Privacy Policy — Lazarus

Effective [Date pending]

This document is awaiting final legal review and may change before launch.

Lazarus is provided by Fourth Day Labs LLC, 1315 Walnut St Ste 801, PMB 421, Philadelphia, PA 19107 ("we", "us"). Questions about this policy or your information: privacy@getlazarus.fit. This policy works together with our Terms of Service and our Consumer Health Data Policy. All three are in the app under Settings → Privacy & terms.

At a glance

This summary is a shortcut. The numbered sections below are the full policy, and they control.

We collect only what the app needs to set a safe plan and keep it working: your account, your starting point, your daily check-ins, and your training log.
We never sell your information, never share it for advertising, and never give it to data brokers.
We do not collect mood, journaling, anxiety, or depression information, your location, contacts, photos, or microphone, or Apple Health or wearable data.
The app has no analytics, advertising, or crash-reporting service, and it does not track you across other companies' apps or websites.
We do not send your information to AI services, and we do not use it to train AI models. Your workouts are chosen by fixed rules that run on your device.
Your buddy sees only what you switch on. Your check-in answers and the sets you log are never shared.
You can delete your account and your information yourself, in the app, at any time.
If a security incident exposes your information, we will tell you (section 4).

1. Who Lazarus is for

Lazarus is a wellness and training app for adults returning to exercise after an injury, surgery, illness, pregnancy or postpartum, or a long break. It is not a medical device and does not provide medical advice, diagnosis, or treatment. It leaves clearance and return-to-sport decisions to qualified professionals. Lazarus is offered only in the United States.

You must be 18 or older to use Lazarus. When you create an account, you confirm this by ticking a box. We do not ask for your birth date, and we do not keep a record of the tick. We do not direct the app to children, and we do not knowingly collect personal information from anyone under 18. If you believe a minor has given us information, contact us and we will delete it.

2. What we collect

We collect only what the app needs to work. This is everything, grouped by what it is for. We get it from you (what you type and tap), from your device (settings you choose, and a push token if you turn on notifications), and from our subscription provider (your purchase status). We do not get information about you from data brokers or other companies.

Giving us this information is your choice. Without your intake and check-ins, though, we cannot tailor your plan or keep it safe for your situation.

Your account. Your email address and password (we never see or store your password in readable form) and, if you choose, a display name. We use these to create and secure your account. If you ask to reset your password, we email a one-time code to your address, and we email you again whenever your password changes, so you can tell us if it was not you.

Your starting point (intake). What you are coming back from (injury, surgery, pregnancy or postpartum, illness, or a long break); your training experience; how long you have been away; whether a doctor or therapist has cleared you to start; whether you are 60 or older (an age band, not your date of birth); whether you can do a few basic movements comfortably; and whether you have pain at rest or during everyday activities. Only if relevant: how many weeks it has been since you gave birth, or whether you still feel worn down from an illness. You can also add goals and a short note about anything you would like us to work around. Anything you type in that note is stored exactly as you write it, so please leave out details you would not want us to hold. We use these answers to set a safe starting level. You can change them later in the app (Settings → My starting point); your new answers replace the old ones, and your plan keeps only the rules each stretch of it followed.

Daily check-ins. Your energy, soreness, sleep, and stress (each rated 1 to 7) and a yes or no about sharp or joint pain. If you are coming back from postpartum, one more yes or no question about leaking, heaviness, or pressure. We use these to adjust that day's session and, together with the sessions you log, to decide whether your plan moves up, holds, or steps back. The sleep and stress ratings are lifestyle and recovery inputs, not a mental-health screening.

Safety screen. The first time you sign in, and again if its wording changes, the app shows a short "Before you start" safety screen. When you tap "I've read this", we store only the date and time you did. We use it to know whether to show the screen again.

Your training. Your program, the sessions you do and how long each was planned to take, the minutes of cardio you record, the sets you log, how hard each session felt, your training load, and your streak. Your daily workout and your place in the program are worked out on your device from your intake, your logged sessions, and your check-ins.

Planned breaks. If you take a planned break (Settings → Take a planned break), we store the day it starts and, if you choose a length, its last day. We never ask why, and no reason is stored. We use the dates so the weeks of your break do not count against your streak, so a break shorter than four weeks does not count against the comparison of your recent training with what came before, and to set where your plan picks up when you come back. Your daily reminder stays off during a break.

Buddy. A single-use invite code, the link between you and your buddy, what you choose to share (see section 6), and the preset encouragements you send and receive.

