Apex is a running and riding app. Some of what it records, such as your heart rate, your workouts and the goals you set, says something about your body and your health. Several US states have special laws for this kind of information, including Washington's My Health My Data Act, Nevada's consumer health data law and Connecticut's Data Privacy Act. This policy explains in plain English what consumer health data Apex collects, why, who it goes to and how you stay in control.
Mohan Prakash Jeyasankar, an individual developer based in the United Kingdom who makes Apex as a free, non-commercial passion project ("Apex", "we", "us" or "our"), provides the Apex iPhone app, its Apple Watch app and widgets. This policy adds to our Privacy Policy, which covers everything else. If the two ever differ about consumer health data, this policy applies.
What "consumer health data" means here
"Consumer health data" means personal information that is linked, or reasonably linkable, to you and that identifies your past, present or future physical or mental health. That includes information about bodily functions and vital signs, such as heart rate. It also includes information we work out from other data, for example a fitness estimate calculated from your workouts. Apex is a fitness app, not a medical service, but we treat all the data below as consumer health data so that you get the full protection of these laws.
Consumer health data we collect
| Category | What it includes | Do we store it on our servers? |
|---|---|---|
| Workouts | For each run or ride: start and end time, duration, distance, pace or speed, splits and intervals, elevation gain, cadence and power (from a sensor you pair or an imported file), estimated calories, and whether it was indoors | Yes |
| Heart rate | Your heart rate during workouts, from Apple Health, your Apple Watch, a Bluetooth heart-rate strap you pair, or a file you import | Only the average and maximum for each workout. Live readings stay on your iPhone. |
| Daily activity | Steps, walking, running and cycling distance, running speed, cycling speed and cadence, active energy and exercise minutes, read from Apple Health | Only your daily step totals. The rest is used on your iPhone. |
| Imported workouts | Workouts you import from Apple Health (which may have come from a Garmin or another watch or app) and GPX, TCX or FIT files you import | Yes, for the workouts you choose to import |
| Fitness estimates we work out | Estimated VO2max, threshold pace, resting and maximum heart rate, heart-rate and pace zones, training load, fitness trend, personal records and short summaries of finished workouts | Yes |
| Goals and training preferences | Your main goal (some goals, such as "Postnatal plan" or "Recover from injury", reveal health information), activity level and training days | Yes. Those two health-related goals are kept only if you have given health consent; otherwise Apex saves the general goal instead. |
| Segment times, only if you use segments | For each segment you pass on an outdoor run or ride: the time, the date, your average speed, the activity it came from, and whether the time was flagged (for example as too fast). Worked out on your iPhone; your GPS track is not uploaded for this. | Yes |
| Workout routes and location | Your precise location while you record a workout, saved as the route, with the first and last 200 metres removed by default. We collect it because it is needed to measure your workout, not to learn about your health, but routes can show where you have been. | Yes (the trimmed route only) |
| Live share, only if you start one | Your position, GPS accuracy, speed, distance so far, elapsed time and phone battery level while the share runs. Heart rate is not part of a live share. | Yes, and deleted 24 hours after the share ends |
| Story progress and Summit receipts | Your weekly workout minutes against your story goal, and, in Summit, one line about your week on each stamp (for example your fastest 5 km yet, or your biggest week in months), worked out on your iPhone from your own workouts | Only which chapters you unlocked and for which week. Summit receipts stay on your iPhone and are never uploaded. |
| Health information you post | Workout stats you choose to attach to a Club post, and anything you write about your health in posts or comments | Yes |
Apex does not ask for or collect medical records, diagnoses, medications, menstrual or fertility data, or your weight. It does not use your data to infer health conditions.
Where it comes from
- You, when you record a workout, set goals, import a file or post in the Club.
- Your iPhone and Apple Watch sensors: GPS location, motion sensors and the Watch's heart-rate sensor, while you record a workout. A run you record on the Apple Watch app (time, distance and heart rate, no GPS route) is sent to your iPhone and saved like any other workout.
