Your health data stays under your control.

Effective date: October 10, 2026
Operator: Enloq, Inc.

Scope and our role

Apex is a cloud-backed U.S.-only wellness, fitness, nutrition, and performance-education service for adults. This policy applies to the Apex iPhone app, website, and related support. Apex is not a medical device, healthcare provider, or emergency service. Apex is not represented as being covered by HIPAA.

Information we process

We process the following categories when you provide or enable them:

• waitlist information, including name, email address, signup source, contact consent, and confirmation that you meet the U.S. and age eligibility requirements;
• account and profile information, including name, email address, authentication identifiers, settings, birth year, goals, and preferences;
• an optional profile photo you choose to add, stored in private, owner-scoped storage and removable at any time;
• if you choose to let Apex use your location, an approximate position read on your device only while you are using Apex and turned into the name of your city or neighborhood on the device. Apex sends that name, never your position, with a Coach request that needs to know where you are (for example to find food near you that fits your plan, or to adapt a plan while you travel), does not store it, and does not use it for advertising or tracking. The choice is asked once, in setup or the first time you open a version that can use it, and you can change it at any time in Settings under Privacy & data. Apex does not use location for any other purpose without telling you in the app and asking again;
• health, wellness, nutrition, fitness, workout, biometric, medication, supplement, symptom, and goal information entered in Apex;
• if you choose to connect Apple Health, by default bounded daily summaries of the categories you select — body mass, body fat, lean body mass, resting heart rate, heart-rate variability, walking heart rate, heart-rate recovery, irregular-rhythm burden, VO₂ max, respiratory rate, blood oxygen, sleeping wrist and body temperature, blood pressure, blood glucose, sleep and its stages, time in bed, breathing disturbances, steps, distance walked, cycled and swum, flights climbed, pushes, stand time, exercise time, active and resting energy, running and cycling power, walking speed, step length, asymmetry, double support, steadiness, stair speed, six-minute walk distance, time in daylight, environmental and headphone audio exposure, the food and water you log elsewhere, mindful sessions, and workout duration — along with source counts and timestamps needed to keep those summaries accurate. Blood pressure and blood glucose are read so Apex can show them back to you beside your other measurements; Apex does not interpret them, score them, or use them to suggest a diagnosis. Apex does not request any reproductive-health category, and does not upload Health Records, location routes, or the names of the apps that recorded your data. Meals are the one exception to daily summaries: a meal another app saves to Apple Health is kept as a single entry (its time, food name, calories and macros) so it appears in your Apex food list and your Coach can see it, and Apex does not keep which app saved it;
• if you separately allow detailed Apple Health data (described below), minute-by-minute heart rate (the average, lowest and highest in each minute), steps, active energy, walking and running distance, walking speed and step length, and, every five minutes, heart-rate variability, respiratory rate, blood oxygen and sleeping wrist temperature, from the same Apple Health categories you already allowed, together with a record of when you said yes or no and the wording you saw;
• unless you turn Apple Health write-back off, identifiers linking a completed Apex-created workout or the exact saved calories and macronutrients in an Apex food entry to copies Apex writes in Apple Health. Apex does not write your water, scores, predictions, AI output, or inferred nutrition to Apple Health;
• lab reports, scans, extracted markers, corrections, notes, and summaries;
• Coach messages, AI context choices, generated plans, and progress reviews, and short facts Coach remembers from your conversations — a preference or routine you stated, or something you asked it to keep — which you can read and remove in Profile;
• optional meal photos and voice recordings that you submit to create editable logging drafts; and
• app version, request ID, and limited technical information needed for security, synchronization, and troubleshooting, including the AI feature category and request time needed to enforce usage limits; and
• if you separately enable Apex Remote Reminders and authorize notifications, a fresh Apple Push Notification service device token and installation identifier used to manage that opted-in reminder. We remove that record when you opt out, sign out, or switch accounts. Any remote reminder uses generic copy only and never includes health values, workout details, meals, or Coach content. Remote reminders are sent only to members who turn them on, and can be turned off at any time in Settings.
• product-interaction records describing how the app itself is used: when a session started and ended, which screens were opened and in what order, how long each was on screen, approximate scroll depth in quarters, which controls in the app (such as buttons and switches) were used and how many times, identified by a fixed name built into the app and never by what you typed, the value you set, or the item a control acted on, which onboarding steps were reached or abandoned, which sign-in method was used, and whether an action such as logging a meal, finishing a workout, or sending a Coach question succeeded or failed, with how long it took. These records are drawn from a fixed list of event names, screen identifiers, counts, durations, buckets, and preset labels, enforced in the app, on the server, and in the database. They cannot contain a food description, an exercise, a marker name or value, a lab or file name, a Coach message, a journal entry, a measurement, or any other content you enter or import into Apex — including how much of it you wrote. They carry no advertising or cross-app identifier. They are retained for 90 days, are tied to your account so they are exported and deleted with it, and are stored only in Apex's own backend; no third-party analytics service receives them. Apex also keeps a daily usage summary for each account, made from these records and from counts of the records you created that day: how many sessions there were and how long they lasted, time spent on each screen, how many times each feature was used, and what that day's AI requests cost. Summaries hold only counts and durations, never your content. They are kept for 13 months so usage can be compared across a year, are read only by Apex's operators to support and improve the app, and are exported and deleted with your account.