Your subscription. Apple handles payment. We and our subscription provider, RevenueCat, receive your account ID and the status of your purchase (for example, that you have Pro or are in a free trial). We never receive your payment card or Apple Account details.

Usage events. To learn whether the app is helping people keep training, we record five simple events about how you use it: that you finished setup, viewed your first session, submitted a check-in, logged a session, or viewed your streak. If you start a free trial or buy Lazarus Pro, we also record up to two events about your subscription, each once per account: that you started a free trial, and that you started a paid plan. Each event is only its name, the time, and your account ID. It never includes your check-in answers, pain or symptom answers, or any other health detail.

How you found us. The first time you use a new account, we ask whether we may record how you arrived, with a one-line choice of “OK” or “No thanks”. If you choose “No thanks”, we record nothing, we do not ask again, and the app works the same. If you close the question without choosing, we ask again the next time you open the app. If you choose “OK”, we record how you arrived: through a clinician's code or link, through a buddy's invite, or on your own. If you start on your own and then use a buddy's invite code within two weeks, we change that record to say a buddy invited you. If a clinician's code was used, we keep the code too. A clinician's code can suggest that you are working with that clinician, so we treat it as health-related information. We use it only in aggregate counts of how people find Lazarus. It is stored with your other information (see section 4), and we do not share it with anyone else or show it to your buddy.

Notifications. We never ask for notification permission when you first open the app. We ask after you pair with a buddy, or when you turn on a notification setting, and you can say no and keep using everything else. If you say yes to buddy notifications, we store a push token for your device (a code that lets Expo's and Apple's notification services reach it) next to your account ID. No other user, including your buddy, can see it, and we delete it when you sign out, when you turn buddy notifications off, and when you delete your account. We send only two kinds of notification: one when a buddy connection is accepted, and one when your buddy sends you encouragement. To send one, our server keeps a small record of the kind of event, your account ID, and when it happened, then passes your token and the fixed notification text to Expo's push service, which hands it to Apple. A notification never includes training or health detail, such as check-in answers, streaks, or session information. Separately, you can turn on a daily reminder in Settings. It is off unless you turn it on, it is scheduled on your device for the time you choose, nothing is sent from our servers for it, and its text carries no streak or health detail.

Technical data. Like any online service, our hosting provider receives your device's IP address and basic request information whenever the app connects, and keeps standard server logs for security and reliability. We do not use any analytics, advertising, or crash-reporting service.

Exercise videos. Exercise demonstration videos are provided by YouTube. Thumbnail pictures load from YouTube's image servers on screens that show exercises, and playing a video loads YouTube's privacy-enhanced player, so the app uses YouTube API Services. YouTube (Google) receives your IP address and basic device information as part of those requests and handles them under the Google Privacy Policy (policies.google.com/privacy). We do not send YouTube your account or any health information.

Kept only on your device. Your sign-in session (encrypted with a key held in your device's secure keychain); your equipment choices; cached copies of your display name and the exercise library; your notification choices, including your daily reminder time if you turn the reminder on, and a copy of this device's push token so we can delete exactly that token; a clinician's referral code or a buddy's invite code, if you arrive through a link, a QR code or the sign-up field, until it has been used (the app stops using one left unused for 30 days), your answer to that question, and a note that your arrival was recorded, with the channel it came through; and, if you check in while offline, a temporary copy of that check-in until it can be saved. The temporary check-in copy is removed from your device as soon as it saves. If you save a file from Settings → Your data (a copy of your information, your training log or your check-ins), the file is made on your device in a folder that is not backed up, and it is deleted once it has been handed to your device's share sheet; anything left behind is cleared the next time you make a file or open the app.

What we do not collect. We do not collect mood, journaling, anxiety, depression, or other mental-health information. We do not collect your location, contacts, photos, or microphone, or any advertising identifier. We do not collect Apple Health or wearable data. Notifications are optional (see Notifications above), and none of them carries training or health detail.

Health-related information. Some of what is listed above is health-related and treated as sensitive: pregnancy or postpartum status, injury, surgery, and illness history, pain, soreness, sleep and stress ratings, your age band, and a clinician's referral code if you use one. We use it to run your training plan; the one exception is the referral code, which we use only in aggregate counts. We never sell it, never use it for advertising, and never share it with data brokers. Our Consumer Health Data Policy describes this in more detail.

3. How we use your information

We use your information to create and secure your account; to build and adapt your plan to your starting point and daily check-in, and to move it up, hold it, or step it back as your logged sessions and check-ins show; to apply safety rules (for example, keeping sessions low-impact during the first 12 weeks postpartum); to track your progress and streak; to let you share with a buddy if you choose; to send the notifications you turn on; to manage your subscription; to count, in aggregate, how people find Lazarus and reach its main steps; to respond to your requests; and to keep the app secure and working.

