Privacy Policy

1. Business Information

Service Name: SyncHealth
Support / Privacy Contact: support@synchealth.life

SyncHealth is currently operated as an individual business. If you have any questions or concerns about this privacy notice or our data practices, please contact us using the email address provided above.

2. Age Requirement

SyncHealth is strictly intended for individuals aged 18 or older. During registration, we collect your Date of Birth (DOB) and validate it server-side to ensure you meet this age requirement. Future dates are automatically rejected. We use your DOB solely for age verification and to send you a birthday greeting email. Your DOB is strictly private and is not exposed to personal trainers or any other third parties.

3. Information We Collect

We process information that you voluntarily provide to us when registering for or using our services. This includes:

A. Account / Identity Information

• First and last name
• Email address
• Phone number
• Gender
• Date of birth
• Profile photo
• Role and subscription plan information
• Timezone

B. Health, Fitness, and Nutrition Information

• Height and weight
• Fitness, calorie, and macronutrient goals
• Food logs, meals, and consumed macronutrients (protein, carbohydrates, fats) (which may be processed using third-party AI for nutritional estimation)
• Diet information and workout schedules
• Weekly progress and measurements
• Other information you voluntarily enter into these features

C. Payment and Transaction Information

When you purchase a subscription, we process the following:

• Razorpay order and payment identifiers
• Transaction amount, currency, status, and timestamps
• Subscription plan metadata

Note: SyncHealth does NOT store or process your raw credit/debit card numbers, CVV codes, or bank account credentials on our servers. This information is handled securely and independently by our payment processor, Razorpay.

D. Trainer Relationship Information

• Trainer-client pairing status (active or revoked)
• Relationship timestamps
• Audit information associated with relationship changes

E. Legal Acceptance and Security Information

• Records of the exact Terms & Conditions and Privacy Policy versions you accepted, including timestamps
• Technical security artifacts such as authentication tokens and temporary verification codes

4. How We Use Your Information

We use the information we collect for the following specific purposes:

• Creating, maintaining, and authenticating your account securely
• Verifying your phone number and email address
• Providing core nutrition tracking, fitness tracking, and history logging functionality (including AI-assisted food analysis)
• Enabling authorized trainer access to your progress (if you choose to pair with a trainer)
• Processing your subscriptions and payments
• Sending transactional service emails (e.g., password resets, welcome emails)
• Sending birthday greetings
• Responding to your support and privacy requests
• Processing self-service account deletion and data export requests
• Maintaining security audit records to prevent abuse and fraud
• Enforcing legal acceptance requirements

5. Trainer Access & Daily Reports

If you explicitly establish an active relationship with an authorized personal trainer on SyncHealth, that trainer is granted server-authorized access to certain information necessary to monitor your progress.

Information accessible to your authorized trainer includes:

• Name and email
• Height, weight, and goals
• Food/meal logs and macronutrient breakdowns
• Diet and workout schedules

Trainer Daily Report Emails: To facilitate coaching, SyncHealth automatically generates and sends a daily email report to your authorized trainer. This email explicitly contains your health and nutrition information, including your weight, consumed macronutrients, logged meals, and a generated PDF summary.

Information NOT accessible to trainers: Your date of birth, payment information, and legal acceptance history are never exposed to your trainer.

6. Third-Party Services & Data Sharing

We use specific third-party infrastructure services to operate SyncHealth. We share information with these providers only to the extent necessary to provide the service.

SyncHealth distinguishes between the data we send to these providers and how they independently handle that information. SyncHealth avoids intentionally logging sensitive health information into Vercel infrastructure logs.

6.1 AI-Assisted Food Analysis

When you use SyncHealth's food-analysis functionality, the food description you submit for analysis may be transmitted to an external AI service used by SyncHealth to estimate nutritional information such as calories and macronutrients. The request contains only the information necessary for this analysis (the food description string) and does not intentionally include unrelated account information such as your name, email address, phone number, date of birth, payment information, trainer information, or SyncHealth user ID.

Depending on the AI model/provider and applicable configuration, the provider may retain or process submitted content in accordance with its own data-use, retention, and model-improvement policies. OpenRouter is an API router that may route your request to various underlying model providers, and their specific data practices may differ from OpenRouter's own policies. SyncHealth does not control the independent data practices of these downstream providers.

7. Data Security

We implement appropriate technical measures to protect your personal information. These include server-side authorization enforcement, secure Firebase Authentication, protected background endpoints (cron jobs), and rate limiting to prevent abuse.

Cookies: SyncHealth uses a secure, HTTP-only session cookie for authentication. This cookie is valid for 7 days by default to keep you logged in securely without unnecessarily exposing your session.

8. Data Retention

We retain your information as follows:

• Temporary Security Artifacts: OTPs, password reset tokens, and verification artifacts are subject to explicit expiration timestamps and are automatically deleted by our systems.
• Account and Health Data: Your profile, health data, and food logs are retained until you explicitly delete your account.
• Promotional Eligibility: To prevent abuse of promotional trials, we maintain a persistent eligibility record even after account deletion. This record contains only irreversible cryptographic hashes of your normalized email and phone number, ensuring your raw contact identifiers are not retained.
• Payment Records: Payment transaction records are retained after account deletion for accounting, legal, financial, or operational record-keeping purposes, with the precise retention period subject to applicable requirements and our formal retention policy.
• Trainer Audit Records: Historical relationship logs and audit records are retained after account deletion for security, accountability, dispute-resolution, or similar legitimate record-keeping purposes, subject to applicable requirements and our formal retention policy.

9. Your Rights: Export, Correction & Deletion

Data Export

You can request and download a structured copy of your personal data through our self-service export mechanism. This export includes your profile, DOB, health data, food logs, progress, payments, relationship history, and legal acceptance history. Internal security credentials are deliberately excluded for your safety.

Data Correction

You can correct most of your profile information directly through your account settings. For fields that are not directly editable (such as your Date of Birth), you may submit a correction request to our privacy/support channel for manual review.

Account Deletion

You may initiate a self-service account deletion at any time. Upon deletion, SyncHealth automatically deletes the personal data under our direct control, including your authentication account, profile, food logs, weekly progress, profile images, and legal history. As noted above, specific payment and audit records may be deliberately retained.

10. Privacy Requests & Grievances

If you have any questions, require assistance with a data request, or wish to file a privacy grievance, please contact us at: support@synchealth.life.

All privacy, correction, deletion, and export support requests are securely routed to this inbox for review.

11. Legal Acceptance & Policy Updates

SyncHealth records your explicit acceptance of this Privacy Policy and our Terms & Conditions, including the specific version and timestamp of your acceptance.

We may update this Privacy Policy periodically. When material changes are made or a new version is published, you may be required to review and explicitly acknowledge the updated document through the application before continuing to use SyncHealth.