Privacy Policy

HEXXIS ("we," "our," or "us") is a health and fitness platform developed by HEXXIS LTDA. This Privacy Policy explains how your personal data is collected, used, stored, and shared when you use HEXXIS.

This Policy covers every part of the platform: the user/patient mobile app, the professional web panel, the partner panel (gym, clinic, studio, or health plan operator), and the hexxis.ai website.

By creating an account or using HEXXIS, you agree to the terms of this Privacy Policy. If you do not agree, please do not use the platform.

1. Company and Roles Under the LGPD

Company: HEXXIS LTDA.
Company registry (CNPJ): 69.027.992/0001-47
Country: Brazil
Privacy contact (data protection officer channel): contact@hexxis.ai

Access to HEXXIS is provided through a contracting partner. For user/patient data, the partner (gym, clinic, studio, health plan operator, or independent professional) decides on the processing and acts as the controller; HEXXIS acts as the processor, handling such data according to the controller's instructions and the agreement in place.

HEXXIS acts as controller only for partner and professional account data, billing, platform security, and anonymized statistics used to improve the product.

2. Data We Collect

2.1 Account and Profile Data

• Full name and email address
• Phone number (optional)
• Password (stored in encrypted format)
• Profile photo (optional, user-provided via camera or gallery)
• CPF (Brazilian tax ID — only for gym partner members, for enrollment verification — stored with HMAC-SHA256 cryptographic hash, never in plain text)

2.2 Health and Fitness Data

Collected during onboarding and ongoing use:

• Age, gender, and physical characteristics (height and current weight)
• Weight history and weight goal
• Body Mass Index (BMI), calculated locally from data you provide
• Physical activity level (sedentary, active, very active, etc.)
• Fitness goals (weight loss, muscle gain, conditioning, health maintenance)
• Dietary preferences and restrictions (vegan, vegetarian, gluten-free, lactose-free, etc.)
• Health restrictions, injuries, and relevant medical conditions (free-text field provided by you)
• Completed workout sessions, exercises performed, and duration
• Daily step count via pedometer (device motion sensor)
• Nutritional records: food descriptions, calorie and macro estimates, analysis history
• Daily habits created by you and completion logs, including medication habits created from a prescription recorded by your professional
• Weekly and quarterly goals, goal check-ins, and answers to quizzes made available by your partner

We do not collect geolocation data. HEXXIS does not track your route via GPS.

2.3 Apple Health and Health Connect Data (optional integration)

If you authorize the Apple Health (iOS) or Health Connect (Android) integration, the app reads — read-only — the following metrics:

• Steps and distance
• Active calories
• Exercise sessions recorded on the device
• Sleep duration

This data is stored on HEXXIS servers to build your dashboard, history, and follow-up reports. We do not read heart rate. Authorization is granted by the operating system and can be revoked at any time in your device settings.

2.4 Camera and Photo Library Data

HEXXIS requests access to your camera and photo library for the following specific purposes:

• Food photo nutrition analysis: You can photograph or select an image of food so the app can identify the item, estimate the portion size, and calculate nutritional information (calories, protein, carbohydrates, fat, fiber, and sodium). The image is sent to the Google Gemini Vision AI service (Google LLC) for processing. No personally identifiable data (name, email, location) is sent alongside the image. Example: you photograph your lunch plate and the app returns estimated macronutrients.
• Profile photo: You can take a photo or choose an image from your gallery to personalize your app profile.
• Community posts: You can share photos in public posts in the app's community area.

Camera and photo library access is always requested via an explicit permission prompt by the operating system before first use. You can revoke these permissions at any time in your device's Settings app.

2.5 Social Data

• Text, photo, and achievement posts shared in the app community
• Comments and likes on other users' posts
• Direct messages between users (content, sender, recipient, read status)
• Friends list: friend requests sent, received, accepted, and removed

2.6 Push Notification Token

To send notifications about workout reminders, weight alerts, planned meals, and motivational messages, we collect and store the Expo push notification token for your device. You can disable notifications at any time in the app settings or your device's Settings app.

2.7 Strava Data (optional integration)

If you choose to connect your Strava account to HEXXIS, with your explicit permission we access:

• Athlete profile (name, profile photo, city, country, gender — as made available by Strava)
• Activity history (sport type, distance, duration, pace, elevation, heart rate if available)

The Strava access token is securely stored in the device's encrypted storage (Expo SecureStore). You can disconnect Strava at any time from within the app.

