Version: 2.0
Effective date: July1, 2026
This Privacy Policy explains how HWPO LLC ("HWPO," "we," "us," or "our") collects, uses, discloses, retains, and protects personal data when you use HWPO's websites, mobile applications, training programs, memberships, personalized and automated features, connected services, human and digital coaching, nutrition and wellness tools, communities, events, content, rewards, storefronts, customer support, and other products or services that link to this Policy (collectively, the "Services"). The Consumer Health Data Notice in Section 14 is part of this Privacy Policy. It provides additional information for residents of Washington and other U.S. states with consumer-health-data laws. It should be published through a prominent, direct link wherever those laws require one.
HWPO LLC is the controller or business responsible for the personal data covered by this Policy, unless a transaction- or feature-specific notice identifies another controller.
HWPO LLC
520 Avenue D, Williston, VT 05495, USA
Email: contact@hwpotraining.com
Email: contact@hwpotraining.com
Do not send laboratory reports, genetics reports, passwords, government identifiers, payment-card information, or other sensitive documents by ordinary email. Use a secure in-product or request-portal method when available.
This Policy applies to personal data processed through the Services and related transactions, fulfillment, events, customer support, marketing, security, and business operations. It does not govern a third party's independent processing, even if you reach that party through an HWPO link, checkout, event, or integration.
Point-of-collection disclosures, consent screens, community rules, promotion terms, checkout terms, or other notices may provide more detail for a particular interaction. For example, an optional connected-data feature may present separate consent for collecting or sharing health data, and a commerce or device provider may present its own authorization or privacy notice. If a more specific notice conflicts with this Policy, the more specific notice controls for that interaction.
The fitness and wellness Services are intended for general-wellness use. Unless HWPO expressly states otherwise in a separate written agreement, do not assume that information covered by this Policy is protected by the U.S. Health Insurance Portability and Accountability Act (HIPAA). Consumer-health, privacy, breach-notification, communications, and other laws may still apply.
The data we collect depends on the Services you use, purchases you make, permissions you grant, audiences you select, and information you choose to provide.
We may collect:
We collect plan, trial, purchase, renewal, cancellation, promotion, tax, invoice, receipt, payment status, currency, transaction, entitlement, and purchase-channel information. Payment-card credentials are generally collected and processed by Stripe, Apple, Google, Shopify, or another payment provider rather than stored directly by HWPO.
When you browse or purchase through the Shop, we may collect:
We may retain order-event or webhook records needed to reconcile transactions, provide order history and support, prevent fraud, and maintain legal records. A commerce provider may independently collect additional payment, device, or transaction data under its own privacy notice.
We may collect:
If you enable optional wellness, connected-data, or personalization features, we may collect or infer information concerning your health, physiology, genetics, reproductive or hormonal health, injuries, or wellness. Depending on what you connect or submit, this may include:
We treat these categories as sensitive and apply the additional practices in Section 14. We do not require optional health, laboratory, or genetics information to use basic training or Shop features.
We may collect and process:
Media may be transmitted to a contracted provider to produce the response, extraction, transcription, moderation, or review you request. Unless the interface states otherwise, temporary copies may remain in provider security systems or backups under applicable contracts and retention periods even if the media is not displayed later in your history.
We may collect:
Content may be visible to another person, a group, members, event attendees, coaches, administrators, or the public as indicated in the interface. A recipient may save or redistribute content outside HWPO's control. Direct messages and nonpublic content may be accessed by authorized personnel or providers when necessary for delivery, security, moderation, support, legal compliance, or enforcement.
We may collect points balances, earning and redemption activity, tiers, streaks, reward selections, discount codes, referrals, promotion eligibility, giveaway entries, survey responses, preferences, and fraud or abuse signals. If you provide information about a referred person, you must have authority to do so.
We collect support tickets, request type, status, account or order context, correspondence, attachments, satisfaction feedback, call or chat information, troubleshooting steps, and resolution history. We also collect email, SMS, push-notification, and in-app communication preferences and engagement, including delivery, open, click, and unsubscribe events where permitted.
