Consumer Health Data Privacy Policy

1. Scope

This Consumer Health Data Privacy Policy is separate from Wera’s general Privacy Policy. It applies to consumer health data Wera controls and is intended to provide the disclosures and rights required by consumer health privacy laws, including Washington’s My Health My Data Act and Nevada’s consumer health data law.

Wera Technologies Inc., a New York corporation operating Wera, is the controller of the consumer health data described here. Contact Wera at team@wera.run with a question or request.

2. Consumer health data Wera collects

• Profile and goals: birthdate, age, sex, preferred units, target event and date, target time, current fitness and training state, training history, recent and peak weekly distance, available training days, and strength-training preferences.
• Activity and workout data: activity type, date and time, duration, distance, pace or speed, calories, elevation, training load, source device, workout details, and outdoor workout routes or GPS coordinates.
• Cardiovascular and fitness data: heart-rate summaries and samples, resting heart rate, heart-rate variability, VO₂ max, zones, fitness estimates, and related timestamps.
• Recovery and sleep data: sleep timing and duration, sleep summaries, recovery indicators, and data used to calculate Wera Body Score.
• Inferences and generated data: Body Scores, training readiness and load calculations, generated plans, paces, adaptations, adherence, and other fitness-related inferences produced from the information above.
• Weather and location: Current-device weather uses coordinates rounded to three decimal places (about 110 meters in latitude; longitude precision varies by location). Wera sends those coordinates to Apple WeatherKit for forecasts and directly from your device to BigDataCloud to display a city or locality name. BigDataCloud also receives your IP address and states that it aggregates coordinate/IP pairings to improve its own IP-geolocation data. Separately, Wera uses locations and times from imported outdoor workouts to estimate historical conditions and weather-adjusted running pace. Historical WeatherKit requests round coordinates to four decimal places (about 11 meters in latitude); they are not controlled by your current-device location permission. Imported routes, calculated results, and associated cached weather evidence may be retained with your activity history.
• Optional health-related support information: health or training details and screenshots you choose to include in feedback or support requests.

Some of these categories—including routes, precise location, biological measurements, and health inferences—may be considered sensitive data under applicable law.

3. Sources

• information you enter during onboarding, account use, or support;
• Apple Health data you authorize Wera to read from your device;
• Garmin data you authorize Garmin Connect to provide directly to Wera through the Garmin Connect Developer Program, or data you previously authorized Terra to retrieve and provide to Wera;
• supported wearable devices and services acting at your direction; and
• calculations and inferences Wera generates from those sources.

4. Why Wera collects and uses it

• create, save, display, and adapt your training plan;
• calculate training paces, fitness estimates, load, recovery indicators, and Body Score;
• import, organize, and display workouts and activity history;
• connect and maintain the wearable services you request;
• estimate historical workout conditions and weather-adjusted pace from imported route locations and timestamps, and provide local forecasts and locality names using device location when enabled;
• provide support, investigate errors, secure the Service, and honor your privacy requests; and
• comply with applicable law and valid legal process.

Wera does not use consumer health data for advertising, profiling unrelated to the requested fitness service, employment, credit, insurance, healthcare eligibility, or data-broker activity.

5. Consumer health data Wera shares

Wera shares data only as reasonably necessary to provide the feature you request, with the recipients described below, or when required by law. BigDataCloud also uses coordinate/IP pairings for its independent geolocation-data improvement:

