Consumer Health Data Privacy Policy

1. Categories of consumer health data we collect

Coach AI Memories photos. Coaches can add reference photos that may contain health information to Library AI Memories. Originals remain stored in Library. A bounded, orientation-normalized copy without image metadata goes to the existing configured AI provider to extract visible text, tables and a factual description; this derived text is stored as searchable passages. Processing checks the source scope and AI permissions. Client-bound folders limit recall to that client; unbound folders are practice-wide, and explicit team copies use the existing team scope. Moving a photo out or removing it from Brain removes searchable passages but keeps the original. Web Library deletion follows existing source-file cleanup and shared-file reference checks. Mobile direct-row deletion does not perform that file and passage cleanup. Provider-held copies and backups have separate retention.

Private client workspaces. Independent clients and clients with coach-sponsored AI can keep personal assistant conversations, confirmed memories, reusable templates, reviewed plan activation history and uploaded lab reports in their own account. Companion names, preset avatars, tone preferences and brief settings are also stored privately. Separate coach permissions and limits govern whether a coached client may activate a nutrition or training plan; presentation preferences cannot grant that permission. Personal lab explanations are educational AI output, not a coach-confirmed review. Sponsorship does not give a coach access to this private material. A client can explicitly share selected message or lab snapshots with their current coach and revoke that sharing in the service.

In personal Zyx chat, you can upload photos or a short video. Videos are temporarily processed into three still frames without audio, and the original and temporary decoding files are removed after processing. The private frames follow the same storage and deletion rules as chat photos. Pressing Send includes your selected images with your request at the configured AI provider. Voice messages begin only when you tap the microphone after recording and AI permissions are checked. Recording stops on cancel, leaving chat, backgrounding or reaching two minutes. The time limit does not submit the recording. Pressing Send sends the audio to our configured transcription provider so its text can become your message. We do not persist this audio on the server. A failed transcription can leave a local clip for retry; success, cancellation or leaving chat requests local deletion. Interrupted processes may leave temporary files subject to device or infrastructure cleanup. The resulting conversation and images stay private unless you explicitly share them, with provider-held copies subject to separate retention.

Optional daily briefs use selected sections of the client's plans, available classes and recorded activity. Clients choose timing, timezone, topics, length and tone, and can disable scheduled briefs. In-app scheduling is separate from optional push. Missing logs are not treated as failed activity. Changing content settings or withdrawing consent hides an incompatible saved summary without generating another paid brief that day. Calendar details enter AI only after separate consent and are limited to relevant events. Google Calendar must be connected by the client. Push notifications contain a generic prompt to open the brief without health details. Memory can be viewed, edited, forgotten or disabled. Disabling it does not delete saved memories; the forget control does.

Independent and coach-sponsored clients can keep private Markdown files with Zyx, including their purposes, saved versions and reviewed changes. Profile, goal and memory file views derive from the corresponding account records. Archiving a file retains its history; forgetting removes its stored content versions and related file proposals. Memory corrections and deletion invalidate earlier AI context and pending proposals. Earlier conversation text remains readable until the conversation is forgotten, but is excluded from future automatic recall after that privacy change. With memory disabled, files are not automatically recalled; explicitly attaching a file sends that selected reference for the requested answer. Exports remain private to the client, and downloaded or provider-held copies have separate retention.

Private documents and authorized knowledge. Clients can upload private PDF, DOCX and text documents or import a public document snapshot. Originals are stored privately, and extracted text is indexed for that client and can be included in consented AI answers. A coach cannot read these files through sponsorship. Deleting a document removes searchable text and queues original-file erasure after 15 minutes, with retries; provider copies and backups have separate retention. The companion also uses currently authorized coach materials and unlocked course lessons, or the LaunchSite general library for standalone clients. Source IDs and revisions help prevent revoked or changed material and derived content from being reused in future answers. Saved replies and plans remain readable after source access ends. Public research sends only fixed general topic labels to search and public article URLs to the page reader, not private questions, names, records or lab values.

