Privacy Policy — XLR8Well Health

XLR8Well Health ("the app") is a companion application for existing XLR8Well clients. It reads health and fitness data already stored on your Android device through Google Health Connect and securely syncs it to your XLR8Well account so that your care team can support you with an up-to-date picture of your health.

The app is operated by XLR8Well ("we", "us", "our"). You need an XLR8Well account to use it. This policy explains exactly what we collect, why, and the control you have.

With your explicit consent, the app requests read access to the following Health Connect data types. We request read access only — the app does not write or modify data in Health Connect.

You choose which of these permissions to grant. The app functions with whatever subset you allow, and you can change or withdraw permissions at any time (see "Your choices and controls" below).

• Deliver the service: sync your wearable and health data to your XLR8Well account so your care team can review trends and provide guidance.
• Keep data current: perform periodic background synchronisation (approximately every few minutes) while you have permissions enabled.
• Account security: authenticate you and protect access to your account.

• Data is transmitted from your device to XLR8Well over an encrypted HTTPS (TLS) connection.
• Your XLR8Well login credentials / session token are stored encrypted on your device using Android's secure storage.
• On our servers, your health data is stored on access-controlled infrastructure and is associated only with your XLR8Well account.
• Access is limited to your care team and authorised XLR8Well personnel who need it to provide the service.

We share your health data only as needed to provide the service:

• Your XLR8Well care team, to support your health and wellness.
• Service providers (e.g. secure cloud hosting and the wearable-sync infrastructure) that process data on our behalf under confidentiality and data-protection obligations, solely to operate the service.
• Legal requirements, where we are required to disclose information by law.

We never share your Health Connect data with third parties for their own marketing or advertising.

• Grant or deny any individual Health Connect permission when prompted.
• Revoke access at any time in the Health Connect app (Settings → Apps → Health Connect → App permissions) or in your device settings. Revoking permission stops further syncing of that data type immediately.
• Stop syncing entirely by signing out of the app or uninstalling it.
• Access & deletion: you can request a copy of, or deletion of, the health data we hold for your account by contacting us (see below). We will action verified requests in line with applicable law.

We retain your synced health data for as long as your XLR8Well account is active and as needed to provide the service. When you delete your account or request deletion, we remove your health data from our active systems within a reasonable period, except where we are required to retain certain records by law.

XLR8Well Health is not directed to children. We do not knowingly collect health data from anyone under the age required by applicable law in their jurisdiction without appropriate consent. If you believe a child has provided us with data, contact us and we will delete it.

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date at the top of this page and, where appropriate, by notifying you in the app.