Consumer Health Data Privacy Policy

This policy covers the health data the Built and Shaped apps handle and your rights over it. Both apps are operated by Core Capital Investments LLC (“we”). It applies to everyone who uses them, wherever you live, and is written to meet Washington’s My Health My Data Act, Nevada’s consumer health data law and Connecticut’s data privacy act.

1. Health data we collect, and what we use it for

• Body and profile details (age, sex, height, weight, body-fat estimate, body measurements) — to set your calories and macros, pick your program and fit every answer to your body.
• Shaped only: reproductive and life-stage information (whether you have a menstrual cycle, are pregnant, trying to conceive, postpartum, perimenopausal or postmenopausal) — to keep training and nutrition advice safe for your stage of life.
• Shaped only: menstrual cycle data, if you track it (period start dates, cycle length, how you felt) — to show where you are in your cycle and coach off how you actually feel.
• Your goal and training history (goal, experience, schedule, equipment, workouts, sets, reps, loads) — to build your program and progress it.
• Food and nutrition (meals, macros, targets, meal photos you choose to scan) — to track intake against your targets.
• Weight log and weekly check-ins (how training, sleep, energy and mood are going) — to see your trend and adjust your plan.
• Progress photos you choose to take — to estimate physique changes (only small thumbnails are kept).
• Lab results you type in or scan — to flag values outside common reference ranges.
• Apple Health data, if you connect it (resting heart rate, heart-rate variability, sleep, active calories, steps; in Shaped, period start dates) — to judge recovery and prefill what you’d otherwise type.
• Things we work out from the above (calorie and macro targets, readiness, plan adjustments, physique and lab notes) — these inferences are the coaching itself.

We use it only to provide the coaching you asked for — not for advertising, marketing profiles, or any other purpose. We don’t collect your location.

2. Where it comes from

• You — what you type, choose or photograph in the app.
• Apple Health, only if you connect it and only the items you allow. These values stay on your phone and are never sent to us or to the AI service.
• The app itself, which works out targets, readiness, plan changes and notes from the above.

3. What we share, and with whom

Only if you said yes to sharing, and only when you use an AI feature, we send the following through our server to the AI service, which uses it to write the answer and nothing else:

• Coach chat: your message plus a summary of what you’ve logged (profile, goal, lifts, meals, weight trend, check-ins, labs, physique notes; in Shaped also life stage and current cycle phase).
• Meal, physique and lab scans: the photo or report you choose, plus (physique) your sex and weight if you typed them in.
• Plan note: your goal, program, phase and targets.

With sharing off, none of this is sent. Anything you type into a chat message is sent so the coach can answer it.

Categories of recipients. We have no affiliates and share health data only with service providers that process it for us:

• AI service providers — Anthropic, PBC (primary) and OpenAI (backup). Under their commercial API terms they do not train models on it; they may keep it for a limited time for safety and abuse monitoring.
• Hosting — Vercel Inc., which runs our server and passes AI requests through without storing them.
• Email delivery — Resend and our database provider, only if you ask the app to email you your plan (your address, goal, program, sex if typed, and the plan’s targets).

Apple, Google and RevenueCat receive purchase records only, never health data. No third party collects your health data over time or across other websites or apps through Built or Shaped — there are no ads, analytics or tracking tools in them.

4. Your consent, and taking it back

We ask before collecting (question 1) and, separately, before sharing (question 2). Neither is part of our terms or medical disclaimer, and nothing is pre-ticked. To withdraw either one, open Settings → Privacy in the app and switch it off; it takes effect immediately. Switching off question 1 deletes your data from the phone, because the app can’t coach without it.

5. Your rights

• Know and access: confirm whether we collect, share or sell your health data, get a copy, and get a list of every third party we shared it with and how to contact them.
• Delete: on your phone, tap Settings → Privacy → Delete all my data — it is gone at once, including the copy the app keeps in your phone’s own storage. For data held off the phone (an emailed plan’s record), ask us: we delete it and tell our service providers to delete it too.
• Withdraw consent at any time, as above.
• Correct anything you entered, in the app.
• No discrimination for using any of these rights.

How to ask: email corecapitalinvestmentsinc@gmail.com with “Health data request” in the subject. You don’t need an account. Because there are no accounts, we may ask for the email address you used or a detail only you would know, so we act on the right person’s data.

We answer within 45 days of receiving your request. If we need more time we’ll tell you why within those 45 days and take up to 45 more. Requests are free, up to twice a year.

Appeals: if we turn down any part of a request, reply with “Appeal” in the subject. We’ll give you a written decision with reasons within 45 days. If we deny your appeal you can complain to your state attorney general — for example Washington, Nevada or Connecticut.

6. How long we keep it

On your phone: until you delete it, delete the app, or switch off question 1. AI requests: we don’t store them. Emailed-plan records: until you unsubscribe or ask us to delete them.

7. Selling, location and security

We do not sell health data, and we never will without the separate, signed authorization the law requires. We don’t collect your location and don’t use geofencing. Data in transit is encrypted (HTTPS), only the people who run the apps can reach the systems involved, and our service providers are bound by contract to use the data only to provide their service to us.

8. Changes

If we change this policy we update the date above. Before collecting a new kind of health data, sharing it with a new kind of recipient, or using it for a new purpose, we’ll ask you again in the app.

9. Contact

Core Capital Investments LLC · corecapitalinvestmentsinc@gmail.com