Privacy Policy

This app is operated by WHOLE Performance AI LLC, a Georgia limited liability company. In this policy we call it WHOLE, "we" or "us".

WHOLE is the legal entity behind the app and the entity that receives subscription payments for purchases made on our website (a purchase made inside the iOS or Android app, where offered, is paid to Apple or Google — section 16). It is the controller of the personal data described here — it decides what is collected and why. You can reach us by email at support@wholepai.us.

We have not appointed a Data Protection Officer, and this policy does not claim one. If that changes, this page changes with it.

• ·You give WHOLE information about your body, your goals and your health so it can build a plan. That is the whole point of the collection.
• ·Your data is never sold, never shared with an advertising network, and never used for advertising of any kind.
• ·Your data is never used to train AI models — not ours, not Anthropic's, not Deepgram's, not anyone's.
• ·Voice coaching and camera form checks are optional and off by default, each behind its own switch in Settings › Privacy. Neither the microphone nor the camera is ever opened until you turn the feature's switch on and your device grants the permission.
• ·Camera form checks run on your device. No video or image ever leaves it — not to us, not to Anthropic, not to anyone. Only the derived results (rep counts, form notes) are stored.
• ·Voice audio goes to exactly one place — Deepgram, our voice provider, to be turned into text and replies into speech — and it is not used to train models. The transcript then travels the same path as a typed coach message. Sections 7 and 8 spell all of this out.
• ·Only a short, specific summary reaches our AI provider, and only when you use the coach. Section 6 lists it field by field.
• ·You can download everything WHOLE holds, or delete it, yourself, from inside the app, without emailing anyone.
• ·WHOLE is for adults 18 and over.

All of it comes from you. WHOLE has no tracking pixels, no advertising identifiers, no location collection, and no third-party analytics reading your health data.

Account details. Your email address, so you can sign in with a one-time code and so we can reach you about your own account. Sign-in is handled by our database provider. Your account has no password — you sign in with a one-time emailed code. The only password sign-in that exists is a single internal account used by app-store review teams; no real user account has, or can set, a password.

Your setup. Your name, height, current weight, an optional goal weight, a sex setting you choose yourself, your experience level, your goals, the equipment you have, the days and lengths you can train, and your food preferences — allergies, dietary restrictions, diet style, budget, household size and how long you are willing to spend cooking. This is what every workout, meal suggestion and hydration estimate is built from. Allergies and restrictions are used as hard exclusions.

Safety screening. Fourteen yes/no answers covering things like pregnancy, recent surgery, chest pain, fainting, breathlessness, heart conditions, blood pressure, joint injury, severe pain, a physician's restriction, medication that affects exercise, eating-disorder history, recent hospitalisation, and clinician-set fluid limits. These exist for exactly one purpose: to compute a safety gate that constrains what the app is willing to suggest to you. They are not used to profile you, and they never leave our systems — see section 6.

Daily check-ins. Sleep hours, soreness, stress, energy, mood, whether you are in pain, whether you are ill, and an optional resting heart rate. Every check-in is optional and skipping one never penalises you.

Your logs. Water you log, workouts you complete, and the weight, waist and written notes you choose to record on the progress screen.

Coach conversations. What you type to the coach and what it replies, kept so the conversation has continuity and you can read it back. In a voice session, the transcript of what you said and the reply are what is kept — the audio is not (section 7).

Camera form summaries. If you use camera form checks, the derived results of the on-device analysis — rep counts and form notes — saved with the workout they belong to. The video itself is never collected at all (section 8).

Consent record. Each permission you turn on or off and the moment you did it, so there is a record of what you actually agreed to.

Subscription record. Your plan tier, renewal date and your usage against the plan's allowances — including, on plans that carry them, voice minutes used and camera sessions used.

Notification settings. Which reminders you allow, your daily cap, quiet hours, and a record of what was sent and whether you opened it, so the app backs off when it is being ignored.

Most of what WHOLE holds is health-related: your body measurements, your safety screening answers, your pain and illness flags, your mood, and what you tell the coach. Some of it — pregnancy, eating-disorder history, a clinician's fluid restriction — is about as sensitive as personal data gets.

We treat all of it as sensitive by default. In practice that means: it is collected only where it changes what the app does for you, the most sensitive fields are deliberately excluded from anything that leaves our systems, and there is no standing internal dashboard through which staff browse user health data.

WHOLE is a general wellness product, not medical care. We are not a healthcare provider, this is not a medical device, and your data here is not a medical record. We are not covered by HIPAA and this policy does not claim otherwise. We hold no privacy or security certification and have not been independently audited; if that changes we will say so here rather than imply it.

