Consumer Health Data Privacy Policy

Scope

This Consumer Health Data Privacy Policy explains how Nuko Nova Dynamics LLC ("DropPace," "we," "us," or "our") collects, uses, shares, and protects "consumer health data" as defined by the Washington My Health My Data Act, the Nevada consumer health data law (NRS 603A.400–603A.550), and similar U.S. state laws. It applies to the DropPace mobile app and our websites. For everything else we process, see our Privacy Policy. This policy is effective as of the "Last updated" date above.

1. Consumer health data we collect, and why

DropPace collects the following categories of consumer health data, only with your permission, when you use a workout feature or explicitly enable Cloud Workout Sync:

• Workout and exercise records you authorize from Apple HealthKit or Google Health Connect — workout type, start and end time, duration, distance, pace, calories, heart rate, step count, elevation gain and loss, running and cycling power, running and cycling speed, cycling cadence, running stride length, running ground contact time, running vertical oscillation, and VO₂ max.
• Workout route location data — the GPS route (polyline) of a workout you choose to render, which is precise location information associated with exercise, and two values we derive from it to recommend styles: a single coordinate averaged from the route's points and simple facts about the route's shape. For a Map Card, we also derive the geographic area covering the route to request map data for the drawing.
• Derived health information — stats computed from the above (for example, average pace) so they can be drawn on your image, and validation results confirming the image matches your workout.
• Account and device identifiers — used to attach your entitlements, usage limits, and selected workout records to your account and installation; they are linkable to the data above only as needed to provide the service and process your render.

We collect and use this data to show the workouts you authorize, recommend styles for the workout you select, create and validate the share image you request, and — only when you separately opt in — keep aggregate workout summaries and simplified routes as DropPace workout records linked to your account, available on your signed-in devices and through the authenticated workout-library website. Explicit GPX, FIT, or TCX workout uploads become part of the same account records. We do not use consumer health data for advertising or marketing, we do not sell it, and we do not use it to determine eligibility for anything.

2. Sources of consumer health data

• Apple HealthKit or Google Health Connect on your device, read only with the permission you grant in your device settings; and
• you, through the workout, stats, and options you select in the app.
• a GPX, FIT, or TCX file you explicitly choose, either for a specific workout route repair or as a complete portable workout upload. The app previews the route before saving a bounded simplified snapshot; DropPace does not retain the raw file.

We do not buy consumer health data, collect it from data brokers, or collect it from other apps or websites.

3. How consumer health data is processed

Your workout data is read on your device. Data for a share you request is transmitted over encrypted connections to our backend, which sends the selected stats and route (and, for photo modes, your photo) to our image-generation processor to render and validate your image. When you open the style grid for a workout, our backend also sends that workout's start time, distance, duration, and pace, the route values described in section 1 (if the workout has a GPS route), and, for photo modes, your photo to the same processor so it can suggest which styles fit. It returns only an order for the styles. To prepare this step, our backend saves the selected workout's stats and route with your account, the same workout record a share uses, and keeps it, even if you never create a share from it, until you remove your cloud workout copies in Settings or delete your account. If you enable Cloud Workout Sync, aggregate workout summaries and simplified routes are encrypted in transit and stored with your account as DropPace workout records, reconciled across your signed-in DropPace clients and the authenticated website. For each workout we may retain up to eight bounded source snapshots so a later observation or upload from another device can repair or enrich the record. Explicit workout-file uploads join the same records, but the raw files are never retained. Cloud sync does not include raw sensor samples. You can export this data, turn syncing off, remove cloud workout copies, or delete your account. The finished image has a permanent public link and remains available until you delete that individual Drop. Deleting your account removes the link's account association and public Display Name credit but leaves the finished image available anonymously. Processing happens in the United States and in the countries where our processors operate.

For a Card, your device draws it using the workout data already on your device: before you have an account, no consumer health data leaves your device. If you ask for a link to a Card, our backend loads the workout record already stored with your account (its stats and route) and redraws the Card on our servers from that record. If the Card's Layout draws a map, your device and, for a link, our servers request the map data covering the route's area, described in section 1, from our map data host. Those requests carry the area and an IP address, not your account or workout stats. If the Layout has a title, our backend can send a summary of the run's start time and stats to our AI processor to suggest one.

4. Sharing, and the third parties that process this data

We do not sell consumer health data. When you create a Drop, the finished image, including the selected stats and any route drawing, becomes publicly available to anyone with its permanent link. Apart from that user-directed publication, we disclose consumer health data only to service providers (processors) that handle it on our documented instructions, under binding contracts, solely to provide the service you request:

• OpenAI (OpenAI, L.L.C.) — receives the selected workout stats and route shape (and, for photo modes, your photo) to generate your image and validate its stats, and the workout summary and route values described in section 3 (and, for photo modes, your photo) to recommend styles for that workout. For a Card with a title, it also receives a summary of the run's start time and stats to suggest a title. It does not use this data to train its models.
• Convex (Convex, Inc.) - hosts our backend, permanent generated-image links, and temporary private source-photo storage.
• Cloudflare, Inc. - hosts the map data a Map Card draws. Your device, and our servers when they redraw a Card for a link, request the map for your route's area from Cloudflare. The request carries an IP address but no account identifier.

No other vendor receives your consumer health data — our analytics and crash-reporting events do not contain workout, route, or health information. We have no affiliates with whom we share consumer health data. On request, we will provide the list of third parties with whom consumer health data has been shared and an email contact for each.

5. Your rights

You have the right to:

• Know and access — confirm whether we collect, share, or sell your consumer health data and access it, including the third parties it has been shared with and how to contact them;
• Withdraw consent — stop our collection at any time by revoking HealthKit or Health Connect access in your device settings or turning off Cloud Workout Sync in DropPace Settings;
• Delete — have your consumer health data deleted, including from archived and backup systems, with deletion requests passed on to our processors; and
• Not be discriminated against for exercising any of these rights.

How to exercise them

Use Settings → Workouts to export workout data, turn off Cloud Workout Sync, or remove cloud workout copies. Use Settings → Privacy → "Delete account & data" to delete your account and associated private data. To remove the selected stats and route drawing in a permanent public Drop, delete that Drop in My Drops before deleting your account, or email us with the Drop link. Email [email protected] from the device in question (or include your Support ID from Settings → About) so we can verify the request. We respond within the time your state's law requires. If we decline a request, you may appeal by replying to our decision; we will review the appeal and respond with the outcome and, if we still decline, you may contact your state attorney general.

6. Cross-site collection

We do not allow third parties to collect your consumer health data across different websites or online services over time. The app's ad measurement, described in section 3 of our Privacy Policy, receives no consumer health data: it tells the ad platforms we advertise on which ads led to an install, and on iPhone it reads your device's advertising identifier only if you allow tracking.

7. Changes to this policy

If we make material changes, we will update the "Last updated" date above and notify you in the app or on this site before the changes take effect. Past versions are available on request.

8. Contact

Questions or requests about consumer health data? Email [email protected].