Consumer Health Data Privacy Policy

This policy covers consumer health data as defined by Washington’s My Health My Data Act, Nevada’s consumer health data law (SB 370) and Connecticut’s Data Privacy Act. We apply it to every member, wherever in the United States you live. It adds to our Privacy Policy, which covers everything else. Club 1000 Plus is run by Bechara Solutions, LLC (“we”).

In short: we collect health data only with your separate consent, use it to run the features you use, share it only when you choose, and never sell it or use it for advertising. You can see it, download it, delete it or withdraw your consent at any time.

1) The health data we collect

Body measurements: weight, waist, hips, neck and thigh measurements, body fat percentage (entered or estimated), and the dates of your check-ins.
Progress photos: check-in photos and photos you add to workout sessions.
Exercise: workouts, sets, weights, repetitions, cardio duration, distance and calories, WOD scores and session notes.
Nutrition: foods and drinks you log, calories, macronutrients and micronutrients, water, fasting times, your calorie and macro targets and weight goal.
Peptides and medications: compounds you enter, doses and schedules, doses taken or skipped, injection sites, vials and pens, and your notes.
Estimates about your body: BMR, expected calorie burn, trend weight, BMI and dose level estimates, calculated from what you enter.
Details used for those estimates: date of birth, gender and height, if you give them, and your fitness goals.
Coaching records: if you have a coach, the targets and routines they send you and the private notes they keep about you.

We do not collect precise location, and we do not collect health data from wearables, other apps or data brokers.

2) Where it comes from

From you, when you enter it; from our own calculations on what you enter; from your coach, if you have one; from ChatGPT, when you ask it to record something for you after connecting your account; and from Facebook, when you sign in with it and allow it to share your birthday and gender.

3) Why we collect and use it

To provide the features you use: your logs, charts, trends, estimates, targets, reminders and exports; to show what you choose to share to your coach, to other members or to ChatGPT; to keep the service secure and investigate abuse; and to meet legal obligations. We do not use health data for advertising, we do not sell it, and we do not build profiles of you for anyone else. Estimates are arithmetic on what you enter, not medical advice.

Your coach and the other coaches at their club, only the categories you tick when you accept their invite (workouts, nutrition with your BMR and body fat %, weight, body measurements, progress photos). Nothing is ticked until you tick it, and peptide logs are never shared with a coach.
Other members: a workout or check-in you choose to share to the feed, and — only if you choose to join the leaderboards — your lifting, cardio minutes, the number of days you logged food or weighed in (never what you ate or weighed) and your weight change on the boards. Leaderboards are opt-in; you can leave them at any time.
OpenAI, through ChatGPT, only if you connect your account and give the separate consent on the approval page, and only the areas you approve.
Our service providers, who process it for us under contract and for no other purpose: our hosting and database provider (Hostinger) and our email provider for account and reminder emails. Browser makers’ push services (such as Google, Apple, Mozilla and Microsoft) carry notifications you turn on in encrypted form and cannot read them.
Authorities, when the law requires it, or to protect someone’s safety.

We have no affiliates that receive health data. Stripe, our payment processor, receives no health data.

Creating an account asks for your consent to collect and use your health data, in its own box, separate from the Terms of Service and Privacy Policy. Members who joined before 21 October 2026 are asked once, the next time they use the app, and any sharing they had already set up with a coach or ChatGPT continues only if they tick it. Sharing with a coach, ChatGPT or the leaderboards needs its own consent, given where you choose it; members who were on the leaderboards before 21 October 2026 are asked once whether to stay on them.

Withdraw your consent at any time in My Profile → Account Management → Personal data → Data & account removal → Withdraw health-data consent, or by email. Withdrawing switches off coach sharing, disconnects ChatGPT, takes you off the leaderboards and stops us collecting anything more until you consent again. It does not delete what is already stored; you can do that as below.

6) Your rights

Know and access: confirm whether we hold your health data and get a copy. My Profile → Account Management → Personal data → Export downloads it.
Who we shared it with: ask us for the list of third parties and service providers that received your health data, with their contact details.
Delete: Delete My Data clears your health records and keeps your login; Delete Account removes everything. You can also ask by email. We tell the service providers and third parties that received it to delete it too. Backups roll over within 30 days.
Withdraw consent: as above.
Appeal: if we decline a request, reply to our answer with “Appeal”; a different person reviews it and answers within 45 days, explaining the outcome. If the appeal is denied, you can contact your state attorney general — in Washington, at atg.wa.gov/file-complaint.

Email requests to [email protected] from your account’s email address. We answer within 45 days, which may be extended once by another 45 days when reasonably necessary; we tell you if so. We verify that the request comes from you and never penalize you for making one.

7) Keeping it and protecting it

We keep health data while your account is active or until you delete it, as set out in the Privacy Policy. Access is limited to the people who run the service. The app and website use HTTPS; passwords are stored as one-way hashes. Encryption of the stored database and backups depends on our hosting provider, and we do not claim end-to-end encryption.

8) Changes and contact

If we change how we collect, use or share health data, we update this page and ask for your consent again before the change applies to you. Questions: [email protected], or Bechara Solutions, LLC, 17 Copley Drive, Methuen, MA 01844.