Privacy Policy

Operated by Forma Labs Technologies, LLC

1. Who We Are and Scope

Forma Labs Technologies, LLC ("Forma Labs," "we," "us," or "our") operates InForma and is the controller responsible for the personal information described in this Privacy Policy.

This Privacy Policy applies to the InForma mobile application, beta and testing versions, AI trainer features, voice interactions, camera-based movement analysis, workout planning, connected health integrations, subscriptions, customer support, the in-app Help chatbot, and any future InForma website or service that links to this Privacy Policy.

InForma is initially available only to users located in the United States. It is intended only for individuals who are at least 18 years old.

This Privacy Policy does not govern employee, contractor, job-applicant, or business-representative information processed by Forma Labs in a workforce or business context.

2. Information We Collect

2.1 Account and authentication information

When you register, we collect information such as your first and last name, email address, password or authentication credentials, email-verification status, account identifier, and confirmation that you are at least 18.

You may register using email and password, Sign in with Apple, or Google sign-in. If you use Apple or Google, we receive the information you authorize that provider to share, such as your name, email address, and provider-specific identifier. We do not receive your Apple or Google password.

Supabase Auth manages registration, authentication, email verification, and sign-in credentials. Passwords are not stored in readable form.

2.2 Fitness profile and workout preferences

To create and personalize your workout plan, InForma may collect your age, sex, fitness level, height, weight, goals, selected muscle-group focus, workout time, plan duration, training days, workout environment, available equipment, exercise preferences, reminder settings, and other information that affects the workout.

Workout-environment choices such as My Gym, Travel Gym, or Outdoor describe your selected exercise setting. They are not precise GPS location data.

2.3 Limitations, pain, and health-related inputs

You may provide information about physical limitations, injuries, discomfort, or body areas that require exercise modifications, including the shoulder, neck, lower back, knee, hip, wrist, or elbow.

This information is optional, but not providing it may reduce InForma's ability to personalize or modify workouts. InForma does not request a detailed medical history and does not diagnose medical conditions.

2.4 Body measurements and progress photos

If you choose to use body-tracking features, InForma may collect your starting weight and optional measurements such as waist, chest, hips, bicep, and thigh measurements.

You may take a progress photo through InForma. After the photo is taken, you may save it to your device or discard it. InForma does not retain a copy after you make that selection and does not upload the photo to Forma Labs, Supabase, an AI provider, or another server.

2.5 Workout and performance information

We may collect workout-plan selections, completed workouts, exercises performed, session duration, repetitions, resistance or weight used, exercise replacements, training-day history, and other performance information stored with your account.

2.6 Connected health information

If you authorize a connection, InForma may read selected information from Apple Health, including heart rate, heart-rate variability, sleep, steps, and workout-related information.

If you authorize Google Health Connect, InForma may read steps, sleep, activity, and readiness information. InForma may write completed workouts back to Apple Health or Google Health Connect.

Connected-health information is processed locally on your device and is not stored in InForma's Supabase database. Live heart-rate information is used during the session and is not retained after the workout.

InForma does not connect directly to smartwatches, fitness trackers, or other wearable devices. Wearable-originated data may be available only through Apple Health or Google Health Connect.

2.7 Device, diagnostic, and optional analytics information

Sentry may process limited technical information needed to identify crashes, security issues, and performance problems, such as app version, operating-system version, device type, stack traces, and error category.

PostHog product analytics is disabled by default. If you opt in, PostHog may receive limited pseudonymous feature-use events. Session replay, screen recording, advertising identifiers, and cross-app tracking are not enabled.

2.8 Subscription and transaction information

Subscriptions are processed through the Apple App Store or Google Play. InForma may receive limited information such as plan, trial status, subscription status, renewal or expiration date, transaction identifier, store source, refund status, and RevenueCat entitlement status.

InForma and RevenueCat do not receive your complete card number, card security code, bank credentials, or app-store password.

