Draft — not yet in effect. Prepared with AI assistance and not reviewed by a lawyer. Highlighted items are still to be confirmed. 草稿，尚未生效。

Ember Consumer Health Data Privacy Policy / Ember 消费者健康数据隐私政策

English

Effective date: [CONFIRM: release date]
Operator: [CONFIRM: legal name and mailing address] ("Ember", "we")
Contact for requests and appeals: privacy@waipyy.com

This policy covers consumer health data: personal information linked or reasonably linkable to you that identifies your past, present or future physical or mental health status, including data we derive or infer. It adds to our general Privacy Policy at https://ember.waipyy.com/privacy.html.

1. Categories of consumer health data we collect

• Body measurements: body weight (entered by you or read from Apple Health), body fat percentage, lean mass, skeletal muscle, waist, height.
• Bodily and fitness information: workouts, sets, loads, cardio, recovery status by muscle group, personal records.
• Health conditions you tell us about: injuries, pain, physical limitations, and anything else you write in coach chat (for example pregnancy, illness or medication, if you choose to mention it).
• Diet information: foods eaten, portions, calories and nutrients, meal photos.
• Inferences: weight trend, estimated maintenance calories and basal metabolic rate, calorie targets, muscle recovery estimates, food quality tags, and the coach's assessment of your readiness to train.
• Profile data used with the above: sex, age (from birth year), goals.

We do not collect precise location, biometric identifiers, or reproductive or sexual health data on purpose; we do not use geofencing.

2. Sources

You (what you type, photos you choose), Apple Health (body weight only, with your permission), and the app's own calculations and AI-generated estimates.

3. How we use it

To provide the features you ask for: training plans, coaching, calorie targets, meal estimates, progress charts, and (if you turn it on) cloud backup. We also use AI usage records (which contain no health content) to enforce the daily AI limit. We also keep consent records, which contain no health values, to show what you agreed to and when (section 5). We do not use consumer health data for advertising, marketing, profiling for third parties, or research, and we do not sell it.

4. Categories we share, and with whom

[CONFIRM: whether Vercel AI Gateway routes these models to other hosting providers; if so, add them.] We have no affiliates that receive consumer health data. We do not sell consumer health data, so we do not ask for a sale authorization.

5. Your consent

We ask for two separate consents, neither pre-selected and neither part of our Terms:

1. Consent to collect consumer health data for Ember's features (asked after sign-in, before you enter health information). The app cannot be used without it, because Ember cannot work without storing health data.
2. Consent to share consumer health data with the AI providers listed above (asked on the AI data consent screen, before any AI request). You can say no and still use the non-AI features. Apple Health data has its own switch, off by default.

These consents apply to the account signed in on that phone. Your phone keeps a working copy of them; signing out, or your session ending (including after 90 days without use), clears that copy, and you are asked again the next time you sign in.

We also keep a consent record on our server each time you agree on a consent screen, answer "Not now" on the AI screen, change AI sharing or the Apple Health switch, or withdraw a consent. It covers health-data collection, the health notice, the 18+ confirmation, AI sharing and Apple Health sharing. Each record holds which consent, whether you granted, declined or withdrew it, the version of the wording, the phone's time, our server's time, the app version, a record ID and your account ID. It holds no IP address, birth year, health values or free text. Records are sent in the background whether or not cloud backup is on, and we keep them to show what you agreed to and when. Signing out is not recorded as a withdrawal. Withdrawing adds a record and does not erase earlier ones. The records are deleted with your account.

You can withdraw either consent at any time. To withdraw sharing consent, use 我的 / Me → AI 设置 / AI settings; new AI requests stop at once. To withdraw collection consent, use 我的 / Me → 隐私 / Privacy. This stops Apple Health reads and cloud backups, turns AI sharing off and brings the consent screen back; the rest of the app cannot be used until you agree again. It does not delete your account, the data on your phone or backups already on our server. To erase them, delete your account in the app or email us at any time (section 6). The consent screen has sign-out and Delete account too, so you do not have to agree again to leave. If you agree again, any Apple Health sync or backup you had on restarts, and AI stays off until you turn it on in AI settings. Exact consent wording is in Appendix A.