Searchable course recordings. A lesson owner can enable text extraction or transcription for course material, including wellness information present in its text or audio. Automatic transcription sends extracted audio segments to the configured provider. Private derived audio, transcript text and timestamps remain with the source until it is replaced, disabled or deleted; deletion queues derived-file erasure with retries. The source course recording follows existing course-file retention. Course and lesson access restrictions still govern which clients may use the resulting passages. This stored course-processing audio is separate from personal voice messages described above.

Through the wellness-coaching workspace, we may process the following categories of consumer health data about a client (“you”):

• Coach-hosted WordPress websites - health information a coach chooses to collect or import through their separately hosted WordPress website may be stored in its files, database and infrastructure backups. The coach controls its forms, plugins and records. This hosting feature does not copy those records into LaunchSite CRM or Shopify, and does not change our wellness-only restrictions. Coach-selected plugins can involve separate providers and privacy terms.
• Network shelf folders - coaching or wellness text in coach-authored folder names and descriptions, with template placement. Members see a folder description only when they can already see a published template inside it. Placement grants no additional access. Folders remain until the owning account is deleted; unfiling a template does not erase its folder. Requested Juno reads may send this content to the existing configured AI provider, under existing provider and conversation retention.
• Uploaded learning materials - wellness information your coach includes in Library resources or Networks course lessons, including video, PDF, office and text documents.
• Course assessment records - quiz answers, assignment text and links, instructor grades and feedback, attempts and completion certificates may contain wellness information you or your coach include. They are stored for the course learning workflow, not used as accredited credentials. Grading keys stay private, and ungraded Learn with Juno practice is separate.
• Health status & symptoms - check-ins, symptom and complaint information, and wellness “system status” grades.
• Library files through connected AI - when a coach requests a file through an authorized MCP client, extracted document text and metadata-stripped image copies, including ready image extractions, may be returned to that external AI provider. Current Library ownership, team membership and applicable client privacy permissions still apply. An explicitly requested image upload saves the original privately in AI Memories and uses the existing OCR and indexing pipeline. Image bytes are excluded from MCP write receipts. The external provider controls retention of copies it receives.
• Measurements, activity & biometrics - weight, body-composition measurements, blood glucose, body temperature, and similar self-reported metrics.
• Connected device data - if you choose to connect Apple Health, Android Health Connect, Whoop, Oura, Fitbit, or Ultrahuman, privacy-minimized daily totals and scores such as steps, sleep duration, resting heart rate, heart-rate variability, recovery, and readiness. Apple Health also imports optional weight as the latest valid measurement per local day, stored in pounds with its measurement date. Health Connect imports only daily steps, sleep duration, resting heart rate and heart-rate variability measured as RMSSD; this stays separate from Apple Health SDNN. If you separately enable Apple Health workout sharing, we also import activity type, start and end times, time zone, duration, distance, energy, average and maximum heart rate when available, recording source, and manual-entry status. We keep your selected links to assigned training and hidden-workout choices. A random app-installation identifier and connection generation prevent stale uploads. We do not collect workout routes or raw continuous sensor streams.
• Lab & diagnostic information - lab files you or your coach upload (for example serum, gut, hormone, or mycotoxin panels) and the marker values extracted from them.
• Charts requested through connected AI - selected coaching measurements, dates, original units, source references and rendered images are returned to the external AI client your coach connected through MCP. Rendering uses bundled Flint and Vega software without sending chart data to Microsoft or a separate chart service. This read-only request does not save a new chart snapshot or imported table in LaunchSite; the external provider's retention terms govern copies it receives.