2.9 Communications and support

We collect information you provide in support requests, including the message, account and device details needed to investigate it, and the support response. Support conversations may be retained as described below.

We may also process your email address, communication preferences, delivery status, and engagement information through Brevo for transactional and marketing communications.

3. How We Use Information

Create, authenticate, secure, and maintain your account.

Generate and personalize workout plans, exercise recommendations, alternatives, and reminders.

Apply limitations and Flare-Up Mode selections to modify workouts.

Provide AI trainer, voice, camera-analysis, and support features that you choose to use.

Read and write connected-health information with your authorization.

Process subscriptions, trials, entitlements, restorations, and cancellations.

Provide customer support and investigate technical, security, fraud, or abuse issues.

Send required service communications and optional reminders or marketing communications.

Measure reliability and improve the service using aggregate or de-identified information.

Comply with legal, tax, accounting, regulatory, and dispute-resolution obligations.

4. Legal Bases and Consent

Depending on the feature and the law that applies, we rely on performance of our contract with you, your consent, our legitimate interests, and legal obligations.

You may withdraw consent by removing saved information, turning off Flare-Up Mode, disconnecting health platforms, disabling camera or microphone permissions, turning off optional analytics, unsubscribing from marketing, or deleting your account. Withdrawal does not affect processing that occurred before withdrawal.

5. AI Trainer and Voice Processing

5.1 AI trainer

InForma uses Anthropic's Claude service to generate AI trainer responses. Depending on the current workout or request, InForma may send your first name and the profile, workout, equipment, limitation, Flare-Up Mode, and recent-session information relevant to the interaction.

InForma does not send your last name, email address, password, Supabase account identifier, profile photo, progress photo, payment credentials, or unrelated health-platform information to Claude.

5.2 Voice interactions

On eligible Premium and Elite plans, you may choose to interact with the AI trainer by voice. ElevenLabs processes audio for speech-to-text and processes the response text to generate the trainer's spoken reply. The resulting text and relevant workout context may be sent to Claude.

InForma does not retain AI chat content, voice audio, voice transcripts, responses, or spoken pain reports after the interaction ends. InForma does not create voiceprints or identify users by their voices.

5.3 No model training

Forma Labs does not use AI conversations, voice recordings, transcripts, pain reports, health information, workout context, camera data, progress photos, or movement-analysis data to train general-purpose AI, voice, or vision models.

We require external providers to apply available no-training controls. Zero-retention arrangements with Anthropic and ElevenLabs are a launch target and must be verified before publication. Until confirmed, those providers may temporarily process or retain information under their applicable commercial terms.

6. Flare-Up Mode and Pain Reports

Flare-Up Mode is optional and remains active until you turn it off. It does not create a permanent medical record.

When enabled, InForma may present alternative exercises intended to meet similar criteria, such as target muscle group, movement pattern, equipment, workout purpose, and difficulty.

On the Basic plan, you select among available alternatives at your own discretion. On Premium and Elite plans, the AI trainer may process the flare-up status and relevant limitations to recommend alternatives and adjust the workout.

On Premium and Elite plans, while voice credits are available, you may also report pain or discomfort to the AI trainer even when Flare-Up Mode is not active. The information is processed temporarily to pause, modify, or replace an exercise and is not retained by InForma after the interaction.

7. Camera-Based Movement Analysis

7.1 Optional Elite live movement analysis

On eligible Elite plans, you may choose to enable live camera-based movement analysis. The feature is off unless you activate it.

InForma uses the QuickPose SDK, which uses MediaPipe pose tracking, to analyze movement locally on your device and provide real-time form cues.

Live camera frames, workout video, body landmarks, joint coordinates, joint-angle calculations, and granular pose data are not uploaded to Forma Labs, Supabase, Anthropic, or another server and are not retained.

A movement-quality score may be generated for the session. The score remains only on your device.

This feature evaluates movement and is not used to identify or authenticate you. InForma does not create facial-recognition templates, persistent body-geometry templates, or biometric identity profiles.