6. Your rights

You may:

• confirm whether we collect, share or sell your consumer health data, and get a copy of it;
• get a list of all third parties and affiliates with which we shared it, with contact information [CONFIRM: provider contact emails or web forms];
• withdraw consent;
• ask us to delete it.

How to ask: delete your account in the app (deletes it on our server and your phone), or email privacy@waipyy.com from the email address on your Ember account (shown in 我的 / Me → 账号 / Account). If you signed in with Apple's private relay address, write from any address and include the account email shown in the app; we will confirm through it. We respond within 45 days. If we need up to 45 more days, we tell you why within the first 45 days. Requests are free up to twice a year.

Deletion: we delete the data from our database, notify our processors and the AI providers we shared it with [CONFIRM: method to request deletion from each AI provider through Vercel, or state that providers hold no copies beyond their retention window], and remove it from backup and recovery systems within 30 days (Neon point-in-time history expires within [CONFIRM: window]). Data already sent to AI providers may be kept by them only for their stated retention period [CONFIRM per provider]. Consent records are deleted with your account. Feedback linked to your account is deleted with it. Feedback that is not linked to an account (sent while signed out, or with an expired session) is not removed by deleting your account, because we cannot match it to you; tell us what you sent and we will delete it. Otherwise it is deleted in a server cleanup after 12 months from when it was sent, so we cannot promise an exact date.

Appeals: if we decline your request, reply to our answer with "Appeal". We answer in writing within 45 days and explain why. If we deny your appeal, you may complain to:

• Washington Attorney General: atg.wa.gov/file-complaint
• Nevada Attorney General: ag.nv.gov/Complaints/File_Complaint
• Connecticut Attorney General: portal.ct.gov/AG (Consumer complaints)

[CONFIRM: these complaint URLs are current at publication]

We will not deny you service, charge you more, or give you a lower quality of service because you exercise these rights. Ember's non-AI features work without sharing consent. The one limit is collection consent: Ember cannot run without storing health data, so the app is unavailable while that consent is withdrawn (section 5).

7. Third-party tracking

No third party collects data from Ember about your activity over time or across other apps or websites. Ember includes no ad, analytics or tracking SDKs.

8. Security and access

Only the operator can access our server and database [CONFIRM: MFA enabled on Vercel and Neon]. Access by our processors is limited by contract to providing their service to us.

9. Changes

We will post changes here with a new effective date. Before we collect a new category of consumer health data, share it with a new category of recipient, or use it for a new purpose, we will ask for your consent again.

Appendix A: consent wording (shown in the app)

Collection consent (health consent version 3)

Ember stores your health and fitness information — body weight and measurements, workouts, diet, meal photos, and injuries or conditions you tell the coach — to plan your training and calculate your targets. Your health data stays on your iPhone unless you turn on cloud backup or agree to AI features, which you are asked about separately. Our server keeps a record of your consent choices, without health data. You can withdraw this consent any time in Me → Privacy, and delete your account and data in Me → Account.

[ ] I agree that Ember may collect my health data for these purposes.

Sharing consent (AI data consent screen, which also lists what is sent to each provider)

Ember's coach, training plans, workout reviews, exercise guides and meal estimates are made by third-party AI models. When you use them, Ember sends the information each feature needs, through its own server, to the AI providers below. Your name and email are not sent, but photos and what you write can still identify you. Buttons: "Agree and use AI features" or "Not now".

