Privacy Policy

Information we collect

Depending on the features you authorize, Macro Health may process:

• Account identifiers and authentication events managed through Clerk.
• WHOOP data, including workouts, strain, cycles, sleep, recovery, heart rate variability, resting heart rate, and body measurements.
• Strava activity data, including workout summaries and authorized streams such as heart rate, power, pace, distance, and location.
• User-provided health information, including blood-test reports, biomarker results, genetic reports, supplements, medications, hormones, notes, and training thresholds.
• Training plans, planned workouts, performance calculations, questions submitted to the AI coach, and generated recommendations.
• Nutrition and Apple Health data only if those integrations are enabled and separately authorized in a future native application.
• Technical logs needed for security, synchronization, reliability, and support.

How we use information

Macro Health uses authorized information to:

• Synchronize and organize health and fitness records.
• Calculate training load, fitness, fatigue, form, trends, and personal baselines.
• Display charts and comparisons for the individual user.
• Answer user questions and generate evidence-backed coaching recommendations.
• Operate, secure, debug, and improve the private application.

Macro Health does not sell personal information and does not use health information for advertising. The application is not a medical provider, and its recommendations are not medical diagnosis or treatment.

Service providers and AI processing

Macro Health relies on service providers to operate the application, including Vercel for hosting, Supabase for database and protected file storage, Clerk for authentication, and authorized data providers such as WHOOP and Strava. When AI features are enabled, authorized user context may be sent through Vercel AI Gateway to selected model providers to answer a question or produce a recommendation.

Service providers receive only the access needed for their role. Provider credentials and refresh tokens are handled server-side and are not exposed to other users.

Sharing and comparisons

Each user's health information is private by default. Family membership does not make private records visible to other family members. Any future sharing requires an explicit, revocable grant.

Users may opt into invited comparison groups. Group sharing is restricted to daily, weekly, or monthly training-load aggregates such as TSS, fitness, fatigue, and form. It does not include raw workouts, location, sleep, recovery, biomarkers, reports, genetics, nutrition, medications, notes, or AI conversations.

Retention and deletion

Information is retained while an account is active and as needed to provide the private application. Users may disconnect WHOOP or Strava to stop future synchronization and may request deletion of imported data, uploaded documents, AI records, or the full account. Limited encrypted backup copies may remain temporarily until the normal backup cycle expires.

Security

Macro Health uses access controls, protected storage, encrypted transport, server-side credential handling, audit records, and user-level database policies. No internet service can guarantee absolute security, so access is limited to invited users and the minimum required service processes.

Your choices

You may decline an integration, revoke provider access, leave a comparison group, or ask the Macro Health administrator to access, correct, export, or delete your information. Use the administrator contact provided with your private invitation. Material policy changes will be communicated to active users before they take effect.

WHOOP data

WHOOP information is accessed only after the user completes WHOOP's authorization flow. Macro Health uses that information to provide the user-requested synchronization, analytics, and coaching features described above. A user can revoke access through Macro Health or their WHOOP account settings.