7.2 Device permissions

You may stop camera analysis at any time by turning off the feature or revoking camera permission through device settings. Revoking permission disables camera-based analysis.

8. Automated Recommendations and User Control

InForma uses automated systems, including AI, to generate and adapt workout plans, recommend exercises, select alternatives, and provide feedback.

Recommendations may consider fitness level, goals, equipment, preferences, schedule, completed workouts, limitations, Flare-Up Mode status, and connected-health indicators such as sleep, activity, HRV, or readiness.

Connected-health indicators inform recommendations but do not determine whether you are medically fit to exercise.

You are not required to follow a recommended exercise. Each recommended exercise includes an option to view and select alternatives, including when equipment is occupied or unavailable, you dislike a movement, or another exercise better fits your environment or preference.

InForma does not use automated processing to make decisions that produce legal or similarly significant effects concerning employment, insurance, credit, medical eligibility, or access to essential services.

9. Who We Share Information With

QuickPose and MediaPipe process pose information locally under the intended configuration and do not receive server-transmitted pose data.

Kling is used to create a fixed library of general exercise videos. Kling does not receive InForma user information and does not create personalized member videos.

n8n is used for internal workflow automation, such as coordinating support and content-pipeline tasks, and may process limited operational data as a processor acting on our instructions.

We may disclose information where legally required, to protect users or the service, or in connection with a merger, acquisition, financing, reorganization, or sale of assets.

We do not sell personal information, display third-party advertising, use advertising SDKs, or share information for targeted or cross-context behavioral advertising.

10. Communications and Notifications

We may send service communications such as email verification, password resets, security alerts, support responses, billing or account notices, and material changes to legal terms.

Optional communications may include workout reminders, rest-day notices, progress check-ins, inactivity alerts, tutorials, product updates, promotional emails, general marketing emails, and a trial-expiration reminder.

Before starting a free trial, you may choose whether to receive an InForma trial-expiration reminder. If you do not enable it, InForma will not send its own reminder. The subscription will still convert to the selected paid plan unless you cancel through Apple or Google before the trial ends.

You may manage optional notifications in the app and device settings and unsubscribe from marketing emails using the unsubscribe link or by contacting support@formalabstech.com. Essential account, security, support, billing, and legal communications may still be sent.

11. Subscriptions, Trials, and Cancellation

Apple or Google processes payment credentials under its own terms. RevenueCat manages subscription status and feature entitlements for Basic, Premium, Elite, trials, upgrades, downgrades, renewals, and purchase restoration.

The trial duration, price after the trial, billing frequency, and automatic-renewal terms are displayed before you confirm a subscription.

You may access cancellation through Help & Support in the app. Cancellation is completed through the Apple App Store or Google Play subscription-management page.

Deleting the InForma app or deleting your InForma account does not cancel an active subscription.

12. Analytics, Quality Assurance, and De-Identified Information

PostHog analytics is optional and disabled by default. When enabled, it is limited to manual, pseudonymous events and excludes sensitive content.

Forma Labs may use aggregated or de-identified technical and product information to evaluate reliability, identify feature problems, understand general usage patterns, improve safety controls, and develop improvements.

We do not use raw AI conversations, voice recordings, transcripts, pain reports, health-platform values, camera images, pose landmarks, progress photos, or personally identifiable workout histories for general research or model training.

Internal product reporting must represent at least 20 users. We take reasonable measures to prevent re-identification and do not attempt to reconnect de-identified information to a user.

13. Retention

We retain personal information only as long as reasonably necessary for the purposes described in this Policy, applicable law, and legitimate business needs. As a general matter:

Account, profile, fitness, and workout information: retained while your account is active, and generally deleted from active systems within 30 days after account deletion is completed (see Section 14).

Customer-support records: generally retained for up to 24 months to resolve issues, maintain security, and identify recurring problems.

Sentry diagnostic and crash data: generally retained for up to 90 days.

