HAC PRIVACY NOTICE

1. INFORMATION WE COLLECT

The following table describes each category of data we collect, whether it is required or optional, the purposes for which it is used, and the categories of recipients.

We do not collect precise geolocation, biometric identifiers, education information, or financial account numbers. HAC does not receive or store payment card details; billing is managed entirely by Apple and Google.

Menstrual/reproductive data is listed as “required” in the table above because the Service’s core functionality—hormone-informed, cycle-aware training insights—cannot operate without it. Processing this data is necessary to provide the Service you have asked us to provide. If you do not wish us to process it, you will not be able to use the Service, and you may delete your account at any time (see §5.3 and §5.4).

2. HOW WE USE YOUR INFORMATION

2.1 Core Service (Required Processing)

Account creation and authentication; generating personalized training, recovery, and nutrition insights; cycle predictions and pattern tracking; data visualization; subscription management; customer support; and security monitoring.

2.2 Model Training and Improvement

• Individualized personalization: Your identifiable, account-level data is processed to generate your personal insights. This is core Service functionality.
• General model improvement: De-identified and/or aggregated data improves algorithm accuracy across the user population. Individual account-level data is not used in identifiable form for general model training.
• Quality assurance: De-identified data may be used to test new features before release.
• Internal algorithm research: Improving prediction models and developing new analytical approaches.
• Product analytics: Our product analytics provider receives events describing how the App and dashboard are used—screens viewed, features used, timings, device type and app version—under a pseudonymous identifier that we can link to your account. Some of these events include limited health-related context, such as the range of cycle days an insight related to. They do not include your name, email address, free-text entries, or your cycle, hormone, or health-platform logs.

We maintain a separate internal database of de-identified health data that we use for the internal model improvement, quality assurance, and algorithm research described above. Every active account is included in this database, whether or not you have given research consent, and your identifying details are replaced with a code before your data enters it. Research consent governs whether de-identified data derived from your account may be shared outside HAC (see §2.3 and §4). It does not govern this internal use.

De-identified datasets used for model improvement and quality assurance are access-restricted to authorized personnel only. Where any re-identification key or linkage table exists, it is stored separately from de-identified datasets with restricted access controls. De-identified data is never used for advertising, third-party audience building, or any purpose inconsistent with the uses described above.

2.3 Research (Optional Processing)

Subject to your separate, optional research consent, de-identified and/or aggregated data may be used for:

• Research collaboration: Sharing de-identified datasets with academic institutions and research organizations.
• Publication: Publishing findings in scientific journals or at conferences. Published research never identifies individuals.

2.4 Communications

Transactional communications are required. We do not currently send marketing communications. If we begin to, we will obtain your consent first and provide a way to opt out.

2.5 Security and Legal Compliance

Fraud and incident detection, safety protection, Terms enforcement, and legal compliance.

3. HOW WE SHARE YOUR INFORMATION

We do not sell your personal information to third parties.

3.1 Service Providers

We confirm that: the recipients above are the principal third parties that receive HAC user data, and the description of what each receives is accurate as of the date of this Notice; no SDK contract grants the provider rights inconsistent with our “no sale” and limited-use commitments; and our app store privacy nutrition labels are aligned with these disclosures.

All service providers with access to user data are contractually required to promptly notify HAC of any security incident affecting HAC user data, as described in Section 6.3.

3.2 Research Partners (De-Identified Data Only)

Subject to your research consent, we may share de-identified and/or aggregated data with research partners. Partners are contractually prohibited from attempting re-identification.

3.3 Third-Party Integrations

Data flows with connected services (Apple Health, Google Health Connect, etc.) are governed by the permissions you grant. You can disconnect at any time.

3.4 Legal Requirements

We may disclose information to comply with valid legal obligations, respond to lawful government requests, prevent harm, or enforce our Terms of Use.

3.5 Business Transfers

In the event of a merger, acquisition, or similar transaction, your information may be transferred. Where practicable and legally permitted, we will provide at least thirty (30) days’ notice and the opportunity to delete your account before the transfer.

3.6 Coaches and Teams

You may choose to connect your account to a coach. Connecting to a coach is entirely optional, you initiate it, and you are asked for separate, affirmative consent at the point of connection. The Service works fully without connecting to a coach.

A connected coach can see:

• Your readiness score and the training you completed or skipped;
• Your self-reported sleep, mood and energy, including how they have trended over time; how your sessions went; and flags we raise when your recent data suggests overreaching or injury;
• Your hydration and fueling entries;
• Your injury details, including how the injury started, days out, your recovery check-in scores for pain, mood and symptoms, and your recovered date;
• Your profile photo, if you have added one;
• Your name, and, when you send a connection request, your age (not your date of birth) and your city and state if you have provided them.