We use your sensitive and health-related information only to provide the service you asked for. We do not use it for any other purpose, and we do not use it to infer other things about you.

Changes to your sessions and your place in the program are made automatically from your answers and history, by fixed rules we wrote. No AI model makes them. If you update your starting point, the same rules adjust your plan: anything that makes it gentler applies the same day, and anything that lets it build more waits for the next Monday and raises your level one step at a time. If you choose how your plan moves, "Stay here a while" applies the same day and Steady climb or "Mix it up" from the next Monday, with the same safety rules; if your Pro plan ends while you use "Mix it up", your plan moves by Steady climb again from the next Monday. They are not legal or similarly significant decisions about you.

We do not use your information for advertising or cross-app tracking, we do not sell it, and we do not share it for advertising.

Lazarus is not offered in the European Economic Area or the United Kingdom. Where the GDPR or UK GDPR nonetheless applies to you, our legal bases are: performing our contract with you (providing the app); your consent (for health-related information you choose to give us and for buddy sharing), which you can withdraw at any time by deleting the information, switching sharing off, or deleting your account (withdrawal does not undo what we did before); our legitimate interests (keeping the app secure and preventing misuse, and counting in aggregate how people find and use it, which we limit to the records described above); and legal obligations.

4. How your information is stored and protected

Your information is stored with Supabase (hosted database and sign-in) in the United States, in Amazon Web Services region us-east-2 (Ohio). Protections include:

Row-level security on every table, so you can read only your own information, and a buddy can read only the specific summaries you have chosen to share.
Encryption in transit, and encryption at rest by our hosting provider.
Your sign-in session is encrypted on your device with a key kept in the secure keychain.
Authorization checked on the server for every request. The app is never trusted to decide who may see what.
Access to your information is limited to the people who need it to run and support Lazarus, and they must keep it confidential.
Automated tests check these access rules each time we change the app.

No system is perfectly secure, but we work to protect your information with these measures.

If something goes wrong. If a security incident exposes your information, we will tell you without unreasonable delay and within the time the law requires. Our message will say what happened, what information was involved, what we are doing about it, and what you can do. We will also notify regulators where the law requires it.

We do not sell your personal information and we do not share it for cross-context behavioral advertising. We have not done either in the past 12 months. We share it only with:

Service providers that act on our behalf, and only what each needs: Supabase (hosting, database, and sign-in), RevenueCat (subscription management), Apple (app distribution and payments, and notification delivery if you turn notifications on), and Resend (our email service: it sends the sign-in code and the password-changed notice to the email address on your account, and receives that address and the text of the message), and Expo (our push-notification service, if you turn notifications on; it issues your device's push token and delivers the notifications, and receives only that token, the fixed notification text, and basic device and request information). YouTube serves exercise videos as described in section 2. Each service provider may use the information only to provide its service to us and under terms consistent with this policy.
Your buddy, limited to what you choose to share (section 6).
Anyone you choose to send a file from Settings → Your data to (a copy of your information, your training log or your check-ins). The file is made on your device and goes only where you send it; we do not receive a copy.
Others where the law requires it, or to protect rights, safety, and the security of the service. We ask for a valid legal process before we disclose any health-related information, we review each request and push back on one that is overbroad or improper, we disclose only what the request requires, and we tell you about it unless the law forbids us.
A successor, if Lazarus is part of a merger, acquisition, or sale of assets. We will tell you first, and any successor must honor this policy for information already collected.

We do not share your information with any affiliate or parent company.

You can connect with one buddy using a single-use invite code that is valid for 7 days. Nothing is shared by default. You decide, with a separate switch for each, whether your buddy can see:

Your streak: your current streak, your longest streak, and the date of your last session.
Your completed sessions: how many you have finished and on which dates.
Your training plan: whether you have one.

Your buddy's screen shows your streak count, how many sessions you have completed and when, and whether you have a plan. Your daily check-ins, your pain and symptom answers, and the sets and reps you logged are never shared, and there is no switch for them. Neither are your planned breaks. Encouragement is preset messages only; there is no free-text chat. If your buddy has notifications on, they get a short notification when you accept a connection or send them encouragement. It says only that one of those things happened.

You can change a switch or remove your buddy at any time, and removing stops their access immediately. If you connect with the same person again later, you each start with nothing shared. We cannot control what your buddy does with what they see, so share with someone you trust.

