Effective date: October 13, 2026
Pumped Fitness is operated by Punk Labs LLC ("Punk Labs," "we," "us," or "our"). This Consumer Health Data Privacy Policy is separate from and supplements the Pumped Fitness Privacy Policy. It explains how we handle consumer health data, including information that may identify or be reasonably linked to a consumer and that relates to physical or mental health, fitness, bodily functions, or health-related inferences.
1. CONSUMER HEALTH DATA WE COLLECT
Depending on the features you choose, Pumped Fitness may collect:
- - Fitness and activity records, including exercises, sets, repetitions, weights, RPE, workout timing and duration, completion history, routines, schedules, rest days, personal records, streaks, progression values, muscle scores, recovery indicators, and fitness inferences calculated from those records.
- - Body and training information you provide, including an optional body profile, training limitations, injury areas, movement restrictions, experience level, equipment, intensity, and fitness goals.
- - Hydration information, including your selected unit, target, logged amounts, dates, and progress calculated from those entries.
- - Self-directed mental and wellness information you choose to enter, including reflections, optional mood selections, habits, goals, tasks, quit-habit titles and resets, reminder choices, breathing or affirmation completions, quote acknowledgements, and related streak or XP records.
- - Connected Health export information, including whether export is enabled, export status, a bounded workout-ID ledger, and the workout name, type, start time, end time, and duration that you direct Pumped Fitness to write to Apple Health or Health Connect.
Pumped Fitness does not read health or fitness data from Apple Health or Health Connect. It does not collect precise location, medical records, diagnoses, prescriptions, biometric identifiers, heart rate, steps, sleep, routes, or body measurements from your device. It does not infer health status from website visits, advertising activity, or data brokers.
2. SOURCES OF CONSUMER HEALTH DATA
We collect consumer health data:
- - Directly from you when you enter information, choose preferences, complete a workout or wellness activity, or enable a feature.
- - From your activity within Pumped Fitness, when the app calculates progress, streaks, recommendations, recovery indicators, muscle scores, or other fitness and wellness inferences from information you provided or created.
- - From the operating system only as needed to confirm whether Pumped Fitness can write a workout you requested to Apple Health or Health Connect. Pumped Fitness does not import records from those services.
We do not purchase consumer health data or obtain it from advertisers, data brokers, public records, social networks, healthcare providers, employers, insurers, or other apps.
3. WHY WE COLLECT AND USE CONSUMER HEALTH DATA
We collect and use consumer health data only to:
- - Provide the workout logging, planning, routine, history, hydration, Mental, reminder, progress, recommendation, and connected-health features you request.
- - Personalize exercise selection, body-map displays, starting hydration targets, and recommendations when you make the separate optional health-personalization choice.
- - Calculate and display progress, streaks, XP, records, muscle scores, recovery indicators, and other requested app results.
- - Save information locally and, when you enable cloud backup, back it up and restore it for your account.
- - At your direction, write a completed workout record to Apple Health or Health Connect.
- - Secure, maintain, troubleshoot, and prevent misuse of the Service, or comply with law.
We do not use consumer health data for advertising, marketing, profiling unrelated to the features you request, eligibility decisions, insurance, employment, credit, or data brokerage.
4. YOUR DIRECTIONS AND CHOICES
Pumped Fitness collects health-related entries when you request the related feature by entering or completing them. Body-profile and training-limitation personalization requires a separate, optional in-app choice. Connected Health remains off unless you select Connect and grant the operating-system write permission. Cloud backup remains optional.
You can decline optional health personalization and Connected Health without losing unrelated features. You can withdraw health-personalization permission, stop cloud backup, disable future connected-health exports, disconnect a health provider, edit or clear app data, or delete your account through Settings. These actions do not affect processing completed before the change.
5. HOW CONSUMER HEALTH DATA IS PROCESSED AND STORED
Consumer health data is stored locally on your device. Sensitive native app fields are protected with app-level encryption where the runtime supports it, in addition to device security controls.
Updated native iOS builds use AES-256-GCM through Apple's CryptoKit for protected local fields, with the device encryption key stored in Apple Keychain; earlier installed versions may use a different implementation. This is local field protection, not a promise that every app file or export is encrypted with that key. The web version does not provide the same device-keystore protection as the native app.
If you enable cloud backup, Pumped Fitness sends account-linked workout, health-personalization, hydration, progress, planning, routine, and Mental information to owner-scoped Google Firebase storage for backup and restore. Connected-health permission state, export status, and the workout-ID ledger remain encrypted and account scoped on the device and are not included in Pumped Fitness cloud backup.
Firebase processes backup records using encrypted network transport and provider-managed storage protection. These backups are not end-to-end encrypted with a key available only on your device. Apple's local encryption does not move them to iCloud or change the sharing purposes described here.