A connected coach cannot see your cycle day, cycle phase, period predictions, cycle start dates, or basal body temperature. This restriction is enforced in our systems, not only by policy. Your email address is not shown to coaches.

You may connect to more than one coach. You or the coach may end a connection at any time; when a connection ends, the coach’s access to your data ends and any training plans that coach assigned are deactivated. Connection codes expire after 30 days. A coach may ask us to email an invitation to a person who is not yet a HAC user; in that case we use the name and email address the coach provides solely to send the invitation.

4. DATA DE-IDENTIFICATION AND RESEARCH

4.1 De-Identification Methods

When we use data for model improvement, research, or publication, we apply de-identification methods designed to reduce the likelihood of re-identification:

• Removal of direct identifiers: As a methodological benchmark, we remove the 18 categories of identifiers specified under the HIPAA Safe Harbor standard (45 CFR 164.514(b)(2)). This is a de-identification methodology we adopt voluntarily; it does not mean HAC is subject to HIPAA or has obtained formal HIPAA certification.
• Aggregation: Where possible, data is combined across many users to create statistical patterns.
• Generalization: Specific values are converted into ranges (e.g., age ranges, geographic regions).
• Data minimization: Only the minimum data necessary for the specific purpose is extracted.

Outputs drawn from our internal de-identified database are suppressed where they would describe fewer than five people internally, or fewer than ten people in anything shared outside HAC.

We describe this data as “de-identified” rather than “anonymous” because no de-identification technique can guarantee zero residual risk with absolute certainty, particularly for rich, longitudinal health datasets. We continuously evaluate our techniques as methods and re-identification risks evolve.

4.2 Contractual Protections

We commit not to attempt to re-identify individuals from de-identified data. We contractually require every research partner and downstream recipient to make the same commitment and implement reasonable safeguards.

4.3 Distinction Between Uses

• Internal model improvement: De-identified data used to tune algorithms. Stays within HAC’s systems. Access-restricted. All accounts are included, regardless of research consent (see §2.2).
• Research collaboration: De-identified datasets shared with external partners under contract. Partners may not attempt re-identification. Only accounts with research consent are included.
• Publication: Only aggregated findings. Individual-level records are never published.

4.4 No Sale of Personal Data

We do not sell personal information. We do not receive payment from research partners for user data.

4.5 Research Consent and Withdrawal

Research consent is separate and optional. You can change your preference at any time. You can give research consent in your account settings. To withdraw it, tap “Stop contributing my data” on the Research & Data screen in your account settings. Withdrawal takes effect immediately. Withdrawal applies to future research only. Data already shared with a research partner before withdrawal cannot be recalled. If you have deleted your account, the de-identified research data derived from it is retained, but the key linking it back to you is destroyed at deletion, so it can no longer be connected to you (see §5.3).

5. YOUR PRIVACY RIGHTS AND CHOICES

5.1 Access and Portability

Access your data through account settings or by contacting us. You can request a portable copy of your full account data by emailing us at emily@teamhac.com. We deliver it as a JSON file through a time-limited download link sent to the email address on your account. We respond within thirty (30) days.

5.2 Correction

Correct information through account settings or by contacting us.

5.3 Deletion

Delete your account through the App or by contacting us. Deletion in the App is immediate and permanent, and you will be asked to confirm your identity first. Before deleting, we offer to email you a copy of your data.

Deleting your account removes your account, your health logs, your insights, your devices and sessions, your imported wearable data, and the key that links you to any de-identified research data. We also delete your account at our wearable integration and authentication providers, and delete your data at our product analytics provider. At our error-monitoring provider we delete feedback you submitted; diagnostic error reports age out under that provider’s retention period.

The following are retained after deletion:

• Consent records, for five (5) years, including your account identifier. We retain these to establish, exercise or defend legal claims about what you agreed to.
• Your answer to our pre-deletion offer to email you a copy of your data, for five (5) years.
• A record that a deletion occurred, which does not contain your account identifier.
• De-identified research data, with the key linking it to you destroyed.
• Records of actions taken by HAC staff, with the link to you removed.
• Financial records, reassigned to an anonymous placeholder account.
• Feedback you submitted, held in the internal collaboration tools described in §3.1, which have no per-user deletion method (see §7).

Backup copies age out on their normal cycle. We do not restore deleted accounts from backups.

