SportVitals Privacy Policy

Last updated: August 31, 2026

SportVitals (“we”, “our”, or “the app”) is committed to protecting your privacy. This privacy policy describes how your personal and health data is handled, stored, and protected when you use the SportVitals application for iOS and watchOS.

1. 100% On-Device Processing & Privacy-First Architecture

SportVitals is designed to be completely private, offline, and on-device. All physiological data analysis, metric computations (such as Body Battery, HRV Status, Sleep Score, and Training Readiness), and database storage are performed entirely locally on your physical device. We do not operate external cloud servers, and we never collect, upload, sell, share, or transmit your personal or health data to any third party.

2. Apple HealthKit Integration

SportVitals integrates with Apple HealthKit (Apple Health) to read fitness and physiological data (including heart rate, heart rate variability, sleep stages, and workouts) in order to calculate advanced recovery and performance metrics.

• Local Access Only: Data read from HealthKit is processed locally on your iPhone and Apple Watch and saved in a local SwiftData container.
• No Third-Party Sharing: Your health data is never shared with third parties or used for marketing, advertising, or data mining purposes.
• User Control: You can grant or revoke permissions to access HealthKit at any time through the iOS Settings app (Settings > Privacy & Security > Health > SportVitals).

3. Google Health Integration & Google User Data

When you explicitly choose to connect Google Health in SportVitals, the app accesses specific categories of health and fitness data from your Google Account via Google Health APIs:

• Activity and Fitness (activity_and_fitness.readonly): Daily steps, active energy burned / calories, distance, floors climbed, active minutes, and exercise/workout sessions.
• Sleep (sleep.readonly): Sleep intervals, sleep duration, and sleep stage breakdowns (deep, REM, light).
• Health Metrics and Measurements (health_metrics_and_measurements.readonly): Heart rate, resting heart rate, heart rate variability (RMSSD/SDNN), oxygen saturation (SpO₂), respiratory rate, body temperature, body fat percentage, and weight.

Purpose of Use

The requested Google user data is used exclusively to:

1. Display your consolidated health and activity history directly within the SportVitals interface on your personal device.
2. Calculate localized physiology scores (such as Body Battery, Recovery, and Readiness).
3. Optionally sync compatible standardized metrics into your local Apple Health store upon your explicit in-app confirmation.

SportVitals does not use Google user data to serve advertisements, develop, improve, or train generalized AI/machine learning models, or transfer data to data brokers or third parties.

4. Data Protection Mechanisms for Sensitive Data

We implement robust technical and organizational security measures to protect your sensitive health and personal data:

1. Encryption in Transit: All communications between SportVitals and Google APIs or authorization endpoints occur exclusively over secure, encrypted channels using industry-standard HTTPS / TLS (Transport Layer Security 1.3/1.2).
2. Encryption at Rest & Secure Storage:
   • All imported data and computed metrics are stored locally on your device within the sandboxed application storage protected by iOS Hardware Encryption / Data Protection (AES-256).
   • OAuth credentials (Access Tokens and Refresh Tokens) are stored exclusively in the Apple Keychain using kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly with kSecAttrSynchronizable = false, ensuring tokens never leave your physical device.
3. No External Cloud Storage: SportVitals does not operate any cloud database or backend server. Your Google Health data and Apple Health data remain strictly on your iPhone and Apple Watch.

5. Data Retention, Deletion, and Revocation

• Retention: Data is retained locally on your device only for as long as you keep the app installed or until you choose to delete it.
• In-App Data Deletion: You can delete all locally stored Google Health records at any time from Settings > Google Health > “Elimina record locali Google”, or by clearing the local database.
• Account Disconnection: You can disconnect your Google account at any time within the app (Settings > Google Health > “Disconnetti Google”), which immediately revokes and purges stored OAuth tokens from the Keychain.
• Google Permission Revocation: You can revoke SportVitals’ access to your Google account at any time by visiting Google Account Security Permissions.
• App Uninstallation: Deleting the SportVitals app from your iOS device immediately and permanently deletes all local data, database records, and sandboxed storage.

6. Google API Services User Data Policy Compliance

SportVitals’ use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

7. Synchronization and Local Storage

All app configuration, preferences, and computed snapshot data are stored locally in the app’s sandboxed storage and shared between your iPhone and Apple Watch using Apple’s secure, native WatchConnectivity framework. No data is stored or transmitted outside of your devices.

8. No Third-Party Analytics, Ads, or Tracking

SportVitals does not include any third-party software development kits (SDKs), advertising networks, tracking tools, or analytics software. We do not track your usage, behavior, location, or device identifiers.

9. Contact Us

If you have any questions or suggestions regarding this Privacy Policy or our data protection practices, feel free to contact us at sportvitalsios@gmail.com.