- Bluetooth sensors you pair: a heart-rate strap, foot pod, bike sensor, power meter or smart trainer, only on the Sensors screen and while you record. Heart-rate readings from them are ignored unless you have given health consent.
- Files you import: FIT, GPX or TCX files from another watch or app. They are read on your iPhone and not uploaded; only the workout that Apex saves from them is stored.
- Apple Health, only if you allow it. Apple Health can include data that other apps and devices, such as a Garmin watch, have written into it.
- Our own calculations: the fitness estimates listed above, which we work out from your workouts.
Why we collect and use it
We use consumer health data only to provide the Apex features you ask for:
- to record, save and show your runs and rides, your history, maps, splits and records, and keep them in sync;
- to move your story along, and in Summit to write each stamp's receipt on your iPhone from your own workouts;
- to coach you: build and adapt training plans, set heart-rate and pace zones, estimate training load and celebrate milestones;
- to run the social features you choose to use: the Club, challenges and leaderboards, segment leaderboards, and the Couples and Duo stories;
- to keep leaderboards fair, by flagging segment times that are too fast for the sport or come from poor GPS, so they are never ranked;
- to keep Apex secure and to meet our legal obligations.
What we don't do: we don't use consumer health data for advertising, marketing, profiling or data mining. We don't sell it or use it to train AI models. We don't make automated decisions about you with it. The AI coach runs on your iPhone, so what it reads is not sent to us or to any AI provider.
Your consent
- Collection. Apex has a separate health data consent screen, shown during setup (and once to people who set up Apex before it existed). Before Apex collects your consumer health data, it shows you this consent screen that explains what it will collect, why, and how to withdraw. This consent is separate from your agreement to our Terms and from Apple's Health and Location permission prompts. You can still use Apex without giving it, but features that need health data, such as heart-rate zones and training load, won't work.
- Sharing. We ask separately before we share consumer health data with anyone other than our service providers. Apex doesn't send your health data to other apps or services. Live sharing is a separate choice that you make each time: nothing is shared until you start a share and pick who sees it (a private link, or your partner and people from your clubs inside the app), and you can stop it at any time.
- Withdrawing consent. You can withdraw at any time in Settings → Your data → Health data consent (tap your avatar, then Settings), in the Health app or iOS Settings (to stop Apex reading Apple Health), or by emailing privacy@apexapp.site. Once you withdraw, Apex stops reading Apple Health and stops sending new health data to our servers. It does not undo what happened before you withdrew. To delete what we already hold, see Your rights.
We may still collect or share consumer health data without separate consent where it is strictly necessary to provide a feature you have asked for, or where the law requires it.
Who we share it with
| Who | What they receive | Why |
|---|---|---|
| Supabase (supabase.com), our hosting provider, acting as our processor | All the server-stored data above, stored in the EU (Ireland) | To store your data and run Apex for us, under a contract that only lets them use it to provide their service to us |
| The other person in your couple or duo, only if you both pair | Your total workout minutes for the current week, rounded down to 5 minutes, and your first name | To run the Couples or Duo story you both chose |
| Other Apex members (signed-in members only) | Workout stats you choose to attach to a Club post; headline totals on your profile card (total runs and rides, distance, time, streaks, weekly goals, XP and level) | To run the Club, challenges and leaderboards |
| Club members or your partner you share a segment with, and other members on public boards (public boards are off until you switch them on) | Your best ranked time on that segment, its date, your first name and avatar. Other people's times appear about 2 hours after they finish. | To run the segment leaderboards you chose to join. You can leave club and partner boards, switch public boards off, or delete any time. |
| People you choose for a live share, only if you start one | Your position and route so far, distance, pace or speed, elapsed time, phone battery level, first name and avatar. People who open a private link need no account. | To let them follow your run or ride at your request. Shares end within 6 hours and are deleted 24 hours after they end. |
| Authorities, only where the law requires it | What the law requires | To comply with the law or protect someone's safety |
Apex has no affiliates. If Apex is ever sold or merged, your data may pass to the buyer. We would tell you first, and the buyer would have to keep the promises in this policy.
