Quixit Consumer Health Data Privacy Policy

This Consumer Health Data Privacy Policy (this “Policy”) explains how Quixit, LLC (“we,” “us,” or “our”) collects, uses, shares, and protects consumer health data through the Quixit mobile application and our website, quixitapp.com (together, the “Services”). This Policy is provided as a standalone notice to comply with applicable consumer health data privacy laws.

This Policy supplements, and should be read together with, our general Privacy Policy available at https://quixitapp.com/privacy. To the extent there is any conflict between this Policy and our general Privacy Policy regarding consumer health data, this Policy controls.

1. Scope and Applicability

This Policy applies to “consumer health data,” which means personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status, including data derived or inferred from other information.

In the context of Quixit, consumer health data includes, for example, ride and workout metrics; heart rate, power, cadence, and other fitness measurements; height and weight; data from Apple Health (once available), wearables, sensors, and connected training apps; precise location data tied to rides and routes; and health-related inferences.

This Policy applies to users of the Services who reside in any state with applicable consumer health data privacy laws.

2. Categories of Consumer Health Data We Collect

We may collect the following categories of consumer health data. The table below also describes, for each category, the purposes for which the data may be collected and how it may be used:

Sources of Consumer Health Data

We may collect consumer health data from the following categories of sources:

• Directly from you, such as workouts you enter and information you provide in Settings.
• Through your use of the Services, including rides and workouts recorded in the app, GPS tracks and ride routes recorded during rides (including background recording if you permit it), route requests, and start points for route generation.
• From sensors and bike computers during recorded rides.
• From Apple Health, if you enable the connection, limited to the data types you authorize on the iOS permission screen.
• From connected training apps and services you choose to link, such as Intervals.icu, TrainingPeaks, TrainerRoad, Wahoo, Garmin, and calendar feeds.
• From our own derivations or computations based on your ride and workout data, such as FTP and training load metrics.
• From AI service providers that process your route notes and coach workout text for route generation and other AI-assisted features, only if you opt in.

3. Purposes for Collection, Use, and Sharing of Consumer Health Data

In addition to the category-specific purposes described in Section 2, we collect, use, and share consumer health data for the following purposes:

• To maintain the security and integrity of the Services.
• To respond to your support requests.
• To comply with legal obligations.

We do not sell consumer health data, share it with data brokers or advertisers, or use it for targeted advertising.

4. Categories of Third Parties With Whom Consumer Health Data Is Shared

We share consumer health data only for the purposes described in Sections 2 and 3 and this Section 4, including as necessary to provide the Services you request.

Categories of Consumer Health Data Shared

We may share the following categories of the consumer health data described in Section 2:

• Consumer health data stored or processed as part of your account.
• Workouts, routes, and other data necessary for connections you establish with connected training apps and services you choose to link, including calendar feeds.
• Health and ride data exchanged with platform health services (e.g., Apple Health, once the connection is available), only as you authorize.
• Limited workout and route information needed for AI-assisted features, only if you opt in. AI service providers do not receive your name, email address, or account identifiers.

Categories of Third Parties and Affiliates

We may share consumer health data with the following categories of third parties:

• Cloud hosting, storage, and processing providers that host, store, and operate the Services on our behalf, including for sync and exports.
• AI service providers, only if you opt in to AI-assisted features, under terms and/or settings that restrict their use of the data.
• Connected training apps and services you choose to link, including calendar feeds, which receive the data the connection requires and handle that data under their own privacy policies.
• Device and platform providers (e.g., Apple), to provide platform integration features you enable.

We do not currently share consumer health data with any affiliates.

Contractual Protections and Cross-Site Tracking

Our processors and service providers process consumer health data under terms that limit processing to our instructions and require confidentiality and appropriate security measures. We do not permit third parties to collect consumer health data over time or across different websites or online services through our Services.

Sharing in Response to Legal Requests and Business Changes

We may disclose consumer health data when required by law or legal process, or when reasonably necessary to protect Quixit, its users, or others from fraud, security threats, or unlawful activity. If Quixit is involved in a merger, acquisition, financing, reorganization, or sale of all or part of the business, consumer health data may transfer as part of that transaction, subject to this Policy and applicable law.