We ask only for approximate location, and we do not request contacts or advertising identifiers.

Sources and purposes

Apex stores account and application data with Supabase. It is not a local-only app.

Information comes from you, the device and features you choose to use, and the service providers that return results for your requests. We use it to create and secure your account; administer founding-access capacity and the waitlist; synchronize and display records; provide user-requested logging, labs, plans, reviews, reminders, and AI features; maintain offline work; respond to support; prevent abuse; and comply with law.

We do not sell personal or consumer health data. We do not use health, fitness, lab, photo, voice, or coaching information for advertising, cross-app tracking, or data-broker activity.

Apple Health is optional. Its daily summaries support visible, non-clinical wellness views in Apex. A completed Apex workout or a saved food entry's exact calories and macronutrients are written to Apple Health only after their own confirmation. Disconnecting Apple Health removes the summaries and any detailed data Apex imported into your account and withdraws your permission to store detailed data (you are asked again if you reconnect); it never deletes data from Apple Health. You can separately remove an Apex-created workout or food-entry copy from Apple Health in its Apple Health menu.

Detailed Apple Health data is a separate choice. If you separately allow it, Apex also stores your detailed Apple Health data — heart rate, steps, active energy and walking distance by the minute, and heart-rate variability, breathing rate, blood oxygen and wrist temperature every five minutes — in your private Apex account. It is off until you say yes: you are asked first, and you can turn it off or delete it at any time in Settings. It is used only to provide your own insights, activity detection and predictions; Apex never sells it, never uses it for advertising or marketing, and never shares it with third parties. If you turn on activity detection, Apex also keeps small counts of how you answer its suggestions (which times of day you dismiss them, how far you move a start or end, and what you rename) so the next suggestion fits you; you can erase them any time in Settings. It comes only from Apple Health, only from categories you already allowed, and never includes voice, photos, location, routes, or Health Records. If you say no, Apex keeps working on daily summaries. Turning it off stops new uploads and stops Apex from using what is already stored, which stays until you delete it; “Delete my stored detailed data” in Settings deletes it and turns storage off.

Continuous heart rate from a wearable is collected only after you declare the device and turn collection on. Apex stores 30-second averages, never per-second readings. Your iPhone remembers which strap you chose so it can reconnect to it; the server is told only the brand, never a hardware serial number. Turning collection off or removing the wearable stops collection; the readings already saved stay in your history until you delete your account.

Heart rate recorded during a workout is separate from continuous collection. When you record a workout live in Apex with a declared wearable or the Apex Watch app, Apex stores that workout's heart rate with it as 30-second averages, along with each set's average and peak, whether or not continuous collection is on. It is part of the workout you chose to record: deleting the workout deletes its heart rate, and deleting your account deletes all of it.