• Progress photos requested through connected AI - when your coach has connected an external AI client through MCP and asks it to review your check-in progress photos, resized copies of the requested photos, with each check-in's date, photo labels and recorded weight, are returned to that AI client. Only a coach who can already see your photos in LaunchSite can request them, and none are sent if you have withdrawn permission for sharing with an external AI assistant. LaunchSite processes these copies in memory, removes photo metadata such as location, and saves no additional image; the external provider's retention terms govern copies it receives.
• Historical charts and imported tables - any selected coaching measurements, dates, categories, original units and source references previously saved through the retired Charts workspace remain historical client records. That workspace's imports, saved charts, sharing and portal access remain unavailable. MCP cannot access those historical chart stores. Existing records are deleted with the client record; copies already downloaded cannot be recalled.
• Pre-participation health screening - where your gym or coach switches it on, your answers to the standard PAR-Q+ readiness questions (for example heart conditions, chest pain, dizziness, chronic conditions, prescribed medication, and joint problems), the date you answered them, and your coach’s recorded decision about any answer you flagged. These answers are used to decide whether you should speak to a doctor first and whether you can book a class yourself; they are not scored, and no automated judgement is made about your fitness to exercise.
• Supplements, peptides & related inputs - wellness supplement and similar information entered for coaching (prescriptions, diagnoses, and lab orders are referred out to a licensed physician and are not provided through the platform).
• Optional Fullscript connection - with an authorized practice and an explicit patient match, released supplement directions, patient-facing messages, assigned resource references and permitted order or eligible lab recommendation/status information can appear in the app. The integration keeps a server-side plan copy for synchronization and can create a separate daily checklist only after the coach confirms its timing. It does not infer doses, mark purchases as taken, or import lab result files. A coach can also explicitly create a patient after reviewing first name, last name and email; no welcome email is sent, and matching requires separate confirmation. Fullscript retains its practitioner authoring and checkout, including when its official editor is embedded. Clinical use remains subject to the platform's existing restrictions and separate provider eligibility; sandbox access does not establish permission for real health records.
• Plans brought across from a previous platform - when your coach starts a browser-extension capture, assigned meal, supplement and workout details and assigned daily-habit task labels may be included in the onboarding draft they review. Task definitions are not proof that you completed them; this capture does not manufacture historical completion records. The extension does not change your source records or copy unassigned library templates onto every client.
• Intake follow-ups - your answers may reveal additional questions chosen by your coach. Answers and file references for questions that become hidden are excluded from submission. Files already uploaded remain in private storage under the existing retention lifecycle.
• Reproductive or menstrual information - cycle status, where you choose to provide it as coaching intake.
• Bodily or health-related imagery - progress photos, and movement or lift video submitted for form review, together with the pose landmarks derived from that video to draw feedback. If your coach enables photo review for Zyx, bounded current and previous check-in photos are sent to the configured AI provider to produce approximate visual body-fat estimates, uncertainty ranges, comparability notes, and week-over-week observations for the coach. These are visual estimates, not measurements or diagnoses. This option is off by default; the platform processes resized copies in memory and saves derived text in the private review and Zyx's permission-gated photo-observations Markdown history without saving another image copy.
• Health-related conversations - messages between you and your coach about your health, and - where your coach records a call and you have consented - recordings and transcripts of coaching or consult calls. Your coach may also speak to the platform’s assistant about your coaching rather than typing; their microphone audio is transcribed so it can become the text of their request, and we do not retain that audio afterwards - what is kept is the resulting text, in your coaching records.
• Pages shared with Co-Work - when your coach connects a browser tab to the assistant, its visible controls and field values may include your health information. If your coach explicitly enables screen sharing, still images of that tab’s visible viewport may also include health information or imagery. The extension masks private controls and opaque frames. These observations pass to our AI provider for the current step and are not saved in our database, application logs, or conversation transcript. Session records retain the coach’s instruction and action outcomes.