PostHog analytics events and security logs: generally retained for up to 12 months.

Encrypted backups: generally rotated and overwritten within 90 days.

Billing, tax, accounting, and other records we are legally required to keep: retained for up to 7 years.

Legal holds may extend retention until the matter is resolved. Deleted information may remain temporarily in encrypted backups until those backups are overwritten and is not used for ordinary business purposes.

14. Account Deletion and Data Export

Settings > Data & Privacy includes Export My Data, Delete My Account, Data Sources, and consent controls.

After you request account deletion, the account enters a seven-day recovery period. You may restore it during that period.

If you do not restore the account, permanent deletion begins. Server-side account, profile, fitness, and workout information is generally deleted from active systems within 30 days after the recovery period ends.

Some information may be retained longer for support, security, billing, tax, accounting, fraud prevention, legal compliance, dispute resolution, or legal holds.

Deleting an account does not cancel an Apple or Google subscription. Information already written to Apple Health or Google Health Connect remains under your control through those platforms.

15. Security

Forma Labs uses administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure.

Encryption in transit and vendor-supported encryption at rest.

Multifactor authentication for production and vendor-administrator accounts.

Supabase role-based access and row-level security.

Separation of development and production environments.

Least-privilege access, access reviews, and personnel-change reviews.

Secret scanning, dependency monitoring, and secure development practices.

Sensitive-data filtering across Sentry, n8n, Supabase, and application logs.

Mobile security testing against OWASP MASVS before launch.

A written incident-response plan.

No security measure can guarantee absolute protection. If a security incident affects personal information, we will investigate, contain, and respond and provide notices where required by law.

16. U.S. Privacy Rights

Confirm whether we process your personal information.

Access and obtain a copy of your information.

Correct inaccurate information.

Delete personal information.

Obtain certain information in a portable format.

Withdraw consent for certain sensitive-data processing.

Appeal a decision about a privacy request.

Use an authorized agent where permitted.

Submit a request through Settings > Data & Privacy or email privacy@formalabstech.com. If you cannot access your account, you may use the email address or mailing address below.

We may request information reasonably necessary to verify your identity and protect the account. We will respond within the period required by applicable law and will not discriminate against you for exercising a privacy right.

17. Children and Age Eligibility

InForma is intended only for individuals who are at least 18. You may not create or use an account if you are under 18.

If we learn that an account belongs to a person under 18, we will suspend or close the account and delete associated information, subject to security, legal, and regulatory retention requirements.

18. Where Information Is Processed

InForma is operated from the United States and is initially available only to users located in the United States.

We and our providers may process information in the United States and other countries where they maintain infrastructure, personnel, or service operations.

Forma Labs may expand to additional countries in the future. Before entering another market, we will review applicable privacy and consumer-protection requirements, implement required safeguards, and update this policy.

19. External Services and Links

InForma may link to or interact with independently operated services such as the Apple App Store, Google Play, Apple Health, Google Health Connect, subscription-management pages, and email unsubscribe pages.

Those services may process information under their own privacy policies and terms. This does not limit the obligations of service providers that process personal information for Forma Labs under contract.

20. Not Medical Care

InForma uses health and fitness information to personalize workouts and provide exercise-related recommendations. InForma is not a medical service and does not diagnose medical conditions, provide treatment, or determine whether you are medically fit to exercise.

Detailed exercise-safety, eligibility, assumption-of-risk, subscription, and cancellation terms belong in the InForma Terms of Service and feature-specific notices.

21. Changes to This Policy

We may update this Privacy Policy. We will update the Last updated date and provide notice before a material change takes effect where required.

22. Contact Us

Privacy requests and questions:

Forma Labs Privacy Team

Email: privacy@formalabstech.com

Mail: Forma Labs Technologies, LLC, 2503D N Harrison St PMB 2104, Arlington, VA 22207-1640, United States

Technical, account, or product support:

Email: support@formalabstech.com

In-app: Settings > Help & Support