5.4 Withdrawal of Consent

Processing your health data is necessary to provide the Service, so there is no way to continue using HAC without it. If you no longer want us to process your health data, delete your account, which you can do in the App at any time (see §5.3). Deleting your account is how you withdraw from health data processing, and it takes effect immediately.

Before you delete, we offer to email you a copy of your data so you can keep it. De-identified data derived from your information before deletion, which can no longer identify you, is not affected. Withdrawal does not affect the lawfulness of processing carried out beforehand. You may also withdraw research consent separately without affecting Service functionality. See §4.5. You may also disconnect a coach at any time without affecting anything else (see §3.6).

5.5 Appeal

If we deny a privacy request, you may appeal by contacting us. We respond within sixty (60) days. If denied, you may contact your state’s regulatory authority.

5.6 Identity Verification and Authorized Agents

To protect your privacy, we may require reasonable verification of your identity before processing a privacy rights request. If you submit a request through an authorized agent, we may require the agent to provide proof of written authorization and may independently verify your identity where permitted by law.

5.7 Marketing

We do not currently send marketing communications. If we begin to, we will obtain your consent first, and you will be able to opt out at any time through an unsubscribe link. We honor opt-outs within ten (10) business days.

5.8 How to Exercise Your Rights

The following summarizes where and how to exercise each privacy right:

• In the App (self-service): View and update your profile information; view your tracked health data and history; give or request withdrawal of research consent; connect or disconnect third-party integrations; adjust notification preferences; connect or disconnect a coach; and delete your account. When you begin account deletion, we offer to email you a copy of your data first.
• By contacting us at emily@teamhac.com: Request correction of data you cannot update in-app; request a portable copy of your data as a JSON file; submit an authorized agent request; file an appeal of a denied privacy request; or ask questions about your data or this Privacy Notice.
• On our website: Review the current Privacy Notice and Terms of Use. Washington residents may also review our Consumer Health Data Privacy Policy.

We respond to verified requests within thirty (30) days (forty-five days for California-specific requests). If we need additional time, we will notify you.

6. DATA SECURITY

6.1 Technical Safeguards

Encryption in transit (TLS) and at rest (AES-256); additional field-level encryption of sensitive health fields using AES-256-GCM with keys held in a managed key service; secure cloud infrastructure (AWS, U.S. regions); regular security audits; intrusion detection; secure password hashing and biometric authentication support; regular patching; logging of application reads and writes of our principal health data tables; and re-authentication before account deletion.

6.2 Organizational Safeguards

Privacy and security training for all team members with data access; defense-in-depth (encryption plus access controls); confidentiality agreements; documented and tested incident response procedures.

6.3 Incident Response

We define a security incident requiring internal escalation and legal review as any unauthorized access to, disclosure of, acquisition of, or loss of personal information or consumer health data. This includes incidents caused by misconfiguration, unauthorized SDK data collection, or third-party vendor failures—not only traditional external attacks.

All service providers with access to user data are contractually required to notify HAC promptly and without unreasonable delay of any security incident affecting HAC user data. Specific notification timelines are established in our vendor contracts.

When an incident triggers notification obligations under applicable law—including the FTC Health Breach Notification Rule (16 CFR Part 318) and applicable state breach notification laws—we will notify affected users and regulators as required. Not every internal security incident will necessarily trigger external notification; we evaluate each incident against applicable legal thresholds.

6.4 Your Responsibility

Keep your password secure and unique. Log out on shared devices. We never ask for your password via email or text.

Compromised account: contact emily@teamhac.com immediately.

6.5 Limitations

No electronic transmission or storage method is completely secure. We implement robust measures but cannot guarantee absolute security.

7. DATA RETENTION

Retention periods for each data category are specified in the data map table in Section 1. Summary:

• Account info, health data, imported data: deleted when you delete your account.
• Subscription metadata is held by Apple and Google under their own terms, and HAC never receives card details. HAC also keeps its own record of your subscription and transaction confirmations, which is reassigned to an anonymous placeholder account when you delete your account (see §5.3).
• Support communications: retained until no longer needed for support purposes.
• Product analytics data collected on or after September 16, 2026 is retained for no more than 24 months. Product analytics data collected before that date is retained while it remains necessary for security, integrity, and legal purposes.
• Server logs: 14 days. Health data access logs: 365 days. Records of actions taken by HAC staff, and records that a deletion occurred, are retained without a fixed expiry.
• Consent records: 5 years after account deletion.
• Backup copies: deleted data ages out of our backups on their normal cycle.
• Feedback you submit in the App is held in the internal collaboration tools named in §3.1 and is retained until no longer needed for product purposes.
• De-identified research data: retained for as long as it remains useful for the stated research purposes. We periodically review retained research datasets and remove those that are no longer needed.
• De-identified data used for internal model improvement and QA/testing: retained under the same standard—for as long as it remains useful for the stated purpose, subject to periodic internal review.

