Privacy Policy — PulsoGym

Last updated: September 21, 2026 Version: 1.4

This is an English translation provided for the convenience of non-Portuguese-speaking users. In case of any divergence between this translation and the original Portuguese-language version, the Portuguese text prevails.

1. Who we are

PulsoGym is a fitness training app developed and operated in Brazil by WL PULSO APP LTDA (trade name WL PULSO), registered under CNPJ no. 68.826.888/0001-50, with its registered office at Rua Helena Abdalla, 25, Apt 702 Sala 1, Luxemburgo, Belo Horizonte – MG, CEP 30380-550, Brazil. For the purposes of Brazil's General Data Protection Law (Lei Geral de Proteção de Dados, Law 13.709/2018, "LGPD"), WL PULSO APP LTDA is the controller of the data described in this policy. When this policy says "we" or "PulsoGym", it means that company.

Data protection officer (encarregado): Leandro Dijon — support@pulsogym.com.br

WL PULSO APP LTDA has appointed Leandro Dijon as its data protection officer (encarregado), under art. 41 of the LGPD.

This same address handles requests for access, correction, deletion and portability.

2. The most important point: the app handles health data

PulsoGym lets a personal trainer record, about their students: a PAR-Q questionnaire, health conditions, medications in use, pain logs, physical assessments (weight, height, body fat percentage, heart rate, blood pressure, circumferences) and body progress photos.

And, if you connect PulsoGym to Health Connect (Android) or to Apple Health (iPhone), the app reads the workouts your watch or other apps record there — with distance, calories and heart rate — and, if you turn on that separate option, your resting heart rate, heart rate variability and sleep (section 3.8).

Under the LGPD these are sensitive personal data (art. 5, II). This means:

• Processing depends on specific, prominent consent from the person (art. 11, I), separate from the general acceptance of this policy.
• This data is never used for advertising, never sold or shared with third parties for commercial purposes, and not used to train artificial intelligence models. It only leaves our database for the processors listed in section 4, and only as far as necessary. The case worth highlighting is Vita, the trainer's AI assistant: when your trainer asks it for a routine, your training file, without your name or contact details, is processed by Anthropic, in the United States (section 3.9).
• The health file your trainer builds is accessed only by you and by the professional you are linked to. Not other students, not other trainers. Of the watch data, a few numbers from each workout go into the leaderboard of the challenges you take part in and, if you want, into the feed; resting heart rate, heart rate variability and sleep stay between you and your linked trainer (section 3.8).

If you're a student and don't want your trainer to record health data, simply don't authorize it — the rest of the app works normally. The same goes for the watch: connecting it is optional.

3. What we collect, and why

3.1 To have an account

The password is stored with an irreversible hash. No one at PulsoGym can read it.

3.2 Your training

Plans, days, exercises, sets, reps, loads, rest time, completed sessions, perceived exertion (RPE), pain logs and history.

Why: it's the app's core function. Legal basis: performance of a contract.

3.3 The social layer — what's visible

Posts, photos, comments, likes, friendships, groups, challenges and private messages.

Read carefully: the photos you post to the feed and your profile photo are kept in public storage. In practice, anyone with the direct file address can open it, even without an account in the app. The address isn't published and is hard to guess, but don't treat the feed as a private place. Photos you wouldn't post openly shouldn't go there.

Private messages and progress photos are kept in closed storage, accessible only to the people involved.

GIFs in comments. If you search for a GIF to comment with, the term you type is sent to Tenor, a Google service, together with the app's language. Of the results, we only keep the address of the GIF you choose, as the comment; the image stays on Tenor's servers, from where it is loaded by whoever sees the comment.

Instagram Stories. When you tap to share to Stories, the image is put together on your device and handed to the Instagram app. From then on, Meta's policy applies.

3.4 If you have a trainer in the app

The professional records on your file: contact details, date of birth, sex, goal, occupation, addresses, attendance, amounts and due dates, contract and attachments, a follow-up diary, and the health data from section 2.

Legal basis: consent (art. 7, I; art. 11, I for sensitive data), given at the moment the link is created. You can undo the link at any time.