We may collect:
We do not collect precise geolocation unless a feature clearly requests it and you grant permission. If you create or attend an in-person event, you may choose to provide an event location, which can be precise and may be visible to the audience identified by the event.
Our websites, storefronts, apps, and service providers may use cookies, SDKs, pixels, local storage, and similar technologies for authentication, cart and checkout operation, preferences, security, analytics, communications, fraud prevention, and other disclosed purposes. Where required, we request consent before using nonessential technologies. A separate cookie notice or preference center may provide additional choices.
We collect personal data from:
If another person provides us with personal data about you, they are responsible for having authority to do so. If we receive Consumer Health Data from a source other than you, we provide disclosures and obtain permissions required by applicable law.
We use personal data for the following purposes.
This includes creating and authenticating accounts; delivering programs, memberships, nutrition tools, and content; maintaining schedules, workouts, progress, and preferences; synchronizing authorized services; providing human and digital coaching; enabling community, messaging, live media, events, leaderboards, rewards, and support; and maintaining account settings.
If enabled, we use training, profile, wellness, connected-device, purchase, usage, and interaction data to:
These processes may use deterministic rules, statistical methods, or artificial intelligence. They are intended to personalize fitness, wellness, content, community, and commerce experiences, not to make decisions producing legal or similarly significant effects.
We do not intentionally use identifiable Consumer Health Data, private coaching conversations, private messages, or private uploads to train a general-purpose third-party model for unrelated customers. HWPO may use limited, access-controlled data to evaluate quality, investigate failures, improve safety, and develop HWPO-specific features where permitted by law and consistent with your choices. Where possible, we use de-identified, aggregated, synthetic, or test data for those purposes.
We use personal data to display products; maintain a cart; validate prices, discounts, and inventory; process payment; calculate tax and shipping; confirm, fulfill, track, return, exchange, refund, or cancel orders; apply rewards; send transaction messages; reconcile provider records; prevent fraud; manage recalls or safety issues; and provide order history and customer support.
We use personal data to create profiles and memberships; deliver posts, reactions, polls, messages, media, live streams, event details, virtual links, RSVPs, attendee lists, reminders, rankings, and notifications; recommend relevant groups or content; moderate and investigate reports; enforce rules; and protect participants and the Services.
If you host an event or post content, we use the information you provide to display and administer it to the chosen audience. If an event is recorded or streamed, we process participant names, images, voices, chat, and other contributions as disclosed for the event.
We use personal data to determine eligibility, credit and redeem points, apply discounts, administer trials or promotions, communicate benefits, prevent duplicate or fraudulent participation, reverse benefits after returns or refunds, measure performance, and comply with promotion rules and law.
We use contact, account, purchase, and usage information for service messages, security alerts, support, receipts, fulfillment notices, subscription notices, event reminders, product updates, surveys, and marketing where permitted. You may unsubscribe from marketing email using the link in the message and from marketing SMS by replying STOP. Transactional, security, order, or account messages may continue where needed.
We use usage, diagnostic, transaction, feedback, and appropriately minimized or de-identified information to understand feature and product performance, troubleshoot errors, conduct testing, measure engagement, forecast inventory and capacity, evaluate safety and quality, and improve the Services. We do not use Consumer Health Data for third-party advertising or data brokerage.
We use data to detect and prevent fraud, payment abuse, trial or promotion abuse, manipulated rankings, unauthorized access, unsafe or prohibited conduct, security incidents, and violations of our terms; authenticate users; enforce entitlements and rate limits; protect legal rights; and maintain audit records.
We use and disclose data when reasonably necessary to comply with law, respond to valid legal process, maintain tax, accounting, product-safety, transaction, and consent records, establish or defend legal claims, conduct corporate transactions, and satisfy regulatory or safety obligations.
HWPO will not use identifiable Consumer Health Data or genetic data for a clinical study or unrelated external research without any notice, consent, ethics review, or other safeguard required by law. We may use de-identified or aggregated information for internal product, training, and performance research where the information cannot reasonably be linked to you and the use is permitted by law.
Some features use artificial intelligence, rules, or statistical systems to generate or moderate content; interpret text, images, audio, or documents; detect safety or fraud concerns; personalize training, wellness, content, community, or product experiences; and suggest changes.