8. CHILDREN’S PRIVACY

The Service is available only to individuals who are at least 18. We do not knowingly collect information from anyone under 18. If we learn we have, we will delete it promptly.

Contact: emily@teamhac.com.

9. THIRD-PARTY SERVICES AND INTEGRATIONS

9.1 SDK Inventory

Third-party SDKs and services are disclosed in Section 3.1. The description in Section 3.1 of what each provider receives, including our analytics and error-monitoring providers, is accurate as of the date of this Notice. No SDK provider has contractual rights inconsistent with our commitments.

9.2 Health Platform Imports

The Service supports optional connections to Apple Health (iOS) and, where available, Google Health Connect (Android), supported wearables (Oura, WHOOP, Garmin, Fitbit), or other compatible health data sources, through our integration partner (Junction, formerly Vital) or direct platform APIs:

• Connections are entirely optional.
• You control which data types the Service can access through your device’s health permissions interface.
• HAC does not use imported health platform data for advertising, marketing to third parties, or sale.
• Health platform data is processed and stored with the same encryption and security controls as all other Service data.
• Disconnecting stops future imports. Previously imported data remains unless you delete it.
• HAC requests access only to the specific health-platform data categories reasonably necessary for the features you have enabled, and only after you grant permission through your device’s health permissions interface. HAC does not write data back to Apple Health.
• HAC’s use of Apple HealthKit data complies with Apple’s HealthKit developer guidelines. HAC’s use of Google Health Connect data complies with Google Play’s health data policies.

9.3 Third-Party Links

The Service may contain links to third-party websites. We are not responsible for their content or privacy practices.

9.4 Analytics and Advertising

We use analytics to understand feature usage. Our product analytics provider is named in §3.1 and what it receives is described in §2.2. We do not use third-party advertising networks and do not sell information to advertisers. If advertising is introduced in the future, this notice will be updated.

10. CHANGES TO THIS PRIVACY NOTICE

10.1 Non-Material Changes

For minor changes, we update the “Last Updated” date.

10.2 Material Changes

For material changes, we provide at least thirty (30) days’ notice via email. You may delete your account before changes take effect.

10.3 Continued Use

Continued use after changes take effect constitutes acceptance.

11. CONTACT US

For privacy questions, data requests, or complaints:

We respond within five (5) business days. Complex requests: up to thirty (30) days.

Security concerns: contact emily@teamhac.com immediately.

12. STATE-SPECIFIC RIGHTS

12.1 California Residents

CCPA/CPRA Rights. California residents have the right to know, delete, correct, opt out of sale/sharing, limit use of sensitive information, and non-discrimination.

Sale and Sharing. We do not sell personal information. We do not share personal information for cross-context behavioral advertising as defined under CPRA.

Service Provider Classification. Our analytics, error-monitoring, cloud infrastructure, and integration providers that process HAC user data do so as service providers or contractors under written contracts that prohibit them from using HAC user data for their own commercial purposes, retaining or selling HAC user data, or combining HAC user data with data from other sources for any purpose other than performing services on HAC’s behalf. Apple and Google process subscription billing data under their own platform terms. Research partners receive only de-identified data under contractual restrictions described in Section 4.

Do Not Sell or Share. HAC does not sell personal information and does not share personal information for cross-context behavioral advertising as defined under CPRA.

Global Privacy Control. We recognize Global Privacy Control (GPC) signals. When we detect a GPC signal from your browser, we treat it as a valid opt-out request under California law. In practice, when we detect a GPC signal we stop collecting product analytics about that person. Because GPC is a browser signal, this applies to our web-based dashboard and website rather than to the mobile App, which does not transmit one. Because we do not sell or share personal information for cross-context behavioral advertising, GPC recognition confirms our existing practices.

Exercising California Rights. To exercise your California privacy rights, you may use the privacy controls in your account settings, contact us at emily@teamhac.com, or call (480) 993-8186. We will verify your identity and respond within forty-five (45) days.

Categories collected: Identifiers; personal information per Cal. Civ. Code 1798.80(e); health information (classified as sensitive personal information under CPRA); internet/electronic network activity. We do not collect biometric identifiers, precise geolocation, professional, or education information.

Sensitive Personal Information. Health data collected through the Service is classified as sensitive personal information under CPRA. We use this data only to provide the Service you have requested and for purposes exempt from the right to limit under California law. We also use de-identified data derived from it for internal model improvement and quality assurance, as described in §2.2.