• Status as someone seeking wellness services - the fact that you use a wellness-coaching service, and related account and contact information.
• Inferences - wellness grades, suggested programs, and AI-assisted summaries derived from the above to deliver coaching.
• Week-by-week coaching records - where your coach uses Runway (a week-by-week view of your coaching), a weekly goal, phase label, target weight, travel week mark, coach note and done mark, the decisions and follow-ups your coach records for a week (for example a lab recheck due in two check-ins), and weekly summaries of measurements you already log. These records are visible only to your coach and their authorised team, never shown to you, and never sent to you unless your coach writes them into a message or review. When your coach asks for suggestions, or turns them on, their own review text, private notes, Loom review transcript and dictation for a check-in, or a Loom transcript or written reply they paste into a week, are sent to our AI provider to propose items that your coach adds or dismisses; your check-in answers are not sent to find these suggestions. A pasted Loom transcript is not stored; a pasted reply is kept on that week for your coach's team unless your coach chooses not to save it. When your coach asks Runway to find decisions in a 1:1 call, the call notes, and its transcript only if you allow recordings, are sent to our AI provider; only a fingerprint (hash) of that text is kept. Where your coach scores a written check-in question, the text of your answer is sent to our AI provider to propose a 1 to 10 score with a short reason and a quote of up to 200 characters, which your coach can change; this can run automatically when you submit or edit a check-in, unless your coach turns it off. When your coach generates a Briefing for a check-in review, that check-in and up to 5 earlier ones, messages between you and your coach since the previous check-in, the Loom review transcript (only if you allow recordings), 1:1 call notes and open follow-ups are sent to our AI provider to prepare a summary and checklist for your coach, each item with a quote of up to 300 characters, along with up to 15 checklist items still open from your earlier check-ins so they are not repeated; the AI may suggest one looks resolved, quoting this check-in, and your coach decides. It is deleted with the check-in. How a confirmed decision worked out (your weekly weight trend and the measurements your coach chose to watch, before and after it) is calculated inside the app when your coach looks, without AI, and is not stored. When your coach asks for a draft of your planned weeks, your weight goal, recent weekly average weight, check-in cadence and protocol block names and dates are sent to our AI provider to propose a phase, goal and target weight for each week; your name, answers and messages are not sent, and nothing changes until your coach applies the draft. Each suggestion keeps a quote of up to 300 characters, an untouched suggestion is dismissed after 60 days, and a draft is deleted 30 days after it was made. These records move with you if you transfer to another coach and are deleted with your client record.
• Anything you type into the public demo - the assistant demo on our public website builds a day of meals from one sentence you write, without an account. If that sentence happens to include something about your own body - an allergy, an intolerance, a condition you eat around - it is sent to our AI provider so it can build the plan. We do not ask for it, we do not write it to any database, and it is not attached to an account or to a coach. See Section 8.
• Community moderation reports and flags - if you post in a community, another member can report your post or comment to that space’s coaches, choosing a reason and optionally writing a sentence. Separately, we read posts and comments members write and flag ones that look hostile, sexual or demeaning, or that give another member dosing or medication advice; a flag records a reason, a confidence score and one sentence for the coach. That reading is of your words only - it is never compared against your plan, your protocol or anyone’s records. A flag never removes anything: your post stays up until a coach looks at it. Coaches’ own posts are not read this way, and you are not told when something you wrote is reported or flagged.
• Saved coaching memories - short notes your coach or the assistant records so your coaching stays consistent between sessions (for example a food you will not eat, or an injury to work around). Your coach can see, edit and delete these. When newer information replaces one, the earlier version stops being used and is kept alongside its replacement for 12 months - with a record of why it was replaced - so your coach can see the change and undo it, after which it is permanently deleted.

