HEROMINUTES is a wellness guidance app. For privacy questions, contact us through our contact form.
Separate, explicit consent for health data: health-related information (injury intake, pain logs, readiness, session history, water log, Feeling check-ins, saved scores and daily Apple Health values) is collected only after you give an explicit, stand-alone consent — a dedicated checkbox at sign-up, separate from your agreement to the Terms of Use. Accounts created before this consent existed are shown a one-time consent screen at sign-in and cannot proceed without responding. Each consent is recorded with a timestamp in our audit log. You can withdraw this consent at any time by deleting your account (Section 7), which permanently erases this data.
| Data | Why |
|---|---|
| Name, email address | Account creation and identification |
| Date of birth | Age verification (18+ requirement) |
| Password (hashed) | Authentication — never stored in plain text |
| Injury intake responses | AI program personalisation |
| Pain logs (zone, score, date) | Phase progression and safety tracking |
| Session history | Streak tracking and progress |
| Phase check-in results | Phase progression logic |
| Readiness scores | AI load adjustment |
| Body weight (optional) | Used only to scale the loads in your programme. You can remove it at any time from Profile. |
| Water you log in the app (the amount of each entry, the day and the time) and your daily water goal — only if you use the water log | Shown back to you as your daily total and history. You can take an amount back with − and change or clear the goal at any time. It is saved to your account, never sent to the AI, and is not read from or written to Apple Health. |
| Your Feeling check-ins (how you feel right now, or how you have felt overall today, on a scale from very unpleasant to very pleasant; up to five words you pick from a fixed list; and, if you choose, a discomfort level from 0 to 10 with the area from the Discomfort Map), with the day and the time you logged it — only if you use them | Shown back to you on Home and used on your iPhone to work out your feeling number. Nothing is typed in your own words. Saved to your account; your mood and the words you choose are never sent to the AI. You can delete your check-ins at any time in Settings (Section 3d). |
| Your scores by day and through the day (with the time each change happened): your feeling number and your overall number, and your Apple Health number only after you agree to “Save my scores to my account” (each a single number from 0 to 100 worked out on your iPhone, with how many of the five Apple Health signals made it) | So Home can show your past days and how a day changed. Never sent to the AI. You can stop saving the Apple Health number, or delete your saved scores, at any time in Settings (Section 3d). |
| Your daily Apple Health values — only after you agree to “Save my scores to my account”: one value a day for your steps, exercise minutes, resting heart rate, cardio fitness (VO2 Max) and heart rate variability, and for each night your minutes asleep and your minutes in each sleep stage (deep, REM, core and awake) | So Home and Progress can show your past days. Never the individual samples or their times, never a route or a location. Never sent to the AI, never sold and never used for advertising. You can stop saving them, or delete them, at any time in Settings (Section 3d). |
| Your location — only when you ask for help | When you hold the safety button on your Apple Watch, we take a single location reading and include it in the text we send to the safety contacts you chose. We do not track you, we do not record where you run, and we take no location at any other time. |
| Your safety contacts (name and mobile number) | Up to five people you choose. We use them for one thing: to text them if you use the safety check-in. Each one confirms by text before they can be alerted, you can remove them at any time, and they are never used for marketing or shared with anyone else. |
| Consent and safety-acknowledgement records (including the choice made on a high-pain warning, with the area and score) | Legal audit trail |
| Browser user agent (consent only) | Audit trail for liability |
| Payment information | None during TestFlight. When subscriptions launch, payment is handled by Apple through the App Store — we never receive or store card data |
| Contact form messages (the email you give, your message, and your name and topic if you choose — only if you use the website form) | Replying to you; passes through Formspree (Section 2b) |
| Usage events (screens viewed, features used, and how long the app waits for a programme) | First-party product analytics — improving the app; never shared or sold |
Our website has a sign-up page for the TestFlight beta at herominutes.com/join. It collects your email address, and your first and last name if you give them — no health data, no account. We use it solely to send your TestFlight invitation and occasional updates about the beta, and we notify ourselves of your request by email (via Resend, our email provider). Before we send an invitation we ask you to tick three boxes acknowledging the beta waiver; you then draw your signature with your finger or mouse; we store, next to your request, which version of the waiver you accepted, a fingerprint of its exact wording, the time you accepted, and your signature as a PNG image (kept in a private file store that only we can open); we also email you a receipt with your waiver reference, the waiver text and your signature, and keep a copy of that receipt with the record. For our own records only, we may match your request to an app account by email address to see whether you have joined. The address and this record are stored in our own database (Supabase) and are never shared, sold, or used for advertising. If you are not invited, the address is deleted within 6 months. We keep the signed waiver record — your name, email, the waiver version, the time and your signature — even if you ask to be removed or are never invited, because it is our record of what was agreed; it is used for nothing else. Asking to be removed deletes your request and we stop contacting you; you can also ask us to remove it at any time through our contact form. The page runs one small script of our own, only to let you draw your signature; it uses no third-party scripts and no trackers.
