Privacy Policy

OH Performance is operated by Xplorer Lab Corp (“OH Performance,” “we,” “us,” or “our”), located in Miami, Florida, United States. For questions, privacy requests, or complaints, email contact@xplorerlab.com.

This Policy applies to the OH Performance website, the iOS and Android mobile application, and related services (collectively, the “Services”). It also explains when specific features share data with providers, including OpenAI. The independent practices of Apple, Google, and other third parties are also governed by their own privacy notices.

3.1 Information you provide

• Account and identity: name, email address, phone number, date of birth or age range, profile photo, account identifiers, and credentials managed through the authentication provider.
• Onboarding and physical profile: sex or gender when requested, height, weight, activity level, experience, goals, availability, preferences, stated limitations, and assessment responses.
• Training and progress: programs, sessions, exercises, sets, repetitions, loads, duration, rest periods, personal records, completion, notes, progress photos, and metrics selected by the user.
• Food and nutrition: meals, foods, quantities, calories, macronutrients, water, dietary preferences, goals, and associated photos or notes.
• Artificial-intelligence features: messages sent to AI Coach, recent conversation history when memory is enabled, food photos you choose to analyze, and profile or training information needed to generate a personalized plan.
• Communications: messages, support requests, surveys, feedback, and files voluntarily submitted.
• Transactions: purchased plan, amount, currency, dates, payment status, and product and transaction identifiers provided by the app store. We do not receive or store your full card number or security code.

3.2 Information collected automatically

• Technical and usage data: IP address, device type, operating system, application version, language, time zone, technical identifiers, crash logs, performance, screens visited, features used, and access dates.
• Cookies and similar web technologies: session, preferences, security, measurement and, where applicable and with required consent, analytics or advertising.
• Approximate location derived from your IP address. We do not collect precise location unless a feature requires it, it is explained at the time, and you grant permission.

3.3 Apple Health, Health Connect, and device data

If you enable an integration, we may request granular access to categories needed for selected features, such as activity, steps, energy, workouts, weight, heart rate, sleep, or other compatible data. The specific types depend on the feature and permissions you grant. We may also write data you choose to synchronize to the connected service.

Access is optional. You may deny or revoke permissions in your device or connected-service settings. We request only categories reasonably necessary to provide the described features. We do not use data obtained through Apple Health or Health Connect for targeted advertising, sale to data brokers, credit decisions, or purposes incompatible with health and fitness. Health data belongs to the user; Apple and Google provide permission mechanisms but are not responsible for OH Performance.

• Create, authenticate, secure, and manage your account.
• Provide requested programs, general recommendations, tracking, synchronization, progress features, and personalization.
• Process subscriptions, confirm payments, maintain access, and manage cancellations, refunds, or disputes.
• Respond to inquiries, send operational notices, and provide support.
• Maintain security, prevent fraud, investigate abuse, and fix errors.
• Analyze performance and usage in aggregate or individually to improve the Services.
• Comply with legal, tax, and accounting obligations and valid government requests.
• Send marketing communications when consent or another applicable legal basis exists; you may unsubscribe at any time.

We do not use information to issue medical diagnoses or make automated decisions that produce legal or similarly significant effects. Fitness recommendations may be generated or adjusted automatically from the information provided, but you may stop using them and contact support.

Where law requires us to identify a legal basis, we process information to perform our contract with you, comply with legal obligations, pursue legitimate interests such as security and Service improvement, protect vital interests in exceptional circumstances, or with your consent. You may withdraw consent without affecting prior processing, although some features may no longer be available.

We may disclose information only as necessary to:

• Providers acting on our behalf, including Supabase for database, authentication, and storage, as well as hosting, email, support, analytics, monitoring, and security providers.
• Apple and Google when they process purchases or subscriptions through their respective app stores.
• Apple, Google, and connected services or devices when you enable an integration or request synchronization.
• Professional advisers, auditors, insurers, and prospective participants in a corporate transaction who are subject to confidentiality obligations.
• Authorities, courts, or third parties when necessary to comply with law, protect rights and safety, investigate fraud, or respond to valid legal process.
• Another person or entity when you expressly request or authorize it.

We do not sell personal information for money. We do not share health data obtained through Apple Health or Health Connect for advertising or with data brokers. If a future practice could be considered a “sale,” “sharing,” or targeted advertising under applicable law, we will update this Policy and provide required opt-out mechanisms before beginning.

OH Performance uses the OpenAI API, a third-party artificial-intelligence service, to generate personalized workout plans, analyze food photos, and answer AI Coach messages. Before transmitting personal information to OpenAI, the application displays a notice that identifies OpenAI, explains the purpose and the data that may be sent, and asks for your explicit permission. If you do not grant permission, we do not make the request to OpenAI.

Data sent for the feature you choose

• Workout generation: goals, age, sex or gender, height, weight, experience, availability, equipment, preferences, focus areas, and stated limitations or injuries.
• AI Coach: the message you enter; your first name when personalization is enabled; and up to eight recent messages when AI Coach memory is enabled.
• Food analysis: the photo you select or take and its file type, to identify food and estimate portions and nutrients.