If the trainer creates a file for someone who has no PulsoGym account, it is the trainer who obtains that person's consent to record health data, outside the app (Terms of Use, section 8).

3.5 On your device

Your chosen language, weight unit and paused workouts stay only on your device, and disappear when the app is uninstalled.

3.6 Push notifications — your device token

If you allow notifications, we store a push token: a code that identifies the PulsoGym installation on that device, generated by Expo together with Apple or Google. We also store the platform (ios or android) and the date.

Why: without that code the server has nowhere to send the alert. Legal basis: performance of the contract, plus the consent your operating system asks for before any notification can arrive.

To reach your device, the short text of the alert — for example, "Ana commented on your workout" — passes through Expo and through the notification service of Apple (iPhone) or Google (Firebase Cloud Messaging, on Android).

Three things worth saying plainly:

• The token is not used to track you. It leaves our database for one place only: Expo's push service, which hands it to Apple or Google. It never goes to an ad network or a data broker.
• It is linked to your account, which makes it a device identifier tied to your identity — that is how we declare it on the App Store.
• It removes itself: signing out deletes the record, and uninstalling the app makes the server delete it on the first delivery attempt. Denying notifications in your device settings means it never exists at all.

3.7 Where you trained — location

At check-in — the record of a workout with a place and a photo — you can tap "Use my location". Only at that moment, and only with the app open in front of you, do we ask for the device's location permission — never in the background, never when you open the app. If you decline, check-in keeps working: just write the place by hand.

What we do with it:

• We store it with the workout session: the coordinate (latitude and longitude), the gym name and the place text. It is the "where" of that workout; the people who see the session are you and, if you are linked to one, your trainer.
• We look for gyms nearby. For that we send only the coordinate and the search radius to OpenStreetMap (the public Overpass server, overpass-api.de) — no name, no email, no identifier of your account at all. The query is anonymous, and of what comes back we only keep the gym you choose.
• It appears to other people, under a rule. The check-in also becomes a post, and the post carries the place: a small map on it and, for anyone with a PulsoGym account, on Pulso Map (last 30 days). If you don't pick a gym from the list, the coordinate shown is rounded to about 110 meters — the exact one stays only in your session. Your name and the workout title only show next to the place when the post is public; otherwise, only the activity and the place show, without identifying you. If you join the territory game, this rule has an exception: see section 3.10.

When you open Pulso Map. If you have already granted the location permission, the app also uses it when you open Pulso Map: it reads the device's last known position only to center the map and show your dot — without asking for the permission again and without storing that position. In Territories mode, the app asks the server for the territories in the area shown on screen, which on opening is centered on you; that query only serves to draw the map and is not stored.

Legal basis: performance of a contract, and the consent your own operating system asks for before the first coordinate exists. You can withdraw it at any time in your device settings.

3.8 Watch data: Health Connect (Android) and Apple Health (iPhone)

It's optional and starts off. Nothing is read until you open My connections in the menu, choose Health Connect or Apple Health, tap Authorize and accept the system's permission sheet. The phone app only reads: it writes nothing to Health Connect or to Apple Health.

What we read on Android (Health Connect):

• Exercise sessions — type, start and end, the source app and device, the title that app gave the workout, and whether it was entered by hand.
• Distance, active calories and heart rate recorded during each session. We store the workout totals and the average and maximum heart rate — not the heartbeat series.
• Steps, only within the window of a workout you log at check-in. We store that workout's total.
• History: on the first connection, the workouts from the last 90 days, so that your history and ongoing challenges already count what you did before connecting. To go beyond 30 days, Health Connect asks for a permission of its own.
• Background reading: with Sync automatically on — and it comes on —, a system task imports new workouts roughly every 15 minutes, even with the app closed. On Android 14 or newer, this depends on a separate permission; if you decline, importing only happens when you open the app.
• Recovery, only if you turn on "Import recovery data" — which comes off and asks for a separate permission: resting heart rate, heart rate variability (HRV) and sleep (start, end, minutes asleep and the time in each stage). One record per day: the first import covers 30 days; after that, the last 3 days on each sync, including the background one.

