# Privacy Policy — Kydos Health L.L.C.

Effective Date: June 6, 2026 Last Updated: July 3, 2026 Version: 5.3

Our Position

Kydos Health L.L.C. does not sell your data. We do not share your health data with third parties for commercial purposes. We do not use your data to train machine learning models. We serve no ads, use no ad SDKs, and use no third-party behavioral analytics tools. These are not aspirational statements — they are binding commitments reflected in how we built this product.

1. Who This Applies To

This Privacy Policy applies to all users of the KYDOS mobile application ("App"), operated by Kydos Health L.L.C. ("KYDOS," "we," "us"). Contact us at privacy@kydoshealth.com.

2. What We Collect

Account and profile information When you create an account, you provide your email address, username, and display name. You may also provide your age, height, weight, body composition, fitness goals, training preferences, and a profile photo.

Activity data We collect the fitness data you log: workouts, food intake, sleep records, water intake, body weight entries, strength training sessions (exercises, sets, reps, weights, personal records, and estimated one-rep maxes), and hydration logs (beverage type and volume). During active workouts where you have granted location permission, we collect GPS route data. You may optionally tag a workout's surface type (trail, road, or mixed) to enable like-for-like performance comparisons. You may also import historical activities by uploading GPX or TCX files from other apps or devices — this data is treated identically to activities recorded in the app.

Saved routes (Route Builder) If you use the Route Builder (a KYDOS Premium feature), you may draw and save custom running or cycling routes, storing the route name, an ordered list of GPS waypoints, and the calculated distance. Saved routes are private to your account. Public route sharing and Community features are not available in this version of KYDOS and are planned for a future update; if introduced, sharing will be strictly opt-in and this policy will be updated first. You can delete any saved route from the Route Library at any time.

Referral program If you share a KYDOS referral link from Settings, we record that link activity when someone uses it to create an account. Specifically: your user ID is stored as the referrer, and the new user's ID is stored as the referred user. We also track whether the referred user later subscribes to KYDOS Premium, which triggers a free promotional month for you (the referrer). This data is stored privately in your account. Referral records for both you and your referred contacts are permanently deleted when your account is deleted.

Hydration data We collect beverage logs you enter: the type of beverage, volume consumed, and time logged. On the Premium tier, we also compute a smart hydration adjustment based on your workout duration, ambient temperature, and beverage dehydration factors (coffee, alcohol). Hydration data is stored in your private account and is never shared or made public.

Weather and air quality conditions With your location permission, we fetch current weather and air quality data from Open-Meteo (an open-source weather API with no advertising or user tracking) to display temperature, wind, heat index, wind chill, Air Quality Index (AQI), and running conditions on your post-workout summary and pre-workout safety screens. Two requests are made per location lookup — one for weather, one for air quality — both to Open-Meteo's public API. Your coordinates are sent per request. No account, persistent identifier, or personal data is transmitted. This data is used solely to calculate safety alerts (extreme heat, cold, storm, air quality) and your outdoor run score.

Guest and on-device data Before you create an account, workout and nutrition data you log is stored locally on your device using AsyncStorage. This data never leaves your device until you create an account and choose to sync it. Daily wellness check-in answers are stored locally keyed by date and are not transmitted to our servers.

Biometric unlock (optional, on-device only) If you enable the optional "Unlock with Face ID" (or Touch ID) feature in Settings, KYDOS stores your encrypted Supabase session tokens in the device's secure enclave (iOS Keychain via expo-secure-store). Authentication is performed entirely by iOS — KYDOS never receives, stores, or transmits your biometric data. The session tokens stored on-device are encrypted by the OS and cannot be read by other apps. You can disable biometric unlock at any time in Settings > Security, which immediately deletes the stored tokens from your device.

Password breach check (signup and password change) When you create an account or change your password, KYDOS performs a privacy-preserving check against the HaveIBeenPwned (HIBP) breach database. Your password is hashed on-device using SHA-1, and only the first 5 characters of that hash (out of 40) are sent to our Edge Function proxy, which forwards them to the HIBP API. Neither KYDOS nor HIBP ever receives your password or enough of the hash to identify it. If our proxy is unreachable, the check is skipped (fail-open) rather than blocking you. This check is performed for your security only; no data is retained.

Body and nutrition data You may optionally log body measurements (waist, hips, chest, arms, thighs, neck, body fat percentage) and detailed nutrition data (macronutrients and micronutrients). This data is stored in your private account and is never shared or made public.

Menstrual cycle data (strictly opt-in) If you choose to enable Cycle Tracking in the App, you may log period start dates, cycle length, and period length. This data is highly sensitive. It is stored privately in your account, is never shared with any third party, is never used in community features or public-facing surfaces, and is never sold or used to train models. You can disable Cycle Tracking and delete all cycle data at any time from your Profile. Cycle information is used solely to display your estimated current cycle phase as a training context tool, not as medical advice.