OpenAI processes this data only to generate the requested result and to operate, secure, and prevent abuse of its service under its applicable terms. Our requests use store: false, so we do not ask OpenAI to retain the result as application state. OpenAI states that API content is not used to train its models unless the customer expressly opts in to share it; its abuse-monitoring logs may retain content and metadata for up to 30 days by default, unless a longer period is required or permitted by law or different retention controls are enabled.

You may withdraw permission at any time under Profile > Privacy & Security > Share AI Data with OpenAI. Withdrawal prevents future transmissions but does not affect processing already completed. You may separately disable personalization and AI Coach memory. We do not send data obtained directly from Apple Health or Health Connect to OpenAI unless a future feature specifically explains that use and requests the appropriate permission.

OH Performance may retain the generated plan, food-analysis result, and AI Coach conversations in your own account when memory is enabled. The retention periods and deletion choices in this Policy apply. We require providers that receive personal information to maintain the same or equivalent protection described here and required by applicable law.

Purchases and subscriptions made in the application are processed by the Apple App Store or Google Play under the applicable store's terms and privacy notices. OH Performance receives limited information, such as the purchased product, transaction identifiers, status, and dates, to confirm the purchase and administer access. We do not receive your complete card details. Do not send card numbers by email or through support.

We use essential technologies to sign you in, maintain security, remember preferences, and operate the website. We may also use analytics to understand usage, detect failures, and improve the product. Where required by law, nonessential technologies are activated only after consent. You may adjust the cookie banner, browser, operating system, or device preferences; blocking essential technologies may prevent features from working.

The application may use identifiers or diagnostics provided by the operating system. We will not enable cross-app tracking for advertising without permission required by the platform and law.

We retain information while your account is active and as long as needed to provide the Services, comply with legal obligations, resolve disputes, prevent fraud, and enforce agreements. Periods vary by category. For example, tax and transaction records may be retained for the legally required period, security records for a reasonable period, and account content until deleted or no longer needed.

Where appropriate, we delete, anonymize, or isolate information after the applicable period. Backups may persist temporarily until securely rotated. Deletion from OH Performance does not necessarily delete data already held in Apple Health, Health Connect, or another third-party service; you must manage that data through the relevant service.

We apply reasonable administrative, technical, and organizational measures, including access controls, encryption in transit, specialized providers, logging, and secure-development practices. No system is completely secure. You must protect your credentials, use a secure device, and notify us if you suspect unauthorized access.

If an incident requires notification, we will act under applicable law. OH Performance is not a health-care provider and does not represent that the Platform is subject to HIPAA in every circumstance.

Xplorer Lab Corp operates from the United States, and our providers may process information in the United States and other countries. Where required, we use legally recognized safeguards for international transfers. Laws in the receiving country may differ from those in your place of residence.

The Services are not directed to children under 13, and we do not knowingly collect their personal information. Users between 13 and 17 require consent and supervision from a parent or legal guardian. If we learn that we collected information from a child under 13 without valid authorization, we will take reasonable steps to delete it and close or restrict the account.

A parent or guardian may contact us to review, correct, or request deletion of information concerning a minor in their care. We may verify the requester's identity and authority.

Depending on your residence and applicable law, you may have the right to:

• Know about or access information we maintain about you.
• Correct inaccurate information.
• Request deletion of information or your account.
• Obtain a portable copy of certain information.
• Restrict or object to certain processing and withdraw consent.
• Opt out of a sale, sharing, or targeted advertising when that practice exists and the right applies.
• Appeal a denied request and lodge a complaint with a competent authority.
• Not receive discriminatory treatment for exercising privacy rights.

To exercise a right, email contact@xplorerlab.com with the subject “Privacy Request,” or use available account tools. We may verify your identity and, where appropriate, a representative's authority. We will respond within the applicable period and explain legal limitations. Laws do not always grant every right to every person, but we will assess each request in good faith.

You may request deletion through the option available in the application or by emailing contact@xplorerlab.com. Removing the application from your device does not automatically cancel a subscription or delete your account. Before closing your account, cancel future renewals under the Terms. We may retain minimum data when required for legal, accounting, security, fraud-prevention, or claims-defense purposes.

We may send transactional and service messages, such as confirmations, security and billing notices, and material changes, which are necessary to administer your account. You may unsubscribe from promotional messages through the unsubscribe link or by contacting us. Even after opting out of marketing, you may receive essential operational communications.

The Services may contain links or integrations directing you to external platforms. Review their policies before providing information. We do not control their independent practices. A link does not mean the third party is governed by this Policy.

We may update this Policy to reflect changes in features, providers, practices, or laws. We will publish the current version and its date. For material changes, we will provide reasonable notice by email, in the application, or on the website and request consent where required.

U.S. state and other national laws may grant additional rights. This Policy provides a general description and does not limit nonwaivable rights. Where an applicable rule requires specific notices, methods, or deadlines, we will handle the request under that rule. Xplorer Lab Corp does not represent that every known or referenced privacy law automatically applies to its business; applicability depends on factors including location, data volume, revenue, and activities.

Xplorer Lab Corp — OH Performance. Miami, Florida, United States. Privacy, support, and legal email: contact@xplorerlab.com.

If you are not satisfied with our response, you may request review by emailing the same address with the subject “Privacy Appeal” and, where permitted by law, lodge a complaint with the relevant data-protection or consumer authority.