Privacy Policy — HMWorkout

Last updated: January 2025 · Effective from January 2025

HMWorkout ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use our website and services at www.hmworkout.com.

1. Information We Collect

Personal Information

Name, email address, and phone number
Date of birth, gender, and location
Body metrics: height, weight, BMI
Health conditions (encrypted and stored securely)
Dietary preferences and food allergies
Fitness level and goals

Usage Data

Workout sessions completed, exercises done, calories tracked
Food items logged and meal completion data
Device type, browser, and IP address
Pages visited and features used

Payment Information

Payment data is processed by Stripe (international) or RazorPay (India). We do not store card numbers or sensitive payment details — only transaction IDs and plan information.

2. How We Use Your Information

To personalise your workout and nutrition plans
To process payments and manage subscriptions
To send you workout reminders and progress updates
To operate the AI coach feature
To improve our services and fix bugs
To comply with legal obligations

3. Health Data — Special Category

Your health condition data is classified as sensitive personal data. We encrypt this at rest and in transit. It is used only to filter unsafe exercises from your plan. It is never sold, shared with insurers, or used for profiling outside HMWorkout's services.

4. Data Sharing

We do not sell your personal data. We share data only with:

Supabase — our database and authentication provider (EU servers)
Stripe / RazorPay — payment processing only
Brevo — transactional email delivery
Cloudinary — exercise GIF hosting
Law enforcement when legally required

5. Data Retention

We retain your account data for as long as your account is active. After account deletion, personal data is removed within 30 days. Anonymised analytics data may be retained indefinitely.

6. Your Rights (GDPR / applicable law)

Right to access your data
Right to correct inaccurate data
Right to deletion ("right to be forgotten")
Right to data portability
Right to object to processing

To exercise any right, contact us at privacy@hmworkout.com.

7. Security

We implement industry-standard security including TLS encryption in transit, AES-256 encryption at rest, bcrypt password hashing, Supabase Row Level Security (RLS), and HTTPS enforced via HSTS. Access to sensitive data is restricted to authorised personnel only.

8. Cookies

We use only essential cookies for authentication sessions. We do not use advertising or tracking cookies.

9. Children's Privacy

Our service is not directed to children under 10. We do not knowingly collect data from children without parental consent.

10. Changes to this Policy

We may update this policy periodically. Material changes will be communicated by email and via a notice on the website.

11. Contact

For privacy enquiries: privacy@hmworkout.com
Website: www.hmworkout.com