Apple Health sharing (separate switch)

Also send body weight from Apple Health to AI. [off by default]

简体中文

生效日期：[CONFIRM: 上线日期]
运营者：[CONFIRM: 法定名称及通信地址]（"Ember""我们"）
请求与申诉联系方式：privacy@waipyy.com

本政策适用于消费者健康数据：与你相关或可合理关联到你、能够反映你过去、现在或将来身体或心理健康状况的个人信息，包括我们推算或推断出的数据。本政策是对我们一般《隐私政策》（https://ember.waipyy.com/privacy.html）的补充。

1. 我们收集的消费者健康数据类别

• 身体测量：体重（你记录或从 Apple 健康读取）、体脂率、瘦体重、骨骼肌、腰围、身高。
• 身体与健身信息：训练、组数、负重、有氧、各肌群恢复状态、个人纪录。
• 你告诉我们的健康状况：伤病、疼痛、身体限制，以及你在教练对话中写下的其他内容（例如你主动提到的怀孕、疾病或用药）。
• 饮食信息：所吃食物、份量、热量和营养素、餐食照片。
• 推断信息：体重趋势、估算的维持热量和基础代谢率、热量目标、肌群恢复估计、食物质量标签、教练对你训练状态的判断。
• 与上述一同使用的资料：性别、年龄（由出生年份计算）、目标。

我们不会刻意收集精确位置、生物识别标识、生殖或性健康数据，也不使用地理围栏。

2. 来源

你本人（你输入的内容、你选择的照片）、Apple 健康（仅体重，需你授权），以及应用自身的计算和 AI 生成的估算。

3. 用途

提供你要求的功能：训练计划、教练指导、热量目标、餐食估算、进度图表，以及（你开启时的）云端备份。我们还使用 AI 使用记录（不含健康内容）来执行每日 AI 额度。我们还保存同意记录（不含健康数值），用来说明你同意过什么、在何时同意（第 5 节）。我们不把消费者健康数据用于广告、营销、为第三方建立画像或研究，也不出售这些数据。

4. 共享的类别和对象

[CONFIRM: Vercel AI Gateway 是否把这些模型路由到其他托管商；如是，需补充。]我们没有接收消费者健康数据的关联公司。我们不出售消费者健康数据，因此不会请求出售授权。

5. 你的同意

我们会分别请求两项同意，均不预先勾选，也不包含在使用条款中：

1. 收集同意：为 Ember 的功能收集消费者健康数据（在登录之后、你填写健康信息之前请求）。没有这项同意就无法使用应用，因为 Ember 不保存健康数据就无法运行。
2. 共享同意：与上列 AI 服务商共享消费者健康数据（在 AI 数据使用同意页、任何 AI 请求之前请求）。你可以拒绝，仍可使用非 AI 功能。Apple 健康数据有单独的开关，默认关闭。

这些同意对应在这台手机上登录的账号。手机上保存着它们的工作副本；退出登录或会话结束（包括连续 90 天未使用）时，该副本会被清除，下次登录时会再次询问。

我们还会在服务器上保存同意记录：你在同意页面同意、在 AI 页面选择"暂不使用 AI"、更改 AI 共享或 Apple 健康开关，或撤回同意时，都会新增一条。记录涵盖健康数据收集、健康提示、18 岁确认、AI 共享和 Apple 健康共享。每条记录包含哪一项同意、你同意、拒绝还是撤回、文字版本、手机时间、服务器时间、应用版本、记录 ID 和你的账号 ID，不含 IP 地址、出生年份、健康数值或自由文本。无论是否开启云备份，记录都会在后台发送；我们保存它们是为了说明你同意过什么、在何时同意。退出登录不算撤回，不会记录。撤回只会新增一条记录，不会抹去之前的记录。这些记录随账号删除。

你可以随时撤回任一同意。撤回共享同意请到 我的 → AI 设置，新的 AI 请求立即停止。撤回收集同意请到 我的 → 隐私：应用会停止读取 Apple 健康和云备份，关闭 AI 数据共享，并回到同意页面；再次同意之前无法使用应用的其他部分。撤回不会删除你的账号、手机上的数据或服务器上已有的备份。如需清除，请在应用内删除账号或随时发邮件给我们（第 6 节）。同意页面上也有退出登录和删除账号，你不必再次同意就能离开。再次同意后，你之前打开的 Apple 健康同步或备份会恢复，AI 则保持关闭，直到你在 AI 设置中打开。具体同意文字见附录 A。

