Privacy Policy

Effective Date: May 20, 2026

This Privacy Policy explains how [LEGAL ENTITY NAME] ("BackNine," "we," "us," or "our") collects, uses, and shares information when you use the BackNine application and related services (the "Service"). By using the Service, you agree to this Policy. If you do not agree, do not use the Service.

BackNine is intended only for individuals 18 years of age or older. We do not knowingly collect information from anyone under 18.

1. A note about health information

BackNine handles information about your body and health (such as sleep, heart-rate variability, activity, weight, body composition, nutrition, mood, and lab results you enter). We treat this as sensitive information and handle it with care. Please note that BackNine is a consumer product and is not a HIPAA-covered entity or a healthcare provider; the data you store in BackNine is generally not "protected health information" under HIPAA. We protect it under this Policy and applicable consumer-privacy laws.

2. Information we collect

a. Information you provide:

• Account & identity: email address and/or third-party login identifier (e.g., Google), and a display name.
• Health & fitness profile: date of birth/age, sex, height, weight, body composition, fitness markers (e.g., VO2 max), and similar details you enter.
• Logs you create: workouts, weigh-ins, meals and nutrition (including meal photos you upload), mood and daily check-ins, goals, and lab/biomarker information you choose to enter.
• Social content: friend connections, groups/crews you join, messages (direct and group), reactions, comments, gear reviews, and participation in challenges and leaderboards.
• Coach Al inputs: the text, descriptions, and images you submit to our AI features.
• Communications: messages you send us (e.g., support requests).

b. Information from connected services:

• Oura Ring: with your authorization, readiness, sleep, heart-rate variability, body temperature, activity, steps, and related metrics.
• Apple Health: data you choose to export to us (e.g., via Health Auto Export), such as steps, sleep, and heart-rate variability.
• Other connected devices you choose to link.

c. Information collected automatically:

• Device & usage data: such as IP address, device/browser type, app interactions, and log data, used to operate and secure the Service.
• Local storage: we store an authentication token and limited preferences on your device, and use a service worker to enable installation and offline functionality. We do not use third-party advertising cookies.

3. How we use information

We use information to:

• provide, operate, personalize, and improve the Service (including dashboards, scores, trends, history, and social features);
• generate AI features ("Coach Al") such as insights, briefings, goal plans, and meal/workout parsing;
• enable the features you choose to use, including sharing activity with friends and groups you connect with;
• understand demand (for example, aggregated, de-identified analysis of what people search for in the gear store) to improve our catalog;
• communicate with you about the Service and respond to your requests;
• maintain security, prevent fraud and abuse, and comply with legal obligations.

We do not sell your personal information, and we do not use your health data for third-party advertising.

4. AI processing

To provide Coach Al features, certain inputs and health data are sent to our third-party AI provider (currently Anthropic, which provides the Claude models) for processing. This may include chat messages, workout/meal descriptions, meal photos, and relevant health metrics needed to generate a response. This data is processed to return results to you and is handled under the provider's terms. AI output may be inaccurate and is not professional advice (see the Medical & Health Disclaimer).

5. How we share information

We share information only as described here:

• Service providers / sub-processors that help us run the Service, under contractual confidentiality obligations, including:
• Supabase – database and authentication
• Vercel – application hosting (front end)
• Render – application hosting (back end)
• Anthropic – AI processing (Coach Al)
• Oura – wearable data (with your authorization)
• Apple Health / export tools – data you choose to send us
• Other users, when you use social features: information such as your display name, activity milestones, scores, streaks, leaderboard standings, group/challenge participation, gear reviews, comments, and messages is shared with the friends or groups you connect with.
• Legal and safety: when we believe disclosure is required by law or legal process, or is necessary to protect the rights, property, or safety of BackNine, our users, or the public.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.

6. Data retention

We retain your information for as long as your account is active or as needed to provide the Service, and afterward only as needed to comply with legal obligations, resolve disputes, and enforce our agreements. You can delete your account at any time; when you do, we will delete or de-identify your personal information within a reasonable period, except where retention is required or permitted by law. Some information may persist in backups for a limited time.

7. Security

We use reasonable administrative, technical, and organizational measures designed to protect your information. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your login credentials confidential.

8. Your California privacy rights (CCPA/CPRA)

If you are a California resident, you have the right to:

• Know / access the categories and specific pieces of personal information we have collected about you;
• Delete personal information we have collected, subject to legal exceptions;
• Correct inaccurate personal information;
• Opt out of the "sale" or "sharing" of personal information — note that we do not sell or share your personal information as those terms are defined under California law;
• Limit the use of sensitive personal information to what is necessary to provide the Service; and
• Non-discrimination for exercising your rights.

To exercise these rights, contact us at [CONTACT EMAIL]. We will verify your request (typically by confirming control of your account email) before responding, and you may use an authorized agent where permitted by law. Depending on where you live, you may have similar rights under other laws; we will honor applicable rights.

9. Your choices

• Disconnect a wearable: you can revoke BackNine's access to Oura or stop exporting Apple Health data at any time through those services and/or your BackNine settings.
• Edit or delete content: you can edit or remove logs, reviews, friends, and other content in the app.
• Delete your account: contact us at [CONTACT EMAIL] or use the in-app option where available.

10. Children

The Service is for adults 18 and older. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, contact us at [CONTACT EMAIL] and we will delete it.

11. International users

The Service is operated in the United States. If you access it from outside the U.S., you understand your information will be processed in the U.S., where privacy laws may differ from those in your location.

12. Changes to this Policy

We may update this Policy from time to time. If we make material changes, we will take reasonable steps to notify you (for example, by posting the updated Policy with a new Effective Date or notifying you in the app). Your continued use of the Service after changes take effect constitutes acceptance.

13. Contact

For privacy questions or to exercise your rights, contact us at [CONTACT EMAIL].