On iPhone (Apple Health) we read the same set — workouts with distance, active calories and heart rate, steps and, with the same separate switch, resting HR, HRV and sleep —, with the same 90- and 30-day windows. In the background, iOS wakes the app when a new workout comes in. If Apple Health is not connected, check-in steps come from the iPhone's own motion sensor. A workout's GPS route is only read if you play territories and authorize it separately (section 3.10). And, if you use PulsoGym on Apple Watch, the watch reads your heart rate and calories during the workout to show them on its screen and, at the end, saves the strength workout to the Health app; those two numbers do not come to our database.

What we use it for:

• The imported workout goes into your history and your week, and counts in the challenges you take part in — each challenge's organizer chooses whether watch workouts count. A workout typed by hand into Health Connect or Apple Health shows up in your history, with a label, but does not count in challenges.
• Recovery shows on the Recovery card, in your Progress, and does not count in any challenge.
• Steps show on that workout's check-in.

Who sees it:

• You.
• The trainer you are linked to: the imported workouts and, if you turned on recovery, resting HR, HRV and sleep.
• Anyone who can see a challenge you take part in — in a public challenge, anyone with a PulsoGym account: the number of workouts, time, distance and calories that counted on the leaderboard. Heart rate, HRV and sleep never go on the leaderboard.
• Your friends, only if you want: with Post imported workouts to the feed on (it comes off), each new workout becomes a post for friends with type, duration, distance, calories and average heart rate. The same applies when you share an imported workout by hand.
• Anthropic, through Vita, if your trainer uses it: it receives only the day, the modality, the minutes and the intensity of cardio workouts — no distance, no heart rate, no recovery (section 3.9).

We never sell this data, never use it for advertising and never pass it to advertisers, data brokers or any other third party beyond those described in this policy.

Legal basis: consent (art. 11, I), given when you authorize on the system sheet — and which you can withdraw at any time.

How to stop (in My connections, on the Health Connect or Apple Health screen):

• Pause: turn off Active — the app stops importing, without revoking the permission.
• Background only: turn off Sync automatically.
• Recovery only: turn off Import recovery data.
• Revoke: on Android, in Health Connect → App permissions → PulsoGym; on iPhone, in the Health app's data permissions.

How to delete. Pausing or revoking does not delete what has already been imported, and today there is no button that deletes everything that came from the watch at once. To delete:

• One workout: delete it in Health Connect or Apple Health. With the connection active, the next sync also deletes it from PulsoGym, together with the posts made from it.
• Everything that came from the watch, recovery included: write to support@pulsogym.com.br.
• Everything, at once: deleting your account deletes this data with it (section 5).

How long: as long as your account exists, or until you delete it as above.

3.9 Vita, the trainer's AI assistant, and Anthropic

If you have an account and a linked trainer, they can ask Vita to build or adjust a draft of your routine. Vita lives in the trainer's desk — the browser version of PulsoGym. The draft only reaches you after the trainer reviews and saves it.

With each request, we send to Anthropic — a United States company that provides the artificial intelligence model Vita uses —, through its API:

• your training file without identification: age (not your date of birth), sex, goal, level, training places, availability, activities and weekly volume you reported, hours of sleep and resting HR noted in the file, health conditions with the notes written in them, contraindications, surgeries and medications with their notes;
• your strength history for the last 8 weeks (best load and reps per exercise) and your estimated 1RM;
• your cardio for the last 8 weeks — day, modality, minutes and intensity —, including the workouts imported from your watch (section 3.8);
• the current routine, when the request is to adjust it;
• the request the trainer wrote, exactly as they wrote it, and the list of exercises in the catalog.

What does not go: name, email, phone, date of birth, occupation, address, emergency contact, photos, physical assessments, location, messages, or the watch's recovery data.

Why: so that the proposed routine respects your history, your limitations and what you already do. Legal basis: the same as for the file (section 3.4), the consent given when the link was created.

What Anthropic does with it. Under the rules Anthropic publishes for the commercial customers of its API, consulted on September 21, 2026, it acts as a processor and processes the data only to answer the request (privacy.claude.com), does not use it to train its models, and deletes inputs and outputs within 30 days — except for the exceptions it lists, such as content flagged for violating its usage policies, which may be kept for up to 2 years (privacy.claude.com).