Our website has a contact form at herominutes.com/contact, and the app's Contact Support link opens it. It collects the email address you give, the message you write, and your name and the topic if you choose to give them — no account, and no health data is asked for (please don't include any). We use it only to reply to you. The form is run by Formspree, a United States company: it receives what you type and passes it to us by email, and may keep it on its own servers under its own policy. After you press Send, Formspree may first ask you to pass a quick “I’m not a robot” check (Google reCAPTCHA) on its own page; that check is run by Formspree and Google, and Google’s privacy policy and terms apply to it. The app itself sends nothing to Formspree — only the web form does, and only when you press Send. We keep your message for as long as it is needed to answer you; you can ask us to delete it through the same form.
HEROMINUTES uses Anthropic's Claude API to generate personalised training programs. When you generate a program, the following data is sent to Anthropic's servers for processing:
Your name is not sent to Anthropic — programs are generated against a generic label, not your identity.
Your water log and your water goal are not sent to Anthropic; they are used only to show you your own log. What you say to the mic never reaches Anthropic either (Section 3e).
Your Feeling check-ins — your mood and the words you choose — are not sent to Anthropic, and neither are your saved scores (the day-by-day and through-the-day records of your feeling number, your Apple Health number and your overall number). Your Apple Health number never reaches the AI in any form, and your saved daily Apple Health values and sleep stages are not sent to Anthropic either. Your morning check-in answers are still sent as readiness data, as listed above.
Anthropic's data handling is governed by Anthropic's Privacy Policy. Data sent to Anthropic's API is not used to train their models under their standard API terms.
Want the full picture? How HEROMINUTES Uses AI explains the whole flow in plain language — every step from your intake to your program, what each stage does, where the app deliberately stops and sends you to a professional, and what AI cannot do.
When you play the spoken guidance for an exercise, the audio is generated by ElevenLabs. Only the generic description of how that movement is performed is sent — the identical text for every person doing that exercise — together with short shared phrases such as counted numbers and rest cues.
No personal data is sent to ElevenLabs. Not your name, not your identity, not your intake answers, not your pain logs, not your phase. Your own figures — your sets, your reps, your comfort ceiling — are assembled on your device from those shared phrases and never leave it.
Generated audio is stored on our own infrastructure and reused, so the same text is not sent again. ElevenLabs' practices are governed by ElevenLabs' Privacy Policy.
Testers told us the spoken coaching was sometimes hard to follow. So when a new exercise guide is written, we run one automatic check over it, asking a single question: could someone with their eyes closed, in the middle of a set, follow these words exactly — and safely? That check is performed by DeepSeek.
What is sent for that check is the guidance itself:
What is never sent: your name, your email address, your date of birth, your biological sex, your body weight, your intake answers, your pain logs, your readiness scores, and your additional notes.
One thing we want to be exact about. The instruction text was written for you, so it can reflect your situation — for example, it may mention working around a particular joint. We do not send the answers you gave us, but we are not going to claim this is anonymous boilerplate either. It is training data, and we treat it as such: it goes without anything that identifies you, and it is a narrower slice than the program data in Section 3.
Where it is processed. DeepSeek is based in China, and data sent for this check is processed there. That is a different country from the rest of our providers, which is exactly why we have set out above the short list of what is sent and the longer list of what is not. Their practices are governed by DeepSeek's Privacy Policy. If you have concerns about this check, write to us through our contact form and we will talk it through with you.
The result of this check is never shown to you and never changes your program or what you hear. It comes to us, so we can find and fix guidance that is hard to follow.
We use a different provider here than for your programs, for one reason: this is a routine quality check that runs on every guide, and running it on a lower-cost provider is what keeps the app affordable. Anything that shapes your actual training — your program, and the safety screening that can stop a session and send you to a professional — stays with Anthropic's Claude, as described in Section 3.
The Apple Watch safety check-in works by text message, and the messages are sent by Twilio. Two kinds of message go out, and nothing else does.
The one-time confirmation. When you add a safety contact, we text that person once to ask whether they agree to be one. They receive your first name and the request; they can reply YES to agree, or STOP at any time. Until they reply YES they are never contacted again, and they cannot be included in a check-in.
The check-in itself. If you hold the safety button, each confirmed contact receives your first name, the time, and a map link for that single location reading. It also says plainly that this is a fitness app alert and not an emergency service.
Twilio therefore receives the mobile numbers of the people you chose and the text of those messages. It does not receive your intake answers, your pain logs, your training history, your email address or your payment details. Their practices are governed by Twilio's Privacy Policy.
About the people you add. A safety contact did not sign up with us — you gave us their number. So we ask their permission before we ever use it, we keep nothing about them beyond the name you gave them and that number, and deleting your account deletes them too.