5. Consent and Authorization

We obtain your consent before collecting or sharing your consumer health data as required by applicable law. You may withdraw your consent at any time through the privacy and data settings in the app or your device, by deleting your account, or by contacting us at support@quixitapp.com. Withdrawal of consent does not affect processing performed before the withdrawal.

6. Your Consumer Health Data Rights

If you are a resident of Washington, Nevada, or another state with applicable consumer health data rights, you have the following rights with respect to your consumer health data:

• Right to Confirm: You have the right to confirm whether we are collecting, sharing, or selling your consumer health data.
• Right to Access: You have the right to access the consumer health data we have collected about you, including by viewing and exporting your data in the app.
• Right to a List of Third Parties: You have the right to receive a list of all third parties and affiliates with whom we have shared, or to whom we have sold, your consumer health data, including an active email address or other online mechanism you may use to contact those third parties.
• Right to Withdraw Consent: You have the right to withdraw your consent to the collection or sharing of your consumer health data, as described in Section 5.
• Right to Deletion: You have the right to request deletion of your consumer health data, including through the app settings, by deleting your account, or by contacting us. When we receive a valid deletion request, we will notify affiliates, processors, contractors, and third parties with whom we have shared your consumer health data to delete that data, as required by applicable law. Data held in backup systems will be deleted within the time periods permitted by applicable law. We may retain information that has been de-identified so that it is no longer linked to you.
• Right to Cease Collection, Sharing, or Sale: You have the right to direct us to cease collecting, sharing, or selling your consumer health data.
• Additional State Rights: Depending on your state of residence (including Connecticut), you may also have the right to correct inaccuracies in your consumer health data, to obtain your data in a portable format, and to opt out of the processing of your data for targeted advertising, sale, or profiling in furtherance of decisions that produce legal or similarly significant effects. You may exercise these rights as described in Section 7.
• Non-Discrimination: We will not discriminate against you for exercising any of your consumer health data rights.

7. How to Exercise Your Rights and Submit Requests

7.1 Submitting a Request

You may exercise your consumer health data rights by any of the following secure and reliable methods:

• In the App: Review, correct, export, and delete your data through the privacy and data settings in the app.
• By Email: Send a request to support@quixitapp.com. Please include your account email address and a description of the right you wish to exercise.

7.2 Authentication

To protect your consumer health data, we will verify your identity before responding to a rights request. We may ask you to confirm information associated with your account. We will not require you to create a new account to exercise your rights.

7.3 Response Timing

We will respond to your request without undue delay and no later than 45 calendar days after authenticating your request. If we need additional time, we may extend the response period by an additional 45 calendar days, but we will notify you of the extension and the reason for it within the initial 45-day period.

7.4 Cost

You may exercise your consumer health data rights free of charge at least twice per 12-month period. We may charge a reasonable fee or decline a request that is manifestly unfounded, excessive, or repetitive.

7.5 Appeal Process

If we decline or partially decline your request, you have the right to appeal. To appeal, send your appeal to support@quixitapp.com with the subject line "Consumer Health Data Appeal." We will respond to your appeal within 45 calendar days. If we deny your appeal, we will provide you with information on how to file a complaint with the applicable state Attorney General:

• Washington State Attorney General: File a complaint at www.atg.wa.gov
• Nevada Attorney General: File a complaint at ag.nv.gov
• Connecticut Attorney General: File a complaint at portal.ct.gov/ag

8. Data Retention

We retain consumer health data only for as long as necessary to fulfill the purposes described in this Policy, including to provide and maintain the Services, comply with our legal obligations, resolve disputes, and enforce our agreements, or as otherwise required or permitted by applicable law.

9. Security Measures

We implement reasonable administrative, technical, and physical security measures to protect consumer health data from unauthorized access, use, or disclosure, including encryption, access controls limiting access to personnel who need it and are bound by confidentiality, and contractual security requirements for our service providers. No system is perfectly secure. We will notify you of a data breach affecting your consumer health data as required by applicable law.

10. Changes to This Policy

When this Policy changes, we will post the updated version with a new effective date and notify you of material changes through the Services or other reasonable means.

If a change involves collecting, using, or sharing additional categories of consumer health data or using consumer health data for additional purposes not previously disclosed, we will obtain your affirmative consent before the change takes effect.

11. Contact Information

If you have questions about this Policy or your consumer health data, or if you wish to exercise any of your rights, please email us at support@quixitapp.com.