Privacy Policy - The Complete Bodybuilder

Last updated: October 13, 2026 · Effective: October 13, 2026

1. Who we are & scope. 27:17 Fitness LLC (7004 Luminary Dr., Las Vegas, NV 89119) operates The Complete Bodybuilder / Sharpened Fitness (the "Tool"). This policy covers our web app, our iPhone and Android apps, and our marketing site. The Tool is for U.S. adults 18+. Contact: privacy@sharpenedfitness.com.
2. Information we collect. Account and profile information (name, email, password, plan); lifestyle and fitness information you provide (age, sex, height, weight, goals, diet style, allergies, equipment, training and nutrition preferences); check-ins, lab values you enter, physique photos, and coaching or support messages; and payment information processed by Stripe (we receive limited billing metadata like last-4 and status, not full card numbers). If you turn on optional features, we also collect workout logs (session dates, exercises, sets, weight, reps, and reps in reserve) and connected-health data (daily sleep duration and efficiency, heart rate variability, resting heart rate, steps, and active calories). We also collect usage and device information (logs, device/browser details, feature usage, and marketing-site cookies). Data you share with a coach is visible to that coach as described below.
3. Optional features and sensitive information. Workout logging and connected health are off by default. You choose whether to turn them on, which sources to connect, and whether your coach can see them. Physique photos, lab values, health and fitness inputs, connected-health data, and workout logs are sensitive personal information. We collect them only with your action and consent, use them only to provide the Tool to you (and to your coach if you allow it), and never for advertising or sale. We keep a dated record each time you turn a permission on or off. Turning a feature off stops future collection; it does not by itself delete data already stored (see Retention).
4. How we use your data. To operate and personalize the Tool; generate AI-assisted educational content when you request it; pre-fill check-ins and show your trends; provide coach features you authorize; process payments; secure the service; and comply with law. We do not use your health data, workout logs, or photos to train third-party public AI models.
5. Connected health services (Apple Health, Health Connect, wearables). If you connect a supported source, we read only the data types you grant permission for and upload them to our Microsoft Azure servers in the U.S. to show your trends and pre-fill your check-ins. Supported sources are WHOOP today, and Apple Health (HealthKit, in our iPhone app) and Android Health Connect (including Samsung Health data synced to Health Connect, in our Android app) when those apps are available. We do not use information from Apple Health, Health Connect, or any wearable for advertising, marketing, or data mining; we do not sell it or disclose it to data brokers, advertisers, or information resellers; and we do not store HealthKit data in iCloud. We share connected-health information only with the service providers needed to run the feature, with your coach if you turn on coach sharing, or when required by law. The use of information received from Health Connect will adhere to the Health Connect Permissions policy, including the Limited Use requirements. You can disconnect any source and delete the data imported from it at any time in Check-ins → Connected tools; you can also revoke access in your phone's Health / Health Connect settings or your wearable account. Disconnecting stops future syncing; deleting removes that source's imported data. WHOOP, Apple, and Google are data sources you choose to connect, not service providers that host the Tool. Sign-in tokens for connected accounts are encrypted at rest.
6. AI processing. When you use an AI feature, the information needed for that feature is sent to the AI provider that performs it. Fireworks AI is used for plan drafting, plan questions, and post-show debriefs and receives the relevant plan or intake details, your question, or debrief information. Anthropic (Claude) is used for plan review, physique-photo analysis, and lab extraction and receives the relevant plan context, the photos you submit for analysis, or the lab documents you submit. Connected-health data and workout logs are not sent to AI providers unless you include them in an AI question. We use these providers under contract, and they may not train their models on your information. Providers may keep API inputs for a limited period for abuse monitoring (and content flagged for safety review for up to two years) under their terms. AI outputs can be wrong or incomplete and are not medical advice.
7. How we share. We do not sell or share personal information for cross-context behavioral advertising. We disclose information to service providers under contract (below) only as needed to run the Tool, to a coach you connect and authorize, as required by law or to protect rights and safety, and in a business transfer with notice. We do not use your photos, name, or results in marketing without your separate written consent.
8. Service providers (subprocessors).

   Provider	Purpose	Data	Location
   Microsoft Azure	Cloud hosting / storage	All app data, including health, workout, photo, and lab data	US
   Fireworks AI	Plan drafting, plan questions, debriefs	Plan/intake details and questions you submit	US
   Anthropic (Claude)	Plan review, physique-photo analysis, lab extraction	Plan context, photos, and lab documents you submit	US
   Qdrant Cloud	Search of our own (non-personal) coaching knowledge library	A numeric search embedding of your question; no health records or workout logs	US
   Stripe	Payments	Billing metadata	US
   Shopify	Marketing site / storefront	Site visitor + order data	US
   Google Analytics (Google LLC)	Aggregate product usage analytics (no health data or photos)	Usage/device events	US
   Email / support provider	Transactional email / support	Email, ticket content	US
   Nutrition data API	Nutrition lookups	Food search terms	US

   We update this list as providers change. WHOOP, Apple, and Google are data sources you connect, not service providers listed here.
9. Retention. We keep account data while your account is active and for 24 months after closure, then delete or anonymize it, except where we must keep records longer for legal, tax, or security reasons. Physique photos, health inputs, imported connected-health data, and workout logs are deleted from active systems within 30 days of your deletion request; you can delete imported health data per source and workout logs yourself at any time. Database backups that may contain deleted data expire on their normal schedule. Billing records are retained for 7 years.
10. Your rights (DSAR). You can access, export, correct, and delete your data via Account → Privacy (self-serve Download my data / Delete my account) or privacy@sharpenedfitness.com, and turn off optional features, disconnect sources, stop coach sharing, and delete imported health data in Check-ins → Connected tools. We verify identity, respond within 45 days (extendable as permitted by law), and don't discriminate for requests. We do not sell your personal information.
11. Security. Encryption in transit and at rest, encryption of connected-account sign-in tokens, access controls, and least-privilege access to photos and health data. No system is perfectly secure. We provide breach notice per applicable law and the FTC Health Breach Notification Rule where it applies.
12. Children. 18+ only; we don't knowingly collect data from anyone under 18 (COPPA-consistent). If we learn we have, we delete it.
13. State disclosures. California (CCPA/CPRA): categories collected, purposes, and rights as described above; other state laws as they apply. (US-only v1.)
14. Changes. We post updates here with a new "Last updated" date and notice of material changes.
15. Contact. privacy@sharpenedfitness.com · 27:17 Fitness LLC, 7004 Luminary Dr., Las Vegas, NV 89119.