Legal

Privacy Policy

How we handle your data

Last updated: August 1, 2026

In plain English

We treat your health, biometric, and location data as sensitive and only collect it with your explicit opt-in consent. We never sell your personal data. You can access, correct, or delete your data, and withdraw consent, at any time. Governed by Canada's PIPEDA and applicable Ontario privacy law.

Your privacy at a glance

Never sold — We never sell your health data
Opt-in only — Sensitive data needs your consent
Delete anytime — Full control over your data

1. Introduction & Scope

This policy explains how Hangly Inc. ("HealthFlex") collects, uses, and protects your personal information, in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable Ontario law.

2. Information We Collect

Account data: name, email, age, login credentials.

SENSITIVE health data: self-reported conditions, fasting habits, supplement use, goals.

SENSITIVE biometric data from wearables: heart rate, HRV, sleep, recovery, steps, calories (Apple Watch, Garmin, Fitbit, Whoop, Oura).

SENSITIVE location data: precise location for outdoor workouts, where your route is recorded and saved to your account.

For Spot Me and coach check-in, your device location is used at full accuracy — including in the background for Spot Me — but only on your device, to confirm you are at your gym. That location is never stored or transmitted. What we save is your gym's identifier (the gym's own coordinate, rounded), whether you are present or away, and, for coach check-in, your distance from the gym in metres.

Payments are processed through the Apple App Store (for subscriptions), Stripe (card processing), and supported methods including Apple Pay, Google Pay, and Interac e-Transfer.

Community content and marketplace interactions with Certified Coaches.

3. How We Collect It

Directly from you, automatically through app use, and via connected wearable and music integrations you explicitly authorize.

4. Why We Collect It

To personalize your adaptive plans, enable features you request (Spot Me, Coach Directory, wearable insights), process payments, maintain safety, and improve the service.

5. Consent — Including Sensitive Data

We collect health, biometric, and precise-location data ONLY with your express, opt-in consent, requested at the point of collection. This includes using your location in the background for Spot Me, even where that location is only read on your device and never stored.

You may withdraw consent at any time in Settings; some features may become unavailable as a result.

6. How We Use Your Information

Including AI-driven personalization of your workout and wellness plans. We do not make automated decisions producing legal effects without a human-reviewable basis.

7. Disclosure to Third Parties

We share data only as needed with: Certified Coaches you book, payment processors, wearable APIs, Spotify (if connected), and cloud hosting providers.

We do NOT sell your personal information to anyone.

8. Cross-Border Data Transfers

Some service providers may process data outside Canada. Where they do, we remain accountable for its protection under PIPEDA.

9. Data Retention & Deletion

We retain data only as long as needed for the purposes described or as required by law. You may request deletion at any time via Settings or by contacting our Privacy Officer.

10. Security

We use encryption in transit and at rest, access controls, and other safeguards appropriate to the sensitivity of health and biometric data.

11. Your Rights Under PIPEDA

You have the right to access, correct, or delete your personal information, and to withdraw consent at any time.

Contact our Privacy Officer to exercise these rights: privacy@healthflex.app.

12. Children's Privacy

HealthFlex is intended for users 18 and older. We do not knowingly collect personal information from minors.

13. Cookies & Analytics

We use limited analytics to understand how the app is used and to improve it.

14. Wallet, Payment & Future KYC/AML Data

Phase 1 payment data is handled by our licensed payment processors.

Phase 2 cryptocurrency features (NOT YET ACTIVE) may require identity verification (KYC) and anti-money-laundering (AML) data and will be governed by a supplementary notice at that time.

15. Changes to This Policy

We may update this policy and will notify you of material changes in-app before they take effect.

16. Privacy Officer & Complaints

Privacy Officer: privacy@healthflex.app

You also have the right to lodge a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca.