BurstReps U.S. Consumer Health Data Privacy Policy

This policy supplements the BurstReps Privacy Policy. It describes our practices for information that is “consumer health data” under the Washington My Health My Data Act, Nevada’s consumer health data law, or another applicable U.S. state law. It applies when such law governs our handling of your data. It covers health data you enter yourself, connect from an OS platform, or generate through the Service—not just Apple Health or Health Connect data. If this policy and the general Privacy Policy differ concerning rights that applicable U.S. law gives you, the applicable law and this supplemental policy control. The separate Health Data Consent is an in-app choice requested before the first health-platform connection; it is not a substitute for this public policy or any distinct consent required by U.S. law.

1. Categories of consumer health data

Depending on how you use BurstReps and what applicable law treats as consumer health data, we may process:

The precise types depend on your entries, device support, OS permissions, and feature use. We do not assume every item is available for every member.

2. Sources

We obtain consumer health data from you when you fill out a profile, log meals or exercise, upload images, send AI Coach messages or attachments, or contact support; from Apple Health or Android Health Connect when you permit the connection and its data types; and from records, calculations, and AI-assisted outputs created while you use the Service. We do not describe advertising networks or data brokers as sources of health data.

3. Collection, use, and processing purposes

We collect and use data to provide the logging, connection, trend, and personalized fitness functions you request; let AI Coach respond to you and access or update relevant Records or plans; operate and secure the Service; investigate errors and safety issues; and evaluate and improve the health, fitness, and AI coaching features we provide to you, including their prompts and algorithms. We do not use consumer health data for ad targeting, data brokerage, or a third party’s independent marketing, and we do not sell it.

We process data only for disclosed purposes and on a basis permitted by applicable law, including when necessary to provide a product or service you requested or when we obtain the required consent. If a new data category or purpose requires affirmative consent, we will disclose it and obtain that consent first. A separate authorization would be required for a sale of consumer health data; our current policy is not to sell it.

4. Categories shared and recipients

For Service delivery, the categories in Section 1 that are necessary for a particular feature may be disclosed to processors acting on our behalf. They may include:

Payment and subscription processors, including RevenueCat, Inc., receive subscription data. We have no specific corporate affiliate to list as a health-data recipient. We do not share consumer health data with advertisers or data brokers. We may disclose information when you direct us to do so, or when applicable law permits or requires a legally valid disclosure; separate sharing consent is obtained where required.

Restrictions on training by outside AI providers, including safety-review exceptions, are described separately in Section 1 of the general Privacy Policy. Provider retention periods and exceptions are described in Section 5 of that policy.

5. Your choices and rights

Depending on applicable law, you may ask us to confirm whether we collect, use, or disclose your consumer health data; access it; learn the recipients or categories of recipients to whom it was disclosed; correct or update it; delete it; withdraw consent; and stop future collection or sharing that depends on consent. You may use available in-app controls to review or edit Records and connection permissions. Send other requests to company@burstreps.com. We use a secure and reliable request process, may verify your identity or an authorized agent’s authority, and respond under applicable law. If we deny a request, we explain the reason and provide an appeal route where required. You may appeal by replying to our decision or emailing company@burstreps.com with “Health data appeal” in the subject. We will provide any further regulator contact required by the law that applies to your request.

Changing an OS permission stops or narrows future access but may not erase previously stored BurstReps data. Contact us or use available in-app controls to withdraw BurstReps consent and request deletion. Refusing an optional connection does not prevent manual meal and workout logging; features dependent on connected health data may be unavailable. We do not discriminate against you for exercising applicable health-data rights.

6. Retention, deletion, and safeguards

We keep health data needed to provide the Service until account closure, an earlier applicable withdrawal of consent, or deletion of that data. We then stop any use dependent on withdrawn consent and delete information under our control without undue delay. We address processor-held copies and account-linked logs and backups through the deletion procedures and data-specific retention exceptions in Sections 5–7 of the general Privacy Policy; not every copy disappears at the same instant. These provider terms do not override a deletion obligation or other nonwaivable right under applicable U.S. law. Applicable U.S. law may prescribe particular response or deletion deadlines, which we follow where applicable. Identifiable source records from Apple Health or Health Connect may be inspected only by designated privacy personnel when necessary for feature improvement, error review, or safety review, and we log that access. We do not send original values from connected health records to external development and analysis tools. We otherwise limit access to people and processors who need it for authorized purposes and use reasonable security safeguards.

7. Third-party collection across websites and services

BurstReps does not authorize a third party to collect consumer health data over time across unrelated websites or online services through our website or app.

8. Changes and contact

We give notice of material changes in the app or on our website before they take effect and seek additional consent where the law requires it. We will make this policy available through a separate, prominent link on our website’s homepage and through relevant app privacy surfaces.

• Company: BurstReps (버스트렙스)
• Representative and privacy officer: Hyojun Choi
• Business registration number: 596-10-02401
• Email and health-data rights requests: company@burstreps.com

The Korean Privacy Policy is the source text for our general practices. This supplemental policy and applicable U.S. law govern the health-data rights they provide, and nothing here waives a right that cannot be waived.

Effective date: October 9, 2026