California Automatic Renewal Law. Subscription auto-renewal terms are disclosed in our Terms of Use (Section 10). Cancel through your device’s app store subscription settings.

12.2 Washington Residents

Washington My Health My Data Act (RCW 19.373). Provides Washington residents with specific rights regarding consumer health data. The disclosures required by the Act are set out in full in our Consumer Health Data Privacy Policy at teamhac.com/consumer-health-data. A summary follows.

Categories of consumer health data collected: Menstrual and reproductive data; body metrics; mood, energy, and sleep data; fueling and hydration data; training data; injury and recovery data, including self-reported pain, mood and symptom scores; imported health-platform data, including data from connected wearables (Oura, WHOOP, Garmin, Fitbit). Also: inferences we derive from this data, including readiness scores, cycle predictions, and insights.

Purposes: Providing personalized hormone-informed training, recovery, and nutrition insights; cycle predictions; pattern-based algorithm operation; de-identified research (with consent); product improvement. Sharing with a coach you have chosen to connect to (with your separate consent).

Categories of third parties: Cloud infrastructure (AWS); health data integration (Junction); analytics provider (PostHog); error monitoring (Sentry); research partners (de-identified data only, with consent); authentication and push notifications (Firebase/Google); internal data analysis (Anthropic); email delivery; internal collaboration tools that receive feedback you submit (Slack, Trello); and coaches you have connected to. No consumer health data is shared with advertising networks or sold.

Affiliates: HAC does not currently have affiliates with whom consumer health data is shared.

Consent: We collect the consumer health data described above to the extent necessary to provide the Service you have requested from us. Sharing your consumer health data with a coach is not necessary to provide the Service, and we obtain your separate, affirmative consent at the point you connect to a coach (see §3.6). Sharing de-identified data with external research partners requires your separate, optional research consent (see §4.5).

Withdrawal: You may disconnect a coach at any time in the App, which ends that sharing. You may withdraw research consent at any time (see §4.5). Because processing your health data is necessary to provide the Service, you withdraw from that processing by deleting your account, which you can do in the App at any time (see §5.3 and §5.4).

Deletion: Through the App or by contacting us. See Section 5.3 for timelines. Deletion in the App is immediate and permanent, and we pass deletion instructions to our processors.

No sale: We do not sell consumer health data.

No geofencing: We do not use geofencing technology around healthcare facilities.

12.3 Connecticut Residents

Connecticut Data Privacy Act. Rights to access, correct, delete, and port data; opt out of sale (we don’t sell), targeted advertising (we don’t engage in it), and profiling with legal effects. We obtain consent before processing sensitive data.

12.4 Colorado Residents

Colorado Privacy Act. Rights to access, correct, delete, port, and opt out of sale, targeted advertising, and profiling. Consent required for sensitive data. Appeal by contacting us.

12.5 Virginia Residents

Virginia CDPA. Rights to access, correct, delete, port, and opt out of sale, targeted advertising, and profiling. Consent for sensitive data. Appeal by contacting us; if denied, contact the VA Attorney General.

12.6 Oregon Residents

Oregon Consumer Privacy Act. Rights to access, correct, delete, port, and opt out of sale, targeted advertising, and profiling. Consent for sensitive data.

12.7 Other States

Residents of Texas, Montana, Iowa, Indiana, Tennessee, Delaware, New Hampshire, New Jersey, Maryland, Minnesota, Nebraska, Kentucky, and Rhode Island may have additional rights. Contact us to exercise them.

13. Coaches and Team Staff

This section applies to coaches and team staff who hold a HAC dashboard account. It describes the information we collect about you. Information about the athletes connected to you is described elsewhere in this Notice, and your obligations when handling it are set out in Section 3.4 of our Terms of Use.

What we collect about you:

• Account information: your name, email address, password, and, where you provide them, your job title and the organization or team you coach for.
• Dashboard activity: the actions you take in the dashboard, including changes you make, the athletes affected, and the date and time. We also record the IP address and browser you used. We retain these records without a fixed expiry, as a security and accountability measure.
• Device and usage data, on the same basis as described in Section 1.

We use this information to operate your account, to secure the Service, and to maintain a record of actions taken on athlete data. We do not use it for marketing, and we do not sell it. Your email address is not shown to the athletes connected to you.

If you invite a person who is not yet a HAC user, we use the name and email address you provide solely to send that invitation.

Your rights under Sections 5 and 12 apply to your own coach account data. To exercise them, contact us at emily@teamhac.com. If we recognize a Global Privacy Control signal from your browser, we stop collecting product analytics about you (see Section 12.1).