Apple Health is off until you say yes. The app asks once, after a session you finish, and you can turn it on or off at any time in Settings. Apple shows its own permission screen, and what you allow there is what decides what the app may do; you can change it in the Health app, under your profile → Apps.
What the app writes. When you press Begin and then finish a session, the app saves it to Apple Health as a workout: the type of workout for your journey, when it started and how long it took — nothing else (not your journey’s name and nothing about how you felt). A session finished without Begin is not saved. Workouts already saved stay in Apple Health if you delete your account, and you can remove them there.
What the app reads. Only these, and only the ones you leave switched on in Settings: your steps, your sleep, your exercise minutes, your resting heart rate, your cardio fitness (VO2 Max), your heart rate variability, and the workouts other apps have recorded. They are shown to you on the Progress tab — today’s value, and your own last 30 days with your own average. Where a published reference exists (for example the adult sleep guideline or WHO’s activity guideline), the app shows where your number sits beside it; those reference figures are stored in the app with their sources, and your numbers are compared with them on your iPhone — never with other users of this app. The fixed tips shown there are written in advance; no AI writes them. They do not change your sessions.
What leaves your iPhone. The individual samples Apple Health holds — every reading as it was recorded, with its time — never leave your iPhone, and neither do your workouts from other apps. Unless you turn on the switch below, nothing the app reads from Apple Health is sent to us at all. Nothing read from Apple Health ever reaches Anthropic or the AI coach, it is never used for advertising, and opening a source link shares none of it. (Apple Health itself may keep your data in iCloud under Apple’s own settings; that is Apple’s, not ours.)
Your Apple Health number and daily values, only if you agree. On your iPhone the app turns those readings into one Apple Health number from 0 to 100, an estimate rather than a measurement, and an overall number (60% how you feel, 40% Apple Health). Only if you turn on Save my scores to my account are that number, how many of its five signals made it, and the overall made with it saved to your account, so Home can show your past days. With the same switch on, the app also saves one value a day for each Apple Health metric it shows you — your steps, your exercise minutes, your resting heart rate, your cardio fitness (VO2 Max, the latest estimate that day) and your heart rate variability — and, for each night, your minutes asleep and your sleep stages as minutes in each stage (deep, REM, core and awake), so Home and Progress can show your past days. Never the individual samples, never their times, never a workout route or a location, and nothing the app does not already show you. Without that switch, your feeling number and an overall equal to it are still saved, and nothing made from Apple Health is. Your choice is recorded with the time in our audit log. Whatever you choose, what is saved from Apple Health is never sold, never used for advertising or marketing, and never shared with Anthropic, any other AI, advertisers or anyone else; it is kept in our own database (Section 4) by the providers listed in Section 6, who store it for us and nothing else, and it is not stored in iCloud.
Changing your mind. Turn Save my scores to my account off in Settings at any time: from that moment no Apple Health number and no daily Apple Health value is saved. Turning it off does not remove numbers already saved; they stay on your account until you delete them. Delete my saved scores then removes the Apple Health part (the Apple Health number from every saved day, and every saved daily Apple Health value), or your Feeling check-ins, or all of your saved scores, daily Apple Health values and check-ins together. They are otherwise kept while your account is open and are erased with it (Section 7).
Water is not Apple Health. The app does not read water from Apple Health or write water to it. Your water log is kept by HEROMINUTES and saved to your account (Section 2), even where it is shown beside your Apple Health numbers.
On Today you can hold the mic and tell the app how you feel instead of tapping. The app asks for the microphone and for speech recognition the first time you hold it; if you say no, the mic goes away and tapping works as before. You can change either at any time in your iPhone’s Settings → Privacy & Security.
Your voice stays on your iPhone. The app listens only while the mic is on. Your iPhone’s own speech recognition turns what you say into text on the phone — the app only offers the mic where your iPhone can do this itself, so your voice is never sent to Apple’s servers, to us, to Anthropic or to any other service. The sound is never recorded or kept. The text is read on your iPhone by fixed word lists (no AI), and it is never saved.
What is saved is only what you confirm. The app shows you what it heard, and nothing is saved until you choose on that screen. What you choose is saved exactly as if you had tapped it: a discomfort entry (the area and a score from 0 to 10), a rest day, or a lighter session. If what you said includes one of the safety words or phrases the app watches for, it first shows its professional-review screen; your acknowledgement is recorded like any other (Section 2), with the warning the screen showed — which quotes the few words it heard (for example “can’t feel my hand”) — and never the rest of what you said. After you acknowledge it, the app shows you what it heard, and the same rule applies: only what you choose is saved.
Your data is stored on Supabase (a PostgreSQL database hosted on AWS infrastructure). Data is encrypted at rest and in transit. Supabase's privacy practices are governed by Supabase's Privacy Policy.