Guardian SOS contact (third-party PII) If you choose to enable Guardian SOS, you provide a name and phone number for an emergency contact. This person is not required to be a KYDOS user. Their name and phone number are stored in your profile and used exclusively to send SMS emergency alerts via Twilio when you activate Guardian SOS. You can update or remove your guardian contact at any time. Guardian contact data is permanently deleted when your account is deleted. We disclose guardian contact information only to Twilio for the sole purpose of message delivery.

Social graph If you follow other KYDOS users, your list of followed users and your follower list are stored in your account. This data is private — your follow relationships are not publicly displayed. Follows are permanently deleted when your account is deleted.

Push notification token and preferences When you grant push notification permission, your device's push notification token (from Apple APNs or Google FCM) is stored in your profile to deliver notifications you have enabled. We also store your notification preference settings — which types of alerts you have chosen to receive (such as streak reminders, readiness updates, weekly summaries, and coach check-ins). Neither your push token nor your notification preferences are shared with advertising networks or third parties. Both are permanently deleted when your account is deleted.

Apple Watch and HealthKit (iOS) When you grant HealthKit permission, KYDOS reads health and fitness data from your iPhone and any paired Apple Watch. Data categories include: activity metrics (steps, active calories burned, and exercise minutes — displayed as the Activity Bars); heart rate, resting heart rate, heart rate variability (HRV), blood oxygen saturation (SpO2), and respiratory rate; VO2Max estimates; sleep analysis; body weight and composition; height; running-specific metrics (power, cadence, stride length, ground contact time, and vertical oscillation); hydration; and mindfulness session data. Data collected on Apple Watch syncs through the paired iPhone and is treated identically to data recorded on the phone. No additional data categories are introduced by Apple Watch use.

KYDOS also writes your completed workout sessions to Apple Health so they appear in your health record.

Standalone Apple Watch coaching: The KYDOS Apple Watch app supports phone-free workout coaching. To enable this, your coach personality selection and subscription entitlement status are cached locally on your Apple Watch when it is in range of your iPhone. This allows the Watch to deliver coached workouts independently. No additional data categories are transmitted to our servers as a result — only the same profile and subscription data already described in this policy is involved.

You may revoke HealthKit access at any time: Settings > Privacy & Security > Health > KYDOS.

Android Health Connect On Android, KYDOS reads the following Health Connect data types: steps, heart rate, resting heart rate, heart rate variability, active and total calories, distance, sleep, body weight, height, body fat percentage, blood oxygen saturation (SpO2), VO2Max, and exercise records. KYDOS also writes your completed workout sessions to Health Connect (ExerciseSession and Distance records), so they appear alongside other health data. You may revoke permissions at any time: Health Connect > App Permissions > KYDOS.

Health store write-back (both platforms) KYDOS writes your completed workout sessions to your device's health app — Apple Health on iOS and Health Connect on Android. No other data is written to either health store.

Diagnostics KYDOS uses Sentry for crash and error monitoring. Crash and diagnostic data is linked only to an anonymous internal account identifier (your account's UUID) — never to your name, email address, phone number, or IP address, which are actively stripped before any report is transmitted. Health measurements and GPS data are also removed before transmission. For users in EU/EEA/UK/Switzerland, Sentry is initialized only after you grant analytics consent via the in-app consent screen.

Glory metrics and Founding Member status Your Glory Index score, tier, earned point history, and Founding Member status (if applicable) are derived from your activity and stored in your account. These power the Earn Your Glory feature, your profile display, and the Apple Watch glance.

Subscription status Your KYDOS subscription status (active, trial, cancelled) is stored in your account and shared with RevenueCat to manage entitlements. RevenueCat receives your anonymous user identifier (Supabase UUID) only — no email address, payment details, or health data. Apple and Google process your subscription payments directly under their own terms and privacy policies.

Music playback control (Android) KYDOS can optionally control whatever music or podcast app you're playing during a workout — pause, resume, skip, and show the track title and artist — without requiring any specific app's SDK. This requires you to grant Android's "Notification access" permission, which is the only way Android exposes another app's active media session. KYDOS does not read notification content: the permission is used solely to query playback metadata (title, artist, album artwork, play/pause state) and send standard transport commands. This data stays on your device for the duration of your workout and is never transmitted, stored, or logged by KYDOS. Granting this permission is optional — if declined, you can still control music and use every other workout feature. You can revoke it at any time in Settings > Apps > Special app access > Notification access > KYDOS.

