Privacy Policy for Bright Workout

Last updated: July 22, 2026

This Privacy Policy explains how Bright Workout, provided by Costas Nanga AB (org. no. 559334-0242) ("we," "our," or "us"), collects, uses, discloses, and protects personal data when you use the Bright Workout mobile app, website, and related services (the "Service"). The Service is available on iOS and Android.

Bright Workout is a fitness, nutrition, sleep, medication-support, and wellness app. Some information we process may be sensitive, including health, fitness, body, nutrition, mood, medication-support, and wellness information. Please read this policy carefully.

1. Information We Collect

Account and Registration Information

When you create or manage an account, we may collect:

• email address;
• authentication identifiers from Supabase Auth, Apple Sign In, or Google Sign-In;
• name, profile photo, avatar, and optional profile details;
• password reset and account security information.

Profile, Fitness, Nutrition, and Wellness Information

Depending on what you enter or choose to track, we may collect:

• age or birth date, sex, height, weight, goal weight, body measurements, body-fat estimates, and preferred units;
• fitness goals, activity level, workout history, custom exercises, strength logs, cardio logs, rest timers, calories burned, and workout notes;
• food logs, calorie and macro targets, barcode results, portion estimates, water intake, diet preferences, allergy notes, and nutrition history;
• medication-support settings and logs, such as GLP-1 or other medication-support status, medication family or medication name if you choose to enter it, reminder settings, appetite check-ins, symptom check-ins, hydration or protein difficulty, support notes, and related summaries;
• sleep goals, sleep logs, meditation activity, guided audio activity, sleep sound preferences, breathing or relaxation activity, mood check-ins, journaling entries, focus items, and wellness goals;
• reminder and notification preferences.

Health App and Device Integration Data

With your permission, Bright Workout may read data from Apple Health, HealthKit, Android Health Connect, Google Fit through Health Connect, or other compatible health sources. Depending on the permissions you approve, this may include:

• steps, distance, active minutes, workouts, exercise sessions, and active calories burned;
• sleep data;
• heart rate, resting heart rate, heart-rate variability, and VO2 max;
• related timestamps, trends, and summaries.

Bright Workout reads this data to power its features and does not write data back to a connected health platform. You can revoke health permissions at any time in your device settings.

Camera, Photos, Microphone, and Speech Data

If you grant permission, we may process:

• camera images you choose to capture for meal analysis and camera input used to scan food barcodes;
• selected photos you choose for meal analysis or your profile image;
• microphone or speech input used to transcribe a spoken food description for meal logging.

Camera, photo, microphone, and speech permissions are used only for the features you choose to use. Some speech recognition may be handled by your device operating system or platform speech services.

App, Device, Analytics, and Diagnostics Data

We may collect technical and usage information such as:

• app version, device model, operating system, platform, language, and general app configuration;
• app interactions, feature usage, screen events, and performance events;
• crash reports, diagnostic logs, and error information;
• approximate technical metadata such as IP address or network request metadata when needed to operate cloud services.

If you explicitly enable optional usage analytics, we use PostHog to understand how the app is used and improve the Service. These events use a random analytics identifier and are not linked to your Bright account ID, name, or email. The events describe app interactions and feature-usage counts rather than the content you log. They may include:

• app opens, sign-up and sign-in (including which sign-in method was used, such as email, Apple, or Google), and onboarding progress and completion;
• paywall interactions, such as a paywall being viewed, dismissed, or a purchase or restore being tapped, and the plan and screen involved;
• trial lifecycle events, such as a trial starting, a trial reminder being shown, or a trial converting or lapsing, and a free feature-gate teaser being viewed;
• feature-usage events, such as food being logged (including the logging method, such as barcode, voice, search, or manual entry), a saved meal being logged or updated, the AI food scan being used, water being logged, and strength workouts or cardio being completed.

Paywall, purchase, and trial lifecycle event names constitute subscription or purchase-history analytics, even though Bright sends no account identifier, product, price, transaction, trial date, or other custom property with them. Feature-usage events record that an action happened and its non-sensitive category only. We do not send food names, calories, body or health measurements, medication-support usage or details, journal content, photos, audio, or other health data to PostHog. You can turn analytics on or off at any time in Settings. Events are not sent without consent and are not backfilled after a later opt-in. We do not use Apple Health or Health Connect data for advertising or analytics.

We use Sentry for production crash diagnostics. Crash reports are configured to exclude account and request data, user-entered content, exception messages, application state, navigation and console breadcrumbs, and performance traces. Reports retain technical crash locations, release information, and limited platform metadata needed to diagnose failures.

