Privacy Policy

1. Introduction

RCMC Medical Weight Loss ("we," "our," "us") operates the FITWithRCMC mobile application (the "App"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our App.

By using the App, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Personal Information

When you create an account, we collect:

• Name and email address
• Profile information (age, height, weight)
• Account login credentials

If you join through an invite or referral, we record which invite code or referring client was used to create your account. We use this information to attribute referrals and to provide referral rewards.

You are responsible for maintaining the confidentiality of your login credentials and for all activity that occurs under your account. If you believe your credentials have been compromised, you must notify us immediately at info@rcmcwellness.com and change your password. We use industry-standard password hashing and do not store passwords in plain text.

2.2 Health & Fitness Data

With your explicit permission, we collect:

• Apple Health (HealthKit) Data: Weight, steps, exercise minutes, and sleep data are read from Apple Health with your permission. When you log a weight in the App, we also write that weight back to Apple Health so your weigh-in also appears in your Health history. Nothing else is ever written to Apple Health, and we never modify or delete Apple Health data.
• Google Health Connect Data (Android): Steps, distance, weight, heart rate, sleep, and exercise sessions are read from Health Connect with your explicit consent. When you log a weight in the App, we also write that weight back to Health Connect so your weigh-in also appears in its weight history. Nothing else is ever written to Health Connect, and we never modify or delete Health Connect data. Write access is optional — declining it only disables weight write-back; read sync keeps working.
• Manual entries: Weight logs, progress photos, water intake, food logs, and habit tracking data you choose to enter.
• Food photos (Meal Photo Analysis): Food photos you submit for AI Meal Photo Analysis are stored on our servers (Supabase Storage) and attached to your meal log entry. They are not deleted after analysis. Your assigned coach can view your food photos and meal logs to review your nutrition and provide feedback. Photos remain part of your meal history until the associated entry is removed or your account is deleted.
• Workout data: Videos watched, workout completion, and exercise history.

We use this data solely to provide you with personalized fitness tracking and progress insights within the App.

2.3 Usage Data

We automatically collect:

• Device type, operating system version, and app version
• App interactions (screens viewed, features used)
• Crash reports and performance data

2.4 Location Data

Location (GPS) — only during Walk/Run tracking. We collect your device's location only while you are actively tracking a walk or run in the App. We use it solely to:

• Map your route and calculate your distance and pace
• Keep tracking accurately if your screen locks or the App is in the background during that session

Tracking stops when you finish or discard the session. We never track your location at any other time, and we never use it for advertising. We do not share your location with third parties. If you deny location access, the App still works — walk/run sessions record time instead of route and distance.

2.5 Coaching Session Data

When you book a 1:1 coaching session, we collect appointment and scheduling data, including the date, time, duration, your assigned coach, and session type. Video sessions are conducted live through our video provider (LiveKit) and are not recorded; we do not store video or audio of your sessions. Attendance, session status, and any session notes are saved to your account so you and your coach can track your progress.

2.6 Community Content

The App includes community features such as the Community feed, posts, likes, comments, shared workouts and Cardio activities, and Live Stream chat. Content you post to these features is visible to other App users. You can block another user, which prevents you from seeing their content and them from seeing yours. Only share information you are comfortable having other App members see. Live Stream chat history is stored as part of your usage data.

3. Use of Artificial Intelligence

FITWithRCMC uses artificial intelligence ("AI") in several parts of the App, including:

• RCMC AI Coach — an AI-powered chat assistant that answers questions and provides coaching-style guidance.
• AI Check-ins — automated check-in conversations that review your logged progress and respond with AI-generated feedback.
• Meal Photo Analysis — AI-based image recognition used to estimate food and nutrition content from photos you upload.
• Smart Meal Generation — AI-assisted generation of meal plans based on your program and macros.

You are interacting with AI, not a licensed medical professional, unless a message is explicitly identified as coming from your human coach. AI features are not doctors, dietitians, or therapists. They do not diagnose, treat, or provide medical advice, and are not a substitute for care from your physician or a qualified healthcare provider. AI-generated responses may occasionally be inaccurate or incomplete. If you have a medical concern, a possible emergency, or a question about a medication or health condition, contact your doctor or emergency services — do not rely on AI Coach or AI Check-ins for that purpose.

Photos, messages, and health data you provide may be processed by third-party AI providers acting as our service providers under contract. We do not permit these providers to use your data to train their own general-purpose models.

4. Data We Collect — At a Glance

We do not sell your personal information.

