Consumer Health Data Privacy Notice
SetLift LLC
Effective August 3, 2026 · Last updated August 3, 2026
This notice supplements our Privacy Policy and is provided under Washington's My Health My Data Act, Nevada's SB 370, and the consumer health data provisions of the Connecticut Data Privacy Act. It describes how SetLift handles information about your body and your physical activity. If you are a resident of one of those states, the rights described here are yours by law. We extend the same practices to all users regardless of where you live.
1. What we treat as consumer health data
These laws define "consumer health data" broadly — as information linked to you that identifies your past, present, or future physical or mental health status. In SetLift, that means:
- Body measurements over time — bodyweight, goal weight, and any other body metrics you record
- Active injuries you tell us about so programming can work around them
- Progress photos — photographs of your body
- Date of birth, gender, and activity level
- Training goals and nutritional focus
- Logged workouts — exercises, loads, sets, reps, duration, and timestamps, which together describe your physical capability and activity
- Coach notes and messages to the extent they discuss your health, injuries, or physical condition
2. Why we collect it
We collect consumer health data for one reason: to operate the app you asked us to operate. Specifically, to store and display your training history, to calculate personal records and progress, to generate or adjust programming around your goals and injuries, and to let a coach you have connected with do their job.
We do not collect it for advertising, marketing, profiling, resale, or research.
3. How we collect it
All of it comes from you, directly, through the app. We do not buy health data from data brokers, we do not infer it from third-party sources, and we do not receive it from other apps or from HealthKit.
4. Who we share it with
We share consumer health data only with the processors needed to run the service, and with people you deliberately share it with:
| Recipient | What they receive | Why |
|---|---|---|
| Supabase (AWS, Ohio USA) | Stores all of it — metrics, injuries, photos, workout logs, messages | Database and file storage. Contractually bound to process only on our instructions. |
| Google (Gemini API) | Only the prompt you type when generating a workout, and the workout image if you use photo import. If you type health information into a prompt, it goes to Google. | AI workout generation. We use the paid tier, under which Google does not train models on prompts or responses. |
| Coaches you connect with | Your training data, and any injuries, metrics, or photos you share within the coaching relationship | So they can coach you. Coaches are independent, not SetLift staff. |
| Other users | Only what you deliberately post or send | Groups, messages, and shares you initiate. |
SetLift has never sold consumer health data and has no plans to. Under the My Health My Data Act, selling would require your separate, signed, written authorization — a document distinct from consent. We do not ask for one, because we do not sell.
5. Consent, and how to withdraw it
We collect and share your consumer health data on the basis of your consent, which you give when you choose to enter it. Each category is optional in the sense that you decide whether to provide it — you can use SetLift to log workouts without recording injuries, body metrics, or progress photos.
You can withdraw consent at any time. To do so:
- Delete specific data in the app — remove progress photos, clear body metrics, remove recorded injuries, or delete individual workouts
- Disconnect from a coach to stop sharing new data with them
- Delete your account — in Settings → Account → Delete Account, which removes all of it
- Email privacy@setlift.app with the subject line "Withdraw consent" and tell us what you want stopped
Withdrawing consent does not affect processing that already happened, and some features stop working without the underlying data.
6. Your rights
You have the right to:
- Know whether we collect, share, or sell your consumer health data, and to see a list of who we have shared it with
- Access a copy of your consumer health data
- Withdraw consent to its collection and sharing, as described above
- Delete it. When you exercise this right we delete it from our active systems and instruct our processors to do the same. We will tell you if any of it must be retained for a legal reason, and why.
- Appeal if we decline a request. Reply to our response and a different reviewer will consider it. If we deny your appeal you may contact the Washington Attorney General at atg.wa.gov/file-complaint or your own state's Attorney General.
Exercise any of these by emailing privacy@setlift.app. We will verify your identity by confirming control of the account's email address, and respond within 45 days. We will not charge you, and we will not degrade your experience for asking.
7. How we protect it
Consumer health data is encrypted in transit with TLS and at rest by Supabase and AWS. Progress photos, voice messages, and coach verification documents are held in private storage that requires authentication.
There is no end-to-end encryption. SetLift's operator and Supabase are technically able to read progress photos, messages, and coach notes. We do not do so routinely, but we will not claim a protection we have not built.
Your profile photo is stored in a public bucket and can be viewed by anyone with the URL. Progress photos are not — but choose your profile photo accordingly.
8. Employees and contractors who can access it
SetLift is currently operated by a single person. Access to production data is limited to the operator and to the service providers listed in Section 4, each of whom is contractually restricted to processing data on our instructions. If we add staff or contractors with production access, we will update this notice.
9. How long we keep it
For as long as your account exists, or until you delete the specific data. Deleting your account performs a genuine deletion of your authentication record and associated data. Backups may hold copies for a limited period before ageing out.
10. Changes
We will update this notice when our practices change, revise the date above, and notify you in the app or by email before material changes take effect.
11. Contact
- Email: privacy@setlift.app