What we do not collect We do not collect advertising identifiers, cross-app tracking data, background health data, or microphone data. We do not collect any data for advertising purposes. We do not use any third-party behavioral analytics SDKs — no Amplitude, Mixpanel, Segment, Firebase Analytics, or similar product exists in this app. We do not track you across other apps or services.

3. How We Use Your Data

We use your data solely to operate the App:

• To calculate your Glory Index, personal records, and streaks
• To deliver KYDOS Coach guidance during workouts
• To sync your data across your devices
• To send push notifications you have enabled
• To process your subscription
• To resolve crashes and technical errors
• To send Guardian SOS emergency alerts when you initiate them
• To compute nutrition targets, weight trend analysis, and adaptive calorie estimates
• To display body measurement history (visible only to you)
• To show your estimated cycle phase as a training context tool, when Cycle Tracking is enabled (informational only — not medical advice)
• To display real-time workout metrics (elapsed time, distance, pace, Ghost Pacing Delta) on your iOS Lock Screen and Dynamic Island via iOS Live Activities during active workouts. This display is local to your device. No additional data is transmitted as a result of Live Activity use. Live Activity display collapses to a minimal view when Stealth Mode is active.
• To surface longitudinal health trends (fitness arc, training load, readiness, body) in your Health Profile — using data you have already logged. No additional data is collected for this feature.
• To generate an Official Activity Record upon your request — a formatted export of your completed workout data (timestamps, distance, duration, pace, HR, source) shared via your device's native share sheet to a destination you choose. KYDOS does not receive or store data transmitted through that share.
• To track your daily hydration goal, log beverage consumption, and (on Premium) calculate smart hydration adjustments based on workout sweat-loss estimates and beverage hydration factors.
• To record strength training sessions, calculate personal records, and (on Premium) surface volume and tonnage trends and progression analytics using only your own historical data.

4. Health Data

Your health data is used only to power the features you have enabled. We do not sell it, license it, or share it with insurers, employers, or data brokers. We do not use it to train artificial intelligence or machine learning models.

You may revoke health data access at any time:

• iOS: Settings > Privacy & Security > Health > KYDOS
• Android: Health Connect > App Permissions > KYDOS

Glory Points earned through sleep and active energy require Apple Watch as the verified data source. Manually entered health data does not qualify.

5. Stealth Mode

When Stealth Mode is active:

• Your location is not transmitted during workouts
• Completed workouts are saved to your device only and are never sent to our servers — including after Stealth Mode is disabled
• GPS coordinates are not stored by KYDOS
• Community features (planned for a future update) are not active
• Live Activity display on the iOS Lock Screen and Dynamic Island collapses to a minimal view that shows no workout metrics
• Tracking continues to function fully on your device — timer, heart rate, laps, coach cues, and saving to Apple Health / Health Connect all work normally
• Earn Your Glory points, Glory Index, and streaks are not earned for Stealth workouts. These are computed from workouts synced to our servers, and Stealth workouts are never synced — not even after Stealth Mode is later turned off. This is a deliberate trade-off, not a bug: full privacy or Glory, not both. Minor accounts (Stealth Mode locked on) are not penalized for this — it is a safety default, not a restriction placed on them individually.

5a. Using KYDOS Without an Account

KYDOS offers a "Continue Without an Account" option on first launch. Choosing it does not create an account of any kind, anonymous or otherwise — no request is sent to our servers at all. It sets a flag stored only in your device's local app storage, so the app knows to keep working without you signing in. No email, password, or any identifying information is collected, transmitted, or stored anywhere but your device.

While using KYDOS this way, your workouts and all other activity stay entirely on your device — nothing syncs to our servers, no server-side record of any kind is created, and no Glory accrues, for the same reason described in Section 5 above: Earn Your Glory points, Glory Index, and streaks are computed from data on our servers, and nothing reaches our servers in this mode. You can still see your own workout history within the app at any time — it's simply read from your device instead of from our servers.

If you later create an account (email, password, and username), your on-device workout history is uploaded to that new account so it isn't lost, and your local data is then cleared from the device — this is the only path by which any of this locally-stored data ever reaches our servers, and it happens only when you actively choose to create an account. This is different from Stealth Mode on an account you already have: Stealth Mode workouts are never retroactively synced even after Stealth Mode is turned off, because that data was deliberately kept private on an account that already existed at the time. Using KYDOS without an account has no existing account for anything to be private "on" — creating one afterward simply brings your data with you, rather than exposing something that was previously protected.

6. Community Routes

Public route sharing and the Community feature are not available in this version of KYDOS. All saved routes are private to your account. If we introduce public sharing in a future version, it will be strictly opt-in and this Privacy Policy will be updated before the feature becomes available.

7. Data Sharing

We share your data only as follows:

Apple and Google process subscription payments directly under their own terms and privacy policies.

We do not share data with advertisers, data brokers, or third-party analytics services.