Nothing is charged while HEROMINUTES is in TestFlight. When subscriptions launch, they are purchased through Apple's in-app purchase system and the payment is processed by Apple. HEROMINUTES never receives or stores your credit card information. Apple's data practices are governed by Apple's Privacy Policy.
We do not sell, rent, or trade your personal data to third parties. The complete list of service providers that process data on our behalf is below — there are no others.
| Sub-processor | What it does | What it receives |
|---|---|---|
| Anthropic | Generates your programs and exercise guidance (Section 3) | Health & training data. No name, email or payment details. |
| ElevenLabs | Generates spoken exercise guidance (Section 3a) | Generic movement instructions only. No personal data at all. |
| DeepSeek (China) | Checks that spoken guidance is clear and safe to follow by ear (Section 3b) | The exercise, its prescribed sets and reps, and its instruction text. No name, email, intake answers or pain logs. |
| Twilio | Sends the safety check-in texts and the one-time confirmation to each contact (Section 3c) | The mobile numbers of the safety contacts you chose, and the text of those messages — which includes your first name and, for a check-in, one map link. No health data. |
| Supabase | Database and authentication (Section 4) | All account and health data, encrypted at rest. |
| Vercel | Hosts the app and its servers | Data in transit, plus standard server logs including IP address. |
| Resend | Sends account emails (sign-in links, welcome) and notifies us of beta requests from /join (Section 2a) | Your email address. No health data. |
| Formspree | Receives messages sent through the website contact form and passes them to us by email (Section 2b) | The email address, message, and name and topic if you give them. Nothing from the app. Its bot check on Formspree’s own page (Google reCAPTCHA) is run by Formspree and Google. |
| Apple | App distribution via TestFlight and the App Store, and payment processing once subscriptions launch (Section 5) | Standard install and crash data, per Apple's own terms. Payment details stay with Apple; HEROMINUTES does not receive them. |
Each provider's practices are governed by its own policy: Anthropic · ElevenLabs · DeepSeek · Supabase · Vercel · Resend · Twilio · Stripe · Formspree · Google (reCAPTCHA on Formspree’s page).
We may also disclose data to law enforcement if required by law or to protect someone's safety.
No advertising, no tracking: we collect basic first-party usage analytics (which screens and features are used, and how long they take to load) solely to improve the app — this data never leaves our own database. The app contains no third-party advertising SDKs, analytics trackers, or marketing pixels, and we enforce this with a Content-Security-Policy that declares which scripts may load, so an unauthorized third-party script or tracking beacon is refused. Your health data is never used for advertising, marketing, or behavioral profiling.
Your account data is retained for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where we are required to retain it for legal or regulatory purposes (e.g., financial records for subscription payments).
Delete your account in the app: go to the Settings tab and tap Delete Account below Sign Out. You will be asked to confirm twice. This action cannot be undone.
What is permanently deleted: your name, email address, date of birth, password and account; your intake answers; your additional notes and any other free text you have written; your saved items and their notes; your water log and water goal; your Feeling check-ins and saved scores; your saved daily Apple Health values and sleep stages; your feedback messages; your programs and exercise guides; and every record that identifies you. Your subscription is cancelled.
What is kept, and why: a narrow set of anonymous training data — which exercise was done, in which phase, whether it was rated too hard or about right, and discomfort scores by body zone — is retained so the app can keep improving for other people. This data carries no user identifier and no link to your account, is stored in separate tables with no connection back to you, and dates are reduced to the month. Once your account is deleted, neither you nor we can identify which rows were yours. Nothing you wrote in your own words is kept.
You can also request deletion through our contact form.
Depending on your jurisdiction, you may have the following rights:
To exercise any of these rights, use our contact form.
Canadian users (PIPEDA / BC PIPA): we collect, use, and disclose your personal information only with your consent and for the purposes described in this policy. You may withdraw consent at any time; because the App cannot provide its services without this data, withdrawing consent means closing your account — delete it in the App (Settings → Delete Account) or use our contact form. If you are not satisfied with how we handle a privacy concern, you may complain to the Office of the Privacy Commissioner of Canada or, in British Columbia, the Office of the Information and Privacy Commissioner for BC.
If you do not agree with this policy, do not create an account; if you already have one, you may delete it at any time as described in Section 7.
We use industry-standard security measures including HTTPS encryption, Supabase Row Level Security (RLS), and hashed passwords. No system is 100% secure; use a strong, unique password and never share your credentials.
HEROMINUTES is restricted to users 18 years of age or older. We do not knowingly collect data from minors. If you believe a minor has created an account, contact us through our contact form.
We may update this Privacy Policy. We will notify you of material changes via email or in-app notice. Continued use after changes constitutes acceptance.
Use our contact form.
Related documents: How We Use AI · Terms of Use · Medical Disclaimer