Consumer Health Data Privacy Policy

This policy explains how D1 Performance LLC ("D1 Performance," "we," "our," or "us") collects, uses and shares consumer health data through our mobile app, websites and in-person training. Section 2 lists what counts. It also explains your rights over that data, including under Washington's My Health My Data Act, Nevada's consumer health data law and similar laws. Our Privacy Policy covers everything else.

• Body measurements. Height and weight, entered by the Athlete, recorded by a trainer at an in-person evaluation, or read from Apple Health or Health Connect. Sex, used only to calculate body and fuel estimates.
• Sleep. Read only from Apple Health or Health Connect, and only if the Athlete connects it.
• How the Athlete feels. The morning Readiness Check-In, check-ins after workouts, and Discomfort Reports (where it hurts, how much, and symptoms such as swelling or numbness).
• Setup's safety questions. A yes or no answer to whether the Athlete has any injuries or anything that hurts right now. If yes, a yes or no answer to whether a doctor, physical therapist or athletic trainer has told the Athlete not to train. If so, setup stops there and that answer isn't sent to us. Otherwise, a Discomfort Report of where it hurts, how much, when, and any numbness or swelling.
• Injury history. Optional notes about past injuries that the Athlete adds in Edit profile after setup.
• Fuel. The Fuel Goal, Fuel Target, weigh-ins and Food Logs. For a nutrition-label photo, the app removes hidden details, such as location, on the phone, then sends it to an AI model to read the label (Section 5). We don't store the photo on our servers. We keep the Food Log entry only if the Athlete saves it, and we record when each label was sent so we can limit how often label reading is used.
• Training. Workout logs, evaluation results and the plan changes our safety rules make in response to the items above.
• Messages. Anything about health that someone writes in the Trainer Thread.

Apple Health and Health Connect access is read-only. The app reads sleep, height and weight, nothing else, and never writes to either one.

• The Athlete, from what they enter in the app.
• Apple Health or Health Connect, only after the Athlete taps Connect in the app and allows access on their phone.
• D1 Performance trainers, who record evaluation results and review training.
• Anyone who writes in the Athlete's Trainer Thread.

A linked Parent/Guardian can't log health records for the Athlete, such as check-ins, Discomfort Reports, weigh-ins or food.

We use consumer health data only to:

• Provide the training service the Athlete asked for: build and adjust the plan, lighten or stop training after a rough check-in or a Discomfort Report, set the Fuel Target, and show progress. Height and weight update fuel estimates. Sleep is shown for context, and the plan doesn't change because of it.
• Show the Athlete's records to their linked Parents/Guardians.
• Let D1 Performance trainers train Athletes and review training.
• Answer support requests and meet legal obligations.

We don't use consumer health data for advertising or marketing, we don't sell it, and we don't use it for insurance, credit or employment decisions. Any other use needs your consent first.

We don't sell consumer health data or share it with advertisers, data brokers or information resellers. We share it with:

• The Athlete's linked Parents/Guardians, who can see these records, including Health measurements.
• D1 Performance trainers and staff, to train Athletes and run the Service.
• Service providers that process it for us:
  • Convex, Inc. stores it as our database and servers, and passes nutrition-label photos to OpenRouter through its AI gateway.
  • OpenRouter, Inc. sends each nutrition-label photo on to the AI model that reads it, and picks the service that runs that model. Each request tells OpenRouter to use only a service whose policy is not to keep or collect what we send. If none is available, the label isn't read. Convex and OpenRouter keep a record of each request for usage and billing, and their own terms govern anything else they keep.
  • A service OpenRouter picks runs the OpenAI model that reads the label, such as OpenAI, L.L.C. or Microsoft Corporation (Azure). Progress Report facts are not sent to AI.
  • 650 Industries, Inc. (Expo), with Apple's and Google's push services, delivers notifications. Some training notifications name the reason for a plan change, such as a rough check-in, and that text can appear on the lock screen. When pain or discomfort causes a plan change, the notification only says your plan changed; the details stay in the app. You can turn notifications off in your phone's settings.
  • Resend, Inc. delivers our emails, such as Trainer Thread alerts and Progress Report notices.
  • Functional Software, Inc. (Sentry) receives error reports. Reports from the app leave out health data. We strip personal details from our server and website reports, but a report from our servers can include an internal account ID.
• Authorities, when the law or legal process requires it, or to protect someone's safety.
• A buyer, if D1 Performance is merged or sold, under this policy.

We don't use geofencing (a virtual boundary that detects when a phone enters a place) around health care facilities, and we don't use location to infer anything about health.

• Health access stays off until the Athlete turns it on. An Athlete aged 13 to 17 doesn't need a linked Parent/Guardian or their approval to turn it on.
• The first time an Athlete under 18 turns it on, each linked Parent/Guardian is sent a notification, and so is a Parent/Guardian who links later. Linked Parents/Guardians can see the measurements in the app.
• Each linked Parent/Guardian can stop future collection while the Athlete is under 18. While any Parent/Guardian's stop is in place, collection stays off, and the Athlete can't turn it back on. Each Parent/Guardian can clear only their own stop. A stop ends when that family link ends or the Athlete turns 18.
• Stopping collection doesn't delete anything. The data already stored stays until it's deleted (Section 7).

We keep consumer health data while the account exists so the Athlete and their family can see their history. It's removed when:

• The Athlete deletes stored Health data in Settings, under Health access. This removes measurements read from Apple Health or Health Connect and what we built from them. Everything else stays, such as manual weigh-ins, Food Logs, Readiness Check-Ins, Discomfort Reports and evaluation results.
• The Athlete deletes their account. This removes it, except for the records listed in Section 11 of the Privacy Policy.

We keep a record of each Health choice, each Parent/Guardian stop and each deletion request as proof of consent. These records hold no measurements.

• Access. See your health data in the app, and ask us for a copy and a list of the third parties we've shared it with.
• Withdraw consent. Disconnect Health in Settings, under Health access, or in your phone's settings. The app stops reading right away.
• Delete. Delete stored Health data or your whole account in the app, or ask us by email.

We won't charge you more or treat you worse for using these rights. A linked Parent/Guardian of an Athlete under 18 can stop collection in the app, and can email us from their own account's email address to ask about or request deletion of the Athlete's health data.

Email support@d1performancetraining.com from the email address on your account. We check that the request comes from the account owner, or from a linked Parent/Guardian's account for their Athlete, and answer within 45 days, or tell you if we need another 45.

If we turn down a request, you can appeal by emailing legal@d1performancetraining.com with "Appeal" in the subject line. We answer appeals within 45 days. If we deny your appeal, you can contact your state Attorney General. Washington residents can contact the Washington Office of the Attorney General.

D1 Performance LLC, 3553 Drews Ct, Alexandria, VA 22309.