Last updated: this document is a working draft prepared for launch and has not yet been reviewed by an attorney. Do not treat it as final legal advice — have counsel review it before relying on it, and before this app is submitted for app store review.

1. Health data we collect

Depending on how you use Conexus Thrive, we collect:

• Account information (name, email, username, role).
• Fitness activity you log yourself (workouts, weight, measurements, meals).
• Messages you exchange with your Provider.
• If you have a Patient role, clinical information your medical provider records about you.
• If you choose to connect a wearable or your phone's health platform (Apple Health, Health Connect), a limited set of activity metrics — steps, active minutes, active energy, exercise minutes, heart rate averages, sleep minutes, and workouts you log through that platform. We do not request broader health records (e.g. clinical records, reproductive health data, or diagnoses) from these platforms, and connecting a device is entirely optional.

2. Why we collect it

We use this data to run the coaching features you signed up for: showing your progress, letting your Provider support you, closing your daily activity rings, evaluating challenge/reward eligibility, and (if you opt in) powering the AI fitness coach and AI-assisted nutrition guidance — which a licensed nutritionist reviews before it reaches you for anything diet-related.

3. Who we share it with

We do not sell your health data, and we do not share it with third parties for their own marketing or advertising purposes. Limited data is shared only with the service providers needed to run the app on our behalf, under contract, and only for that purpose:

• Our hosting infrastructure provider (to run the servers your data lives on).
• Our AI provider (Moonshot AI, which operates the "Kimi" models), to generate AI coach responses and draft nutrition guidance — always reviewed by a human nutritionist before it's presented as dietary guidance.
• ConexusCRM, our sister platform, for messaging delivery, video sessions, and payment processing for coaching sessions and Fuel Lab purchases.
• Your assigned Provider(s), as part of delivering your coaching/care.

We never share connected-device health data with any of these beyond what's needed to close your rings and evaluate rewards.

4. Your choices

• Connecting a health device/wearable is optional and can be disconnected at any time; disconnecting stops new data from syncing (it does not delete data already recorded).
• You can request a copy of your data or ask us to delete your account by contacting us below.
• You can opt out of appearing on any leaderboard at any time.

5. Data retention

We retain your data while your account is active and for a limited period after closure as needed for legal, safety, and financial record-keeping obligations.

6. Security

We use encryption in transit (TLS) for all traffic to the app, and access to clinical/PHI data is restricted to your care team and logged.

7. Contact

Questions or data requests: privacy@conexusthrive.com