Privacy Policy

1. Who we are

OMNID is provided by OMNID L.L.C., a Wyoming limited liability company ("OMNID", "we", "us"). We decide how and why your personal information is used, which makes us its controller (the term used in UK and EU law). You can contact us about anything in this policy at support@omnid.app.

This policy covers the OMNID website and app, subscriptions and custom programs. It applies wherever you live, and section 11 adds what applies in particular places. Words like "Service" mean what they mean in our Terms of Service.

2. What we collect

Your account

• Email address, password (stored only as a one-way hash by our authentication provider) and the name you choose to show.
• If you sign in with Google or Apple: the email address and, where the provider sends them, your name and profile picture. We never receive your password for that account and we ask for nothing else in it.
• When you created the account, and your confirmation that you are 18 or older and accept our terms, with the version you accepted and how you gave it.

Your body and your training

• Height, bodyweight, age, sex, activity level and, if you enter it, body fat percentage.
• Your goal, the days you can train, your training experience, the program you run and where you are in it.
• Every set you log: exercise, load, repetitions, reps in reserve, and any notes you write.
• Starting numbers you enter for a lift so that a load can be suggested before you have logged it: a set you can do today, or your best before a break.
• Bodyweight entries over time, and, if you use them, daily energy intake entries and a nutrition goal.
• Your display preferences, such as kilograms or pounds and reps in reserve or RPE.

Your consent to use health information

Before you enter body measurements, we ask for your consent to use them and your nutrition entries, separately from our terms. We store that you gave it, when, and the exact wording. If you do not give it, you can still use the programs and the training log, and the parts that need those measurements stay empty. You can give or withdraw it in Settings; withdrawing it deletes your stored body measurements, bodyweight history, intake entries and nutrition goal.

Health questions

Before your first program we ask seven yes or no questions about your health. Your answers are used on the spot to show you guidance. They are saved to your account only if you tick a separate box asking us to save them, and then we store the answers, the date and the exact wording you agreed to. You can delete them from You at any time.

Custom programs

If you buy a custom program we also collect your application and intake questionnaire, which can include injuries, past surgery and medical history you choose to tell us; the video clips you film of yourself performing a set of movements, after you agree to the filming; the position of your joints in each frame of those clips, recorded as numbers; our reviewer's notes; if you postpone your start, your answers to the short check-in you complete when you resume (whether, since your screening, you have had a new injury, surgery or a hospital stay, a new diagnosis or a new or changed prescription medicine, or a pregnancy or birth, and your description of your daily life since then), which we use to decide whether your screening stands or a new screening and its re-review fee apply, and to fit your program to you; the written assessment and program we produce; and the messages you and your coach exchange in the app, with when each was read, which can include health information you choose to share, such as an injury or pain.

Purchases

• Your plan, subscription status and billing dates, and the identifiers our payment provider gives us. Your card details go to the payment provider and are never seen or stored by us.
• At checkout: the country of residence you declare, and in the United States and Canada the state, province or territory, the country your internet connection appears to come from (the country only, not your IP address), your email address, and the exact text of each statement you agreed to, with the time. We keep this as a record of what you were shown and accepted.
• When you change plan: the terms shown to you and your agreement to them, with the time, as at checkout.
• The billing emails we send you (confirmation of your subscription, the reminders before your free month ends, renewal reminders for annual plans, confirmation of a plan change, confirmation of a custom program purchase and of its delivery, a yearly reminder while a custom program subscription runs, cancellation and withdrawal confirmations, and notice of any price change), with their text and when they were sent.

Messages

• What you write to us and our replies, and, with a custom program, the messages you exchange with your coach in the app.

Technical information

• Sign-in cookies that keep you signed in (see section 8).
• Your device's time zone, read by the app and stored in a cookie, and otherwise the time zone your connection appears to come from, so that a session you log is dated on your own calendar.
• Like any website, our hosting provider receives your IP address and browser details in order to deliver pages to you, and keeps them in short-lived server logs for security and fault-finding. We do not use them to identify or follow you.
• To comply with sanctions law and our payment provider's terms, when you use our website to sign up, sign in, use the app or pay, we check the country and region your internet connection appears to come from, as our hosting provider works it out from your IP address, and refuse access from the places section 2 of our Terms names. We do not store the result of that check, or your IP address, for it.
• If something fails on our servers, an error report goes to our error-monitoring provider. It is set not to include request contents, headers or IP addresses, and we do not put your training data or answers into it.

Website measurement

When you open a page on our public website we record the page's path, the domain name of the site that linked you to it, and any campaign tags in the address. We do not set a cookie for this, and we do not store your IP address, browser details or anything else that links one visit to another. Pages you see after signing in are not measured. Separately, we record a small number of account events (an account created, a checkout started, a subscription started or ended) against your account, so that we can see whether the business is working. If you delete your account, those events stay only as anonymous counts.

We do not knowingly collect information from anyone under 18. We do not buy information about you from anyone, and we receive information about you from others only as described above (your sign-in provider and our payment provider).