The principal input categories and purposes are described in Sections 3 and 5. Inputs may be missing, stale, or wrong, and automated outputs may be inaccurate. We identify a conversational feature as automated where appropriate; a persona or coaching style does not mean that a named person created or reviewed an output.
HWPO does not intend to use these features to make a solely automated decision that produces legal or similarly significant effects, such as employment, insurance, credit, housing, education admission, or access to healthcare. Where a feature provides a confirmation step, a proposed workout or record change requires your review before it is applied. Where available, you may use the original prescribed workout instead of a personalized version.
Residents of jurisdictions with applicable rights may request information about relevant automated processing, object to or restrict certain processing, correct input data, withdraw consent, or request human review. Contact us using Section 13.
We do not sell personal data for money. We do not share personal data for cross-context behavioral advertising as those terms are defined by California law. We do not sell Consumer Health Data.
We may disclose data as follows.
We use companies that provide data hosting, authentication, payments, commerce, fulfillment, communications, artificial intelligence, analytics, diagnostics, feature delivery, content and video hosting, community services, moderation, and support. Depending on your use and current deployment, these may include:
These providers may process personal data only for contracted services, legal compliance, security, or other purposes permitted by their agreement with HWPO. The precise providers may change. We will update this Policy or a linked subprocessor list when a change materially affects sensitive data or where notice is required.
We disclose transaction and contact data to payment processors, commerce platforms, fraud-prevention providers, warehouses, carriers, customs authorities, returns processors, manufacturers, and customer-service partners as necessary to accept payment, fulfill and support an order, process a return or refund, address a recall or product-safety issue, and comply with law.
These parties may independently control certain data, such as payment credentials, carrier tracking, or customs information. Their own privacy notices apply to their independent processing.
Assigned coaches, coaching supervisors, event or community administrators, customer-support staff, commerce staff, engineers, security personnel, and other authorized workers may access data necessary for their duties. Access should be role-based, limited to a business need, and subject to confidentiality obligations.
If a coaching, event, or support service requires sharing particular contact, training, video, order, or wellness context, we disclose that information as described when you enroll, participate, or request assistance. We do not give every coach or host unrestricted access to every data category.
When you connect or interact with a third-party device, app, laboratory, genetics service, affiliate, social service, or other partner, we exchange information necessary to perform your request. The third party may independently control information it receives from you or from HWPO.
We disclose profile, membership, leaderboard, community, message, media, activity, event, RSVP, attendee, or location information to the audience you select or the feature indicates. Event hosts may receive participant information needed to administer the event. Do not post or share sensitive information unless you want the indicated audience to see it.
We may disclose information when we reasonably believe disclosure is necessary to comply with law or valid legal process; protect the rights, safety, or security of a person, product, transaction, or the Services; investigate fraud or abuse; enforce agreements; conduct a product recall; or establish or defend legal claims.
If HWPO is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, data may be disclosed to professional advisers and transaction parties subject to appropriate protections. We will provide legally required notice or choice before a successor uses personal data in a materially different way.
You control operating-system permissions and connected-service authorizations. The Services request the categories displayed by the platform or authorization screen. You can change permissions through your device or provider settings, although disabling access may stop related features.
Data obtained through Apple Health or HealthKit is used to provide health, fitness, and related functionality you request. We do not use Apple Health or HealthKit data for advertising, sell it to data brokers, or use it in a manner prohibited by Apple's platform rules.
Disconnecting a provider stops future collection once the revocation is processed. It does not automatically delete historical information held by HWPO or the provider. Use the deletion methods in Sections 12 through 14 for previously collected information.
Shop, community, payment, and app-store providers may require separate accounts, cookies, or permissions. Changing an HWPO preference may not change the independent settings or records maintained by those providers.
We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, including providing your account, transactions, training history, community, support, and requested features; satisfying your choices; maintaining security and auditability; complying with legal obligations; and resolving disputes. Retention depends on the data and context.
We may retain a minimized record of a request, consent, transaction, fraud determination, moderation action, product-safety issue, or legal hold after other data is deleted when necessary to demonstrate compliance, prevent abuse, or satisfy law. Where possible, we separate or de-identify that record.