In our database, the text of the request and the draft are kept as long as your account and the trainer's exist.

3.10 The territory game

The game is optional and starts off. You join in Settings → Join the territory game and leave whenever you want in Settings → Leave the game. When you join, your workouts from the last 30 days that are valid for the game start to count.

What counts:

• Places — gyms and pools. A check-in with a place scores, as long as the workout's coordinate is within 500 m of the place. If the gym is not in the registry, you can create it: the name and the coordinate go into a registry of places that anyone with an account can see.
• Streets — iPhone only. Outdoor runs, walks and rides imported from Apple Health. For this the app asks, separately, for permission to read the route the watch recorded, and only reads it with the app open. The route becomes a count of passes through hexagons on a map — about 350 m across for running and about 900 m for cycling. We store that count, the distance and a simplified line of the route, without the first and last 50 m. The Android app does not read routes.

What others see:

• Anyone with a PulsoGym account, even people who don't play, sees the territory map: who owns each place and each hexagon, with name and photo, and the top five of each territory, with their points. In practice, this shows that you train often at a gym or run in a neighborhood — even if your check-ins are for friends only.
• Players also see the route lines of other players who went through a hexagon in the last 30 days, with name and photo, and the route on a workout's post, when they can see that post.
• Someone who loses a territory to you may receive an alert with your name.
• Between people who have blocked each other, name and photo don't show, routes aren't shown and the alert isn't sent.

What the 50 m cut does not hide. We cut the ends of the line so that the drawing doesn't point at your front door. But the hexagon count uses the whole route: the hexagon where the workout starts and ends — often your home's — scores like any other, and the line usually ends inside it. Anyone who sees the map or the post can infer the approximate area you set out from; and, if you are the owner or among the top five of that hexagon, your name appears on it. If you share the workout artwork to Instagram Stories, the hexagons go along, uncut. If this bothers you, don't authorize route reading: places still count.

Leaving the game deletes your points and removes you from the leaderboards and the map. Routes already recorded stay stored, visible only to you, until you delete the workout or the account.

Legal basis: performance of a contract — the game is a feature you choose to use —, and the consent the operating system asks for before the app reads location or routes.

3.11 Installation identifiers and technical data

Besides the push token (section 3.6), three technical identifiers exist because of services the app uses:

• App updates (Expo). To receive fixes without going through the store, the app checks Expo's servers when it opens and sends a random code created at installation (the EAS Client ID), with the platform and version. That code is not stored in our database or linked to your account.
• Notifications on Android (Google). Firebase Cloud Messaging creates an identifier per installation (the Firebase Installation ID) to deliver notifications. According to Google, it does not uniquely identify a person or a device (Firebase documentation).
• Maps on Android (Google). On Android, the app's maps are Google Maps. According to Google, the Maps SDK collects technical device data (model, system version), IP address, crash reports, a pseudonymous identifier of its own and the movements you make on the map, such as dragging and zooming (Google Maps documentation). On iPhone, the maps are Apple's.

3.12 What we do NOT collect

We don't collect background location, contacts from your device's address book, advertising identifiers, or browsing history. The app has no usage analytics, crash reporting or advertising SDK. There is no cross-app tracking, and we don't sell data to anyone.

Two caveats, so that this list is exact:

• On iPhone, if you play territories and authorize it, we read from Apple Health the route the watch recorded (section 3.10). It is location data, but read with the app open, from what the watch has already recorded — not the device's GPS in the background.
• The push token (section 3.6) and the identifiers in section 3.11 serve to deliver alerts, update the app and draw maps. None of them is an advertising identifier, and we don't use them to follow you across other apps or websites.

4. Where the data is kept, and international transfer

The main infrastructure is Supabase (database, storage and sign-in), hosted on Amazon Web Services in the us-west-2 (Oregon, United States) region. These are the providers that process your data so the app can work:

In other words: your data is stored and processed outside Brazil. The LGPD allows this (art. 33), and the basis here is your specific, prominently informed consent — which is what this paragraph provides.

None of these providers is authorized to use your data for their own purposes; they act as processors, handling only what's necessary for the app to work.