Purchase Information

If we offer paid features, subscriptions, trials, or in-app purchases, purchases may be processed by Apple App Store, Google Play, RevenueCat, or another payment provider. We may receive purchase status, product identifiers, entitlement status, renewal status, transaction identifiers, and related subscription metadata. To associate a purchase and its entitlements with your account, we share a Bright account identifier with RevenueCat and the relevant app store. We do not receive your full payment card details from app-store purchases.

Information from Support and Communications

If you contact us, we may collect your email address, message content, attachments, and any information needed to respond to your request.

If you submit a demo request on our website, we collect the name, email address, company name, and message you provide. We use Resend as our email delivery provider to send the request to Bright Workout. Resend processes this information on our behalf for email delivery and security.

2. How We Use Your Information

We use personal data to:

• create, authenticate, secure, and manage your account;
• provide fitness, nutrition, sleep, medication-support, wellness, meditation, journaling, and tracking features;
• store and display your logs, goals, trends, summaries, and progress;
• calculate calorie targets, macros, body metrics, hydration goals, readiness-style indicators, sleep scores, health direction metrics, medication-support summaries, and related insights;
• provide medication-support reminders, check-ins, nutrition and hydration support, and progress summaries;
• process food images, barcode scans, manual food estimates, workout generation, and other AI-powered features;
• connect with Apple Health, HealthKit, Android Health Connect, Google Fit through Health Connect, and other third-party integrations you authorize;
• send reminders, notifications, account messages, support replies, and service updates;
• analyze app usage, debug issues, improve reliability, and develop new features;
• detect, prevent, and respond to fraud, abuse, security incidents, and policy violations;
• comply with legal obligations and enforce our Terms of Service.

3. AI Processing

Some Bright Workout features use AI or automated systems to analyze food images, estimate nutrition, generate workout programs, or provide coaching-style suggestions.

When you use these features, we may send the relevant input, such as a food image, food description, workout preferences, or custom instructions, to our backend and AI service providers for processing. Our production AI provider is Microsoft Azure OpenAI Service, configured for processing within the European Union under Microsoft's data processing terms. Our AI provider does not use your inputs to train its models. AI outputs may be stored with your account if you save them as logs, workouts, or other app content.

Food images you submit for meal analysis are sent to our backend and AI provider only to produce the analysis for that request. Bright does not store these food images on our servers or in our cloud storage after the analysis is returned; they are processed transiently and then discarded. Profile images you choose are stored in our cloud storage so they can be displayed in the app, and are deleted when you delete your account or change the image.

Personalized AI coach insight is separate, optional, and off by default. If you explicitly enable it, Bright may send minimized weekly activity, sleep, nutrition, and training totals, today's calorie and macro totals and targets, your latest VO2 max value, your selected goal, medication-support status, local hour, and muted coaching categories to an AI provider. We do not include your name, email, account identifier, exact weight, date of birth, individual food or workout entries, workout or exercise names, notes, journal content, or raw health records in that request. Bright continues to provide deterministic on-device coaching when this option is off or when a reviewed cloud provider is unavailable.

Do not submit information to AI features that you do not want processed for that feature. AI outputs are estimates and should not be treated as medical, nutritional, or professional advice.

4. Supabase and Other Service Providers

We use Supabase for backend services, authentication, database storage, file storage, and edge functions. Supabase processes personal data on our behalf to help operate the Service. Some medication-support settings, check-ins, reminders, and summaries may be stored in Supabase and may also be cached locally on your device so the feature can remain available in the app.

We may also use service providers for analytics, diagnostics, cloud infrastructure, AI processing, authentication, app-store purchases, notifications, email, and support. These include, among others, Microsoft Azure OpenAI Service for AI processing, PostHog for optional usage analytics, Sentry for crash diagnostics, Apple, Google, and RevenueCat for authentication and purchase and subscription management, Supabase for backend and storage, and Resend for delivery of website contact and demo requests. These providers may process personal data only as needed to provide services to us, comply with law, or protect their systems.

Personal data may be processed and stored in the United States, the European Economic Area, or other regions where we or our providers operate. Where required, we use appropriate transfer safeguards, such as standard contractual clauses or equivalent protections.

5. Food and Nutrition Data Sources

Bright Workout may use food and nutrition data from third-party sources such as USDA FoodData Central, Open Food Facts, branded food databases, barcode databases, and user-provided entries. These sources may be incomplete, inaccurate, or user-contributed. You should verify nutrition and allergen information independently.

6. How We Share Information

We do not sell your personal information.