5. How We Use Your Information

We use your information to:

• Provide, maintain, and improve the App and its features
• Track your fitness progress and display it to you and your coach
• Send notifications (workout reminders, progress updates) — if you enable them
• Analyze usage patterns to improve the user experience
• Communicate with you about your account and subscription

6. Health Platform Integrations (Apple Health & Google Health Connect)

The App integrates with Apple Health (HealthKit) on iOS and Google Health Connect on Android, read-only except for the weight write-back described below. Specifically:

• We read weight, steps, distance, heart rate, sleep, and exercise data only with your explicit consent
• We write back only one data type: the weight you log in the App, saved as a weight sample so your weigh-in also appears in Apple Health / Health Connect. We never modify or delete data in Apple Health or Health Connect
• Weight write-back runs only if you grant write access. If you decline it, nothing is written and read sync continues to work normally
• We never share health platform data with third parties
• We never use health platform data for advertising, marketing, or analytics unrelated to the App's fitness features
• You can revoke access at any time: on iOS via Settings → Privacy → Health, on Android via the Health Connect app's permissions or your device's app permissions

Advertising carve-out. Health data from Apple Health (HealthKit) and Google Health Connect is never used for marketing or advertising purposes, and is never transferred or sold to third parties for advertising, ad targeting, or ad measurement — regardless of your ad preferences or account settings. Your health data is used only to provide the fitness features you have chosen to enable.

7. Data Storage and Security

Your data is stored securely using Supabase (SOC 2 compliant, encrypted at rest and in transit). We implement appropriate technical and organizational measures to protect your personal information.

All communications between the App and our servers are encrypted using industry-standard TLS/SSL protocols.

In the event of a data breach that compromises your personal information, we will notify you and the relevant authorities as required by applicable law, without undue delay after we become aware of the breach.

This Privacy Policy also protects the personal information of our coaches and staff — including their names, contact information, and schedules — under the same data-security and confidentiality commitments described in this policy.

8. Data Sharing

We do not sell your personal information. We may share data only in these limited circumstances:

• With your coach (as part of the RCMC program) to monitor your progress
• With service providers who help us operate the App (e.g., cloud hosting) — bound by strict confidentiality agreements
• To comply with legal obligations or protect our rights

Email providers. We use service providers to deliver email: (a) Resend processes emails sent through our authentication provider, such as password reset and account verification messages; and (b) GoHighLevel (GHL) and our email infrastructure send coaching, billing, and account notifications (for example, coach invitations and billing updates).

9. International Data Transfers

Your information is processed and stored on servers located in the United States by us and our service providers (including Supabase, Stripe, GoHighLevel, LiveKit, Cloudflare, and Resend). If you access the App from outside the United States, your information will be transferred to and processed in the United States, and by using the App you consent to that transfer and processing. We take appropriate safeguards to protect your information during transfer.

10. Your Rights

You have the right to:

• Access your personal data held by us
• Correct inaccurate data
• Request deletion of your account — we will deactivate your account and remove your data upon request; deletion requests are processed manually, typically within 7 business days
• Withdraw consent for Apple Health / Google Health Connect access at any time
• Export your data upon request

To exercise these rights, contact us at info@rcmcwellness.com.

11. California Privacy Rights

If you are a California resident, the California Consumer Privacy Act (CCPA) gives you the following rights:

• Right to know: you may request the categories and specific pieces of personal information we have collected about you, the purposes for which it was collected, and the categories of third parties with whom we share it.
• Right to delete: you may request deletion of your personal information, subject to certain legal exceptions.
• Right to opt out of sale/sharing: we do not sell your personal information, and we do not share it for cross-context behavioral advertising, so there is no sale or sharing to opt out of.
• Right to non-discrimination: we will not deny goods or services, charge different prices, or provide a different level of service because you exercised your privacy rights.

To exercise any of these rights, email us at info@rcmcwellness.com with "California Privacy Request" in the subject line. We will verify your identity before responding and will respond within 45 days (extendable by another 45 days with notice).

12. State Consumer Health Data Laws

Some states — including Washington (My Health My Data Act) and Nevada (SB 370) — provide additional rights regarding consumer health data. To the extent these laws apply to your data, we honor the rights they provide, including the rights to access, delete, and opt out of certain sharing of your health data. You can exercise these rights by contacting us at info@rcmcwellness.com.

13. Children's Privacy

The App is not intended for individuals under the age of 18. We do not knowingly collect personal information from minors.

14. Data Retention

Active accounts: we retain your personal information for as long as your account is active and for as long as needed to provide the App and comply with our legal obligations.

Inactive accounts: if your account has been inactive for 24 consecutive months, we may deactivate it; your data is retained as described below until you request deletion.

After deletion: once an account deletion request is processed, your account and associated data are removed; backups are purged within 30 days of deletion.

Billing records: financial records required for tax and accounting purposes are retained for 7 years as required by law.

Anonymized data: aggregated, anonymized analytics that no longer identify you may be retained indefinitely.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date.

16. Contact Us

If you have questions about this Privacy Policy, please contact us:

• Email: info@rcmcwellness.com
• Website: https://fitwithrcmc.rcmcmed.com
• Address: RCMC Medical Weight Loss, 800 Crystal Falls Parkway, Unit 7, Leander, Texas 78641, USA