Apex only reads from Apple Health. It never writes or saves anything there.
We never sell it
We do not sell consumer health data, and we have not done so in the past. We don't exchange it for money or anything else of value, and we don't give it to advertisers, data brokers or information resellers.
No geofencing
We do not set up virtual boundaries (geofences) around hospitals, clinics, mental health, reproductive or sexual health facilities, or any other place where health care is provided. We do not use your location to identify or track people who visit those places, to collect health data from them, or to send them notifications or ads.
Your rights and how to use them
Whichever state you live in, you can ask us to:
- Confirm and access: confirm whether we collect, share or sell your consumer health data, and give you a copy of it, with a list of every third party it has been shared with and how to contact them;
- Delete: delete your consumer health data;
- Withdraw consent: stop collecting and sharing it, as described in Your consent.
How to make a request:
- In the app: tap your avatar, then Settings → Delete Account, to delete your account and all data stored with it. Settings → Your data → Health data consent withdraws your consent. Settings → Your data → Export my data exports your runs and rides ("Export Everything" adds your segment times). You can also delete single segment times in the app.
- By email: write to privacy@apexapp.site from the email address linked to your Apex account (or your Apple relay address), or tell us your Apex display name.
We confirm your identity using reasonable steps, for example by checking that the request comes from your account's email address. We respond within 45 days of receiving your request. If we need more time, we can extend once by another 45 days, and we will tell you why within the first 45 days. Requests are free up to twice a year.
When we delete your consumer health data, we delete it from all our systems. We don't keep separate backups. We also tell our processor and any third party we shared it with about your request. Apex never writes to Apple Health, so your data there is not affected; you manage it in the Health app.
Appeals
If we decline your request, in whole or in part, you can appeal. Reply to our response with "Appeal" in the subject line, or email privacy@apexapp.site. Within 45 days of receiving your appeal, we will tell you in writing what we decided and why. If we deny your appeal, you can complain to your state attorney general:
- Washington: Washington State Office of the Attorney General, atg.wa.gov
- Nevada: Nevada Office of the Attorney General, ag.nv.gov
- Connecticut: Connecticut Office of the Attorney General, portal.ct.gov/ag
How we protect it and how long we keep it
Only the people and processors who need consumer health data to run Apex can access it. Database rules let each member read only their own private data, and shared features go through narrow functions that return only what is described above. Data is encrypted in transit and at rest. For more detail, see Security in our Privacy Policy.
We keep consumer health data while your account is open. When you delete your account, we delete it straight away, and within 30 days at most. See Retention.
Changes to this policy
If we want to collect new categories of consumer health data, use it for a new purpose or share it with a new kind of recipient, we will update this policy and ask for your consent in the app first.
Contact us
- Email: privacy@apexapp.site
Apex is run by one person, so we handle requests by email. We don't have a postal address for Apex.
Legal basis
This policy is designed to meet:
- Washington My Health My Data Act, RCW chapter 19.373: definitions (RCW 19.373.010); consumer health data privacy policy and homepage link (19.373.020); consent to collect and separate consent to share (19.373.030); rights to confirm, access, withdraw consent and delete, with 45-day responses and appeals (19.373.040); access limits and security (19.373.050); processors (19.373.060); no sale without valid authorisation (19.373.070); no geofencing within 2,000 feet of health care facilities (19.373.080).
- Nevada consumer health data law (SB 370 of 2023), NRS 603A.400 to 603A.550, including the geofencing ban within 1,750 feet (NRS 603A.540).
- Connecticut Data Privacy Act, Conn. Gen. Stat. §§ 42-515 et seq., as amended by Public Act 23-56 (SB 3), including the consumer health data rules in § 42-526.