Privacy Policy

This Privacy Policy explains how [Company Legal Name](“we”) collects, uses, and shares information when you use Ultravium (the “Service”). We take your health data seriously and only use it to provide and improve the Service.

Information we collect

• Account: email and password (stored hashed).
• Profile & health: age, sex, weight/height, training experience, equipment, and any medical conditions, injuries, allergies, goals, and preferences you provide.
• Connected & uploaded health data: metrics from devices you connect (e.g. WHOOP, Oura — recovery, sleep, heart rate, workouts), and data you upload (InBody/body composition, VO₂ max, body weight, bloodwork/biomarkers, nutrition logs).
• Coach conversations: the messages you exchange with the AI coach and facts it remembers about you.
• Payment: handled by Stripe. We receive your subscription status but do not store your full card number.
• Usage & technical: basic logs needed to run and secure the Service.

How we use it

To operate the Service, personalize your coaching and programming, generate your scores and insights, process payments, communicate with you, and keep the Service secure. We do not sell your personal data.

AI processing

To power the AI coach and read your uploaded photos/PDFs, relevant data is sent to our AI provider, Anthropic (Claude), which processes it to generate responses. We share only what is needed for that purpose.

Service providers (sub-processors)

• Stripe — payments & subscriptions.
• Anthropic — AI coaching & document parsing.
• Vercel — application hosting.
• Neon — database hosting.
• WHOOP / Oura — only when you choose to connect them, to import your data.

Health data & HIPAA

Ultravium is a consumer wellness product and, in most cases, is not a HIPAA-covered entity; the health information you provide is generally not “Protected Health Information” under HIPAA. We nonetheless handle it with care and limit access to what is needed to run the Service.

Your rights

Depending on where you live (e.g. GDPR, CCPA), you may have rights to access, correct, export, or delete your personal data, and to withdraw consent. You can disconnect data sources at any time, and request export or deletion of your account by contacting [contact email]. [Self-service export/delete is on our roadmap.]

Data retention & security

We retain your data while your account is active and as needed to provide the Service or meet legal obligations, and delete or anonymize it after. We use industry-standard measures (encryption in transit, hashed passwords, encrypted third-party tokens) to protect your data, though no method is 100% secure.

Cookies

We use a single essential cookie to keep you signed in. We do not use third-party advertising or cross-site tracking cookies.

Children

The Service is not directed to anyone under 18, and we do not knowingly collect their data.

International transfers

Your data may be processed in the United States and other countries where our providers operate.

Changes & contact

We may update this policy; material changes will be notified. Questions or requests: [contact email].

[This document is a starting template and is not legal advice. Replace the bracketed placeholders and have it reviewed by a qualified attorney before launch.]