Privacy Policy

What We Collect

When you use NOWISLIFE we may collect:

• Account information — first name, last name, email address, phone number, and password hash (or passkey credential ID)
• Profile data — optional profile photo
• Fitness data — exercises, workout logs, completion history, and team challenge contributions
• Health data — heart rate, daily steps, active calories, and (to personalize coaching) resting heart rate, heart rate variability (HRV), and sleep duration from Apple HealthKit (only when you explicitly authorize access on your device)
• Device & session data — login IP address, browser user agent, push notification token, and session timestamps (for security monitoring)
• Analytics data — pseudonymous usage events and interactions (see Analytics & Tracking below)
• Communications — support tickets and contact messages you send us, including any screenshots you attach

We do not collect facial-recognition or fingerprint biometric identifiers. Passkey biometrics (Face ID, Touch ID, etc.) are processed entirely on your device and are never transmitted to our servers. Optional Apple Watch motion data, if you choose to contribute it, is treated as sensitive data (see below).

We collect this information from you directly, from your device and app, and — only with your authorization — from Apple HealthKit.

How We Use Your Data

We use your data to:

• Operate and improve the NOWISLIFE service
• Verify your identity and secure your account
• Send transactional communications (email verification, password reset, team invites)
• Power optional features such as the AI Coach and AI support triage
• Send push notifications for workout reminders and team activity (configurable in Settings)
• Detect and prevent fraud or abuse
• Comply with legal obligations

AI Coach

NOWISLIFE includes an optional AI Coach you can chat with, plus a short daily message on your Today page.

The interactive chat is powered by a third-party AI provider. To respond, Coach is given your first name, any facts you have asked it to remember (such as your equipment, goals, or injuries/limitations), notes Coach keeps from earlier messages, a summary of your current routine, your streak, your most recent completed workout, your most-trained exercises, today's scheduled workout, and the messages you send — including any photos you attach (for example, a whiteboard or program you want parsed into a workout). If you ask Coach about your history, your progress, or a team challenge, the relevant records are shared for that request as well. Attached images are sent to a third-party AI provider for parsing and are not stored by NOWISLIFE — they are used only for that chat turn.

The short daily Today message is generated using third-party AI providers, from a summary of your recent workout activity.

Your email, password, phone number, and account credentials are never shared with the AI provider, and Coach never changes your data without your explicit confirmation. You can disable the daily Coach message in Settings and clear your chat history from the Coach menu.

AI Support Triage

When you submit a support ticket or contact message, the text of your message, your name, and any screenshot you attach may be processed by an AI model to help our support team triage and respond faster. No payment information or passwords are ever included.

SMS Verification

We use a third-party SMS provider to send one-time SMS verification codes to the phone number you provide during account registration. These codes are used solely to verify your identity and secure your account.

• Message content: One-time numeric verification codes only
• Frequency: One message per verification request (registration and password reset)
• Opt-out: Reply STOP to any message to stop receiving SMS. You may also contact us at nowislife.com/contact
• Opt-in: Reply START to resume receiving verification messages
• Message and data rates may apply depending on your carrier and plan
• We do not send marketing, promotional, or recurring messages via SMS

For more details, visit our SMS Consent & Disclosure page.

Apple Health Integration

NOWISLIFE offers an optional integration with Apple HealthKit on iOS devices. This integration requires your explicit, separate consent before any health data is accessed.

When authorized, NOWISLIFE may:

• Read from HealthKit: heart rate, daily step count, active calories burned, workouts (including those you record in other apps), and — to personalize your coaching — resting heart rate, heart rate variability (HRV), and last night's sleep duration
• Write to HealthKit: completed workout sessions (workout type, duration, total volume, and session name)

To power your personalized coaching ("The Read" on Today and your daily coach message), NOWISLIFE stores summaries of certain Apple Health data on our servers, linked to your account — for example, a daily recovery summary (resting heart rate, HRV, and sleep duration) and summaries of workouts you record outside NOWISLIFE (such as type, duration, and calories). Other HealthKit data is processed on your device only.

