HEROMINUTES is a wellness guidance app. For privacy questions, contact us at herominutes@gmail.com.
Separate, explicit consent for health data: health-related information (injury intake, pain logs, readiness, session history) is collected only after you give an explicit, stand-alone consent — a dedicated checkbox at sign-up, separate from your agreement to the Terms of Use. Accounts created before this consent existed are shown a one-time consent screen at sign-in and cannot proceed without responding. Each consent is recorded with a timestamp in our audit log. You can withdraw this consent at any time by deleting your account (Section 7), which permanently erases this data.
| Data | Why |
|---|---|
| Name, email address | Account creation and identification |
| Date of birth | Age verification (18+ requirement) |
| Password (hashed) | Authentication — never stored in plain text |
| Injury intake responses | AI program personalisation |
| Pain logs (zone, score, date) | Phase progression and safety tracking |
| Session history | Streak tracking and progress |
| Phase check-in results | Phase progression logic |
| Readiness scores | AI load adjustment |
| Consent timestamps | Legal audit trail of accepted agreements |
| Browser user agent (consent only) | Audit trail for liability |
| Payment information | Processed by Stripe — we never store card data |
| Usage events (screens viewed, features used) | First-party product analytics — improving the app; never shared or sold |
Our website has a sign-up page for the TestFlight beta at herominutes.com/join. It collects one thing: your email address — no name, no health data, no account. We use it solely to send your TestFlight invitation and occasional updates about the beta, and we notify ourselves of your request by email (via Resend, our email provider). The address is stored in our own database (Supabase) and is never shared, sold, or used for advertising. If you are not invited, the address is deleted within 6 months; you can also ask us to remove it at any time at herominutes@gmail.com. The page itself runs no scripts and no trackers.
HEROMINUTES uses Anthropic's Claude API to generate personalised training programs. When you generate a program, the following data is sent to Anthropic's servers for processing:
Your name is not sent to Anthropic — programs are generated against a generic label, not your identity.
Anthropic's data handling is governed by Anthropic's Privacy Policy. Data sent to Anthropic's API is not used to train their models under their standard API terms.
Want the full picture? How HEROMINUTES Uses AI explains the whole flow in plain language — every step from your intake to your program, what each stage does, where the app deliberately stops and sends you to a professional, and what AI cannot do.
When you play the spoken guidance for an exercise, the audio is generated by ElevenLabs. Only the generic description of how that movement is performed is sent — the identical text for every person doing that exercise — together with short shared phrases such as counted numbers and rest cues.
No personal data is sent to ElevenLabs. Not your name, not your identity, not your intake answers, not your pain logs, not your phase. Your own figures — your sets, your reps, your comfort ceiling — are assembled on your device from those shared phrases and never leave it.
Generated audio is stored on our own infrastructure and reused, so the same text is not sent again. ElevenLabs' practices are governed by ElevenLabs' Privacy Policy.
Your data is stored on Supabase (a PostgreSQL database hosted on AWS infrastructure). Data is encrypted at rest and in transit. Supabase's privacy practices are governed by Supabase's Privacy Policy.
Subscription payments are processed by Stripe. HEROMINUTES never receives or stores your credit card information. Stripe's data practices are governed by Stripe's Privacy Policy.
We do not sell, rent, or trade your personal data to third parties. The complete list of service providers that process data on our behalf is below — there are no others.
| Sub-processor | What it does | What it receives |
|---|---|---|
| Anthropic | Generates your programs and exercise guidance (Section 3) | Health & training data. No name, email or payment details. |
| ElevenLabs | Generates spoken exercise guidance (Section 3a) | Generic movement instructions only. No personal data at all. |
| Supabase | Database and authentication (Section 4) | All account and health data, encrypted at rest. |
| Vercel | Hosts the app and its servers | Data in transit, plus standard server logs including IP address. |
| Resend | Sends account emails (sign-in links, welcome) and notifies us of beta requests from /join (Section 2a) | Your email address. No health data. |
| Stripe | Payment processing (Section 5) | Payment details. No health data. |
| Apple | App distribution via TestFlight and the App Store | Standard install and crash data, per Apple's own terms. |
Each provider's practices are governed by its own policy: Anthropic · ElevenLabs · Supabase · Vercel · Resend · Stripe.
We may also disclose data to law enforcement if required by law or to protect someone's safety.
No advertising, no tracking: we collect basic first-party usage analytics (which screens and features are used) solely to improve the app — this data never leaves our own database. The app contains no third-party advertising SDKs, analytics trackers, or marketing pixels, and we enforce this technically with a strict Content-Security-Policy that blocks any unauthorized third-party script or tracking beacon from loading. Your health data is never used for advertising, marketing, or behavioral profiling.
Your account data is retained for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where we are required to retain it for legal or regulatory purposes (e.g., financial records for subscription payments).
Delete your account in the app: go to the Settings tab and tap Delete Account below Sign Out. You will be asked to confirm twice. This action cannot be undone.
What is permanently deleted: your name, email address, date of birth, password and account; your intake answers; your physio notes and any other free text you have written; your saved items and their notes; your feedback messages; your programs and exercise guides; and every record that identifies you. Your subscription is cancelled.
What is kept, and why: a narrow set of anonymous training data — which exercise was done, in which phase, whether it was rated too hard or about right, and discomfort scores by body zone — is retained so the app can keep improving for other people. This data carries no user identifier and no link to your account, is stored in separate tables with no connection back to you, and dates are reduced to the month. Once your account is deleted, neither you nor we can identify which rows were yours. Nothing you wrote in your own words is kept.
You can also request deletion by emailing herominutes@gmail.com.
Depending on your jurisdiction, you may have the following rights:
To exercise any of these rights, contact herominutes@gmail.com.
Canadian users (PIPEDA / BC PIPA): we collect, use, and disclose your personal information only with your consent and for the purposes described in this policy. You may withdraw consent at any time; because the App cannot provide its services without this data, withdrawing consent means closing your account — delete it in the App (Settings → Delete Account) or email us. If you are not satisfied with how we handle a privacy concern, you may complain to the Office of the Privacy Commissioner of Canada or, in British Columbia, the Office of the Information and Privacy Commissioner for BC.
If you do not agree with this policy, do not create an account; if you already have one, you may delete it at any time as described in Section 7.
We use industry-standard security measures including HTTPS encryption, Supabase Row Level Security (RLS), and hashed passwords. No system is 100% secure; use a strong, unique password and never share your credentials.
HEROMINUTES is restricted to users 18 years of age or older. We do not knowingly collect data from minors. If you believe a minor has created an account, contact us at herominutes@gmail.com.
We may update this Privacy Policy. We will notify you of material changes via email or in-app notice. Continued use after changes constitutes acceptance.
Related documents: How We Use AI · Terms of Use · Medical Disclaimer