When you have an account and are signed in, your data is stored in your own row of our database, hosted by Supabase in the United States. Row Level Security is enforced at the database, so one user cannot read another user's data.

WHOLE is built as a web application delivered inside a native app shell, so it runs in a web view on your device. When you use WHOLE without an account, everything you store — your setup, check-ins, logs and history — stays in that web view's local storage on that device, and clearing it is as simple as using the delete action or clearing the app's stored data.

Two kinds of data never live anywhere at all: camera video, which is analysed frame by frame on your device and discarded (section 8), and voice audio, which exists only in transit while it is being transcribed (section 7).

One exception, stated plainly: coach messages.Sending a coach message transmits that message to WHOLE's server to be answered and safety-screened, whether or not you have an account. On a deployment with an AI key configured — including this one — the second-stage safety check described in section 9 also sends it to Anthropic before any account or plan check happens. Without an account you will then be asked to start a plan rather than receive a coaching reply, but the message you sent has already travelled. If you want nothing to leave the device, do not send coach messages.

If you later sign in on a device that holds demo data, that data is carried up to your account so you do not lose it — and only for keys your account does not already have, so it can never overwrite your real history.

The WHOLE Coach is powered by Claude, made by Anthropic. Nothing reaches Anthropic until you send a coach message — typed, or spoken in a voice session — and no other part of the app calls out to them. Spoken messages reach Anthropic as their text transcript, never as audio; nothing from the camera reaches Anthropic at all.

When you send a coach message, this is what we put in the request to Anthropic. It is the complete list — every value below, and nothing besides them:

• ·The message you just sent — typed, or, in a voice session, the transcript of what you said — together, while the Coach memory switch in Settings › Privacy is on, with up to the 11 messages immediately before it in that conversation: your side and the coach's replies, 12 messages in total. With Coach memory off, the message you just sent travels alone.
• ·Your first name, so the coach can address you.
• ·Your training level, as a number from 1 to 6.
• ·Your goal keys (for example lose_fat, energy) — the keys only, never anything you wrote about them.
• ·Your maximum session length, in minutes.
• ·Your safety gate — one derived word (normal, restricted or clearance_recommended), never the 14 screening answers behind it.
• ·Your coach personality, as one of five fixed style names, and your intensity setting as a number from 1 to 5.
• ·Your current mood state — a single word: confident, neutral, overwhelmed or discouraged.
• ·Your mood-influence setting, written out as a sentence telling the coach whether it may adjust your plan or only the way it speaks to you. It travels with the mood state above and only with it: if you set mood influence to 'No influence' in Settings, neither the mood state nor this sentence reaches Anthropic. The setting itself still travels as far as our own server — it is listed in the next section.

Sent to us, but not to Anthropic. Three other things travel with a coach message. They reach WHOLE's own server and stop there — none of them is written into the request to Anthropic:

• ·Your plan snapshot — your tier, when the current period started, and your usage counts — which our server uses to check you are inside your allowance and to count the message.
• ·Your sign-in token, which our server exchanges with our database provider to confirm who you are.
• ·Your mood-influence setting itself, as a single word. Unlike the sentence built from it, this one travels with every coach message — including when you have set it to 'No influence', because that value is precisely what tells our server not to build the mood sentence for Anthropic at all.

Never sent: Your height, weight and goal weight · Your 14 safety screening answers · Your allergies and dietary restrictions · Your check-ins, hydration log and workout log · Your progress metrics and written notes · Your email address · The audio of your voice — Anthropic receives text only; audio goes to Deepgram to become text and stops there (section 7) · Camera video or images — frames never leave your device at all (section 8).

One other request goes to the same provider: the second-stage safety check described in section 9, which runs before your message reaches the coach. It carries your latest message — and, while Coach memory is on, the one message you sent before it — and none of the profile fields above; it is asked to categorise the message and nothing more. If the first-stage screen, which runs on our own server, answers your message, the request to Anthropic is never made at all.

Your conversations are not used to train AI models — not Anthropic's, not ours. WHOLE uses the commercial API to answer you and nothing more. Because the coach is a third-party system, please do not paste medical records or other sensitive documents into it — or read them aloud in a voice session, which amounts to the same thing.

What else exists, and what does not. The coach can now speak and listen (section 7), and the app can check your form through the camera (section 8) — both optional, both off by default. There is still no photo storage, no location collection, no community feed, and no research programme. Where the app shows switches for capabilities like these, each one states plainly whether it is built yet.