2.8 Professional Tracking Data (B2B)

If you are a member of a partner gym, clinic, or wellness studio, the professionals (trainers and nutritionists) linked to your account may record:

• Physical assessments: Body composition (weight, body fat percentage, muscle mass, basal metabolic rate), body circumferences (chest, waist, hips, arms, thighs, calves), skinfolds, resting and maximum heart rate, blood pressure, postural observations, orthopedic complaints, and assessment photos
• Medications: Name, dosage, frequency, schedule, and instructions (e.g., "Losartan 50mg, once daily at 8:00 AM")
• Health conditions: Diagnosed conditions (e.g., hypertension, diabetes), severity, and diagnosis date
• Professional notes: Trainer, nutritionist, or other professional observations about your progress, category (general, nutrition, workout) — may or may not be visible to you as defined by the professional
• Meal plans: Calorie target, macronutrient distribution, restrictions, guidelines, and shopping list set by the nutritionist
• Exam reminders: Requested exam, frequency, target date, and status (pending, scheduled, done, declined)
• Workout programs assigned by the professional, including those imported from PDF files they upload

Professionals can only access patients of the units they are linked to. The contracting partner has access to patient data and to the activity of the professionals in its unit.

2.9 Appointment and Referral Data

If your partner gym or clinic offers scheduling, we collect appointment and session data including date, time, appointment type, location or online meeting link, status (pending, confirmed, completed, canceled), and associated notes.

If your partner is a health plan operator, the platform also records referrals to network clinics (specialty, reason, validity, and status). The clinic receiving the referral gains care-level access to your data on the platform.

3. How We Use Your Data

• Create and manage your account and user profile
• Generate personalized workout programs based on your goals, activity level, and restrictions
• Calculate and display health metrics (BMI, weight progress, calories)
• Provide nutritional analysis of food via camera and text
• Generate personalized weekly meal plans based on your preferences and goals
• Offer AI-generated habit suggestions, weekly and quarterly goals
• Track and display your daily step progress, workouts, and habits
• Display your performance in the global activity ranking
• Send reminder and motivational notifications (only with your permission)
• Enable social interactions in the app community (posts, likes, comments, friendships)
• Integrate activity data from Strava, Apple Health, and Health Connect (only if you connect or authorize)
• Allow your professional to follow your progress, record appointments, and send guidance
• Generate follow-up reports and an engagement index used as decision support for the professional (see 4.7)
• Send reminders and reports via WhatsApp, when your partner uses that channel
• Provide support, keep the platform secure, and prevent fraud
• Bill contracting partners and comply with legal and regulatory obligations
• Continuously improve the platform based on aggregated, anonymized statistics

4. AI and Third-Party Services

HEXXIS uses external Artificial Intelligence services to deliver advanced features. Below we detail each service, the data sent, and the purpose:

4.1 Google Gemini Vision AI — Food Photo Analysis

When used: When you use the "Analyze Photo" feature in the Nutrition tab.

Data sent: The photographic image of the food you captured or selected from your gallery. No personally identifiable data (name, email, location) is sent alongside the image.

Processor: Google LLC, via the Gemini Vision API.

Purpose: Identify the food in the image, estimate the portion size, and calculate nutritional information (calories, protein, carbohydrates, fat, fiber, and sodium).

Google's Privacy Policy: https://policies.google.com/privacy

Your consent: The app requests your explicit permission before sending any image for AI analysis on the first use of this feature.

4.2 Google Gemini — Recommendations, Document Reading, and Professional Support

When used: To generate workout programs, weekly meal plans, habit suggestions, weekly and quarterly goals, and the Smart Tracking widget; to read documents uploaded by your professional; and to support tasks in the partner panel.

Data sent:

• Your profile data: goal, activity level, gender, age, height, current weight, target weight and trend, restrictions, and a summary of workouts and habits for the period. No name, email, or direct identifier.
• Bioimpedance reports and workout PDFs uploaded by your professional, to pre-fill forms that the professional reviews and confirms before saving.
• Appointment notes typed by the professional, to identify exam requests and create reminders.
• For campaign audience suggestions in the partner panel: internal identifier, engagement level, days since last activity, goal, and health conditions — without the patient's name, which is restored only on our servers.

Processor: Google LLC, through the Gemini API on a paid plan. The applicable terms prohibit the use of submitted content to train Google's models.

Purpose: Personalize recommendations, save the professional from retyping data, and support partner management. HEXXIS does not use your data to develop or train its own AI models.

4.3 Strava — Optional Integration

We use the Strava public API exclusively when you voluntarily authorize the integration. See Strava's Privacy Policy at https://www.strava.com/legal/privacy.

4.4 Expo Push Notifications

Your device's push token is sent to Expo's (Expo Inc.) notification infrastructure exclusively to deliver the alerts and reminders you authorize. Expo's privacy policy: https://expo.dev/privacy.

4.5 MuscleWiki — Exercise Database

We use MuscleWiki's exercise video and instruction library to display video demonstrations. No personal data of yours is shared with MuscleWiki.

