Consumer Health Data Policy — Lazarus

Effective [Date pending]

This document is awaiting final legal review and may change before launch.

Lazarus is provided by Fourth Day Labs LLC, 1315 Walnut St Ste 801, PMB 421, Philadelphia, PA 19107 ("we", "us"). Questions about this policy or your consumer health data: privacy@getlazarus.fit. This policy is a focused view of the health-related information already described in our Privacy Policy. It sits alongside the Privacy Policy and the Terms of Service in the app under Settings → Privacy & terms.

At a glance

This summary is a shortcut. The numbered sections below are the full policy, and they control.

We collect your health-related information only to run your training plan and keep it safe. We do not sell it, use it for advertising, or share it with data brokers.
Your buddy can see only the items you switch on. Your check-ins, pain and symptom answers, and logged sets are never shared.
We do not collect your location, and we do not use geofencing.
You can delete everything yourself in the app, and you can withdraw consent at any time.

1. What this policy covers

This policy explains how Lazarus handles consumer health data: information that is linked or reasonably linkable to you and that identifies or could reveal your physical health status. It is written to meet Washington's My Health My Data Act (RCW 19.373), and we apply it to everyone who uses Lazarus, wherever they live, including residents of Nevada, Connecticut, and other states with consumer-health-data laws.

Lazarus is for adults 18 and older. It is a wellness and training app. It is not a medical device and does not provide medical advice, diagnosis, or treatment. Lazarus is not a health care provider or insurer covered by HIPAA, so your information in Lazarus is not "protected health information" under HIPAA. The laws named in this policy, and the Federal Trade Commission's Health Breach Notification Rule, protect it instead.

2. Consumer health data we collect, and why

We collect only what the training engine needs, plus one optional item used to count how people find Lazarus (the last item below). For each item, the reason is the use we make of it.

Injury, surgery, illness, pregnancy (whether you are pregnant now), or postpartum history (what you are coming back from): to set a safe starting level and, if you are pregnant, to apply pregnancy safety rules. We do not ask how many weeks pregnant you are.
Medical-clearance status (whether a doctor or therapist has cleared you): to decide whether and how to begin, and to point you to a professional when that is the safe call.
Your movement check and whether you have pain at rest: to set your starting level and safety limits.
Weeks since you gave birth, and one yes or no question about leaking, heaviness, or pressure (asked only if you are coming back from postpartum): to apply postpartum safety rules, for example keeping sessions low-impact during the first 12 weeks.
Whether you still feel worn down from an illness: to pace your return.
Your age band (under 60, or 60 and older): to choose a gentle enough starting point.
Your daily check-in: pain, soreness, sleep, and stress (each 1 to 7, with pain as yes or no) and energy (1 to 7): to adjust or hold that day's session and, with your logged sessions, to decide whether your plan moves up, holds, or steps back.
Anything you choose to write in your goals or "work around" note: to personalize your plan. It may include health details if you choose to write them.
Training activity: the sessions you complete and how long each was planned to take, the minutes of cardio you record, the sets you log, how hard each session felt, the dates of any planned break you take (never the reason, which we do not ask), and the training-load figures calculated from them, which we treat the same way as the items above.
Derived information: health-related conclusions the app calculates from your answers, such as your training level, safety limits (for example, "keep it low-impact"), and daily readiness. These are used to deliver your adaptive plan.
A clinician's referral code, if you use one (typed at sign-up, or arriving with a clinician's link or QR code): it can suggest that you are working with that clinician. We use it only in aggregate counts of how people find Lazarus, never to run your training plan.

We do not collect mood, journaling, anxiety, depression, or other mental-health information. The sleep and stress ratings are lifestyle and recovery inputs used only to adjust that day's training, not a mental-health screening. This is a permanent commitment. We do not collect Apple Health or wearable data in this version. If a future version does, we will update this policy before it ships.

3. Where it comes from

Directly from you, through the intake and your daily check-ins.
From the app itself, which calculates the derived information above from your answers.
From a clinician's referral code or link, if you use one when you sign up and say “OK” when we ask whether we may record how you arrived.

We do not buy consumer health data about you or get it from data brokers.

4. How we use it

We use it to run the training service for you: setting your starting level, adapting each session to your daily recovery, moving your plan up, holding it, or stepping it back as your history shows, applying safety rules, and tracking your progress. The one exception is a clinician's referral code, which we use only in aggregate counts of how people find Lazarus. We do not use any of it for advertising, cross-app tracking, or profiling for legal or similarly significant decisions. We do not use geofencing, and we do not collect your location. We will not collect more kinds of consumer health data, or use or share it for a new purpose, without first telling you and getting your consent.

