Health data privacy
How we handle fitness information when consumer health privacy laws apply.
United States · Ages 18 and older
Scope of this notice
Section titled “Scope of this notice”Kratos Flyfitness LLC operates Kratos Performance. This notice supplements our privacy policy where information we process qualifies as consumer health data under applicable US state law, including Washington’s My Health My Data Act.
“Consumer health data” means personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status. RCW 19.373.010. The categories below describe fitness information that may fall within that definition depending on its content and use; they do not classify every video, measurement or technical record as health data.
Information and purposes
Section titled “Information and purposes”Information that may qualify | Why we process it |
|---|---|
Optional body measurements | The height and weight you choose to provide maintain the measurements in your athlete profile. These fields are optional. |
Training media and movement information | Videos and photos, where their contents reveal covered health information, and derived body-position landmarks and movement measurements, including joint angles, support the movement analysis and private training records you request. |
Training and performance records | Workout, performance and setup information you enter or record, including information from compatible training hardware and notes that reveal covered health information, supports recording, organizing and reviewing your training. |
Account and record identifiers associate this information with your private records. Local processing, cloud storage, and cloud analysis involve different information: a locally retained source video can remain on your device while its derived results synchronize to your account; requesting cloud analysis can involve a temporary source upload.
We process relevant information to provide the features you request, synchronize and maintain your records, resolve support issues, diagnose failures, protect the service and handle privacy requests, as permitted by applicable law. Additional consent is obtained where required for the specific collection, use or disclosure.
We do not sell consumer health data or share it for targeted or cross-context behavioral advertising. We do not use private customer videos or health information to train or fine-tune our own AI or machine-learning models, including our movement-analysis models. Running a model to provide the analysis you request is a separate operation from training a model.
Sources of information
Section titled “Sources of information”You, through optional profile measurements, training records, media and notes you enter, capture, import or upload.
Your device and compatible training hardware, through the recording and analysis features you use.
Our analysis and calculation processes, including movement information derived from your recordings.
Disclosures of covered information
Section titled “Disclosures of covered information”Service providers and processors perform operational services on our behalf, such as hosting, customer support, and security infrastructure. These providers act only on our documented instructions and are contractually required to protect personal information. Google Firebase and Google Cloud provide account infrastructure, databases, storage and backend processing. Modal provides cloud movement-analysis processing and receives the source media and processing information needed for that analysis. The information each provider receives depends on the feature you use.
Authorized Kratos personnel and contracted providers may access relevant records or media when needed to provide requested features, handle support, troubleshoot failures, protect the service or meet legal obligations. Access is limited to the information needed for the task, and additional consent is obtained where required by applicable law.
When you export information or use your device’s sharing tools, the recipients you select receive that information. We may also disclose covered information where permitted or required by applicable law in response to legal process, to protect rights or safety, or in connection with a business transaction that preserves the protections required for the information.
Disclosure to a contracted processor is different from sharing with a third party under some consumer health privacy laws. This notice describes provider processing as well as other disclosures so you can understand where covered information goes.
Your rights and requests
Section titled “Your rights and requests”Where applicable consumer health privacy law provides these rights, you may request access, deletion or withdrawal of consent. Washington law provides:
A consumer has the right to confirm whether a regulated entity or a small business is collecting, sharing, or selling consumer health data concerning the consumer and to access such data, including a list of all third parties and affiliates with whom the regulated entity or the small business has shared or sold the consumer health data and an active email address or other online mechanism that the consumer may use to contact these third parties.
A consumer has the right to withdraw consent from the regulated entity’s or the small business’s collection and sharing of consumer health data concerning the consumer.
A consumer has the right to have consumer health data concerning the consumer deleted and may exercise that right by informing the regulated entity or the small business of the consumer’s request for deletion.
You may exercise Your consumer-health rights by contacting Us. Please note that we may ask You to verify Your identity before responding to such requests. If You make a request, We will try our best to respond to You as soon as possible.
Contact: info@kratosflyfitness.com, subject “Kratos Performance health data request.” Identify the right and records involved. Do not send passwords or payment-card details. You do not need a new account to submit a request. Withdrawing consent may affect a feature that requires the information.
You can also edit available profile fields and request account deletion through the app’s account settings. Our account-deletion page explains how to request account deletion without the app. A request to delete particular covered health records can be made by email.
We handle requests within the periods required by the law that applies to you. We explain any permitted extension or refusal and the available appeal process. You may appeal a refusal by emailing the same address with the subject “Appeal — Kratos Performance health data request.” We provide a written response within the applicable period. If a Washington appeal is denied, you may submit a complaint to the Washington Attorney General.