3. How we use it, and our legal basis

Laws such as the UK and EU General Data Protection Regulation ask us to state the legal reason for each use. Where we say "contract" we mean the use is needed to provide what you signed up for.

• To create and run your account, give you your programs, record your sets, calculate suggested loads, estimates and charts, and let you export your data. Basis: contract; for health information, see section 4.
• To take payment, manage your subscription, keep a record of what you agreed to at checkout, and send you the billing emails consumer law requires. Basis: contract, and our legal obligations (tax, consumer law).
• To design, deliver and reassess a custom program from your screening, to decide from the check-in you answer when you resume a postponed start whether a new screening and its re-review fee apply (section 10 of our Terms sets out the rule), and, using a copy that leaves out your name and contact details, to improve how the screening measures movement, only if you agree to that separately. Basis: your explicit consent.
• To let you message your coach, and to coach you from what you write. Basis: contract; for health information in your messages, your explicit consent, which the custom program checkout asks for.
• To answer your messages and send you messages about your account, such as sign-in links, password resets and changes to your subscription or to these terms. Basis: contract, and our legitimate interest in running the Service.
• To keep the Service secure, prevent abuse (for example by limiting how often an action can be repeated), find and fix faults. Basis: our legitimate interest in a working, secure service.
• To count visits and sign-ups so we know whether the business is working. Basis: our legitimate interest; the page counts identify nobody.
• To check that the Service is not used from a place sanctions law, or our payment provider's terms, do not let us serve (section 2, Technical information). Basis: our legitimate interest in complying with the sanctions law that applies to us and with our payment provider's terms.
• To comply with the law and to establish or defend legal claims. Basis: legal obligation and legitimate interest.

We do not sell your personal information, share it for cross-context behavioral advertising, use it to show you ads, or use it to make decisions about you that have legal or similarly significant effects. Suggested loads are calculated automatically from your own logs; they are suggestions you are free to ignore, not decisions about you. We do not send marketing email. If we ever want to, we will ask first.

4. Health information

Some of what you give us is health information under many privacy laws: body measurements in the context of training, your answers to the health questions, everything in a custom program application and screening, and what you tell your coach about injuries, pain or your health. We handle it with extra care.

• We use it only to provide the Service you asked for and as this policy describes. We never sell it, and we never share it for anyone else's own purposes.
• We rely on your explicit consent to use health information. Using your body measurements and nutrition entries, saving your health question answers, filming a custom program screening, and using the health information a custom program and your messages with your coach rest on each have their own consent step, separate from our terms. You can withdraw consent at any time, without affecting what was done before; withdrawing it means we can no longer provide the parts of the Service that need that information.
• Access inside OMNID is limited to the people who need it to provide the Service: for custom programs, the reviewer and the coach working with you.
• Before a custom program closes, your coach may email you a note of anything in your conversation worth keeping, at your request or on the coach's own suggestion, and that note can contain health information. It is sent from our support address, so it passes through the provider that hosts that mailbox (section 5), and a copy stays in your inbox, which we cannot delete from.

5. Who we share it with

We share your information only with service providers who process it on our behalf, under contract, and only for the purposes in this policy:

• Supabase, which hosts our database, sign-in and file storage, including screening video.
• Vercel, which hosts the website and app.
• Stripe, which processes payments and holds your payment details.
• Sentry, which receives error reports from our servers.
• Resend, which delivers our billing emails and the emails telling you or your coach that there is a new message (which never contain the message itself), and the provider that delivers our sign-in and password reset emails.
• The provider that hosts our support mailbox, which carries what you write to us and our replies, including any note from your conversation your coach emails you (section 4), which can contain health information.
• Google or Apple, only if you choose to sign in with them, and only to confirm who you are. We send them nothing about your training or purchases.

Beyond them, we disclose information only if the law requires it, to protect someone's safety, to enforce our terms or defend a legal claim, or to a business that takes over the Service, which would have to honor this policy. The movement tracking used during a screening runs inside your own browser; video is not sent to any outside service to be analyzed.

6. Where your information is stored

OMNID is run from the United States, and our providers store and process information in the United States and other countries where they operate. If you live in the United Kingdom, the European Economic Area, Australia, New Zealand or Canada, this means your information is transferred out of your country. Where the law requires it, we rely on safeguards for those transfers such as the standard contractual clauses approved for that purpose, and on our providers' own commitments to protect it to the standard your law expects.