We use administrative, technical, and physical safeguards designed for the nature and sensitivity of the data. These may include encryption in transit, encryption of selected credentials at rest, access controls, tenant and user isolation, audit logging, rate limits, monitoring, secure credential storage, payment-provider controls, and restrictions on sensitive file access.
No method of transmission or storage is completely secure. You are responsible for protecting your credentials and devices and for promptly reporting suspected unauthorized access. Community recipients and event participants may copy information you share; use audience and privacy controls carefully.
If a breach affects your personal data, we will investigate and provide notice to affected individuals, regulators, platforms, or others as required by applicable law, including consumer-health breach-notification rules where applicable.
Depending on your account, device, plan, and location, you may be able to:
Some controls disable only future collection, processing, or display. For example, disconnecting a wearable does not erase historical metrics; leaving a community does not necessarily delete prior posts; canceling a subscription does not cancel a Shop order; and deleting an HWPO account may not erase legally retained order or payment records. We explain the effect of a control where reasonably possible.
An in-app export may not include every category held by HWPO or its providers. To make a formal access or portability request, use the privacy request methods in Section 13.
You may unsubscribe from marketing email using the link in a message, opt out of marketing SMS by replying STOP, and manage push notifications through the Services or device settings. We may still send nonmarketing messages concerning security, purchases, fulfillment, subscriptions, events you joined, or requested support.
Where available, use the cookie preference center to manage nonessential website or storefront technologies. Browser settings can also block or delete cookies, but doing so may affect sign-in, cart, checkout, preferences, or other functions.
We do not currently sell personal data or share it for cross-context behavioral advertising. We honor legally recognized browser-based opt-out preference signals for processing to which they apply. If our practices change, we will update this Policy and provide required choices before beginning the new processing.
Your rights depend on where you live and may be subject to exceptions. They may include the right to:
Submit a request to contact@hwpotraining.com with the subject Privacy Request. We will verify your identity using information proportionate to the request's sensitivity. An authorized agent may submit a request where permitted, but we may require proof of authority and direct confirmation from you.
We respond within the period required by applicable law. For example, qualifying consumer-health requests are generally handled without undue delay and within 45 days, subject to a permitted extension. GDPR and UK GDPR requests are generally handled within one month, subject to permitted extensions.
If we deny a request, we will explain the basis when required and describe how to appeal. Submit an appeal through the same method with the subject Privacy Appeal. If an appeal is denied, you may contact the regulator or attorney general identified in our response.
We will communicate qualifying deletion requests to processors and recipients as required. Certain data may remain where an exception applies, including records needed for tax, accounting, fulfillment, product safety, fraud prevention, chargebacks, legal claims, security, or protection of another person's rights.
If GDPR or UK GDPR applies, our legal bases ordinarily include:
You may withdraw consent at any time without affecting processing already lawfully carried out. Withdrawal may disable a feature that cannot operate without the data.
You may complain to the data-protection authority where you live, work, or believe a violation occurred. Before publishing this Policy for EEA or UK users, HWPO must insert any required EU or UK representative and data-protection-officer details here: [EU/UK REPRESENTATIVE OR DPO DETAILS, IF REQUIRED].
For California residents, the categories described in Section 3 map to identifiers; customer records; protected classifications; commercial information; internet or electronic activity; geolocation; audio, visual, and similar information; professional or employment information if supplied; inferences; and sensitive personal information, including account credentials, precise location if enabled, health information, genetic data, message contents where applicable, and information concerning sex life or sexual orientation if voluntarily supplied.
We collect these categories from the sources in Section 4, use them for the purposes in Section 5, and disclose them to the recipient categories in Section 7. We do not sell personal information and do not share it for cross-context behavioral advertising. We use sensitive personal information only for requested Services and other purposes permitted without offering a separate right-to-limit mechanism, unless our practices change.
California residents may request access, deletion, correction, and information about practices; opt out of sale or sharing if those practices begin; limit qualifying use of sensitive information; and exercise rights without unlawful discrimination. We honor legally recognized browser-based opt-out preference signals for processing to which they apply.
