California Consumer Privacy Act (CCPA) Policy

It applies to you if you are a California resident and a "consumer" under the CCPA. If you live elsewhere, the same practices apply to you in substance — see our Privacy Policy and our Consumer Health Data Privacy notice.

The business responsible for the personal information described here is TECHFORWARD SOLUTIONS LIMITED, the operator of PHYSIOATHLETX.

• We do not sell your personal information, for money or for anything else of value.
• We do not share it for cross-context behavioral advertising.
• There are no advertising pixels, ad SDKs or third-party ad trackers anywhere in the app.
• Sensitive personal information is used only to provide the service you asked for.
• You can export everything and delete your account yourself, from the Account section, without contacting us.

In the last twelve months we have collected the following categories. For each one: what it is, where it came from, what we use it for, and who it is disclosed to. Every recipient listed is a service provider or contractor bound by a written contract that forbids using your information for its own purposes.

One correction to that, because accuracy cuts both ways: paid billing has not opened yet. Every plan is free in founding access, no card has been taken and no charge has been made, so no payment record has in fact been collected and nothing has been disclosed to Airwallex in the last twelve months. The Commercial information category below describes what will be collected from the moment billing opens.

No category above is disclosed for money or for cross-context behavioral advertising. Disclosure happens only for the business purposes listed.

We do not collect government identification numbers, Social Security numbers, driver's license numbers, card numbers or financial account numbers, precise geolocation, biometric identifiers, racial or ethnic origin, religious beliefs, union membership, sexual orientation, the contents of your mail or messages, or education or employment records.

Your card details go straight to Airwallex on its own hosted checkout. They never reach our servers, so we cannot disclose what we never receive.

The health-adjacent information you choose to enter can be sensitive personal information under the CCPA. We use it only to perform the service you signed up for and to keep it secure — the purposes the statute permits without a separate limitation right.

We do not use or disclose it to infer characteristics about you, to advertise to you, or for any purpose you did not enter it for. You may still send us a request to limit its use; because we already use it only for those permitted purposes, our answer will be a written confirmation of that. If you want the data gone instead, delete your account in the Account section.

• Providing the app and the features of the plan you hold.
• Creating, authenticating and securing your account.
• Billing, renewals, trials, cancellations and refund handling through Airwallex.
• Answering support requests you send us.
• Security, fraud prevention and debugging errors.
• Measuring product usage so we can improve the app.
• Meeting legal, tax and accounting obligations.

Only to the service providers and contractors below, each under a written contract limiting them to processing on our instructions:

• Supabase — database, authentication and storage.
• Vercel — application hosting and delivery.
• Airwallex — payment processing and subscription billing.
• Anthropic — the AI coach and food-photo estimates, with the minimum context described above.
• PostHog — first-party product analytics, with no health values in events.
• Apple, Google and Mozilla push services — delivering the reminders you switch on.

We may also disclose information if the law requires it, to respond to a valid legal process, or to protect our rights and the safety of users. If our business is ever transferred, the same commitments follow the data.

In the preceding twelve months we have not sold personal information and have not shared it for cross-context behavioral advertising. That includes the personal information of consumers we know to be under 16 — the app is not offered to anyone under 18.

Because there is nothing to opt out of, a Global Privacy Control signal changes nothing about how we handle your data. You can still submit a request, and we will confirm our practices to you in writing: see Do Not Sell or Share My Personal Information.

• Know and access — ask what categories and specific pieces of personal information we hold, where they came from, why we use them, and who we disclose them to, and get a copy in a portable format.
• Delete — ask us to delete the personal information we hold about you.
• Correct — ask us to fix personal information that is inaccurate.
• Opt out of sale or sharing — available to you even though we do not sell or share.
• Limit the use of sensitive personal information — we already restrict it to providing the service.
• Non-discrimination — we will not deny you the service, charge you a different price, or give you a lower level of service because you exercised a right.

One honest note on deletion: your account is what gives you access, so deleting it ends your subscription and your access to the app. That is the effect of deletion, not a penalty for asking.

• Access or copy — open Account and use "Download my data". The export is immediate and covers your profile, logs, nutrition data, check-ins, coach chats and subscription status. You can also email us instead.
• Delete — open Account and use the Danger Zone. Deletion cascades through your data, and any live subscription is cancelled with our payment provider so no further charge is taken. Billing records the provider holds are kept for as long as tax and accounting law requires. Export first if you want a copy.
• Correct — most fields (goal, conditions, equipment, diet preference, nutrition profile, logs) are editable in the app. For anything you cannot edit, email us.
• Opt out of sale or sharing — email us with the subject "Do Not Sell or Share", or follow /do-not-sell.
• Limit sensitive personal information — email us with the subject "Limit sensitive PI".

Email requests go to support@physioathletx.com. We confirm receipt within 10 business days and respond within 45 days. If we need more time we will tell you within that first 45 days and take up to 45 days more. Requests are free, and you may make them twice in any 12-month period.

If we cannot grant a request, we will tell you why in writing. You can reply to that email to ask us to look at it again.

We verify you by the email address on your account. Send the request from that address, or tell us the address so we can email you to confirm it is you. If we cannot match a request to an account, we cannot disclose or delete data, and we will say so.

For requests to know specific pieces of information we may ask you to confirm details already in the account before we send anything. We never ask for a government ID or a card number to verify a request, and we use anything you send for verification only, then delete it.

You may use an authorized agent. Send us written permission signed by you that names the agent and the request, from the email address on the account or with enough detail for us to verify it. We may also contact you directly to confirm you gave permission and to verify your identity. An agent with a valid power of attorney under California Probate Code sections 4000 to 4465 does not need to provide separate written permission.

PHYSIOATHLETX is not offered to anyone under 18, and we do not knowingly collect personal information from anyone under 18. We have never sold or shared the personal information of consumers under 16, and we will not do so.

If you are a parent or guardian and believe a minor created an account, email us and we will delete the account and its data.

We do not offer financial incentives, discounts or different service levels in exchange for personal information, so there is no notice of financial incentive to give you.

If our practices change — in particular if we ever began to sell or share personal information, which we do not do today — we would update this page and the Do Not Sell or Share page before the change took effect, and notify you in the app or by email.

TECHFORWARD SOLUTIONS LIMITED, a Hong Kong company, company number 76317223.

Unit 2A, 17/F Glenealy TowerNo.1 Glenealy, CentralHong Kong

Privacy, CCPA and all other requests: support@physioathletx.com.