7. How long we keep it

• Account, body and training information, starting numbers included: for as long as your account is open.
• When you delete your account in Settings, your account and the information linked to it are deleted from our live database straight away, including your logs, measurements and health answers. Copies in our provider's backups are overwritten on its backup cycle, within 30 days, and we do not restore deleted accounts from them.
• Checkout records, plan change records and billing emails: kept for 3 years, or until 1 year after your subscription ends if that is later, even if you delete your account sooner, because consumer law requires us to be able to show what you agreed to and what we told you. They are then deleted automatically.
• Account events used for counting: kept for 24 months, and only as anonymous counts once the account is deleted.
• The record of when you gave or withdrew consent to use your health information: kept while your account is open, and deleted with it.
• Custom program screening video: deleted automatically 12 months after it is filmed, whether or not your account is still open.
• Joint position data from a screening: kept longer so that a later screening can be compared with an earlier one, and deleted no later than 5 years after filming.
• The written assessment from a screening, which contains no images: kept with your custom program while your account is open.
• Your custom program application, including the resume check-in if you postponed your start: kept while your account is open, and deleted with it.
• Payment records: kept by our payment provider for as long as financial and tax law requires, which can be after your account is deleted.
• Messages to us and our replies, including a note from your conversation your coach emails you: for as long as needed to deal with them, and then for up to two years in case the matter comes up again.
• Messages with your coach: kept while your custom program subscription runs and for 2 years after your last custom program ends, so that your coach can pick up where you left off if you come back and so that we can deal with any question about the coaching, then deleted automatically. When a custom program closes, its conversation leaves the app at once and is not shown to you there again, but the messages are in your data export, and you can ask us for a copy, until they are deleted. If you delete your account, they are deleted with it.
• Server logs and error reports: for a short period set by those providers, for security and fault-finding.

You can ask for screening video to be deleted sooner by writing to support@omnid.app from the email address on your account. We complete it within 30 days. Deleting the video does not withdraw a program already built from it.

If your account has a custom program application, deleting it from Settings is not possible, because the screening files are kept on their own schedule; write to us and we will delete the account and the application together.

8. Cookies

We use only the cookies the Service needs to work:

• Sign-in cookies, set by our authentication provider, which keep you signed in and protect your session. Without them you cannot use the app.
• A time zone cookie, which stores your device's time zone for up to a year so that sessions are dated on your own calendar.

We use no analytics, advertising or social media cookies, and nothing that tracks you across other websites. Because we do not track you across sites, we treat browser Do Not Track and Global Privacy Control signals as already satisfied; there is nothing further for them to switch off.

9. Your choices and rights

Wherever you live, you can do the following, and we will not treat you differently for doing it:

• See and correct most of your information directly in the app.
• Download your training record and your raw data in Settings, under Privacy and data.
• Delete your health question answers from You, at any time.
• Delete your account in Settings.
• Ask us for a copy of the information we hold about you, to correct it, to delete it, or to stop or limit a use of it, by writing to support@omnid.app from the email address on your account.

We may need to confirm that a request comes from you before acting on it, and we reply within 20 business days at the latest. If we cannot do what you ask, we will tell you why. Some laws let you appeal a refusal; you can do that by replying to our answer, and we will look at it again within 45 days.

10. Security

Information travels to and from OMNID encrypted. Each person's data in our database is fenced off so that a signed-in account can reach only its own rows. Screening video is never public and is opened only through links that expire, within an hour at most. Access by our own staff is limited to what their work needs. No system is perfectly secure; if a breach affects your information, we will tell you and the authorities where the law requires.

11. If you live in particular places

United Kingdom and European Economic Area

You have the rights to access, rectification, erasure, restriction, portability and objection, and to withdraw consent, under the UK GDPR or the GDPR. You can complain to a data protection authority: in the United Kingdom, the Information Commissioner's Office (ico.org.uk); in Ireland, the Data Protection Commission (dataprotection.ie); or the authority where you live or work. We would be grateful for the chance to put things right first.

Australia

We handle your personal information in line with the Australian Privacy Principles. You can ask to access or correct it as described in section 9. If you are not satisfied with how we handle a complaint, you can contact the Office of the Australian Information Commissioner (oaic.gov.au). Your information is disclosed to our service providers in the United States, and may be processed by them in other countries where they operate.

New Zealand

You have the rights to access and correct your information under the Privacy Act 2020, and can complain to the Office of the Privacy Commissioner (privacy.org.nz).

Canada

You can access and correct your information, withdraw consent, and complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca). We do not currently offer the Service to residents of Quebec, Manitoba, Saskatchewan or Nova Scotia.

United States

We do not sell personal information or share it for targeted advertising, and we do not use or disclose sensitive personal information to infer characteristics about you. Residents of Washington, Nevada and Connecticut have additional rights over consumer health data, set out in our Consumer Health Data Privacy Policy. Residents of other states with privacy laws may have rights to access, correct, delete and obtain a copy of their information, and to appeal our decision; use the contact details below.

12. Children

OMNID is for adults. You must be 18 or older to create an account, and we do not knowingly collect information from anyone younger. If you believe someone under 18 has given us information, write to us and we will delete it.

13. Changes to this policy

If we change this policy, we will update the date at the top. If a change is significant, for example a new use of your information or a new kind of recipient, we will tell you by email or in the app before it takes effect, and ask for your consent where the law requires it.

14. Contact

OMNID L.L.C., a Wyoming limited liability company.

Email: support@omnid.app. Write from the email address on your account when your request is about your account.