AI features

Apex uses AI as part of how the app works; it is not optional. When you use an AI feature, Apex sends the information needed for that request to a third-party AI processor. Depending on the feature, that can include a prompt, food description, selected meal photo, voice recording, lab file, or an image or PDF you attach in Coach. Coach requests include your stored profile and health context only after you choose personalized Coach. Until you answer, or if you choose chat-only, that stored health context is not included. Chat-only still sends the message and any attachment you choose to submit. Journal sharing has a separate choice. The minute-by-minute readings are never sent to an AI provider; only summaries Apex works out from them can be. Apex also uses an AI processor to estimate nutrition values you leave blank. Coach research may use third-party web-search grounding. AI output can be incomplete or wrong and is shown as educational guidance or an editable draft. Review it before saving a record or acting on it.

During a Review Meal voice correction, Apex sends the new recording and only the meal names, servings, and macros currently visible in that draft. It does not send meal history for that correction.

Service providers and disclosures

Apex discloses information only as needed to provide the features you request, protect the service, comply with law, or complete a business transaction subject to this policy. Each provider below is bound by contract to protect your information to the standard described in this policy, and to use it only to provide the service Apex asked them for — not for their own purposes. Current provider categories and recipients are:

• Cloud infrastructure: Supabase provides authentication, database, private file storage, and related backend services.
• AI processing and research: Google provides Gemini and Search grounding for user-requested AI features. Apex may add or change AI providers as the product develops; this list names the providers in use and is updated when they change. Whichever provider handles a request, the processing is as described above, and health context is never sent for a purpose beyond the request that needs it.
• Platform services: Apple provides Keychain, Speech recognition, notification authorization and APNs token issuance, widgets, Shortcuts, diagnostics, TestFlight, and App Store distribution.
• Legal and safety: information may be disclosed when reasonably necessary to comply with law, protect users, investigate abuse, or defend legal rights.

Apex has no affiliates with which it shares consumer health data.

Storage, retention, and deletion

Waitlist information is kept only as needed to administer access, until you ask us to remove it, or until the waitlist is discontinued. Joining the waitlist does not create an Apex account. You can withdraw by emailing the contact below.

Canonical account records are kept while your account is active or until you delete the applicable record. Apex does not deliberately store meal photos or voice recordings in its application database or file storage after the requested draft is processed. Local temporary files are removed after processing or cancellation. Private lab links expire, and on-device exports remain under your control.

Detailed data is kept at one-minute resolution for 400 days and at five-minute resolution after that, until you delete it, disconnect Apple Health, or delete your account.

Account → Privacy & account data lets you export information and permanently delete your account. A verified deletion request removes the active account and associated application records and files, and Apex directs relevant processors to honor the request. Limited information may remain temporarily in protected backups, security records, or where retention is required by law; consumer health data in backups subject to Washington law will be deleted within the legally permitted period, which is no longer than six months after authentication of the request.

Your choices and U.S. privacy rights

You can edit records, disconnect Apple Health to stop future imports, turn off or delete detailed Apple Health data, separately remove an Apex-created Apple Health workout copy, turn off AI health-context personalization, change or disable local reminders and remove their related APNs installation, export your data, delete records, and permanently delete your account. Depending on your state, you may also ask us to confirm, access, correct, or delete personal or consumer health data; provide a portable copy; identify third parties with whom it was shared; or withdraw consent from future collection and sharing.

Submit a request from Account → Privacy & account data or email pranu@enloq.co. We may need to verify your identity. We do not discriminate against you for exercising a privacy right. If we refuse a request, reply to the decision with “Privacy appeal” in the subject line. We will respond within the period required by applicable law and explain how to contact the relevant regulator if an appeal is denied.

Security

Apex uses encrypted network transport, private owner-scoped storage, database row-level security, protected on-device files, Keychain session storage, bounded uploads, and server-only administrative and AI credentials. No system is perfectly secure. Protect your password and exported files, and contact us promptly about suspected unauthorized access.

Age and availability

Apex is intended only for people who are at least 18 years old and are located in the United States. We do not knowingly collect personal information from anyone under 18. If you believe a minor has created an account, contact us so we can investigate and delete the account.

Changes and contact

We will post material changes here and update the effective date. Privacy questions and requests can be sent to: