Legal · Washington My Health My Data Act

Consumer Health Data Privacy Policy

Effective date: 09 August 2026 · Last updated: 09 August 2026

I Can Do Hard Things, LLC, a Florida limited liability company (“ICDHT,” “we,” “us”).

This Consumer Health Data Privacy Policy describes how I Can Do Hard Things LLC (“ICDHT,” “we,” “us”) collects, uses, and shares “Consumer Health Data” as defined by Washington’s My Health My Data Act (RCW 19.373). It applies to all users of ICDHT, regardless of location, to the extent required by law. The same rights described here are honored where Nevada and Connecticut consumer-health-data provisions apply. I Can Do Hard Things LLC does not sell Consumer Health Data, so no separate state authorization to sell is triggered.

This policy is separate from, and in addition to, the ICDHT Privacy Policy, which is linked distinctly at https://icandohardthings.fit/privacy.htmlhttps://icandohardthings.fit/health-data-privacy.html

The fact that shapes everything below: ICDHT has no servers. We do not operate a backend, a database, or an account system. Your Consumer Health Data is created and stored on your own iPhone. It leaves your device only in the limited circumstances described in Sections 4 and 5, and only where you have taken an action that sends it — connecting Strava, authorizing Apple Health, or searching for a race. Free-trial eligibility is tracked through an Apple ID-linked purchase record so that reinstalling the app does not grant a second free trial. That record is account-identity information handled by Apple, not Consumer Health Data, and it is addressed in the ICDHT Privacy Policy and the Terms of Service.

1. Categories of Consumer Health Data We Collect

Precise geolocation data collected during run tracking — GPS coordinates, routes, distance, pace, and elevation gain/loss, including background location while a run is in progress
Fitness and workout data — completed runs (GPS-tracked and manually logged), workout completion history, effort and feeling ratings, streak data, and calorie estimates
Health and fitness data synced through Apple HealthKit, where you have granted authorization — distance, duration, pace, and workout records
Injury information you voluntarily enter — injury type and the resulting training plan volume/intensity adjustments
Recovery and physical-therapy exercise logs — structural checklists of completed routine tasks
Workout schedule data written to your device calendar — if you export your training plan, workout type, date, and duration are written as calendar events on your device. This stays entirely on-device through Apple's EventKit framework; it is never sent to us or to any third party
Physical activity, pace, and training-plan data used to infer your fitness milestones, training timelines, and readiness metrics

We collect this data solely because it is structurally necessary to provide the algorithmic training plans you have requested. We do not collect Consumer Health Data for any secondary purpose.

Planned but not yet collected: a future optional Pro feature (“Zone 2 training”) may require heart-rate data. Heart-rate data is not collected today. Before that feature ships, we will update this policy to add heart rate as a collected category and will obtain any renewed authorization or consent required at that time.

2. Sources of Consumer Health Data

Directly from you — onboarding prompts (name, target goal, baseline pace, target races, injuries, available training days, weekly mileage volume) and ongoing manual logs
From your device’s location services — during active run tracking, including background tracking while a run is in progress
From Apple HealthKit — only where you have explicitly granted system authorization
From Strava — runs you have recorded on Strava, if you choose to connect your Strava account

To generate, adapt, and rebuild your personalized multi-race training plan
To record and display your run history, routes, splits, and performance statistics
To recommend injury-appropriate exercises and warmup/cooldown guidance
To match HealthKit- or Strava-recorded activity with your planned workouts
To display your running streak metrics and cumulative training summaries
To let you send runs you logged in ICDHT to your own Strava account, if you choose

We do not sell Consumer Health Data. We do not use it for advertising, do not share it with data brokers or advertisers, do not use it to build profiles for any purpose unrelated to ICDHT’s core training features, and do not bundle third-party analytics or advertising SDKs.

ICDHT itself receives no Consumer Health Data — there is no ICDHT server to receive it. Data leaves your device only in these situations:

Recipient	What is shared	When
Strava, Inc.	Import: runs you recorded on Strava are read into the app. Export (planned, not yet built): once export ships and you enable it, runs you log inside ICDHT — distance, duration, pace, GPS route and coordinates, elevation — will be sent to your Strava account.	Import occurs once you connect your Strava account. Export is planned and not yet built. Once it ships, export will occur only for runs you choose to send, or automatically if you turn that setting on. Your Strava authorization token is stored locally on your device and is never transmitted to us.
Apple, Inc. (HealthKit)	Workout records — distance, duration, pace, calories	Only where you have authorized HealthKit access. HealthKit is an on-device Apple framework; the data remains under Apple’s control on your device.
Open-Elevation API	Geographic coordinates only (latitude and longitude), not linked to your name, account, or any identifier	When elevation or terrain data is looked up for a race location or run route
RunSignup API	Your race search query, such as a race name or location. No health data and no user identifier is sent.	When you search for a race during onboarding or plan setup

No Consumer Health Data is shared with advertisers, data brokers, analytics companies, or any other commercial third party.