• Terra: Garmin account identifiers, authorization status, and the health and fitness categories you approve. Terra facilitates authorization, retrieves and normalizes the data, delivers it to Wera, and processes deletion or deauthentication requests. Review Terra’s End User Privacy Policy.
• Garmin Connect: for a direct connection you authorize, Garmin provides Wera the permitted health and activity categories and receives structured workouts or plans you ask Wera to send. Wera keeps the connection credentials on its server and uses them only to maintain the authorized integration.
• Supabase: the consumer health categories Wera stores, together with the account identifier needed for authentication, database hosting, and private file storage.
• Vercel: information transmitted through Wera’s application and limited request or diagnostic information needed to host and operate the Service.
• Apple WeatherKit: current-device coordinates rounded to three decimal places and forecast windows, plus imported workout coordinates rounded to four decimal places and workout times for historical weather. Requests do not include your account identifier or heart-rate samples.
• BigDataCloud: current-device coordinates rounded to three decimal places and your IP address for locality lookup and its independent improvement of IP-geolocation data. See its privacy policy.
• Resend: health-related text or screenshots only when you choose to include them in a support or feedback submission that Wera sends to its support inbox.
• OpenAI: the current Progress experience does not send running signals to OpenAI. Redacted support or feedback text may be used to organize requests into tickets; it can contain health or training details you choose to provide. Wera does not attach imported Garmin records to support classification. Redaction is not a guarantee that health details you type into a support message are removed.
• Legal and safety recipients: the minimum information required by valid legal process or reasonably necessary to protect a person, Wera, or the Service.

Wera does not sell consumer health data. Wera has no affiliates with which it shares consumer health data for independent purposes. If Wera ever proposes a sale of consumer health data, it will first request the separate written authorization required by law.

6. Your consent and wearable permissions

Before onboarding, Wera asks you to make a separate, affirmative choice consenting to the collection and use described here. Opening this policy is optional; selecting the health-data checkbox is the action that records consent. Apple Health and Garmin also present their own provider-level permission steps, where applicable.

You may withdraw consent at any time by changing Apple Health permissions, revoking Garmin access, deleting your Wera account, or emailing team@wera.run. Turning off a device permission or disconnecting a provider stops that source’s future access, but does not erase imported data or itself stop every use of existing records. To pause health-data collection and processing on Wera’s servers, open Settings → Health-data consent and confirm withdrawal. This keeps your account and existing history, but pauses new imports and health-based calculations. You can review the policies and give consent again to resume. Requests already in flight may finish; subsequent health writes are blocked. For requests concerning particular data or sharing, email the support address above. Withdrawal does not affect earlier lawful processing.

7. Your consumer health data rights

Subject to verification and applicable law, you may request to:

• confirm whether Wera collects, uses, or shares your consumer health data;
• access the consumer health data Wera maintains about you, including a list of the third parties and processors with which it was shared;
• withdraw consent for future collection or sharing;
• correct inaccurate consumer health data;
• delete particular consumer health data while keeping your account, or delete the entire account; and
• appeal Wera’s refusal to act on a request.

Submit a request or appeal to team@wera.run with “Consumer Health Data Request” or “Privacy Appeal” in the subject. Wera may ask for information reasonably necessary to verify that the request belongs to you. Wera will respond within the period required where you live and will explain any denial and available appeal or regulator-contact options.

Wera will not discriminate against you for exercising a privacy right. Some features cannot operate after the data needed for those features is deleted or consent is withdrawn.

8. Deletion

When Wera approves a deletion request, it deletes the covered data from active Wera systems and instructs relevant processors to delete it. For a direct Garmin connection, Wera requests removal of its Garmin registration. For a Garmin account connected through Terra, Wera also sends Terra a deauthentication request so Terra revokes access and deletes its cached connection data.

Archived or backup copies are isolated from ordinary use and are deleted or overwritten under protected backup schedules. Where Washington law applies, deletion from archived or backup systems will be completed as required and no later than six months after the authenticated request, unless law permits or requires retention. Deletion from Wera does not erase records independently controlled by Apple, Garmin, or another wearable provider.

9. Security and retention

Wera uses encrypted network connections, authentication, row-level database access controls, private file storage, server-only credentials, signed wearable webhooks, and access restrictions intended to protect consumer health data. No system can guarantee absolute security.

Wera retains active account, plan, and authorized health information while needed to provide history, calculations, and adaptations, or until you request deletion. More specific retention periods and provider practices are described in the general Privacy Policy. Wera may retain limited information when law requires it or when reasonably necessary to establish, exercise, or defend legal claims.

10. Changes and contact

Wera will post revisions here with a new effective date. If a change materially affects the collection, use, or sharing covered by your consent, Wera will present the change and request renewed consent before continuing the affected processing where required.

Questions, rights requests, consent withdrawals, and appeals may be sent to team@wera.run.