UPLFT Consumer Health Data Privacy Policy

Last updated: 23 September 2026

This policy applies to you if you are a resident of Washington State, or if your consumer health data is collected in Washington. It is offered to every UPLFT user regardless of where they live, because we would rather apply one standard than two.

UPLFT is operated by Jaden Joseph, operating as UPLFT, a sole proprietorship based in Victoria, British Columbia, Canada. Contact: hello@uplftapp.com.

1. The categories of consumer health data we collect, and why

We collect the following, and we use it for one purpose: to build and adjust your training and nutrition programme, and to show you your own history.

Category	What it is	Why we need it
Bodily functions and vital signs	Body weight, height, weigh-ins over time	Sets your load estimates and calorie targets
Biological characteristics	Your date of birth and your sex	Both change what the engine considers safe and appropriate to prescribe
Bodily and physical injury	Areas you mark as painful or injured, movements you block, pain you report during a session	Keeps the engine from prescribing something that would hurt you
Health conditions and symptoms	Whether you report being ill, and your soreness, sleep and energy check-ins	Scales the session down on a day you are not up to it
Exercise and fitness data	Every exercise, set, rep, load and difficulty rating; session dates, duration and completion	This is what the engine reads to choose your next session
Diet and nutrition	Food and drink you log, with its calories and macronutrients, and any dietary restrictions you set	Tracks you against the targets the app calculates
Bodily images	Progress photos and meal photos you choose to take	Progress photos are yours to look back on; meal photos are read to estimate what you ate
Measurements derived from the above	Estimated one-rep maxes, competence levels per movement, whether you are stalling or have earned a step up	These are the engine's conclusions about you, generated rather than entered

We do not collect precise location, and we do not use geofencing of any kind.

2. Where the data comes from

From you directly, when you complete the intake, log a session, log food, record a weigh-in, take a photo, or answer a readiness check.
From your device, when you use the camera, the microphone or speech recognition to log something, but only the resulting text or image, and only when you start it.
Generated by UPLFT itself, in the case of the derived measurements in the last row above. You did not enter these; the engine worked them out from what you logged.

We do not buy consumer health data, and we do not receive it from data brokers, advertisers, or any other app.

3. What we share, and with whom

We do not sell consumer health data. Not to anyone, for any price, ever.

These companies process consumer health data on our instructions and only to run UPLFT for you. Under Washington's Act that makes them processors rather than third parties, and passing data to them is not "sharing". We name them anyway, because you should know who touches your data.

We do not share your consumer health data with any third party, and we do not sell it.

Who	Categories they receive	Why	How to contact them
Supabase	All eight categories in section 1	They host our database, our sign-in and our file storage	supabase.com/privacy
Anthropic	Diet and nutrition, and bodily images, and only when you use the meal reader	To read the food and estimate its calories and macronutrients	anthropic.com/legal/privacy
Sentry	None of the categories in section 1. Crash reports tagged with your account number	To tell us when the app breaks	sentry.io/privacy
RevenueCat	None of the categories in section 1. Your account number, email address and purchase history	To work out whether your subscription is active	revenuecat.com/privacy

Categories of third party, stated plainly: cloud hosting and database providers, an artificial intelligence provider used to read meal photos, a crash reporting provider, and a subscription management provider. There are no affiliates. UPLFT is one person.

We will also disclose data if the law requires it, and if UPLFT is ever sold the data would transfer with the business.

4. Your rights, and how to use them

You have the right to:

Confirm whether we collect, share or sell your consumer health data, and to see what we hold. We do not sell it.
Get a list of every third party and affiliate we have shared it with, along with a way to contact each one. Section 3 is that list.
Withdraw your consent to our collecting or sharing it.
Have it deleted. Deleting your account removes your consumer health data from our live systems. Two things sit outside that sweep, and we would rather name them than imply a clean sweep: crash reports already sent to Sentry, which carry an account number and age out on Sentry's own 90-day schedule, and your subscriber record at RevenueCat. Ask us and we will remove both by hand. Copies inside our hosting provider's automated backups persist until that provider's own rotation overwrites them.

To delete it yourself, right now: open UPLFT and go to Settings → Delete account. You do not need to ask us, and you do not need to explain why.

For anything else, email hello@uplftapp.com. We will answer a consumer health data request within 45 days, the window this Act sets. Requests under Canadian law are answered within 30 days, as the Privacy Policy says. If both could apply to you, we use whichever is sooner. If we genuinely need longer we will tell you why before that deadline, and take no more than 45 further days. If we refuse a request we will tell you why, and how to appeal it. An appeal goes to the same address and we will answer it within 45 days.

Exercising any of these rights costs nothing and we will never treat you differently for it.

If you are unhappy with our answer, you may complain to the Washington State Attorney General at www.atg.wa.gov/file-complaint. The My Health My Data Act also allows you to bring a claim directly under Washington's Consumer Protection Act.

5. Consent

We ask for your consent before collecting any of the data in section 1, at a step shown before your account is created. That step names what we collect and what it is for. Consent to collection is asked separately from your agreement to our Terms of Service.

We do not share your consumer health data for any purpose beyond running the service, as described in section 3. If that ever changes, we will ask you again separately and specifically, before it happens.

You can withdraw consent at any time by deleting your account.

This policy covers consumer health data only. Everything else UPLFT holds, and the full detail of how long we keep it, how it is protected and who can see it, is in the Privacy Policy.