Privacy Policy

Where coaches using the Entropy platform are licensed healthcare providers subject to the Health Insurance Portability and Accountability Act (HIPAA), Entropy Lifestyle operates as a Business Associate under HIPAA with respect to Protected Health Information (PHI) accessed through the platform. In those relationships, our handling of PHI is governed by Business Associate Agreements (BAAs) executed between Entropy and those covered entities. Entropy voluntarily applies HIPAA-equivalent security and privacy standards to all health data we handle, regardless of whether HIPAA applies as a matter of law.

Our website uses cookies and similar technologies to understand how visitors interact with our pages, diagnose technical issues, and measure performance. Our mobile app uses analytics SDKs for equivalent purposes. Analytics data is aggregated and de-identified before analysis.

Analytics tools we use may include services such as Google Analytics, Firebase, or similar platforms operating under their own privacy policies. We configure these tools to minimize data retention, disable advertising features, and prevent cross-site tracking. We do not use analytics data to build advertising profiles.

You can manage cookie preferences through your browser settings. Limiting cookies may affect website functionality but does not impact core app features.

Entropy Lifestyle treats all health metrics as sensitive personal data. We apply the following specific protections:

• No advertising use. We never use your health data for advertising or marketing profiling of any kind, consistent with Apple HealthKit guidelines and applicable law.
• No sale. We do not sell, rent, or trade your health data to any third party.
• Purpose limitation. Health data is used exclusively to generate your personalized wellness protocol, power wellness insights, and improve the experience that serves you.
• Minimum necessary access. We request only the health data types necessary to deliver the features you use. You control which categories to share.
• HealthKit restrictions honored. Data obtained via Apple HealthKit is handled in strict compliance with Apple's HealthKit data use restrictions and may not be used for any purposes not expressly permitted by those restrictions.

You may manually log additional wellness information, including nutritional intake, hydration, mood, energy levels, and notes. This data is stored in your account and subject to the same protections as wearable-sourced data.

• Analyzes your recovery score, HRV, resting heart rate, sleep duration, sleep efficiency, SpO2, and daily strain to select the right protocol intensity for the day.
• Generates personalized workout sessions with sets, reps, and intensity adjusted to your readiness zone, accounting for injury history and strength profile where applicable.
• Schedules your wellness tasks around your calendar, meal windows, and wake/sleep times derived from your wearable data.
• For users with an active coach, applies your coach's rules and protocol overrides on top of your health data.

• The AI does not diagnose medical conditions, predict disease, or replace clinical judgment.
• The AI does not make decisions that produce significant legal effects.
• AI-generated protocols are wellness guidance, not medical prescriptions.

AI-generated protocols are framed by wellness principles and coach rules set by our team and your coach. You always have the ability to ignore, override, or modify any protocol the Service surfaces.

Where technically feasible, the App explains the primary factors behind a protocol adjustment (e.g., "Your HRV dropped 18% last night, so your session has been adjusted to a lighter intensity today"). You have the right to request a plain-language explanation of any significant automated protocol decision affecting you.

Your health metrics, including recovery scores, HRV, resting heart rate, sleep data, strain, and schedule context, are transmitted to Google Cloud's Gemini API or Anthropic's Claude API, as applicable, to generate your personalized protocol. Your name, email address, and other direct identifiers are never included in these requests; only a pseudonymous user ID and health metrics are transmitted.

Google Cloud. Entropy Lifestyle has executed a signed Business Associate Agreement (BAA) with Google Cloud covering the processing of health data through Google Cloud's AI services. This BAA establishes Google Cloud as a HIPAA-covered Business Associate with respect to health information transmitted for protocol generation. Under this BAA and Google Cloud's Data Processing Addendum, Google is contractually prohibited from using your data to train or improve its AI models, and your data is not retained beyond the time required to process each request.

Anthropic. Claude is used for protocol processing and document import features, including uploading workout files, meal plans, and similar content. Anthropic's API Data Processing Agreement prohibits using customer API inputs to train or improve its models. Your health data is not retained by Anthropic beyond the time required to process each request.