Third-party services that are not our processors. Some features talk directly to services that follow their own rules. On our side, we send none of them your name, your email or your account identifier:

• OpenStreetMap (Overpass server): the coordinate and radius of the gym search (section 3.7).
• Tenor, from Google: the GIF search term and the app's language (section 3.3).
• Google Maps, on Android: the technical data in section 3.11.
• Instagram, from Meta: the image you decide to share to Stories (section 3.3).
• Apple Maps or Google Maps: when you tap to open a place in one of those apps, the place's coordinate — and the gym's name, when there is one — go to it.

As with any access over the internet, your device's IP address reaches these services.

5. Your rights, and how to exercise them

The LGPD (art. 18) guarantees that, at any time, you can:

About deletion

When you delete your account, you choose between:

1. Leave the file with the trainer — your account and everything you created are erased; the file the professional built stays with them, unlinked from any account. This is what professional regulation usually requires of them.
2. Erase everything — including the file, assessments and progress photos.

If you are a trainer, your students' files — data, health, assessments, photos, diary, schedule and finances — are deleted with your account. The app offers to export them first.

Deletion is immediate and irreversible. Backup copies kept by the infrastructure provider are overwritten in their retention cycle, within 30 days.

6. How long we keep it

• While the account exists: all data covered by this policy, with what sections 3.8 (watch), 3.9 (Vita) and 3.10 (territories) say about deleting it sooner.
• After deletion: nothing, except the items below.
• File with the trainer: when you choose to leave it with them (section 5).
• Backup copies: up to 30 days.
• Reports: those made about your account or your content remain recorded for as long as necessary for moderation, even after the reported account is deleted. Blocks do not: they disappear when either of the two accounts is deleted.
• Territory game places you registered (name and coordinate of a gym or pool) remain in the registry, with no link to you.
• Monthly territory trophies: the record of who owned each territory in each month keeps your account's internal code and the points, with no name, photo or route. No one else sees it.
• At Anthropic: what was sent through Vita follows the period described in section 3.9.

7. Security

• All traffic is encrypted in transit (HTTPS/TLS).
• Access to data is restricted by rules in the database itself (Row Level Security): authorization doesn't depend on the app, but on the server.
• Watch data follows those same rules: only you and your linked trainer can read your imported workouts and your recovery data.
• Progress photos and contract attachments are kept in private storage, with temporary 1-hour links.
• The Anthropic access key stays on the server only; the app never talks to it directly.
• Passwords with an irreversible hash.

No system is infallible. If an incident occurs with meaningful risk to your rights, we will notify you and the ANPD (Brazil's data protection authority), as required by art. 48 of the LGPD.

8. Children and teenagers

PulsoGym is for adults 18 and over only. We do not create accounts for minors, and at sign-up you must declare that you are 18 or older.

The reason is straightforward: the app handles health data, and processing a child's or teenager's data requires specific, prominent consent from a parent or legal guardian (art. 14 of Brazil's LGPD), genuinely verified. We would rather not offer the service to minors than offer it without that care.

If we find that an account belongs to someone under 18, it is closed and the data deleted, with no prior notice and no way to recover it.

If you are a parent or guardian and have identified a minor's account, write to support@pulsogym.com.br. We close the account and delete the data as soon as we confirm it.

9. Content published by users

Posts, comments and messages are the responsibility of whoever writes them. The app offers report, block and hide, and reported content is reviewed within 24 hours. Content or accounts that violate the Terms of Use may be removed without notice.

Workouts and recipes published by users are not medical guidance. Consult a health professional before changing your exercise or eating routine.

10. Changes to this policy

If we change something material, we'll notify you in the app before the change takes effect. A change that expands the use of sensitive data will require new consent — silence is not enough.

11. Contact

support@pulsogym.com.br

WL PULSO APP LTDA (trade name WL PULSO) · CNPJ 68.826.888/0001-50 · Rua Helena Abdalla, 25, Apt 702 Sala 1, Luxemburgo, Belo Horizonte – MG, CEP 30380-550, Brazil.

You can also file a complaint directly with Brazil's National Data Protection Authority (ANPD): gov.br/anpd