Residents of other states may have similar rights, including access, correction, deletion, portability, opt-out, consent withdrawal, and appeal. We process qualifying requests under the law applicable to the requester. The additional Consumer Health Data Notice follows.
Effective date: July 1, 2026
This section is HWPO's Consumer Health Data Privacy Notice for Washington's My Health My Data Act and other applicable U.S. consumer-health laws. In this section, "Consumer Health Data" means personal information that identifies or can reasonably be linked to a consumer and identifies the consumer's past, present, or future physical or mental health status, as defined by applicable law. It can include information inferred from non-health data and information about health-related products or services.
Depending on the Services you request, we may collect:
We collect and use Consumer Health Data to provide the product or service you request, including to:
We do not use Consumer Health Data for third-party advertising, data brokerage, eligibility decisions in employment, insurance, credit, housing, education, or healthcare, or to train a general-purpose third-party model for unrelated customers.
We will obtain affirmative consent before collecting or using additional categories or purposes when applicable law requires it. Where law requires consent to sharing that is separate from collection consent, we will request it separately.
Consumer Health Data comes from:
We may share the categories described in Section 14.1 as necessary to provide the Service you request. Depending on that Service, recipients may include:
HWPO currently identifies no corporate affiliate with which it shares Consumer Health Data for the purposes described in this Notice. If that changes, this Notice will be updated before sharing when required.
Disclosures to processors are governed by contracts intended to restrict processing to HWPO's instructions and the purposes in this Notice. We do not sell Consumer Health Data. If HWPO ever proposes to sell Consumer Health Data, it will first obtain a valid, separate authorization containing the information and signature required by applicable law.
Subject to applicable law, you may:
Contact contact@hwpotraining.com with the subject Consumer Health Data Request. You do not need to create a new account to exercise a right, although we may ask you to use an existing account and may request additional information to authenticate a sensitive request.
Withdrawing consent stops future collection or sharing after the withdrawal is processed but does not affect processing that was lawful before withdrawal. A personalized, connected-data, coaching, or wellness feature may no longer work if it requires the data.
When you request deletion, HWPO will delete applicable Consumer Health Data from active systems and notify processors and other recipients as required, subject to lawful exceptions. Deletion from archived or backup systems may be delayed until those systems are restored or rotated, but not longer than the period permitted by applicable law.
We will respond without undue delay and within the legally required period. If we refuse a request, you may appeal through the same method with the subject Consumer Health Data Appeal. We will respond to the appeal and provide a method to contact the appropriate attorney general when required.
We will not collect, use, or share a new category of Consumer Health Data, or use existing Consumer Health Data for a materially new purpose, without first updating this Notice and obtaining affirmative consent where required.
HWPO is based in the United States and its providers may process data in the United States and other countries. Those countries may have data-protection laws different from the laws where you live.
Where GDPR, UK GDPR, or another law requires transfer safeguards, HWPO will use an approved mechanism such as an adequacy decision, standard contractual clauses, the UK addendum or international data transfer agreement, or another lawful mechanism, together with supplementary safeguards where appropriate.
You may contact us for information about the transfer mechanism relevant to your data.
The Services are not intended for children under 16, and HWPO does not knowingly collect personal data from a child under 16 through the Services. A user who is 16 or older but under the age of legal majority may need parent or guardian authorization under local law.
If you believe a child provided personal data in violation of this section, contact us. We will investigate and delete the information where required. We do not knowingly sell or share for cross-context behavioral advertising the personal data of anyone under 16.
An event, promotion, or product may have a higher minimum age or require parent or guardian involvement. Hosts and users may not use the Services to solicit personal or sensitive information from minors unlawfully.
We may update this Policy to reflect changes in the Services, products, technology, law, or business operations. The updated Policy will state its effective date. If a change materially affects your rights or the processing of sensitive or Consumer Health Data, we will provide advance notice and obtain consent where required.
For privacy questions or requests:
HWPO LLC
520 Avenue D, Williston, VT 05495, USA
Email: contact@hwpotraining.com
Email: contact@hwpotraining.com
Website: HWPO
Privacy Policy: Privacy Policy
For your security, use the request portal or in-product controls rather than attaching sensitive health, identity, or payment documents to ordinary email.