and private file storage.
• Vercel: information transmitted through Wera’s application and limited request or diagnostic information needed to host and operate the Service.
• Apple WeatherKit: location rounded to approximately 100-meter precision, timezone, and forecast window when you affirmatively enable weather guidance. Wera does not provide WeatherKit with your wearable health record.
• Resend: health-related text or screenshots only when you choose to include them in a support or feedback submission that Wera sends to its support inbox.
• Legal and safety recipients: the minimum information required by valid legal process or reasonably necessary to protect a person, Wera, or the Service.

Wera does not sell consumer health data. Wera has no affiliates with which it shares consumer health data for independent purposes. If Wera ever proposes a sale of consumer health data, it will first request the separate written authorization required by law.

6. Your consent and wearable permissions

Before onboarding, Wera asks you to make a separate, affirmative choice consenting to the collection and use described here. Opening this policy is optional; selecting the health-data checkbox is the action that records consent. Apple Health, Garmin, COROS, and Zepp also present their own provider-level permission steps, where applicable.

You may withdraw consent at any time by changing Apple Health permissions, revoking Garmin, COROS, or Zepp access, deleting your Wera account, or emailing team@wera.run. Withdrawal stops future collection once processed but does not affect processing that was lawful before withdrawal.

7. Your consumer health data rights

Subject to verification and applicable law, you may request to:

• confirm whether Wera collects, uses, or shares your consumer health data;
• access the consumer health data Wera maintains about you, including a list of the third parties and processors with which it was shared;
• withdraw consent for future collection or sharing;
• correct inaccurate consumer health data;
• delete particular consumer health data while keeping your account, or delete the entire account; and
• appeal Wera’s refusal to act on a request.

Submit a request or appeal to team@wera.run with “Consumer Health Data Request” or “Privacy Appeal” in the subject. Wera may ask for information reasonably necessary to verify that the request belongs to you. Wera will respond within the period required where you live and will explain any denial and available appeal or regulator-contact options.

Wera will not discriminate against you for exercising a privacy right. Some features cannot operate after the data needed for those features is deleted or consent is withdrawn.

8. Deletion

When Wera approves a deletion request, it deletes the covered data from active Wera systems and instructs relevant processors to delete it. For a linked Garmin, COROS, or Zepp account, Wera also sends Terra a deauthentication request so Terra revokes access and deletes its cached connection data.

Archived or backup copies are isolated from ordinary use and are deleted or overwritten under protected backup schedules. Where Washington law applies, deletion from archived or backup systems will be completed as required and no later than six months after the authenticated request, unless law permits or requires retention. Deletion from Wera does not erase records independently controlled by Apple, Garmin, COROS, or another wearable provider.

9. Security and retention

Wera uses encrypted network connections, authentication, row-level database access controls, private file storage, server-only credentials, signed wearable webhooks, and access restrictions intended to protect consumer health data. No system can guarantee absolute security.

Wera retains active account, plan, and authorized health information while needed to provide history, calculations, and adaptations, or until you request deletion. More specific retention periods and provider practices are described in the general Privacy Policy. Wera may retain limited information when law requires it or when reasonably necessary to establish, exercise, or defend legal claims.

10. Changes and contact

Wera will post revisions here with a new effective date. If a change materially affects the collection, use, or sharing covered by your consent, Wera will present the change and request renewed consent before continuing the affected processing where required.

Questions, rights requests, consent withdrawals, and appeals may be sent to team@wera.run.