Privacy Policy

1. Who We Are

Hemingway Performance is a personal health and performance tracking platform operated by David Hemingway ("we", "us", "our"). The platform is accessible at hemingwayperformance.com and via the Hemingway Performance iOS app.

For privacy questions, contact us at: [email protected]

2. What Data We Collect

We collect only the data you choose to provide or sync. This may include:

• Account data — username, hashed password, account creation date
• Body composition — weight, body fat %, muscle mass, BMI, and related metrics from connected scales (Wyze, Withings)
• Training data — workout sessions, exercises, sets, reps, weight, RPE, and duration
• Blood work results — lab markers you upload via PDF (e.g. testosterone, IGF-1, lipids, CBC)
• Health protocols — hormone or peptide protocols you enter manually (e.g. dosing schedules)
• Apple HealthKit data — steps, resting heart rate, HRV, sleep, weight, and body fat % (iOS only, with your permission)
• Google Health data — steps, weight, sleep, and biometrics synced from connected devices (with your permission)
• DEXA scan results — if uploaded manually

We do not collect browsing history, location data, contacts, camera access, or any data unrelated to health and performance tracking.

3. How We Use Your Data

Your data is used solely to:

• Display your personal performance dashboard
• Generate AI-powered summaries of your blood work results (via Anthropic Claude API)
• Track training progress, PRs, and body composition trends over time
• Send protocol injection reminders and blood draw alerts (if you enable push notifications)
• Allow you to export or review your own data

We do not use your health data for advertising, profiling, or any purpose other than delivering the service to you.

4. AI-Powered Features

When you import blood work results, your uploaded lab report is sent to Anthropic's Claude API to extract and summarize the results. This data is processed under Anthropic's commercial API terms and is not used to train their models. Your lab report may contain identifying details (such as your name) as printed on the original document. We are working to minimize the identifying information sent for processing.

The AI-generated synopsis is a convenience summary only. It is not medical advice. Always consult a qualified healthcare provider regarding your blood work results.

5. Data Storage & Security

• All data is stored in Cloudflare D1 (SQLite database), hosted in the United States
• Passwords are stored as one-way cryptographic hashes — we never store plaintext passwords
• All data in transit is encrypted via HTTPS/TLS
• All data at rest is encrypted by Cloudflare's default encryption
• Session tokens expire automatically
• API keys and secrets are stored in Cloudflare Workers environment variables — never in code
• Per-user data isolation — all database queries are scoped to the authenticated user

6. Third-Party Services

We integrate with the following third-party services, each subject to their own privacy policies:

• Cloudflare — infrastructure, CDN, Workers, D1 database (cloudflare.com/privacypolicy)
• Anthropic — AI API for blood work summaries (anthropic.com/privacy)
• Apple HealthKit — health data sync on iOS (Apple Privacy Policy applies)
• Google Health — optional health data sync (policies.google.com/privacy)
• Wyze / Withings — optional scale integration (respective privacy policies apply)
• Resend — transactional email delivery (resend.com/privacy)

We do not sell, rent, or share your personal data with any third party for marketing or advertising purposes.

7. Apple HealthKit

On iOS, we request access to Apple HealthKit data including steps, resting heart rate, heart rate variability (HRV), sleep analysis, weight, and body fat percentage. This access is optional and requires your explicit permission.

• HealthKit data is used only to populate your personal dashboard
• HealthKit data is never shared with third parties or used for advertising
• HealthKit data is never sold
• You can revoke HealthKit access at any time via iOS Settings → Privacy → Health

8. Your Rights & Data Deletion

You have the right to:

• Access — view all data we hold about you (visible in your dashboard)
• Export — your workout and health data is visible and reviewable at any time
• Correct — update or correct any data you've entered
• Delete — permanently delete your account and all associated data

To delete your account and all data, go to Profile → Settings → Delete Account in the app, or email [email protected] and we will process the deletion within 30 days.

9. Medical Disclaimer

Hemingway Performance is a personal tracking tool, not a medical device. It is not intended to diagnose, treat, cure, or prevent any disease or medical condition.

Nothing in this app constitutes medical advice. Blood work summaries generated by AI are for informational purposes only. Always consult a qualified healthcare provider before making decisions about your health, medications, or treatment protocols.

Hemingway Performance is not a HIPAA-covered entity. If you require HIPAA-compliant health data management, this platform is not appropriate for that use.

10. Children's Privacy

Hemingway Performance is not directed at children under 18. We do not knowingly collect personal data from anyone under 18 years of age. If you believe a minor has provided us with personal data, please contact us and we will delete it promptly.

11. International Users & GDPR

Hemingway Performance is operated from the United States. If you access the platform from the European Union or other regions with data protection laws, please note:

• Your data is processed and stored in the United States
• You have the right to access, rectify, erase, and port your data
• You have the right to object to or restrict processing
• Our legal basis for processing is your consent and the performance of our service contract with you

To exercise any GDPR rights, contact [email protected].

12. Changes to This Policy

We may update this privacy policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Material changes will be communicated via the app or email. Continued use of the platform after changes constitutes acceptance of the updated policy.