For a full list of our data-processing sub-processors, contact hello@entropylifestyle.com.

We share data with trusted vendors who assist us in operating the Service, including cloud hosting, authentication, crash reporting, analytics, email delivery, and customer support. These providers are contractually prohibited from using your data for their own purposes and must process it only on our instructions.

When you connect WHOOP, Oura, Strava, Garmin, Apple Health, or Google Health Connect, data flows between those platforms and Entropy Lifestyle according to your authorization. See Section 7 for details on each integration, including what data is accessed, how it is used, and how to disconnect.

We may share aggregated, anonymized data, from which individual identity cannot reasonably be reconstructed, with research partners, academic institutions, or in public reports to advance health and wellness science. This data cannot be used to identify you. Research partners are contractually prohibited from using this data for commercial product development, advertising, or any attempt to re-identify individuals.

We may disclose your information if required by law, subpoena, court order, or government authority, or when we believe in good faith that disclosure is necessary to protect our rights, prevent fraud, or protect the safety of a person.

If Entropy Lifestyle is involved in a merger, acquisition, sale of assets, or restructuring, your information may be transferred to the successor entity. We will notify you via email and/or a prominent in-app notice prior to such a transfer, and you will have the option to delete your account and data.

Coach relationships. When a coach using the Entropy platform is a HIPAA covered entity (e.g., a licensed healthcare provider), Entropy operates as a Business Associate under HIPAA with respect to PHI accessed through the platform. These relationships are governed by Business Associate Agreements (BAAs) executed between Entropy and those coaches prior to any PHI access. All coach access to your health data is logged in a tamper-evident audit record and is subject to the minimum-necessary standard.

Google Cloud (AI sub-processor). Entropy has executed a signed BAA with Google Cloud covering the processing of health data through Google Cloud's AI services used for protocol generation. This BAA ensures that health metrics transmitted to Google Cloud's Gemini API are handled in accordance with HIPAA requirements, including restrictions on secondary use, data retention limits, and breach notification obligations.

With your explicit permission, Entropy Lifestyle reads health and fitness data from Apple Health on your device. All HealthKit data is processed in compliance with Apple's HealthKit guidelines. HealthKit data is never used for advertising or shared with third parties for advertising purposes. You can revoke Apple Health access at any time via Settings → Health → Data Access & Devices → Entropy Lifestyle.

With your explicit permission, Entropy Lifestyle reads health data from Google Health Connect on Android devices. Data use is limited to the purposes described in this policy. You can revoke access via Google Health Connect settings at any time.

If you connect your WHOOP device, Entropy Lifestyle receives recovery, strain, and sleep data from the WHOOP API. Your connection is governed by WHOOP's Privacy Policy. You can disconnect WHOOP at any time within the Entropy Lifestyle app settings.

If you connect your Oura Ring, Entropy Lifestyle receives the following data types from the Oura API: sleep stages and duration, readiness score and contributing factors, daily activity summary, resting heart rate, and heart rate variability (HRV). We use this data solely to generate your personalized wellness protocol and recovery recommendations.

Oura data is never used for advertising, sold to third parties, or shared beyond what is necessary to operate the Service. When you disconnect Oura, we will delete your Oura-sourced data within 30 days. Your connection is also governed by Oura's Privacy Policy. To disconnect Oura, navigate to App Settings → Integrations → Oura → Disconnect, or revoke access via your Oura account at cloud.ouraring.com.

If you connect Google Calendar to enable scheduling features, we access only the calendar data necessary to schedule wellness protocols and reminders. We do not read the content of your calendar events.

If you connect your Strava account, Entropy Lifestyle receives activity data from the Strava API, including workout summaries, sport type, elapsed time, distance, elevation, and heart rate data from your logged activities. We use this data solely to incorporate your training load into your personalized recovery and performance protocol.