Fitness platforms you choose to connecthttps://support.strava.com
Apple, Inc.https://privacy.apple.com
API service providers necessary for app functionalityhttps://github.com/Jorl17/open-elevation

Once your data is in Strava or Apple Health, it is governed by their privacy policies, not this one. We encourage you to review Strava’s Privacy Policy and Apple’s Privacy Policy.

6. Affiliates Who Receive Consumer Health Data

ICDHT has no corporate affiliates and does not share Consumer Health Data with any parent or subsidiary corporate entities.

7. Your Rights and How to Exercise Them

You have the right to: - Confirm whether we are collecting, sharing, or selling your Consumer Health Data - Access your Consumer Health Data, including a list of all third parties with whom it has been shared and an active contact for each - Withdraw consent to the collection and sharing of your Consumer Health Data - Request deletion of your Consumer Health Data - Be free from discrimination for exercising any of these rights

Because your data is stored entirely on your own local device, you can exercise these rights immediately, without contacting us:

Access. All of your Consumer Health Data is visible inside the app — your profile, training plan, run history, run details with routes and splits, exercise log, and streak.
Withdraw consent. Turn off Location access, Health access, or Calendar access for ICDHT in iOS Settings, and disconnect Strava (or disable Strava export specifically, while keeping import) in the app. Revoking a permission stops further collection or sharing immediately.
Delete. Use Settings → Delete All My Data in the app to permanently erase everything ICDHT has stored on your device. Deleting the ICDHT app from your device has the same effect. Either action is permanent and cannot be undone by us, because we never had a copy.
Delete data already sent to a third party. Data you previously synced to Strava or Apple Health lives in those services and must be deleted there. On your request, I Can Do Hard Things LLC will forward a deletion request to Strava on your behalf, at Strava’s support channel https://support.strava.com. You can also delete the synced data yourself, using Strava’s or Apple Health’s own deletion controls.

To make a formal request or ask a question, contact us at Support@icandohardthings.fit. We will respond within 45 days of receipt. If we deny your request, we will explain why in writing and provide an appeal path. I Can Do Hard Things LLC will decide any appeal within 45 days of receipt and explain the decision in writing. If we deny your appeal, we will give you a method to contact the Washington Attorney General to submit a complaint.

We collect, use, and share Consumer Health Data only as necessary to provide the training features you have requested, or with your consent: - Location tracking occurs only after you grant iOS location permission, and only during an active run. - HealthKit data is read or written only after you grant HealthKit authorization. - Strava import occurs only after you connect your Strava account through Strava’s own authorization flow. Strava export occurs only for a run you actively send, or after you separately turn on automatic export. Today, ICDHT collects Consumer Health Data only as necessary to provide the training features you request, so no separate collection consent applies. Any sharing of your Consumer Health Data occurs only after a consent that is separate and distinct from any consent to collect. If ICDHT adds an automatic-export setting, turning it on requires a separate opt-in, given before the first automatic export.

We do not sell Consumer Health Data, and we will not do so without first obtaining your separate, valid written authorization as required by RCW 19.373.070.

9. Data Security and Retention

Storage location. All Consumer Health Data is stored locally on your device using the operating system’s app storage. It is protected by your device’s own protections — passcode or Face ID, iOS file-level encryption, and the iOS application sandbox.
In transit. All communication with third-party services occurs over encrypted HTTPS/TLS connections.
No servers, no accounts. ICDHT operates no servers and requires no account, so there is no central store of user data to breach, and no corporate employee has access to your Consumer Health Data.
Retention. Your Consumer Health Data is retained on your device for as long as you keep the app installed and choose to keep it.

10. Geofencing

Consistent with Washington law, ICDHT does not use geofencing technology to identify or track consumers, to collect Consumer Health Data from consumers, or to send notifications, messages, or advertisements to consumers relating to their Consumer Health Data or health care services, within 2,000 feet of any in-person health care service provider.

11. Children

ICDHT is for users 18 and older. Users 13 to 17 may use ICDHT only with the consent and supervision of a parent or legal guardian. ICDHT is not directed to children under 13, and we do not knowingly collect Consumer Health Data from children under 13.

12. Changes to This Policy

If we make material changes to this policy, we will update the “Last Updated” date above and, where required by law, obtain your renewed consent.

13. Contact

Questions or requests: Support@icandohardthings.fit