Privacy Policy

1.Who is who: roles and responsibilities

Rep² connects exercise, nutrition and health professionals ("Coach") with their clients ("Client"). Under the LGPD, each party has a role:

• The Coach is, as a rule, the controller of the data of the Clients they register and work with: the Coach decides what to record (assessments, measurements, prescriptions) and is responsible for having the legal basis to do so.
• Rep² is the processor of that data — it processes it on the Coach's behalf and instructions — and is the controller of the data needed to run the platform itself: registration, sign-in, billing and technical operating records.

In practice: requests about content your Coach recorded (an assessment, a prescription) should start with them; requests about your account and the platform itself come to us, through the channels in Section 16.

2.What data we collect and why

We collect only what running the service requires. By category:

Registration and profile

• Name, email, profile photo and bio.
• Date of birth, biological sex, height and starting weight — used for training calculations and goals.
• Phone number and city. The city is entered by you from a list of Brazilian municipalities published by IBGE (Brazil's national statistics agency) — the app does not use GPS or access your location.
• For a subscribing Coach, also: Brazilian taxpayer ID (CPF or CNPJ), address and ZIP code (CEP) — required for billing.
• When a Coach invites a Client, the Coach may enter, before the Client signs up: that Client's name, email, phone number and notes.

Health (sensitive data — detailed in Section 3)

• Screening and health history (a PAR-Q-style health questionnaire: medical history, restrictions, warning signs).
• Body measurements: weight, body fat percentage, circumferences and notes.
• Progress photos — optional, stored in a private area.
• Periodic check-ins: answers, photos and audio sent to the professional.
• Daily metrics from your phone or watch, when you allow it: steps, weight, sleep, resting heart rate and HRV (heart rate variability, an indicator of recovery).

Training and nutrition

• Training programs, completed workouts, sets, loads, reps and RPE (rating of perceived exertion), personal records and cardio sessions.
• Meal plans and logged meals.

Messages

• Conversations between you and the team that works with you: text, images, video and audio.

Payment (subscribing Coach only)

• Billing history and subscription identifiers. The Coach's name, email and CPF/CNPJ are sent to the payment processor (Asaas). Clients have no payment data in Rep².

App operation

• Our own technical records (app usage events and errors), linked to your account, for app functionality and improvement — kept for an indefinite period while your account exists, and deleted when it is deleted. We may delete records older than 90 days sooner.
• Technical crash reports sent to Sentry, with no personal identification: they carry no user ID, email, IP address or content, and the error message is scrubbed before it is sent.
• We do not use third-party analytics tools, advertising trackers or your device's advertising identifier (IDFA). We also do not access your contacts.

3.Health data and the consents we ask for

The first time you sign in, Rep² presents three consents:

• Personal data (required to use the app): name, contact details and usage data, to run the service.
• Health data (required to use the app): screening, measurements and metrics, shared with the professional who works with you.
• Progress photos (optional): you can use Rep² normally without accepting this one.

You can withdraw any consent at any time inside the app. Without the two required consents, the app does not continue — because without them we cannot provide the service.

Metrics from your phone or watch have a finer control: consent is per category (steps, weight, sleep, HRV, resting heart rate, workouts), and sharing with the Coach is a separate choice from collecting for yourself. For accounts in Brazil, sharing with the professionals linked to you starts on and can be turned off; for accounts in the United States, it starts off and turns on only when you choose. Every consent change is recorded in a history that cannot be deleted or edited, together with the version of the terms you accepted.

4.Apple Health, Apple Watch and Health Connect

If you allow it on your device, Rep² connects to Apple Health (iPhone/Apple Watch) or to Health Connect (Android):

• Reads: steps, weight, body fat percentage, sleep, HRV, heart rate (including resting), active energy, distance and recorded workouts.
• Writes: the workouts you do in Rep² can be saved back to Health as activity.

Health permission is granted and removed in your device's own settings, in addition to the per-category controls inside the app (Section 3).

5.Who sees what inside Rep²

This is the heart of the product, and the rules are enforced in the database itself — they do not depend on a screen behaving well:

• You see your data. Always.
• Your lead professional and the team professionals who work with you see your training, health and progress data while their relationship with you is active. Being in the same organization or practice grants access to nothing: a professional who does not work with you cannot see your data.
• Progress photos: only you and the professionals with an active relationship with you. They are kept in private storage — they are not public and have no open link.
• Prescriptions have an author. If you switch professionals, the new Coach does not see the training program or meal plan written by the previous one (it is that professional's authored work). But they do see your execution history — loads, reps, effort — and your health history, because prescribing without knowing the load you lift would be dangerous for you.
• Chat: the conversation is a group chat with the team that works with you. If your lead professional changes, a new conversation starts — the new professional does not inherit the previous one's history.
• Watch/phone metrics: you choose, category by category, what the Coach sees (Section 3).
• Rep² staff: platform administration has no routine read access to your health values; any exceptional access (e.g. supporting a serious problem) is logged in an audit trail.