Private Zyx coaching reviews also hold measurable goal baselines, targets and progress assessments; proposed plan changes, coach revision requests, acknowledgements, saved versions and decisions; source evidence; intervention history; scoped coaching instructions and their supporting edits; and follow-up expectations, dates, measurement comparisons and coach-recorded outcome notes. Applicable instructions are included directly in the next review, and relevant feedback may form a temporary search query for the coach's knowledge documents. Feedback instructions are not stored as vectors or used to retrain a model. Wording or plan edits and skipped drafts can suggest bounded candidate instructions, which are excluded from review context until the coach activates them. A preference confirmed for multiple clients can suggest a separate coaching default requiring its own activation. Follow-up comparisons do not establish that an intervention caused a health outcome.

2. Sources of the data

Platform support messages and bug reports may also contain health information you choose to include. Administrators can enable private Discord notifications, bounded Jev classification and isolated OpenRig sessions using Codex for engineering and Claude Code for advice and independent review. Separately enabled scans can include text and supported screenshots posted by members of selected Discord community channels, including people without a LaunchSite account. When such a report becomes a support case, the Codex and Claude Code sessions investigating or building it can also view still-image screenshots attached to those messages; the worker removes its copies when the job ends. Content transfer is disabled by default and requires a separate operator setting. These account-specific provider terms, retention and deletion limits are described in the provider register. When separately enabled, supported screenshot bytes are sent transiently to the configured Azure vision provider. Bounded derived observations may be retained and shared with existing triage and engineering providers. The web service does not retain raw image bytes or signed attachment links and does not copy them to private support threads; the support worker uses signed links only to download screenshots for its sessions and keeps those copies only while the job runs. Derived observations follow the source report deletion and retention lifecycle. When an administrator chooses to plan a private triage card of community messages, that card's bounded message text and any derived screenshot observations are also sent once to the configured Azure AI provider to separate its distinct requests into their own support cases; the short request titles it returns are kept with the private card only until a source message is edited, deleted or expires. If an administrator selects the example-based support classifier instead of Jev, bounded support text, earlier messages in the conversation and derived screenshot observations are sent to the configured Azure AI provider to label each request; only the label, its confidence and usage counts are kept. Other attachments are not copied by this support integration.

• Directly from you - through the client portal, check-ins, uploads, and messages.
• From your coach - the wellness coach you work with, who may enter or upload information on your behalf as part of coaching you.
• From the previous coaching account your coach chooses to capture - the optional LaunchSite Sync extension reads supported records and assigned-plan previews using the signed-in browser session. Source authentication and account-recovery fields are removed before upload. Captures stay in private staging until reviewed and follow the previous-platform record retention described in our Privacy Policy.
• From a device you connect, at your direction - the LaunchSite OS iOS app reads only the Apple Health categories shown on its connection screen after you approve Apple’s permission prompt. Apple Health imports the latest valid weight measurement per local day within the last 90 days, stored in pounds as daily summaries. Connect or Sync requests weight read access; automatic collection never requests new permissions. Empty results can mean no source measurement or unavailable read access, which Apple does not distinguish. In Android, Health Connect reads follow your in-app confirmation and Android read permissions. Once you connect this phone, sync runs when you open or return to the app (at most every five minutes), choose Sync now, or change permissions. Foreground sync reads at most the latest 30 local calendar dates, including today, and sends only daily summaries to LaunchSite for you and your coach. It requests no write, background-read or older-history permission. Health Connect is an on-device source, not a Google cloud recipient of this sync. A wearable account (Whoop, Oura, Fitbit, Ultrahuman) shares data only after you authorise the connection at that provider. We never receive a device password or credential, and we do not collect raw heart-rate samples.
• Generated by the platform - grades, analyses, transcripts, and inferences the software produces from the information above.
• Directly from you on our public website - the assistant demo in the homepage hero, which anyone can use without signing in.

3. Why we collect and how we use it

We collect and use consumer health data only to provide the wellness-coaching service that you or your coach requested, specifically to:

• Operate the coaching workspace and your client portal.
• Generate coaching outputs - wellness grades, suggested programs, lab summaries, reminders, and progress tracking.
• Enable communication between you and your coach.
• Show source-labeled device trends to you and your coach when you enable a connection.
• Secure, maintain, troubleshoot, and improve the service.
• Build the day of meals asked for in the public demo, and hold each network to three free builds a day so the demo cannot be used to run up our AI costs.