When WHOLE runs without an AI key — demo mode — the coach answers from a small built-in script on our own server instead: your message still travels to WHOLE's server to be answered, but nothing reaches Anthropic.

Voice coaching lets you talk to the coach out loud and hear it answer. It is optional, off by default, and double-gated: the Voice coaching switch in Settings › Privacy must be on before the app will even ask your device for microphone permission, and the microphone is only ever live during a voice session you have started. Turn the switch off and the coach goes back to text; nothing else changes.

What happens to your audio.While you speak, your audio streams through WHOLE's server to Deepgram, the speech company that turns it into text, and the coach's reply — the same text you would otherwise read on screen — is sent to Deepgram to be turned into speech. WHOLE never stores the audio in either direction: it exists in transit, and what is kept is the transcript, which becomes an ordinary coach message in your conversation history.

What Deepgram keeps.Every request WHOLE sends to Deepgram opts out of their model-improvement programme, which means your audio is not used to train or improve Deepgram's models. Under Deepgram's published terms for opted-out requests, data is retained only for as long as is needed to process the request. Deepgram processes in the United States and acts as our processor — it appears in the list in section 11.

The transcript travels like any typed message. Once your words are text, they follow exactly the path described in sections 6 and 9: the safety screening runs on the transcript before it can reach the coach, and the transcript — never the audio — is what reaches Anthropic. Safety responses work the same for spoken messages as typed ones.

Voice coaching is part of paid plans and metered in minutes; your minutes used are part of the subscription record in section 3. On a device or plan where voice is not available, the app says so — the microphone is not requested and nothing is recorded.

Camera form checks let the app watch your movement during a set, count reps and offer form guidance. Like voice, they are optional, off by default, and double-gated: the Camera form checks switch in Settings › Privacy must be on before the app will even ask for camera permission, and the camera runs only during a set you have started it for.

No video leaves your device. None. Frames from your camera are analysed on the device itself, by an on-device pose model (MediaPipe), frame by frame, in memory. They are not uploaded to WHOLE, not sent to Anthropic, not sent to Deepgram, not stored on the device, and not turned into photos or recordings. There is nothing for us to hand over, leak or delete, because we never have it.

What is stored instead is only what the analysis derives: rep counts and short form notes, saved with the workout session they belong to, in your workout log. That is the complete output. If you deny camera permission, the feature falls back to a demonstration-only mode — it never blocks the rest of the app.

Honest limits, by design. Form feedback exists only for exercises whose checks we have built and validated — the app does not improvise opinions about movements it was not built to read. And when tracking is poor — bad light, a limb out of frame — the app treats what it cannot see as missing and says less, rather than converting uncertainty into criticism of your form. Camera form checks are AI-assisted form guidance, not medical movement analysis; the Terms of Service say more about what that means.

WHOLE screens coach messages — typed or transcribed from voice — for signals of a crisis, a medical emergency or disordered eating, and answers those with a stop-and-seek-help message and public resources. The first stage runs on our own server before any AI call, so it works the same on every plan. A second stage asks the AI provider to classify the same message, and can only ever escalate the first stage's answer, never soften it.

When a safety response fires we record that it fired: the category, which stage caught it, and one bounded detail. For the first stage that detail is the wording of the pattern that matched — a fixed rule from our own code, not anything you typed. For the second stage it is the classifier's category and confidence score, and nothing else: the model also returns a free-text explanation of its decision, and we deliberately discard that rather than log it, because prose written about your message can restate your message. Your message itself is never recorded, and neither is any description of it. We also record the size of each coach request in tokens for cost monitoring — never its content.

These responses are pattern-matching in software, not a crisis service. No human monitors your messages, and the app cannot contact anyone on your behalf. In an emergency, contact your local emergency number.

Where the law requires us to name a basis for each use, these are ours:

• ·Your consent — for the health-related data that drives personalisation, for the AI coach, for voice coaching and camera form checks, and for optional notifications. Consent is asked for in separate pieces, never bundled into one 'I agree', and you can withdraw any of it later.
• ·Performing our contract with you — running your account, delivering the plan you subscribed to, and billing you for it.
• ·Our legitimate interests — keeping the service secure, preventing abuse of usage limits, and fixing faults. We do not rely on legitimate interests to process health data.
• ·Legal obligations — keeping the records we are required to keep, and responding to lawful requests.

Where consent is the basis, withdrawing it turns off the feature that depended on it — it never disables the rest of the app, and it never removes your access to safety responses. Turning off Voice coaching or Camera form checks in Settings › Privacy is exactly such a withdrawal, and it takes effect immediately.