4.6 Google Calendar — Schedule Sync (Professionals and Partners)

When it is used: Only when a professional, gym or partner clinic voluntarily connects their own Google account, from the Settings screen of the portal, in order to sync their appointment and session schedule.

Data accessed: Upon authorization through Google OAuth, HEXXIS accesses the calendar events of the connected Google account (Google Calendar — events scope) and the account's email address (used solely to display which account is connected).

Purpose: (1) To create, update and remove in Google Calendar the appointments recorded in HEXXIS; and (2) to read busy time slots from Google Calendar in order to avoid scheduling conflicts and prevent double bookings.

Who processes it: Google LLC, through the Google Calendar API. Access tokens are stored securely on our servers and used only for the purposes described above.

Control and revocation: The connection is optional and can be disconnected at any time from the Settings screen of the portal, or directly at myaccount.google.com/permissions. Upon disconnection, tokens are revoked and deleted.

Limited Use: HEXXIS's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google Calendar data for advertising, we do not sell it, and we do not share it with third parties except to operate the calendar functionality described above.

4.7 Engagement Index and Automated Decisions

The platform automatically calculates an engagement and risk index for each patient, based on signals such as BMI, recorded health conditions, medication and habit adherence, workout and appointment frequency, pending exams, and open referrals. The weight of each signal varies with the type of partner (clinic, gym, personal trainer, or health plan operator).

This index is shown to the professional and to the partner as decision support — for example, to prioritize who to contact. It does not block your account, does not restrict your access, and does not replace clinical assessment. The system also sends automated reminders to patients (re-engagement after a period without activity, medication adherence, and follow-up alerts).

Under article 20 of the LGPD, you may request a review of these automated decisions and information about the criteria used, at contact@hexxis.ai.

4.8 Edamam — Text-Based Nutrition Analysis

When you describe a food by text, the description is sent to Edamam's nutrition analysis API (via RapidAPI, United States) to estimate calories and macronutrients. No identifying data is sent alongside it.

4.9 WhatsApp — Reminders, Reports, and Support

When your partner uses the WhatsApp channel, we send habit and exam reminders, appointment confirmations, monthly follow-up reports, and partner campaigns to your number. The content travels through WhatsApp infrastructure (Meta Platforms, Inc.). You may ask your partner or contact@hexxis.ai to stop these messages.

4.10 Infrastructure and Email

• Railway Corp. (United States): hosting of the platform's servers, database, and files.
• Resend (United States): transactional email, such as password resets and operational notices.
• Google Fonts: the website's fonts are loaded from Google servers, which receive the visitor's IP address.

5. Business Model and Subscription

HEXXIS offers a freemium model with three plans:

• Free: Access to basic workout and health monitoring features, at no cost.
• Start: Access to nutrition, community, directed workout programs, and full history.
• Pro: Full access to all features, including custom workout builder, AI camera-based food analysis, AI smart tracking, quarterly goals, and priority support.

Access to HEXXIS is provided through a contracting partner (gym, clinic, studio, health plan operator, or independent professional), which makes plans available to its members and patients, including workout programs and meal plans created by its professionals.

The app does not process payments, does not use Apple In-App Purchase or Google Play Billing, and does not collect credit card data. Partners contract directly with HEXXIS. Should we adopt an online payment method, this Policy will be updated before it goes live, and HEXXIS will store only tokenized identifiers provided by the payment provider.

6. Device Permissions

The following permissions may be requested by the app:

• Camera: To photograph food for AI nutritional analysis, take a profile photo, and capture photos for community posts. Example: "Take a photo of your plate so the AI can calculate calories and macronutrients."
• Photo Library: To select images from your gallery for the same purposes described above.
• Motion Sensor (Pedometer): To count your daily steps using the device's accelerometer/motion sensor.
• Push Notifications: To send workout reminders, weight alerts, meal reminders, and motivational messages.

All permissions are requested by the operating system before first use. You can manage them in your iPhone/iPad Settings at any time.

7. Data Sharing

We do not sell your personal data. We share data only in the following situations:

• With your contracting partner and its professionals: The partner you are linked to and the professionals of that unit access your account data, health records, and progress. For health plan operators, the network clinic receiving your referral also gains access.
• With suppliers that process data on our behalf (sub-processors): As detailed in Section 4 — Google (Gemini and Calendar), Railway (hosting), Expo (notifications), Resend (email), Edamam (nutrition), WhatsApp/Meta (messaging), and Strava (when you connect it). The current list is kept in this Policy.
• With Strava: Only if you voluntarily connect your account.
• For legal compliance: In response to court orders or competent authority orders.
• In case of business transfer: In a merger, acquisition, or company sale, provided the acquirer agrees to comply with this Policy.