We do not use consumer health data for targeted advertising, we do not sell it, and we do not use it to train AI models.

4. Categories of data we share

We share the categories of consumer health data listed in Section 1 only as needed to provide the service, and only with the categories of recipients in Section 5. We do not share consumer health data with third parties for their own marketing or advertising.

5. Who we share it with

• Your coach - for coaching records, the wellness coach who owns your coaching relationship and any team members that coach has authorised. Your separate personal files, memory, conversations and uploaded labs remain private unless you explicitly share selected supported snapshots with your current coach.
• An external AI client selected by your coach - when the coach deliberately connects an MCP-compatible AI service, that service may receive the consumer health data needed for the coach's requested tool call. The coach can revoke future access in LaunchSite, while the external provider's own retention and privacy terms govern copies it already received.
• Service providers and connected sources. 21 providers and device sources in our register can access consumer health data, depending on the enabled feature. These include storage, hosting, AI and transcription services, and connected devices. Each is named at /privacy/subprocessors, with on-device sources identified separately from recipients of our transfers. Apple Health and Health Connect supply approved summaries from your device; this sync does not upload those summaries to Apple or Google cloud services. Applicable service terms and account settings govern provider processing and retention. Coach-selected message content and external integrations can also convey health information; a provider's category does not by itself guarantee that it never receives such content.
• Legal & safety - to comply with law or valid legal process, or to protect the rights, safety, and security of users and the platform.
• Affiliates / successors - an affiliate, or an acquirer in a merger or asset sale, subject to this policy.

We do not sell consumer health data, and we do not share it with data brokers.

6. Consent

We collect and process consumer health data to provide the coaching service you or your coach requested. Where the law requires consent for collecting or sharing consumer health data beyond what is necessary to provide that service, we will obtain it, and you may withdraw consent at any time as described below.

Apple Health daily sync reconciles only submitted categories and dates: missing values in that snapshot, including an empty successful snapshot, remove matching imported daily values. Unsubmitted categories and dates remain unchanged. The 90-day read window is not a retention limit. Workout imports use explicit source-deletion events; an empty workout query does not remove them.

Optional connections are separately consented. Connecting a device requires both an in-app explanation and the device maker’s own permission step. Disconnecting in LaunchSite OS stops future sync and deletes the imported device data from your workspace; you can separately revoke access at Apple Health, iOS Settings, Android Health Connect settings, or the wearable provider. Connecting a device does not itself enable AI processing.

For Health Connect, disconnecting or revoking every read category on a previously connected installation removes its imported summaries and connection. A new phone, reinstall or cleared local setup marker requires setup again and preserves your previously imported history. A provider block remains until you explicitly reconnect, so a delayed upload cannot restore the connection. Disconnecting does not revoke Android permissions; you can remove them separately in Health Connect settings. If you revoke one category, we remove its retained imported summaries when the app next reconciles Android permissions. These actions do not delete the source records on your device or in other apps.

Disabling workout sharing alone deletes imported workouts and their links while keeping daily totals and manual exercise logs. Withdrawing wearable or wellness-processing permission also stops workout sharing and removes these imports and links. Regranting permission requires enabling workout sharing again. Leaving, joining or changing a coaching relationship removes imported workouts and links and requires enabling sharing again. Hidden workouts stay in storage but are excluded from coach views and AI reads. Visible workout summaries can be read by your owning coach and, when your wearable and AI processing permissions allow it, by their requested AI tool. Workouts sync when you open or return to the iPhone app, or request a sync. Source-deletion events remove matching imports when received; an empty Health query is not treated as deletion.

Call recording. Your coach - not us - decides whether to record a coaching or consult call, and is responsible for obtaining the consent your jurisdiction requires from every participant before doing so. If you do not want a call recorded, tell your coach; if you believe a call was recorded without your consent, contact us at privacy@launchsite-os.com.