The Coach memory switch in Settings › Privacy controls exactly what it names: switched on, your conversation is saved and your recent turns travel with each coach message; switched off, only the message you just sent is transmitted and nothing new is saved. Turns saved while it was on stay stored until you remove them — Delete my account (or Delete my data, if you never made one) in Settings › Privacy removes them all.

WHOLE does not sell your data and does not share it with advertisers. The companies below process it on our behalf so the product can work, each limited to what their job requires.

We will also disclose data where the law requires it, or to protect the rights and safety of users or the public. If WHOLE is ever involved in a merger or acquisition, your data may transfer with the business — you would be told before it happened, and this policy would continue to apply until you were given notice of a new one.

WHOLE is operated from the United States and our database, AI and voice providers store and process data in the United States. If you use the app from outside the US, your data is transferred there.

Where a transfer of this kind needs a specific legal mechanism — such as the Standard Contractual Clauses for users in the UK or EEA — we rely on our providers' data processing terms. This policy is governed by the laws of the State of Georgia, without regard to its conflict-of-laws rules, and any dispute about it goes to the state and federal courts located in the State of Georgia.

WHOLE keeps a rolling window of your most recent entries rather than everything forever. The current limits are:

Everything above ends when you delete your data, which you can do at any time. That removes it from the live database straight away.

Backups are the one place a copy can outlive that. The backups in question are our database provider's, taken and rotated on their schedule rather than ours, and encrypted. We cannot reach into a backup to erase one person from it — a copy of your data leaves only when the backup holding it rotates out and is overwritten. Our intent is that this happens within about 30 days, and that is the window we design around. We are telling you our intent rather than a guarantee on purpose: we have not independently audited our provider's rotation, so we are not going to print a deadline we cannot yet stand behind. If that matters to your decision, email support@wholepai.us and we will tell you what we currently know.

What we can commit to is how backups are used. They exist for disaster recovery and nothing else — they are never used to serve, re-create or reactivate an account you deleted, and if a recovery ever restored data you had already deleted, we would delete it again.

Depending on where you live you may have the right to access your data, get a copy of it, correct it, delete it, restrict or object to certain uses, withdraw consent, and be free from discrimination for exercising any of these. WHOLE offers the core ones to everyone, regardless of location, and offers them in the app rather than through a support queue.

• ·Access and export — 'Download my data' in Settings › Privacy produces a complete, readable JSON file of everything the app holds for you, including your consent record.
• ·Correction — your setup, goals, schedule, food preferences and safety answers are all editable in the app at any time. Correcting them there is the correction right.
• ·Deletion — the delete button in Settings › Privacy. Signed in, it reads 'Delete my account' and closes the account entirely; if you are using WHOLE without an account it reads 'Delete my data' and clears the device. See section 15 for exactly what each one does.
• ·Withdrawing consent — every permission has its own switch on the same screen, and can be turned off whenever you like. Voice coaching and camera form checks are two of those switches.

If you would rather ask us to do any of this for you, or you want to appeal a decision we made about a request, email us at support@wholepai.us. We do not charge for requests and we do not treat you differently for making one.

We would rather be exact here than reassuring. The delete button sits in Settings › Privacy. When you are signed in it reads Delete my account, and pressing it makes WHOLE:

• ·Cancel any live subscription billed through Stripe first, so a closed account can never keep being billed by us.
• ·Delete every row of your data from our database — your setup, safety answers, check-ins, hydration, workout logs (including camera form summaries), coach conversations (including voice transcripts), progress metrics and notes, consent record, notification settings and history, and your subscription record.
• ·Delete the sign-in record itself, so your email address is no longer registered with WHOLE.
• ·Erase every WHOLE key held in your browser's local storage and sign you out on that device.

That is a full account closure, not a local wipe, and we cannot undo it. If you are using WHOLE without an account, the same button reads Delete my data instead: there is nothing on our servers to remove, so it simply clears the device.

If you subscribed inside the iOS or Android app, where offered, that subscription is billed by Apple or Google rather than by us, and deleting your account does not cancel it — cancel it in your device's subscription settings, before or after you delete. Section 16 explains store billing.

One honest caveat, either way: what this removes is the live copy. A copy can sit in our database provider's encrypted backups until those rotate, which section 13 explains. It is never used to bring a deleted account back.