8. Data Retention

We retain your data while your account and your partner's contract are active. Retention periods by category:

• Account data, health data, and protocols: while the account and the contract are active.
• Access logs: 6 months, under article 15 of the Brazilian Internet Civil Framework.
• Tax and billing data: 5 years, under tax legislation.
• Support tickets: 5 years, matching the Consumer Protection Code limitation period.
• Clinical records created by the professional (assessments, medication, conditions, notes): follow the period set by the controlling partner and by professional regulation — for example, 20 years for medical records (Law No. 13,787/2018).
• Anonymized data: may be retained indefinitely for statistical purposes, as it no longer identifies you.

When you delete your account in the app, deletion is immediate and irreversible, with no quarantine period. Backup copies are purged within 90 days. Community posts may be anonymized. Records created by your professional remain under the controlling partner's responsibility, for the period above.

There is no automatic deletion of inactive accounts. When a partner's contract ends, the partner has 90 days to export its patient base, after which the data under its control is deleted.

9. Data Security

• All communications between the platform and our servers use HTTPS (TLS).
• Passwords are stored with encryption (bcrypt hash).
• CPF is stored only as an HMAC-SHA256 cryptographic hash, never in plain text.
• Role-based access control: patient, professional, partner, and administrator. Professionals can only access patients of the units they are linked to.
• Rate limiting on login, first access, and password recovery endpoints.
• Sensitive files, such as meal plans and attachments, are served only through authenticated routes.
• Access tokens for external services (Strava) are stored in Expo SecureStore (native encrypted device storage).
• Automated database backups.
• Database access is restricted to authorized partners and developers, who sign confidentiality agreements.
• Two-factor authentication and penetration testing are planned and not yet implemented.

In the event of a security incident affecting your data, you will be notified as required by applicable law.

10. Your Rights

As a data subject, you have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of incomplete, inaccurate, or outdated data.
• Deletion: Request deletion of your data, except where retention is required by law.
• Portability: Request transfer of your data to another service provider.
• Objection: Object to processing carried out based on legitimate interest.
• Consent withdrawal: Withdraw previously given consent at any time, without prejudice to prior processing.
• Information: Obtain information about who we share your data with.

To exercise any of these rights, write to contact@hexxis.ai. We triage requests within 2 business days and respond within 15 days, as required by article 19 of the LGPD.

Identity verification: the request must come from the email address registered on the platform; where that is not possible, we confirm identity through a link sent to that address.

Patients linked to a partner: because HEXXIS is a processor in those cases, we forward the request to the controlling partner and support them in responding, letting you know it was forwarded.

Export: data is provided as PDF or CSV by email. You may also delete your account at any time in the app, under Profile → Settings → Delete Account.

Consent withdrawal: because health data is essential to the service, withdrawing consent generally means deleting the account. Specific consents can be withdrawn on their own: AI photo analysis, the Apple Health or Health Connect integration (in device permissions), and the Strava connection (in the app).

California residents (CCPA): You have the right to know what personal information we collect, to request deletion, and to opt-out of the sale of personal data (we do not sell personal data).

EU/EEA residents (GDPR): You have the right to lodge a complaint with your local supervisory authority.

11. International Data Transfers

Some of the suppliers that process data on our behalf are based outside Brazil, with servers in the United States: Railway (hosting and database), Google (Gemini and Calendar), Expo (push notifications), Resend (email), Edamam (nutrition), WhatsApp/Meta (messaging), and Strava (optional integration).

These international transfers rely on each supplier's data protection terms and clauses, which provide a level of protection compatible with the LGPD, under article 33 of Law No. 13,709/2018 and ANPD Resolution No. 19/2024.

12. Children's Privacy

HEXXIS is intended for users 16 years of age or older. We do not knowingly collect data from persons under 16. If we identify an account created by someone under 16 without lawful guardian consent, we will immediately delete the account and associated data. If you are a parent or guardian and have identified such an account, please contact us at contact@hexxis.ai.

13. Changes to This Policy

We may update this Privacy Policy periodically. For material changes, we will notify you in the app and by email at least 15 days before they take effect and ask for a new acceptance, recorded with date, time, and document version. Minor changes are published here with a revised update date.

We keep the version history of this Policy available on request at contact@hexxis.ai.

14. Contact Us

For questions, data rights requests, or complaints related to the processing of your personal data:

• Privacy channel (data protection officer): contact@hexxis.ai
• Company: HEXXIS LTDA., CNPJ 69.027.992/0001-47, Brazil — as controller for the data described in section 1. For patient data, please also contact the partner you are linked to.
• Website: https://hexxis.ai/