We do not sell consumer health data and therefore do not seek the separate authorization a sale would require.

7. Your rights

Subject to applicable law, you have the right to:

• Confirm & access - confirm whether we process your consumer health data and access it.
• Delete - request deletion of your consumer health data, including from our subprocessors.
• Withdraw consent - withdraw consent to our collection and sharing of your consumer health data.
• Appeal - appeal a refusal to act on a request.

For your personal workspace, use your account's privacy and export controls or email privacy@launchsite-os.com directly. For records in a coach's workspace, contact your coach or email us; fulfilling those requests may require us to coordinate with your coach. We will respond within the timeframe required by applicable law and will not discriminate against you for exercising a right.

8. Data retention & security

Health Connect's 30-day read window limits each sync, not how long approved summaries remain in your coaching record. Retained summaries follow the client-record policy below until disconnected, revoked as described in Section 6, or deleted with the account. The provider block contains no measurements and is also removed with the client record. We keep category-only setup evidence in the device cache, excluded from Android backup. Content-free sync tickets prevent delayed uploads from replacing newer readings; they expire after ten minutes and are removed when replaced, used, disconnected or deleted with the client record.

Client Zyx chat photos are private, including when a coach pays for AI. Uploading saves a draft; pressing Send shares the selected photos with our existing AI provider for that reply. Images are resized and re-encoded without EXIF/location metadata. Sent images stay with the conversation until the conversation or account is forgotten. Unsent drafts expire after 24 hours and are removed during scheduled cleanup. Removal revokes access immediately and queues storage deletion with retries after a one-hour delay. Provider copies and infrastructure backups follow their separate retention procedures. Photos are not automatically turned into memories.

Private Zyx review payloads, source excerpts, context and the review's copy of photo observations are purged during scheduled cleanup after 90 days from creation. When photo review is enabled, a dated copy of the derived observation is also kept in Zyx's coach-visible, photo-permission-gated Markdown history, including prior file versions, so the next review can compare with the preceding observation; that client memory follows the workspace's client-record retention rather than the 90-day raw-review window. Unfinished reviews expire before cleanup, with an active send lease allowed to finish. Private conversation messages, revision tasks, saved draft versions and structured follow-up checkpoints expire with the source review; messages and revision tasks also have a 90-day age limit. Raw feedback and instruction duplicate/conflict suggestion records expire after 180 days. Scoped instructions are separate records with a default expiry of 180 days for check-in or client instructions and 365 days for coach defaults; a different future expiry can be selected. Retired instructions are removed after 30 days. Compact review decisions remain with the workspace, goal assessments remain with the client record, and applied plans and sent messages follow their ordinary retention. Transferring a client to another coach removes the previous coach's private review history and client-specific instructions.

What you type into the public demo is not retained at all: the request and the plan it produced exist only for the length of that one request, and closing the page ends them. The only thing kept is a one-way hash of the network address, with a count, so the three-builds-a-day limit can be enforced; the address cannot be read back out of it, and it holds nothing you wrote. Everything below concerns the coaching workspace.

We retain consumer health data while your (or your coach’s) account is active or as needed to provide the service, then delete or de-identify it within a commercially reasonable period, subject to legal obligations. We protect it with encryption in transit and at rest, row-level access controls, private file storage served only through authenticated short-lived access, and least-privilege access for automated tooling. See our security practices and Section 6 of the Privacy Policy.

9. Breach notification

If a breach affecting consumer health data occurs, we will notify affected individuals and any authorities as required by applicable law, including the FTC Health Breach Notification Rule and applicable state breach-notification laws, within the timeframes those laws require.

10. Changes & contact

We may update this policy and will post material changes here with a revised date. Questions or requests: privacy@launchsite-os.com · LaunchSite OS, LLC.

This document is provided as a starting template and is not legal advice. Have a qualified privacy attorney review and adapt it for your business and the states in which your clients reside before publishing.