Consumer Health Data Privacy Policy

Who is responsible

Foil Run is operated by Wren Dougherty in the United States. Contact privacy@foil.run about consumer health data or to exercise the rights below.

Health data and its sources

Depending on the features you use, covered information can include:

• Heart-rate samples, measurement times, and summaries such as average and maximum heart rate, from your Watch or a file you choose to import. Foil Run creates summaries from those samples.
• Activity, location, motion, and session context linked to those measurements, to the extent that it identifies your health status. Sources are your recordings, enabled device sensors, imported files, and information you enter.
• Health information you choose to include in notes, recordings, feedback, or support and privacy requests, and account or contact information needed to associate it with you or handle your request.

Heart-rate upload starts off on the device. Apple separately controls Health access. A file you import may already contain heart rate even if device upload is off. Motion capture has its own Apple permission. We do not use GPS, motion, or voice to infer medical conditions.

Why and how we use health data

We process covered data to provide the private recording, upload, storage, display, analysis, export, and support features you request; respond to privacy requests; secure those features; and comply with law. Optional collection or sharing requires the applicable choice unless it is necessary for a product or service you request.

Consumer health data is excluded from Help Improve, model training, rider profiling, industry reports, advertising, and marketing. Foil Run does not sell consumer health data.

Health data disclosures and recipients

• Hosting and service providers process health data needed to operate the requested feature on our behalf. These are Foil Run's application and database hosting provider and the device and Health platform services on your phone and watch.
• A local recap you choose to share may include average and maximum heart rate and a coverage note. It is created on your device; recipients are the people or services you choose. Foil Run does not host that image. Public hosted shares, Courses, and boards exclude recorded heart-rate samples and summaries.
• If you separately choose external-AI voice processing, an external AI provider receives the selected voice recordings. If you donate a report, an external AI provider may process its available session evidence to investigate the reported problem. This can include health information in the original track, screenshots, recordings, transcripts or analysis you donate. Providers work on our behalf for this private support purpose; donation does not authorize unrelated health research, advertising or provider general-purpose model training.
• We may disclose covered data when required by law, or in a business transfer subject to applicable health-data protections.

We have no affiliates receiving consumer health data. We do not authorize advertising networks or equipment brands to collect consumer health data through Foil Run over time or across services.

Your health-data rights

Where applicable, you can confirm whether we collect, share, or sell your consumer health data; access it and obtain a list and contact details of the third parties and affiliates that received it; withdraw consent to collection or sharing; and request deletion. You can also ask us to correct information you provided. Exercising these rights does not require creating an account.

Email privacy@foil.run with your request. We may request information reasonably needed to verify your identity. You can turn off device heart-rate upload, revoke Apple Health access, or delete sessions or your account using the available controls. Turning off an upload setting does not delete previously uploaded data. Identify any separately submitted feedback when requesting its deletion.

Applicable deletion requests also cover required notification to processors and other recipients and deletion from backups under the timelines required by law. We respond to requests within the applicable legal period and explain any permitted extension or refusal. We do not unlawfully discriminate for exercising these rights.

To appeal a refusal, reply to our decision or email a health-data request appeal identifying the request and why you disagree. We will provide a written decision within the applicable legal period. Washington consumers can also submit a complaint to the Washington Attorney General.

Changes to this Policy

The date above identifies the current notice. We will disclose material changes and obtain any required consent before collecting, using, or sharing covered data under a new category, purpose, or recipient arrangement. Updating this Policy does not itself enable a data choice.