Consumer health data privacy notice
Effective October 6, 2026.
Health data, sources and purposes
We process the following information to provide the training features you request:
| Category | Source | Purpose and location |
|---|---|---|
| Training profile, goals, plans, workout records and feedback, including any health information you enter | You and your use of the app | On-device planning and progress. If you separately enable cloud collection, goal titles, weekly target, weekly streak/session count and declared workout windows are uploaded to provide connected training and your later sharing choices. |
| Workouts, VO₂ max, resting heart rate and heart-rate variability | Apple Health, with your permission | On-device training context. These readings are excluded from NGS cloud summaries. Completed workouts can be written to Health for activities you enable. |
| Training-context and progress estimates derived from these inputs | NGS calculations | Informational planning and progress; these do not establish medical readiness. Only the described cloud-summary fields leave the device for NGS cloud use. |
| Account identifiers, training time zone, consent and access records associated with cloud training summaries | You, Apple authentication and service operations | Connect the requested information to your account, apply choices and protect access. |
| Saved locations used for training conditions | Locations you select and Apple Maps search results | Retrieve weather/marine conditions from Apple WeatherKit, Open-Meteo or NOAA using coordinates, dates or station identifiers. Whether a particular request identifies health status or seeking health services must be assessed in context. |
| Health information you voluntarily send in a support request | You | Respond to your request. Please do not send medical records; support does not provide medical clearance. |
Health data we disclose and recipients
DigitalOcean processes NGS cloud summaries and associated account information to host the service. Google Workspace processes any health information you include in support correspondence forwarded to our business mailbox.
Accepted Circle members receive only the goal, streak or workout-window categories you choose to share with them. An agent provider receives only the categories separately authorized for its connection. The ChatGPT connection is provided by OpenAI. A grant lasts up to 30 days; that access limit is not a promise about deletion of previously received information. Apple receives completed workouts you choose to write to Apple Health. Forecast providers receive the limited location-related requests described above. Resend receives invitation/contact and delivery information rather than training summaries.
We may make disclosures required or otherwise permitted by applicable law for legal and security purposes. We do not sell consumer health data.
Collection, sharing and withdrawal
Cloud collection requires its own affirmative choice. Agreeing to service terms or acknowledging this notice does not authorize collection or optional sharing. Circle and agent sharing are separately chosen. New health-data categories or purposes require the disclosures and choices required by applicable law before processing begins.
Use Cloud connection to withdraw cloud collection and sharing, Circle to remove a connection or change sharing, Agent Access to revoke an agent, and Apple Health or iPhone Settings to change Health permissions. An offline request may remain pending until the server confirms it. Revocation stops future access; it does not automatically erase prior copies. Deletion is a separate right and process.
Requests and appeals
Email contact@nextgoodsession.com to request confirmation of processing, access, withdrawal, deletion, or an applicable recipient list and recipient contact information. You can request correction or a copy through the same route. Tell us enough to identify the request, without including medical records or passwords. Invited nonusers can use this route without creating an account. We authenticate requests proportionately and may ask for additional information reasonably needed to verify them.
Where Washington's My Health My Data Act applies, we respond without undue delay and within 45 days of receipt. A reasonably necessary extension of up to 45 additional days requires notice and reasons during the initial period. Applicable access responses are free up to twice annually, subject to statutory exceptions. You may appeal a refusal by replying to the decision or emailing the same address; “Privacy appeal” is an optional subject, not a required form. We respond to an appeal within 45 days and explain our decision. If denied, we provide the Washington Attorney General complaint route.
Where required, deletion includes notifying relevant affiliates, processors, contractors and other recipients, and deleting from backup/archive systems within the applicable deadline. Washington permits the specified backup/archive delay for no more than six months after authentication; this is a legal ceiling, not NGS's chosen backup-retention period. We do not unlawfully discriminate against you for exercising your rights. Washington rights statute.
Where Nevada's consumer-health provisions apply, you may request confirmation of collection/sharing/sale, a third-party recipient list, cessation of collection/sharing/sale, and deletion. We respond without undue delay and within 45 days after authentication, with a reasonably necessary additional 45 days on timely notice. Deletion and recipient notification have a separate 30-day deadline after authentication, subject to the statutory backup exception. Appeals use the same contact route; we respond within 45 days after receipt, with reasons and Nevada Attorney General contact information if denied. We provide information free as required by law, including at least two requests annually and additional requests that are not manifestly unfounded, excessive or repetitive. Nevada statute, NRS 603A.505–.520.
Where Connecticut's consumer privacy law applies, you may request access, correction, deletion and an applicable portable copy, and exercise applicable opt-outs for sale, targeted advertising and qualifying profiling. We respond within 45 days of receipt, with a qualified additional 45-day extension on notice. Appeals use the same contact route; we respond within 60 days of receipt, with reasons and Attorney General contact information if denied. Information is provided free as required by law, including once every twelve months, subject to statutory exceptions. NGS does not engage in selling information or targeted advertising. Connecticut Attorney General guidance.
We will communicate material changes through the app or other appropriate direct notice and update the effective date. New health-data purposes or categories require the disclosures and choices required by applicable law before processing begins.