Important:

• No HealthKit data of any kind is used for advertising or data mining, sold, or shared with third parties — whether it stays on your device or is stored as one of these summaries
• Aside from the summaries described above, other HealthKit data is processed on your device and is not transmitted to our servers
• Health data is not stored in iCloud by NOWISLIFE
• We retain these summaries only as long as needed for coaching, and in no case longer than 24 months
• You can revoke Apple Health access at any time through your device Settings or within the NOWISLIFE app — revoking stops further collection and deletes the health summaries previously stored on our servers
• Deleting your account also deletes this data
• NOWISLIFE is a consumer fitness app, not a healthcare provider — HIPAA does not apply to this data; it is protected by this policy and consumer-health-data laws instead
• You must provide separate, affirmative consent before any health data is collected (see Consumer Health Data Rights below)

Movement Sensor Data (Optional Contribution to Improve Auto-Tracking)

Separately from the Apple Health integration above, you can optionally choose to contribute raw movement-sensor data from your Apple Watch to help us improve NOWISLIFE's automatic set and rep tracking. This is off by default and requires your separate, affirmative consent.

This is distinct from rep counting itself. Your Apple Watch counts reps and detects sets on your device whether or not you turn this on. Turning it on additionally lets us collect and store the underlying raw sensor readings so we can train and improve that feature.

When you opt in, during a workout we collect:

• Raw motion-sensor readings from your Apple Watch (accelerometer, gyroscope, and device-motion values) recorded during a set
• Labels describing the set — the exercise, your confirmed rep count, set timing, which wrist the watch is on, and your handedness

This data is uploaded to our private cloud storage and linked to your account so it can be used as labeled training data.

Important:

• Contributing this data is optional and off by default — you must turn it on in Settings and provide separate, affirmative consent
• It is used solely to train and improve NOWISLIFE's own automatic-tracking features — never for advertising, data mining, marketing, or any unrelated purpose
• It is never sold to or shared with third parties
• Raw sensor recordings are retained only as long as needed to train our models and are then deleted; in no case are they retained for more than 24 months
• You can withdraw consent at any time in Settings — doing so stops all further collection and deletes the raw movement data you previously contributed
• Deleting your account also deletes this data
• Because this is health-related data, it is covered by the consent, withdrawal, and deletion rights described under Consumer Health Data Rights below

Push Notifications

NOWISLIFE collects and stores a push notification token from your device to deliver notifications. Notification categories include:

• Routine reminders — scheduled alerts for your daily exercises
• Follow-up reminders — check-ins after a workout window
• Team updates — activity from your teams
• Challenge alerts — team challenge notifications
• Goal milestones — personal achievement celebrations

You can enable or disable each category individually in Settings. Routine reminders are scheduled locally on your device. Push tokens are stored securely and used solely for delivering notifications.

Workout Sharing

You may share workout templates via a link. Anyone with the link can view the shared workout data (exercise names, sets, reps, and targets). You control what you share — sharing is always initiated by you and can be revoked.

Analytics & Tracking

We use the following analytics services to understand how the app is used and to improve the experience:

• Product analytics — pseudonymous event tracking to understand feature usage (website only). A pseudonymous user ID (not your name or email) is associated with events. No personally identifiable information (name, email, phone) is sent to our analytics provider.
• Error monitoring — a third-party service for error and performance monitoring. On our website, when an error occurs it may capture a short diagnostic session replay; all text is masked and all media is blocked, and replays are recorded only on errors, never during normal use. In the mobile app, only error and crash diagnostics are captured, with personal data scrubbed before transmission — no session replay is recorded.

We do not respond to browser Do Not Track (DNT) signals. We honor Global Privacy Control (GPC) and other recognized opt-out-preference signals as valid opt-out requests; a GPC signal disables analytics for that visit. We do not disclose personal data for money or other valuable consideration, and we do not use it for cross-context behavioral or targeted advertising — so we do not "sell" or "share" your personal data as those terms are defined under state privacy laws.

We use strictly necessary session cookies (HttpOnly, Secure) to maintain your authenticated session. We do not use third-party advertising cookies.

Service Providers

We share data with the following service providers solely to operate the NOWISLIFE service, under data processing agreements:

| Category | Purpose | |----------|---------| | Cloud infrastructure | Database hosting, private file storage, and content delivery | | AI processing | AI Coach chat, generated daily messages, and AI support triage | | Communications | SMS verification and transactional email delivery | | Rate limiting & bot protection | Abuse prevention on registration, login, and API endpoints | | Analytics | Pseudonymous product and website analytics | | Error monitoring | Error, crash, and performance diagnostics | | Push & app updates | Push notification delivery and over-the-air app updates |

We do not sell your personal data. Beyond these service providers, we share data only:

• When required by law, court order, or to protect the rights and safety of NOWISLIFE or its users
• In connection with a merger, acquisition, or sale of assets (users will be notified)

Data Retention & Deletion

You may delete your account at any time from within the app. Account data is permanently deleted after a 7-day grace period. We keep each category of data only as long as needed for its purpose:

| Category | Retention | |----------|-----------| | Account, fitness logs, profile photo | Life of your account; deleted after the 7-day grace period | | Apple Health recovery summary | Until you disconnect Apple Health; no longer than 24 months | | Optional movement-sensor data | Until you withdraw consent; no longer than 24 months | | Login & SMS-consent IP, user agent, session timestamps | Up to 12 months, for security | | Push notification token | Until you disable notifications or delete your account | | Support tickets | Up to 24 months after resolution |

Aggregated or de-identified data that can no longer be linked to you may be retained longer for analytics.

Security

We implement industry-standard safeguards including encrypted connections (HTTPS), hashed passwords (bcrypt), access controls, third-party bot protection during registration and login, and rate limiting on authentication endpoints. No method of transmission or storage is 100% secure. We encourage you to use a strong, unique password and enable passkey authentication.

Data Breach Notification

If a breach affects your personal information, we will notify affected users without unreasonable delay and no later than 60 days after discovery, by email and in-app notice. We will also notify the U.S. Federal Trade Commission as required by the FTC Health Breach Notification Rule — at the same time as users if 500 or more are affected, and otherwise through the FTC's annual reporting — and will notify prominent media outlets where a breach affects 500 or more residents of a single state. We will also comply with applicable state breach-notification laws.

Children

NOWISLIFE is intended for users 18 years of age and older. During registration, you must separately confirm that you meet this age requirement. We do not knowingly collect personal information from anyone under 18. If we become aware that a user is under 18, we will terminate the account and delete the associated data.

App Updates

NOWISLIFE may receive over-the-air updates without requiring a new download from the App Store. These updates may include bug fixes, performance improvements, and minor feature enhancements. Major feature changes will be communicated through the app.

California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the right to:

• Know what personal information we collect, use, disclose, or sell
• Delete your personal information (subject to certain exceptions)
• Correct inaccurate personal information
• Opt out of the sale or sharing of personal information (we do not sell or share personal data)
• Limit the use of sensitive personal information (including health and fitness data)
• Non-discrimination for exercising your privacy rights

We honor Global Privacy Control (GPC) browser signals as a valid opt-out request.

To exercise any of these rights, submit a request through nowislife.com/contact. We will respond within 45 days.

Privacy Rights in Other U.S. States

If you live in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, or Montana, you have the right to confirm and access your personal data, correct it (except in Utah), delete it, obtain a portable copy, and opt out of sale, targeted advertising, and significant profiling. We do not sell personal data, run targeted advertising, or profile you in those ways. We process sensitive data — including health and fitness data — only with your consent and never for advertising.

To exercise these rights, contact us through nowislife.com/contact; we respond within 45 days (extendable once where allowed). If we deny your request, you may appeal by replying to our response, and if the appeal is denied you may contact your state Attorney General. You may use an authorized agent to submit a request on your behalf.

Consumer Health Data Rights (Washington, Nevada, Connecticut)

If you use NOWISLIFE's health or fitness features, your consumer health data is also governed by our separate Consumer Health Data Privacy Policy, which controls if it conflicts with this section. Under the Washington My Health My Data Act and the similar Nevada and Connecticut laws, you have the right to:

• Give separate, affirmative consent before any health data is collected, and withdraw it at any time in the app
• Confirm and access the health data we hold, and request deletion — when you delete it, we also direct our service providers to delete it
• Not be discriminated against for exercising these rights

We never sell your health data, we never share it with independent third parties for their own use, and we never track your location. Consumer health data here includes data derived from Apple HealthKit, fitness data you log, raw motion-sensor data you contribute, and the recovery and readiness inferences we generate for your coaching.

Privacy Requests

To submit any privacy request — including data access, correction, deletion, a CCPA request, or a Washington MHMDA request — contact us through nowislife.com/contact. Please include your name and the email address associated with your account so we can verify your identity.

Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the effective date above and notify you through the app. Continued use of NOWISLIFE after the effective date constitutes acceptance of the updated policy.

Contact

Questions about this Privacy Policy? Contact us at nowislife.com/contact.

NOWISLIFE is currently available to U.S. users only.