6. 你的权利

你可以：

• 确认我们是否收集、共享或出售你的消费者健康数据，并获取副本；
• 获取与我们共享过这些数据的所有第三方和关联方名单及联系方式 [CONFIRM: 各服务商联系邮箱或网页表单]；
• 撤回同意；
• 要求删除。

如何提出：在应用内删除账号（同时删除服务器和手机上的数据），或用 Ember 账号的邮箱（见 我的 → 账号）发邮件至 privacy@waipyy.com。如果你用 Apple 隐藏邮箱登录，可以用任意邮箱来信并附上应用中显示的账号邮箱，我们会通过该邮箱确认。我们会在 45 天内答复；如需再延长最多 45 天，会在前 45 天内说明原因。每年两次以内免费。

删除：我们会从数据库中删除数据，通知我们的处理方及共享过数据的 AI 服务商 [CONFIRM: 经 Vercel 向各 AI 服务商请求删除的方式，或说明服务商在保存期限外不保留副本]，并在 30 天内从备份和恢复系统中删除（Neon 时间点恢复记录在 [CONFIRM: 窗口] 内过期）。已发给 AI 服务商的数据只会在其声明的保存期限内保留 [CONFIRM: 各服务商]。同意记录随账号删除。与账号关联的反馈会随账号删除。未与账号关联的反馈（未登录时发送，或用已过期的会话发送）不会因删除账号而删除，因为我们无法把它与你对应；请告诉我们你发送的内容，我们会删除。否则它会在自发送起 12 个月后的服务器清理中删除，因此我们无法承诺确切日期。

申诉：如果我们拒绝你的请求，请回复我们的答复并注明"申诉"。我们会在 45 天内书面答复并说明理由。如申诉被驳回，你可以向以下机构投诉：

• 华盛顿州总检察长：atg.wa.gov/file-complaint
• 内华达州总检察长：ag.nv.gov/Complaints/File_Complaint
• 康涅狄格州总检察长：portal.ct.gov/AG

[CONFIRM: 发布时这些投诉网址仍然有效]

你行使上述权利，我们不会拒绝服务、提高收费或降低服务质量。即使不同意共享，Ember 的非 AI 功能也能正常使用。唯一的限制是收集同意：Ember 不保存健康数据就无法运行，因此在撤回该同意期间应用无法使用（第 5 节）。

7. 第三方追踪

没有任何第三方从 Ember 收集你在一段时间内或跨其他应用、网站的活动数据。Ember 不含广告、统计分析或追踪 SDK。

8. 安全与访问

只有运营者可以访问我们的服务器和数据库 [CONFIRM: Vercel 和 Neon 已开启多重验证]。处理方的访问受合同限制，仅用于向我们提供服务。

9. 变更

变更会在此发布并更新生效日期。在收集新类别的消费者健康数据、与新类别的接收方共享或用于新目的之前，我们会重新征得你的同意。

附录 A：同意文字（在应用内显示）

收集同意（健康同意第 3 版）

Ember 会保存你的健康与健身信息——体重和身体数据、训练、饮食、餐食照片，以及你告诉教练的伤病或身体状况——用来安排训练、计算目标。你的健康数据保存在 iPhone 上；只有打开云备份，或同意使用 AI 功能（会另行询问）时才会离开手机。我们的服务器会保存你的同意记录，其中不含健康数据。你可以随时在"我的 → 隐私"中撤回同意，在"我的 → 账号"中删除账号和数据。

[ ] 我同意 Ember 为上述目的收集我的健康数据。

共享同意（AI 数据使用同意页，该页还列出发给各服务商的内容）

Ember 的教练、训练计划、训练点评、动作要点和餐食估算由第三方 AI 模型完成。使用这些功能时，Ember 会经自己的服务器把该功能需要的信息发给下列 AI 服务商。不会发送你的姓名和邮箱，但照片和你写的内容本身可能识别出你。按钮："同意并使用 AI 功能"或"暂不使用 AI"。

Apple 健康共享（单独开关）

同时把 Apple 健康中的体重发给 AI。[默认关闭]

本政策以英文版为准；中文版供参考。