Strava data is never used for advertising, sold to third parties, or shared beyond what is necessary to operate the Service. When you disconnect Strava, we will delete your Strava-sourced activity data within 7 days, consistent with Strava's API Agreement. Your connection is also governed by Strava's Privacy Policy. To disconnect Strava, navigate to App Settings → Integrations → Strava → Disconnect, or revoke access directly via your Strava Connected Apps settings at strava.com/settings/apps.

If you connect your Garmin device or Garmin Connect account, Entropy Lifestyle receives health and activity data from the Garmin Health API. Data types accessed include: daily activity summaries, sleep data, resting heart rate, heart rate variability (HRV), stress levels, Body Battery energy, SpO2 readings, and workout records. We use this data solely to generate your personalized daily wellness protocol and recovery recommendations.

Garmin data is never used for advertising, sold to third parties, or shared beyond what is necessary to operate the Service. When you disconnect Garmin, we will delete your Garmin-sourced data within 30 days. Your connection is also governed by Garmin's Privacy Policy. To disconnect Garmin, navigate to App Settings → Integrations → Garmin → Disconnect, or revoke access via your Garmin Connect account at connect.garmin.com.

You may request a copy of the personal information we hold about you, including your health data, in a commonly used machine-readable format (data portability).

You may update or correct inaccurate information directly in the App settings or by contacting us.

You may request deletion of your account and associated personal data at any time by navigating to Settings → Account → Delete Account, or by emailing hello@entropylifestyle.com. We will process your request within 30 days.

You may withdraw consent for optional data processing (e.g., health platform integrations, marketing emails) at any time. Withdrawal of consent does not affect the lawfulness of processing that occurred before withdrawal.

You may disconnect any wearable or health platform integration at any time via App Settings. Future data from disconnected sources will no longer be received.

You may opt out of marketing communications by clicking "Unsubscribe" in any email or adjusting notification settings in the App.

You may request a record of instances where your health data was accessed or shared, including access by your coach or other authorized parties. We maintain a tamper-evident audit log of all health data access and will provide this accounting upon request within 30 days. This right is consistent with HIPAA §164.528 and applies to all health data we process on your behalf.

We honor Global Privacy Control (GPC) signals as required by California, Colorado, and Connecticut law. If your browser or device broadcasts a GPC signal, we treat it as an opt-out of cross-context behavioral advertising. We do not engage in cross-context behavioral advertising, our analytics are limited to aggregate, de-identified usage data only. We do not currently respond to browser-level "Do Not Track" (DNT) signals because no universal standard exists, but GPC is honored as described above.

If you are a California resident, you have the following additional rights: Right to Know, Right to Delete, Right to Correct, Right to Opt Out of Sale/Sharing (we do not sell or share personal information), Right to Limit Use of Sensitive Personal Information, and Non-Discrimination. To submit a California privacy request, email hello@entropylifestyle.com with the subject line "California Privacy Request." We will respond within 45 days.

Residents of Virginia, Colorado, Connecticut, Texas, and other states with comprehensive privacy laws have rights similar to those described in Sections 10 and 11.1. Contact us at hello@entropylifestyle.com to exercise these rights.

If you are located in the European Economic Area, United Kingdom, or Switzerland, you have the following additional rights under the General Data Protection Regulation (GDPR) or equivalent law:

• Legal basis for processing. We process your data on three bases: (1) contract performance, to deliver the Service you signed up for; (2) consent, for health integrations and marketing emails, which you may withdraw at any time; and (3) legitimate interests, for security, fraud prevention, and aggregate analytics, balanced against your rights.
• Right to object. You may object to processing carried out under legitimate interests. We will cease that processing unless we can demonstrate compelling legitimate grounds that override your rights.
• Right to restrict. You may ask us to restrict processing of your data while a dispute about accuracy or lawfulness is being resolved.
• Right to complain. You have the right to lodge a complaint with your local supervisory authority, for example, the ICO (UK), CNIL (France), or your national Data Protection Authority within the EU.

We do not currently have a formal EU/UK representative or Data Protection Officer. Direct all GDPR-related requests to hello@entropylifestyle.com.