We may share information:

• with service providers that help us operate, secure, analyze, and improve the Service;
• with Apple Health, HealthKit, Health Connect, Google Fit through Health Connect, or similar integrations when you authorize data sharing;
• with app stores, payment processors, or subscription providers to process purchases and manage entitlements;
• with AI providers when you use AI-powered features;
• with analytics providers for the limited, optional app-usage events described above;
• with legal, safety, or security parties when required by law, to protect rights and safety, or to investigate abuse;
• in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to appropriate protections;
• with your consent or at your direction.

We may share aggregated or de-identified information that cannot reasonably identify you.

7. Health Data Protections

Health, fitness, nutrition, and medication-support data is used to provide user-facing Bright Workout features, such as activity tracking, sleep tracking, workout summaries, trends, medication-support check-ins, reminders, and wellness insights.

We do not use Apple Health, Health Connect, or medication-support data for advertising, sell it to data brokers, or use it to determine credit, insurance, employment, medication eligibility, pharmacy access, or similar eligibility decisions.

Medication-support features are for personal tracking and habit support only. Bright Workout does not use this data to recommend whether you should use GLP-1 medications or any other medication, select a medication, set a dose, change titration, choose a pharmacy, or choose compounded products.

You control health-data access through Apple Health, HealthKit, Health Connect, Google Fit, and device permission settings. If you revoke access, Bright Workout may stop receiving new health data, but previously stored data may remain in your Bright Workout account until deleted under this policy.

8. Legal Bases for Processing

If you are in a region where legal bases are required, we process personal data based on one or more of the following:

• your consent, such as when you grant health, camera, microphone, photo, notification, or analytics permissions;
• performance of a contract, such as providing the Service and managing your account;
• legitimate interests, such as improving, securing, and debugging the Service;
• legal obligations, such as complying with applicable law or valid legal requests.

Where required by law, including for special categories of personal data such as health or medication-support information, we rely on your explicit consent or another applicable legal basis and condition for processing.

You may withdraw consent where processing is based on consent, but this will not affect processing that occurred before withdrawal.

9. Data Retention and Deletion

We retain personal data for as long as your Bright Workout account exists or as long as needed to provide the Service, comply with law, resolve disputes, enforce agreements, protect security, maintain backups, or support legitimate business operations.

You can delete your account in the app settings. Account deletion is intended to permanently delete your account and associated app data, subject to limited retention where required or permitted by law, security, fraud prevention, dispute resolution, backups, or legitimate business operations.

You may also contact us to request deletion. Temporary app caches, local device data, health sync metadata, and diagnostic logs may be deleted periodically or after inactivity. You may need to delete local app data from your device or revoke health permissions separately through your device settings.

10. Your Rights and Choices

Depending on where you live, you may have rights to:

• access personal data we hold about you;
• correct inaccurate or incomplete personal data;
• delete personal data;
• export or receive a copy of personal data;
• object to or restrict certain processing;
• withdraw consent for certain processing;
• opt out of certain analytics or communications;
• appeal a decision if we deny a privacy request, where required by law.

You can control many choices directly in the app or your device settings, including:

• health data permissions;
• camera, microphone, speech recognition, photo, and notification permissions;
• notification preferences;
• optional usage analytics;
• account deletion;
• optional profile and tracking inputs.

To exercise privacy rights or request analytics opt-out support, contact us at info@brightworkout.com.

11. Security

We use technical and organizational safeguards designed to protect personal data, including authentication, access controls, encrypted transport, service-provider security controls, and database-level authorization where appropriate.

No method of transmission or storage is completely secure. You are responsible for keeping your login credentials secure and for using a secure device.

12. Children's Privacy

Bright Workout is intended for users aged 16 and older. We do not knowingly collect personal data from children under 16. If you believe a child under 16 has registered or provided personal data without appropriate consent, contact us at info@brightworkout.com and we will take appropriate steps to delete the data.

13. Third-Party Links and Services

The Service may link to or integrate with third-party services, including app stores, health platforms, authentication providers, food databases, AI providers, and external websites. Third-party services have their own privacy policies and practices. We are not responsible for their privacy practices.

14. Updates to This Policy

We may update this Privacy Policy from time to time. If changes are material, we will take reasonable steps to notify you, such as through the app, website, app-store release notes, email, or other appropriate means.

Your continued use of the Service after an updated Privacy Policy becomes effective means you acknowledge the updated policy.

15. Contact Us

The data controller for personal data processed through the Service is:

Costas Nanga AB (org. no. 559334-0242)

c/o Crister Kaiser AB, Box 55640, 102 14 Stockholm, Sweden

If you have questions or concerns about this Privacy Policy or your data, contact us at:

info@brightworkout.com