The steps run in that order on purpose, and a failure at any point is reported rather than swallowed. If we cannot reach the billing system to stop your subscription, nothing is deleted at all and your account is left untouched — an account you can still cancel from is recoverable, a deleted account with live billing is not.

Subscriptions purchased on the web are processed by Stripe. When you start checkout, Stripe receives your email address and a reference to your account so the right plan is applied to the right person. You enter your card details with Stripe directly — WHOLE never sees or stores your card number. Stripe tells us when a subscription starts, changes or ends, and we record your tier, renewal date and usage, plus a small bookkeeping record of the last billing event we applied — so a stale or duplicated notification can never change your plan.

Managing or cancelling a subscription purchased on the web opens Stripe's own billing portal, where your payment details stay with Stripe rather than passing through us.

Purchases made inside the iOS or Android app, where offered, are billed by Apple or Google, not by Stripe. The store collects your payment under its own privacy terms, and the payment itself — your card details included — stays with the store; card numbers never reach WHOLE. To confirm a store purchase and keep your plan in sync, WHOLE uses RevenueCat, a subscription-management service. RevenueCat receives a random identifier for your account, the store's receipt for your purchase, your subscription state, and basic device and app details — never your name, your email address, your health data or your card number. Refunds and cancellation for a store purchase are handled through the store, in your device's subscription settings, rather than by us.

Data is encrypted in transit and encrypted at rest by our database provider. Access to your row is restricted at the database itself, so one account cannot read another's. The elevated server-side access that exists is limited to specific jobs — building coach context, recording your plan usage — rather than a general-purpose admin view of user health data.

Your most sensitive fields are protected by not travelling: the fourteen screening answers are reduced to a single derived word before anything leaves our systems, camera video never leaves your device at all, voice audio is never written to storage, and all of them are kept out of logs, error reports and URLs by design.

No system is perfectly secure, and we do not claim ours is. If a breach affects your information we will notify you and the relevant authorities as required by law, including under the FTC's Health Breach Notification Rule.

WHOLE is for adults aged 18 and over. You must confirm you are 18 or older before you can finish setting up, and we record that confirmation. The app is not directed at children, we do not market it to them, and we do not knowingly collect data from anyone under 18.

If we learn that an account belongs to someone under 18, we close it and delete the data. If you believe a child has given us information, email us at support@wholepai.us and we will remove it.

Some states — including Washington (My Health My Data Act) and Nevada (SB 370) — give their residents specific rights over "consumer health data." This section gathers, under one heading, what this policy already says about WHOLE's handling of that data. Nothing here is new practice; it is the same handling described in sections 3 through 15, labeled the way these laws expect.

What consumer health data we collect. The categories in sections 3 and 4: your safety-screening answers (including pregnancy status and eating-disorder history), daily check-ins (sleep, soreness, stress, energy, mood, pain, illness, optional resting heart rate), weight and waist entries, hydration and workout logs — including the rep counts and form notes derived by camera form checks — and anything health-related you choose to write in coach messages or notes, or say in a voice session, which is kept as its transcript. All of it comes from you directly — WHOLE does not buy, infer from third parties, or derive consumer health data from your location (we collect no location data at all), and camera video is analysed on your device and never collected.

Why we collect it. Solely to provide the product you asked for: building and adapting your plan, computing the safety gate that constrains what the app will suggest, and answering the coach messages you send. Not for advertising, not for marketing segmentation, and not for training AI models.

Who can access or receive it. The service providers in section 11, acting on our instructions: our database provider stores it, our hosting provider transmits it, our voice provider transcribes what you say in a voice session, and our AI provider receives coach messages plus the limited summary in section 6 when you use the coach. We do not sell consumer health data, and we do not share it for advertising — with anyone, in any state.

Your rights. You can access and export everything, ask us to correct it, withdraw consent switch by switch, and delete it entirely — all from inside the app, as section 14 describes, wherever you live. To exercise any of these by request instead, or to appeal a decision we made about a request, email support@wholepai.us. If you are not satisfied with the outcome of an appeal, you may raise it with your state attorney general.

We will update this policy as the product changes — including when a capability described here as not built becomes real, as we did when voice coaching and camera form checks shipped. The date at the top always shows when it last changed.

For material changes — anything that meaningfully affects how your data is handled, who receives it, or how long it is kept — we will give you reasonable notice in the app or by email before it takes effect. Where a change needs your consent, we will ask for it rather than assume it.

Questions about this policy, your data, or a request you have made: email support@wholepai.us.

Email is how to reach us — it goes directly to the people responsible for your data. WHOLE Performance AI LLC is a Georgia limited liability company.