When you enable Connected Health, the device operating system stores the Pumped workout record in Apple Health or Health Connect. Pumped Fitness does not copy data from those services into its cloud backup.
6. CONSUMER HEALTH DATA WE SHARE
For purposes of consumer health privacy laws, "share" may include disclosing data to a service provider that processes it for us. Depending on your choices, we may share:
- - Account-linked workout, body-profile, training-limitation, hydration, progress, planning, routine, and Mental data with Google LLC through Firebase Firestore when you enable cloud backup.
- - Completed workout name, type, start time, end time, and duration with Apple Inc. through Apple Health or with Google LLC through Android Health Connect when you explicitly connect that service and direct export.
- - Information with a court, regulator, law-enforcement body, or another party when legally required or reasonably necessary to protect rights, safety, and security.
- - Information with a successor or adviser involved in a merger, financing, reorganization, bankruptcy, or transfer of the business, subject to applicable law and this Policy.
- - Information with another party when you direct us or provide legally sufficient consent.
We do not currently share consumer health data with any Punk Labs LLC affiliate. We do not intentionally disclose consumer health data to Sentry, Vercel Web Analytics, GitHub Pages, advertising networks, data brokers, employers, insurers, or social networks. No third party is permitted by Punk Labs LLC to collect consumer health data over time and across unrelated websites or online services when you use the Punk Labs website.
7. NO SALE, ADVERTISING, OR GEOFENCING
We do not sell consumer health data. We do not use or disclose it for targeted advertising, cross-context behavioral advertising, marketing, or use-based data mining. We do not use a geofence around a healthcare facility or another location to identify, track, collect data from, or send health-related messages or advertisements to a consumer.
8. YOUR CONSUMER HEALTH DATA RIGHTS
Depending on where you live, you may have the right to:
- - Confirm whether we collect, share, or sell your consumer health data and access that data.
- - Obtain a list of the third parties and affiliates with whom your consumer health data was shared or sold and contact information for them where required.
- - Correct inaccurate consumer health data.
- - Withdraw consent for future collection or sharing.
- - Delete consumer health data from our records and have us notify applicable processors and recipients of the request.
- - Appeal a refusal to act on your request.
You can use the app's Settings controls for common access, correction, withdrawal, clearing, export, and account-deletion actions. If you cannot access the app or want to make another consumer health request, visit https://www.punklabs.dev/delete-account or email support@pumpedapp.net with the subject "Consumer Health Privacy Request." To appeal a decision, use the subject "Privacy Appeal." Do not send a password, government identifier, medical record, or other unnecessary sensitive information.
You do not need to create a new account to submit a request. We may ask for information reasonably necessary to authenticate you and protect the account. We will not unlawfully discriminate against you for exercising a right, and we will respond within the period required by applicable law. Where applicable, access responses are free up to the frequency required by law.
Deletion from archived or backup systems and independent provider systems may take additional time where applicable law permits. Apple Health and Health Connect records are controlled through their device interfaces; Pumped Fitness makes a best-effort attempt to delete its Android Health Connect workout records during account deletion or app-data clearing while permission and Health Connect remain available. You can review or delete remaining exported records directly in Apple Health or Health Connect and contact us for assistance.
9. RETENTION AND SECURITY
We retain consumer health data while your account remains active and as needed to provide the features you request. Local data remains until you edit or clear it, delete your account, uninstall the app, or the operating system removes it. Limited security records, records required by law, and residual service-provider backup copies may remain only as reasonably necessary and subject to applicable deletion requirements.
The affected pre-release testers agreed to the October 2026 iOS beta-data reset described in Section 7 of the Privacy Policy. Updated builds remove known obsolete-format local beta records and their matching local recovery copies, including old workout, hydration, and wellness entries, together with setup-completion markers tied to the old records. This limited retirement does not delete existing cloud backups, accounts, Apple purchases, or local records encrypted in current supported formats, and reinstalling an earlier app version does not restore removed records.
We use access controls, owner-scoped Firebase Security Rules, encrypted transport, device protections, and app-level local encryption where supported. No method is completely secure, and we cannot guarantee absolute security.
10. CHANGES AND CONTACT
We will update the effective date and provide additional notice in the app or by email when a material change requires notice. We will obtain consent before collecting, using, or sharing additional categories of consumer health data or using them for additional purposes when applicable law requires it.
For consumer health privacy questions or requests:
Punk Labs LLC Email: support@pumpedapp.net Consumer health policy: https://www.punklabs.dev/consumer-health Account deletion and requests: https://www.punklabs.dev/delete-account Website: https://www.punklabs.dev/