Effective date: October 4, 2026
Last updated: October 4, 2026
Reform LLC operates Pact. Contact support@reformapp.org about consumer health data. This policy supplements the Pact Privacy Policy. It addresses Washington’s My Health My Data Act and applicable consumer-health-data protections in Nevada, Connecticut, and other states. Statutory coverage depends on the law and facts; we extend the request rights described here to all U.S. Pact users.
Pact is a direct-to-consumer accountability service, not a medical provider, and Reform does not operate Pact as a HIPAA covered entity or business associate. Do not assume that information in Pact is protected by HIPAA.
We apply this policy to the following fitness and potentially health-related information:
| Category | Source |
|---|---|
| Daily step totals and optional step goal | Apple Health with permission; goals entered by you |
| Workout dates, photos, weekly goals, streaks, achievements, and progress | Your entries and calculations based on those entries |
| Onboarding fitness goals, commitment and consistency answers, general lifestyle barriers | You |
| Fitness-related comments, reactions, reports, and support messages, including health information voluntarily included | You, your partner, or a person reporting content |
| Inferences about goal completion and consistency used to tailor reminders | Pact’s processing of activity and onboarding information |
| Notifications indicating activity or goal completion, including messages without numbers | Generated from relevant Pact activity |
| Identifiers associated with these records, such as account identifiers, email, and push tokens | You, platform services, and service operation |
We do not request diagnoses, symptoms, medications, reproductive health details, sleep measurements, heart rate, weight, nutrition records, genetic information, or other medical history. Users may nevertheless reveal sensitive facts in free-form content. We do not extract biometric identifiers from photos or request device GPS location. Photos may visibly reveal places even after embedded metadata is removed.
We process these categories to provide requested workout logging and accountability, optional step tracking and sharing, progress and streak displays, selected reminders, support, safety, security, and legally required reporting. Optional features that require consent are not enabled merely because you accepted the Terms.
We do not use this information for advertising, marketing, AI-model training, or unrelated profiling. The only advertising-related processing is the adult-only Meta install measurement described in Section 4. Pact does not provide diagnosis or treatment and has no generative-AI features; uploaded photos are screened for unsafe content by an automated image-classification service from Google (Cloud Vision SafeSearch), as described in our Privacy Policy.
Your partner sees workout records and photos, weekly goals, streaks, achievements, and comments/reactions. Step count and step-goal progress are shared only if you separately enable step sharing. Partner notifications can reveal activity or goal completion. Notifications about your step-goal activity are sent to your partner only while step sharing is enabled. Step-sharing consent resets to off for each new pairing.
You choose the pairing through an invite code. There is no discovery or matching feature. You may stop step sharing or end the pairing. Ending it ends each user’s access to the other’s records and deletes reactions, but each user keeps their own records in their own account, and we cannot guarantee deletion of screenshots or other copies already made outside Pact.
| Provider/category | Relevant processing |
|---|---|
| Supabase — backend | Stores account-linked fitness records, photos, comments, inferences, and related records in Pact’s U.S. backend; provides authentication, database, and storage services. |
| Expo and Apple — push delivery | Process push tokens, notification contents, and delivery payloads. A message that someone met a step goal can convey fitness information even without a step total. |
| Zoho Mail — support | Processes correspondence and attachments, which can include health information supplied by users or needed to answer a request. |
| Resend — transactional email | Processes recipient email addresses, service-message content, and delivery records. Routine messages concern accounts and billing rather than detailed activity, but their association with Pact can reveal use of a fitness service. |
| RevenueCat and Apple — subscriptions | Process account-linked subscription and transaction information that can reveal a relationship with Pact, rather than serving as Pact’s workout or step database. |
| Cloudflare — website delivery/security | Processes requests for Pact pages and associated technical information, potentially indicating interest in a fitness service; does not host Pact’s app database. |
| Google and Apple — account authentication | Process chosen sign-in interactions and identifiers, which may reveal a relationship with Pact. |
The list deliberately includes possible health-related context rather than assuming that a provider receives no health data just because a numerical measurement is omitted. We remain responsible for meeting applicable processor-contract requirements and other legal restrictions when providers process consumer health data on our behalf. Their independent platform processing is also subject to their own policies and applicable law.
We do not disclose Pact consumer health data to affiliates for their independent use. We do not sell consumer health data or disclose it to data brokers. We do not send workout, photo, comment, step, or partner information to advertisers or advertising analytics companies. For users 18 or older, Meta receives limited device and install information described in the Privacy Policy. Because Pact is a fitness-related app, the fact that a device has Pact installed may be treated as consumer health data. You can turn this off in Settings or by emailing support@reformapp.org. Required legal disclosures, qualifying emergencies, and business transfers are limited by applicable law as described in the Privacy Policy.
We collect and process information necessary to provide a product or service you request or with consent where required. Pact explains optional Apple Health collection separately from partner step sharing. Permission to collect steps does not itself authorize partner sharing.
You can:
A withdrawal does not undo an already completed disclosure. We stop future processing that depends on the withdrawn consent and explain any affected functionality. Revoking access in Pact does not alter the source records in Apple Health.
You may request confirmation of collection, sharing, or sale; access to your consumer health data; withdrawal of consent; deletion; and an appeal of a denied request. Access includes the list of third parties and affiliates to whom your consumer health data was shared or sold, with an active email address or other online contact mechanism as required by law. We do not sell this data.
Email support@reformapp.org with Health Data Request in the subject line. We authenticate the request proportionately and verify any authorized agent’s authority. We do not demand more verification information than necessary.
We respond within 45 days, or a shorter period required by applicable law. Any extension is limited to what the applicable law permits and is explained before the initial period ends. If denied, reply with Appeal; we respond within 45 days or a shorter applicable deadline, explain the decision, and provide the relevant complaint route.
Washington residents may complain to the Washington Attorney General. Nevada and Connecticut residents may contact their respective state attorneys general. We do not discriminate for exercising rights; a feature that needs data you decline or delete may no longer function, but exercising a right does not justify unrelated penalties.
Steps are retained until you delete them through Pact’s collection setting, request deletion, or delete your account. Workout records, photos, and comments are removed when deleted through available controls or when the account is deleted. When a pairing ends, the former partner loses access and reactions are deleted, but each person’s own workout records and photos remain in their account. Onboarding data and associated inferences remain only as needed for the relevant feature and account. The Privacy Policy’s inactivity process applies after 24 months without sign-in, followed by a warning and a 30-day interval.
We address deletion in active systems, archives, and backups as required by applicable law and notify relevant processors, affiliates, contractors, and other recipients of qualifying deletion requests. Routine Supabase database backups expire on a rolling 7-day schedule; those backups do not contain the actual Supabase Storage photo files. Provider-specific records must also be addressed and are not all subject to that same backup schedule.
Restricted legal records may be retained only under an applicable legal basis, such as a statutory preservation obligation. They are not available for ordinary partner sharing or reused for unrelated purposes. We reapply deletion instructions before data recovered from a backup is returned to service.
We use access restrictions, provider encryption in transit and at rest, private photo storage, signed access links, and metadata removal. Administrative access is limited to Reform’s principal and provider access needed for the service. No security measure eliminates all risk. Applicable breach-notice requirements govern any reportable incident.
Pact does not operate geofences or request device location permission. We do not use geofencing around health care facilities to identify or track people, collect health data, or send health-related advertisements or messages.
We update this policy before changing the practices it describes and obtain affirmative consent for new categories or purposes where required. Continued use is not a substitute for legally required consent.
Reform LLC — support@reformapp.org