6.Artificial intelligence

Some Rep² features use third-party AI models — currently DeepSeek, Anthropic (Claude) and Google (Gemini). When a feature is used, the content it needs is sent to the provider to generate the response:

• Generating or adjusting a training program or meal plan (a Coach action): the Coach's written request, the current plan and the exercise catalog are sent. The feature does not send your profile — but the Coach's free text may mention information about you.
• Workout summary: the Client's first name and the session stats (sets, loads, time) are sent.
• Importing a training program from a file (a Coach action): the uploaded file (PDF or image) is sent in full to the provider to be read.
• Meal photo (a Client action, optional): when you choose to estimate a meal from a photo, the image is sent to Google (Gemini), which identifies the foods and estimates the portions. The app asks for your permission before the first upload, and you can log the meal without a photo.
• Progress photos: a photo uploaded without a pose selected may be sent to the provider (Google Gemini or Anthropic) only to identify the pose and file it; and, when the Coach asks for a progress analysis, the compared photos are sent to the provider (Anthropic or Google Gemini) to generate an assessment that the Coach reviews.

We keep the content of these exchanges for 90 days — for diagnostics and cost control — after which it is deleted, leaving only numbers (tokens and cost). Images (meal photos and progress photos) are not copied into that record. Rep²'s AI does not decide anything on its own: every suggestion goes through the Coach, who is the author of and responsible for the prescription.

7.Who we share data with (subprocessors)

We do not sell personal data, and we do not share it for advertising. We use vendors ("subprocessors") strictly to run the service:

Beyond these, data may be shared when required by law (a court order or an order from a competent authority) or to protect the rights of Rep² and the safety of users.

8.International data transfers

Most of the vendors in Section 7 operate outside Brazil — the database and file storage run on infrastructure in the United States. When you use Rep², your data is transferred to those environments, to the extent needed to provide the service (article 33 of the LGPD). We choose established vendors with their own public security and privacy commitments, and we limit what each one receives to the minimum described in Section 7.

9.How long we keep data

Aggregated, anonymized data — which does not identify anyone — may be kept for statistics and product improvement.

10.Your rights and how to exercise them

Under article 18 of the LGPD, you can request: confirmation that we process your data, access, correction, anonymization, portability, deletion, information about who we share it with, and withdrawal of consent. The actual paths in the product:

• Withdraw consents: inside the app, in the profile area — at any time.
• Control health data from your watch/phone: inside the app, per category, including sharing with the Coach.
• Delete your account: inside the app (Section 11).
• Export your data (a copy in a readable format) and any other request: through the contact channel in Section 16. We respond within the LGPD timeframes.

Requests about content recorded by your Coach (assessments, prescriptions) should go to them first, as they are the controller of that content (Section 1) — but you can contact us if you do not get an answer.

11.Account deletion

You delete your account inside the app itself, in the account area, with a double confirmation. How it works:

• The request starts a 30-day grace period, during which you can cancel and keep the account.
• After that period, your personal data is deleted or anonymized: name, avatar and contact details are removed; photos, media and messages you authored have their content erased.
• Your workout history may be kept without identification (anonymized) — it is no longer your personal data.
• Messages sent by other people in the conversation are not deleted — they are those people's data.

Each anonymization is logged in an audit trail.

12.Security

Measures we apply today:

• Access control in the database: the "who sees what" rules in Section 5 are enforced row by row in the database itself, on every query.
• Private storage for progress photos, chat media and audio — no public links.
• Encrypted connections (HTTPS) between the app/dashboard and the servers.
• Audit trail for sensitive actions (anonymization, exceptional access to health data), in a log that cannot be altered.

No system is invulnerable. If a relevant security incident affects your data, we will notify you and the ANPD (Brazil's National Data Protection Authority) as required by article 48 of the LGPD.

13.Minors

Rep² is intended for people 18 and older. Minors may use the service only represented or assisted by their legal guardians, who must accept the Terms and this Policy and consent to the processing of the minor's data — as set out in Section 1 of the Terms of Use. A Coach who registers a minor Client declares that they have obtained that consent from the guardian.

In the United States, Rep² is available only to people aged 18 or over (Section 17.1).

14.Website, cookies and notifications

• Website (www.rep2.app): the Android test access form and the English version waitlist collect your name, your email and, if you choose, your WhatsApp number, used only to contact you about test access. The pages load fonts from Google Fonts — your browser contacts Google's servers for this. We do not use advertising cookies or audience trackers on the website.
• Web dashboards: use cookies and local storage strictly necessary to keep you signed in.
• Push notifications: sent through Expo/Apple/Google (Section 7); you turn them on and off in your device settings.

15.Changes to this Policy

We may change this Policy as the product evolves — especially during the Beta. Material changes will be announced by a notice in the app/dashboard or by email, with the new effective date. Changes that expand the use of sensitive data will ask for new consent, not just give notice.

16.Contact, Controller and Data Protection Officer (DPO)

To exercise your rights, ask questions or make any request about personal data:

• Controller: Diego Rodrigo Neufert, an individual, developer and operator of Rep²
• Data subject contact channel: support@rep2.app
• Data Protection Officer (DPO): not required — Rep² is operated by an individual and qualifies as a small-scale processing agent (ANPD Board Resolution No. 2/2022, article 11), which waives the appointment of a DPO. The contact channel above handles the requests under article 18 of the LGPD.

You can also file a complaint with Brazil's National Data Protection Authority (ANPD).

This document is a draft produced with the support of artificial intelligence and must be reviewed by a lawyer duly admitted to the Brazilian Bar (OAB) before official publication and use. This English text is an unofficial translation of that draft; the Portuguese version prevails.

17.Additional information for users in the United States

This Section applies to you if you use Rep² from the United States. It was originally written in English. If it conflicts with any other Section of this Policy, this Section governs for users in the United States.

17.1 Age requirement and children

In the United States, Rep² is available only to people aged 18 or older; the guardian-assisted use described in Section 13 does not apply. Rep² is not directed to children, and we do not knowingly collect personal information from children under 13, as required by the Children's Online Privacy Protection Act (COPPA). A Coach may not register a Client in the United States who is under 18. If we learn that we have collected personal information from someone under 18 in the United States, we will close the account and delete that information. If you believe this has happened, email support@rep2.app.

17.2 California privacy rights (CCPA/CPRA)

This part describes our practices under the California Consumer Privacy Act, as amended by the California Privacy Rights Act. Whether or not that law applies to Rep², we honor the rights described here for California residents.

Personal information we collect. In the last 12 months we collected the following categories, from the sources and for the purposes described in Sections 2 to 6:

We do not collect precise geolocation: your city is entered by you (Section 2).

Sources. You; your Coach and the professionals on your team, who may enter information about you; your devices, through Apple Health or Health Connect, when you allow it; and Apple or Google, when you sign in with them.

Disclosures. We disclose each category above for business purposes to the service providers listed in Section 7, under contracts that limit their use of it, and to the Coach and team professionals you are linked to, as described in Section 5.

No sale or sharing. We do not sell personal information and do not share it for cross-context behavioral advertising, and we have not done so in the last 12 months. We have no actual knowledge of selling or sharing the personal information of consumers under 16. Because of this, we do not offer a "Do Not Sell or Share My Personal Information" link, and Global Privacy Control signals do not change how we process your data. If this ever changes, we will update this Policy and offer an opt-out before we start.

Sensitive personal information. We use and disclose sensitive personal information only to provide the Service you request and for the other purposes permitted by the CCPA regulations, and not to infer characteristics about you. Because of this, we do not offer a "Limit the Use of My Sensitive Personal Information" link.

Retention. As described in Section 9.

Your rights. You have the right to know what personal information we collect, use and disclose and to access it; to request deletion; to request correction of inaccurate information; to receive a copy in a portable format; and not to be discriminated against for exercising these rights.

17.3 How to make a request

Email support@rep2.app with the subject "US privacy request." Because Rep² operates exclusively online and has a direct relationship with you, email is our method for submitting requests. You can also delete your account in the app (Delete your account).

• Verification. We verify requests by matching them to your account, usually by asking you to write from the email address you signed up with. If you can't, we may ask for other information reasonably needed to confirm your identity.
• Authorized agents. You may use an authorized agent. We may ask the agent for your signed permission and ask you to confirm your identity directly with us.
• Timing. We confirm receipt within 10 business days and respond within 45 calendar days. If we need more time (up to another 45 days), we will tell you why.
• Content entered by your Coach. Where your Coach decides what to record about you (Section 1), we may forward your request to the Coach or help them respond.

17.4 Consumer health data (Washington, Nevada and other states)

This part is our consumer health data privacy policy under the Washington My Health My Data Act, Nevada law and similar state laws.

• Consumer health data we collect: health screening and health history answers; body measurements; progress photos; check-in answers; daily health metrics from Apple Health or Health Connect (steps, weight, body fat percentage, sleep, resting heart rate, HRV, workouts, active energy and distance); workout logs; meal plans, logged meals and meal photos.
• Why we collect it: only to provide the features you use, as described in Sections 2 to 6. We never use it for advertising.
• Sources: you, your devices (with your permission), and the professionals who work with you.
• Who we share it with: the Coach and team professionals you are linked to (Section 5), and the service providers in Section 7 that process it on our behalf, including the AI providers described in Section 6. We have no affiliates. Sharing your health metrics from Apple Health or Health Connect with your professionals is a separate control from collecting them, and you can turn it off at any time in the app (Section 3).
• Consent: we collect consumer health data with your consent (Section 3), and you can withdraw it at any time in the app.
• We do not sell consumer health data, and we do not use geofencing around health care facilities.
• Your rights: to confirm whether we collect, share or sell your consumer health data; to access it, including a list of the third parties we have shared it with; to withdraw consent; and to have it deleted, including by our service providers. Make your request as described in Section 17.3; we respond within 45 days.
• Appeals: if we decline your request, you may appeal by replying to our answer with the subject "Appeal." We will respond to the appeal within 45 days. If the appeal is denied, you may contact the attorney general of your state.

17.5 Other notices

We do not disclose personal information to third parties for their own direct marketing purposes (California Civil Code Section 1798.83). Your data is stored on infrastructure in the United States (Section 8).