8. Data Security

We implement reasonable technical and organizational measures to protect your data, including encryption in transit and at rest and access controls that ensure each user can only access their own records. However, no system is completely secure, and we cannot guarantee absolute security. You provide your data at your own risk.

We are not responsible for the independent privacy or security practices of the third-party services listed in §7. Each provider named there operates under its own security program and terms.

Profile photos are stored in private storage and delivered via short-lived signed links. By default your profile photo is visible only to you. You may opt in to make it visible to other signed-in KYDOS users from your Profile settings (Profile > tap your avatar area). If you enable Stealth Mode, your photo reverts to private regardless of this setting. Minor accounts (under 18) can never make their photo public — this restriction is enforced at the database level and cannot be overridden.

Body photos (progress photos) are always private — visible only to you, regardless of any setting.

Social profile information. When you follow other KYDOS users, the app reads their public profile fields — username, display name, Founding Member status, and (if they have enabled the public toggle) their profile photo — to display them in social surfaces such as "People I Follow." This read is performed through a SECURITY DEFINER database function that enforces the same privacy guards: minors are never exposed, stealth users are never exposed, and users who have not opted in to public visibility are never returned. If you are in Stealth Mode, you see no other users and no one sees you, regardless of their settings.

9. Your Rights

Export Export all your data at any time: Settings > Privacy & Data > Export My Data.

Deletion Delete your account: Profile > Settings > Danger Zone > Delete Account. Deletion is immediate, covers all tables, and is permanent — workouts, routes, food logs, body measurements, strength history, hydration logs, referral records, push tokens, notification preferences, and your profile are all deleted.

Two narrow exceptions are retained in de-identified form only, with the link to your account removed: (1) if you gave data consent, a record containing only the timestamp and consent version is retained for GDPR Art. 5(2) / Art. 7(1) accountability — no personal data remains; (2) if you ever triggered Guardian SOS, a record containing only the send timestamp is retained to meet legal accountability obligations — no personal data, no guardian phone number, no location data remains. These anonymized records cannot be linked back to you after deletion.

EU, UK, and California users EU/UK/CA users have additional rights — including access, correction, erasure, portability, and the right to object to processing. Submit requests to privacy@kydoshealth.com with subject: "Data Rights Request."

10. EU / EEA / UK / Switzerland

Data controller: Kydos Health L.L.C. — privacy@kydoshealth.com

In-app consent screen: Users whose device locale indicates an EU/EEA/UK/Switzerland region are presented with a consent screen on first launch. This screen explains our optional data practices (crash analytics, coaching personalization) and allows granular consent per category. You can update your consent preferences at any time from Settings > Privacy & Data.

Legal bases:

Health data (HealthKit / Health Connect) is processed under Art. 9(2)(a) — explicit consent granted when you enable HealthKit or Health Connect. You may withdraw at any time in device settings. Withdrawal does not affect prior processing.

Your rights (Art. 15–22): You have the right to access, rectify, erase, restrict, and port your personal data, and to object to its processing. You may also withdraw consent at any time without affecting the lawfulness of processing before withdrawal. To exercise any right, contact privacy@kydoshealth.com or use the in-app tools at Settings > Privacy & Data.

Retention: Personal data is retained until you delete your account. Crash reports are retained for 90 days. Authentication tokens expire automatically.

International transfers: Data is stored on servers in the United States. Transfers from the EEA or UK are governed by Standard Contractual Clauses. Contact privacy@kydoshealth.com for documentation.

Supervisory authority: You may file a complaint with your local data protection authority. EU: edpb.europa.eu. UK: ico.org.uk.

11. Children

KYDOS is not intended for users under 13 (under 16 in the EEA/UK). We actively enforce this at account creation:

• Under 13: Users who report an age below 13 during sign-up are blocked from creating an account. No account data is collected for users blocked at this step.
• Ages 13–17 (minors): Users aged 13–17 are permitted to use KYDOS with the following default protections applied automatically at account creation: Stealth Mode is enabled (location is not transmitted; workouts are stored on-device only); community features, public route sharing, leaderboard participation, and the referral program are disabled by default. Minors may not disable Stealth Mode from the app.
• Parental notice: Users under 18 are advised during onboarding that parent or guardian awareness is required.

If you believe a child under 13 has created an account, contact privacy@kydoshealth.com and we will delete it immediately. The EEA/UK minimum age is 16; users who indicate they are 13–15 and whose device locale indicates EEA/UK are blocked from account creation.

12. Changes

We will notify you of material changes via in-app notice before they take effect. Continued use after the effective date constitutes acceptance.

13. Contact

Kydos Health L.L.C. Privacy inquiries and data subject requests: privacy@kydoshealth.com General inquiries: contact@kydoshealth.com Website: kydoshealth.com