7. Keeping and deleting your information

We keep each kind of information only as long as it is needed for the purpose we collected it for:

Your account, intake, check-ins, training records (including the dates of any planned break), buddy links, usage events, how-you-found-us record, and when you acknowledged the safety screen: while your account is active. We do not delete an active account on our own.
Your push token: until you sign out, turn buddy notifications off, or delete your account, whichever comes first.
A check-in you make offline: on your device only, until it saves, and then removed. Any that have not saved when you sign out or delete your account are removed from your device then.
A file you make in Settings → Your data: on your device only, until it is handed to the share sheet, and then deleted.
Server logs kept by our hosting provider: a limited period set by that provider, for security and reliability only.
Purchase and delivery records held by Apple, RevenueCat, and Expo, and email delivery records held by Resend: as the law and their own policies require.

You can delete your account and information yourself in the app: Settings → Delete account and data. This removes your account and the information described in this policy from our live systems right away. Copies in our hosting provider's routine backups are overwritten as those backups expire, within 30 days. We keep nothing about your health after that, except limited records we must keep to meet legal obligations. Apple, RevenueCat, Expo, and Resend may keep purchase or delivery records as the law or their own policies require.

8. Your rights and choices

In the app you can change your display name and equipment, correct or update your starting-point answers (Settings → My starting point), manage buddy sharing, turn notifications and the daily reminder on or off, manage or restore your subscription, and delete your account and information. You can download a copy of your information yourself in Settings → Your data: everything we hold about you as one file (Download all my data), your training log as a spreadsheet (CSV) or a PDF, and your check-ins as a spreadsheet. The copy leaves out only the usage events described in section 2, the record of how you found Lazarus, two server work queues, and your device's push token; to get a copy of those, to correct anything else, or to ask any privacy question, contact privacy@getlazarus.fit. We will check that the request is yours, and we will answer within 45 days. If we need more time, we may extend that once by another 45 days and will tell you why. We apply the rights below to everyone who uses Lazarus, wherever they live, and we will not treat you worse for using them.

Access, correction, deletion, and a copy. You can ask what we hold about you, ask us to fix it, ask us to delete it, and ask for a copy you can take with you.
If we say no. Reply to our answer to ask us to reconsider. We will review it and answer in writing within 45 days with our reasons, and we will tell you how to contact your state attorney general.
Someone acting for you. You can ask an authorized agent to make a request for you. We will ask for proof that you gave them permission.
States with consumer-health-data laws, such as Washington: see our Consumer Health Data Policy.
California (CCPA/CPRA): you can know, access, correct, and delete your personal information; opt out of its sale or sharing (we do neither); and limit the use of sensitive personal information (we already use it only to provide the service). We do not disclose personal information to third parties for their direct marketing (Cal. Civ. Code 1798.83).
Nevada: you can opt out of the sale of covered information. We do not sell it.
If you are in the European Economic Area or the United Kingdom (Lazarus is not offered there, but we give you the same rights): you can access, correct, erase, restrict, or port your data, object to its processing, withdraw consent, and complain to your supervisory authority (in the United Kingdom, the Information Commissioner's Office). We answer within one month, extendable where the law allows. You are not required by law or contract to give us your information, but without it we cannot tailor your plan or keep it safe for your situation.

9. International users

We operate from the United States, and Lazarus is offered only in the United States. Your information is stored and processed in the United States and wherever our service providers operate. If you use the app from outside the United States, for example while travelling, you understand your information is transferred there. Where required, we rely on the Standard Contractual Clauses in our providers' data-processing terms, and you can ask us at privacy@getlazarus.fit how to get a copy of the relevant safeguards.

10. Tracking, advertising, and AI

The app does not track you across other companies' apps or websites, shows no advertising, and does not use an advertising identifier. Because there is no tracking, there is nothing to switch off, and the app does not respond to a Do Not Track signal.

We do not send your personal information to any AI service, and we do not use it to train AI models. The rules that choose your workouts are fixed, were written by us, and run on your device.

11. App Store privacy details

The "App Privacy" information on our App Store page is based on this policy. Health and fitness information collected in the app is not used for advertising or tracking and is not sold.

12. Changes to this policy

We may update this policy as the app changes or the law changes. We will post the new version with a new effective date and, for material changes, tell you in the app before the change takes effect where we can. We will not collect new kinds of information, or use or share your information for a new purpose, without telling you first and asking for your consent where the law requires it. Earlier versions are available on request.

13. Contact

Fourth Day Labs LLC, 1315 Walnut St Ste 801, PMB 421, Philadelphia, PA 19107. Email: privacy@getlazarus.fit.