5. Who receives it

We do not sell your consumer health data and we do not share it for advertising. We have no affiliates, and we do not share it with any affiliate or parent company. It goes only to these categories of third parties:

A service provider that stores it for us: Supabase, our hosting provider, which holds it under our instructions in the United States. It is protected by row-level security so only you can read your own information.
Your buddy, only if you opt in and only for the items you switch on: your streak, your completed sessions and their dates, or whether you have a plan. Your daily check-ins, your pain and symptom answers, and the sets and reps you logged are never shared.

Apple and RevenueCat, which handle payment and subscriptions, receive subscription status only, not your consumer health data. Apple and Expo, which deliver notifications if you turn them on, receive your device's push token, basic device information, and a fixed message with no health detail, not your consumer health data. A clinician's referral code stays in our own database: we do not share it with anyone else, and we never show it to your buddy. YouTube, which serves exercise videos, receives your IP address and basic device information when a thumbnail or video loads, not your consumer health data.

If you save a file from Settings → Your data (a copy of your information, your training log or your check-ins), it is made on your device and goes only where you choose to send it. That is your choice, not sharing by us, and we do not receive a copy.

Each service provider processes the data only on our instructions and under a contract consistent with this policy. Only the people who need it to run and support Lazarus can access it, and they must keep it confidential.

We disclose consumer health data where the law requires it only after we receive valid legal process. We review each request, push back on one that is overbroad or improper, disclose only what it requires, and tell you about it unless the law forbids us. We may also disclose it to a successor if Lazarus is part of a business transfer, with notice to you, and the successor must honor this policy.

We collect the consumer health data listed above because it is necessary to provide the training service you asked for. A clinician's referral code is the exception. It is optional: the first time you use a new account we ask, with a one-line choice of “OK” or “No thanks”, and we keep the code only if you say “OK”. If you say “No thanks”, we record nothing about how you arrived. Consent to collection and consent to sharing are separate. We do not share your consumer health data except with your buddy, which needs your separate opt-in for each item. Before any collection, use, or sharing beyond what is necessary to provide the service, we will ask for your consent, and you can withdraw it at any time. We do not sell consumer health data, so we do not need the separate signed authorization that a sale would require.

7. Your rights

You have the right to:

Confirm whether we are collecting, sharing, or selling your consumer health data, and access it, including a list of all the third parties and affiliates we have shared it with and a way to contact them. (We do not sell it. We have no affiliates.)
Withdraw your consent to our collection and sharing of your consumer health data.
Delete your consumer health data.

How to use these rights. In the app you can correct or update your starting-point answers (Settings → My starting point), download a copy of your consumer health data, as one file or as your training log and check-ins (Settings → Your data), delete your account and all your information (Settings → Delete account and data), and manage buddy sharing at any time. For anything else, such as the list of third parties, contact privacy@getlazarus.fit. We will check that the request is yours and respond within 45 days. If we need more time, we may extend that once by another 45 days and will tell you why within the first 45 days. We will not deny you goods or services, or otherwise discriminate against you, for using these rights.

If we say no, you can appeal. Reply to our answer and say you want us to reconsider. We will review it and answer in writing within 45 days, with our reasons. If we still decline, we will give you the contact details for your state attorney general so you can submit a complaint. In Washington, that is atg.wa.gov/file-complaint.

What deletion means. When you delete your account or your consumer health data, it is removed from our live systems right away and we instruct our providers to do the same. Copies in our hosting provider's routine backups are overwritten as those backups expire, within 30 days. We keep nothing about your health beyond that, except limited records we must keep to meet legal obligations.

8. How we protect it

Your information is stored with Supabase using row-level security on every table, encryption in transit, encryption at rest by our hosting provider, encrypted storage of your sign-in session on your device, server-side authorization, and access limited to the people who need it. The Privacy Policy describes these measures in full. No system is perfectly secure, but we work to protect your information.

If a security incident exposes your health information, we will tell you without unreasonable delay and within the time the law requires, and we will notify the Federal Trade Commission, state regulators, and others where the law requires it.

9. Changes to this policy

We may update this policy as the app changes or the law changes. We will post the new version with a new effective date and, for material changes, tell you in the app before the change takes effect where we can. We will not collect new categories of consumer health data, or use or share it for a new purpose, without first telling you and getting your consent.

10. Contact

Fourth Day Labs LLC, 1315 Walnut St Ste 801, PMB 421, Philadelphia, PA 19107. Email: privacy@getlazarus.fit.