Privacy Policy

Homestead (“Homestead”, “we”, “us”) runs a coaching platform: a dashboard for coaches and a companion mobile app for their clients. This policy explains what we collect on either surface, why we are allowed to hold it, who can see it, how long we keep it, and how to get it back or get rid of it.

The short version: your data goes to one coach, the one you chose. It is never sold, never given to advertisers, and never fed to analytics vendors. Health data only reaches us if you switch it on, and you can switch it off again in the app.

1. Who this applies to

This policy covers both roles on Homestead: coaches, who run their business on the coach dashboard, and clients, who use the mobile app their coach invited them to. Where a practice differs between the two, we say so.

2. What we collect

Account and sign-in

The email address you sign in with. Homestead uses passwordless one-time-passcode sign-in, so that address is used to deliver your code and identify your account. It is not used for marketing. Accounts created before email-only sign-in may also have a phone number stored; it identifies the account but is no longer used to deliver codes.

Health data

This is the sensitive part, so here is the whole list. Under UK and EU data protection law, information about your health is special category data (Article 9 of the UK GDPR and the EU GDPR) and gets stricter treatment than the rest. If you are a client and you turn health sharing on, Homestead may hold:

• Sleep: duration and sleep stages, per night.
• Heart: heart rate readings through the day, resting heart rate, and heart rate variability.
• Blood pressure: systolic and diastolic readings, and pulse recorded with them.
• Fasting blood glucose: readings you enter in the app, in mg/dL or mmol/L.
• Body measurements: body weight and body fat percentage.
• Hydration: water intake.
• Activity: steps, distance, exercise minutes, stand hours, active and resting energy, and cardio sessions you or your coach record.
• Nutrition: calories, protein, carbs, fat and fiber, from your food log or synced from your phone.
• Health history you write down yourself: your answers on a PAR-Q+ readiness questionnaire, answers to check-in questions your coach asks, and anything health-related you type into a message or a note.

Three routes get that data to us:

• Apple Health or Health Connect, if you connect them. Your phone syncs roughly once a day. Homestead only reads; it writes nothing back into your health store. Data from a Fitbit, Garmin, Samsung or Strava account arrives this way too, because those apps write into Apple Health or Health Connect. We never connect to those accounts directly.
• Readings you type in. Blood pressure and fasting glucose check-ins are entered by hand, and only appear if your coach has switched that feature on for you.
• What you write in check-ins, signed documents and messages.

Training and nutrition data

Workout plans, exercise logs, set, rep and RPE history, session notes, nutrition targets, meal plans, food logs, and any supplement or compound protocol your coach sets up with you.

Check-ins, messages and photos

Check-in answers, including numeric, text and photo responses, and 1:1 messages between you and your coach, which may include photos you choose to send. Photos pass through an automated image-moderation service before they are stored, so disallowed content is caught before it lands on our servers.

Signed documents

If your coach requires a liability waiver, a PAR-Q+ questionnaire, or a custom document, we store your answers, attestations, typed signature, and the version of the document you signed. PAR-Q+ answers are health data, and are covered by section 3 like everything else in that category.

Coach business data

If you are a coach, we store the programming, nutrition plans, check-in forms and documents you author, your roster, and your enrollment page content. That is your content, described further in our Terms of Service.

Technical records

Error logs, performance traces and an audit trail of significant account actions, kept so we can keep the platform running and investigate anything that goes wrong.

3. Health data: your consent, and taking it back

Health data is the one category we hold purely because you said yes. Not because you signed up, not because your coach asked, and not because it was in a document you scrolled past.

• It is off until you turn it on. When you first sign in, the app asks. Decline and nothing leaves the device. Apple Health and Health Connect then ask again on their own permission screen, per data type, so you can share sleep and withhold heart rate if that is what you want. Homestead only ever receives the types you tick.
• Typed readings are consent too. Blood pressure and glucose check-ins reach us only when you enter one. Your coach can switch the feature on; only you can put a number in it.
• You can withdraw at any time, without giving a reason. Turn sharing off from the profile screen in the Homestead app, or revoke it at source: on iOS in Settings, Health, Data Access & Devices, Homestead; on Android in Health Connect, App permissions. Any of those stops new health data reaching us immediately.
• Withdrawing stops the flow, it does not erase the history. Readings already synced stay on your account until you ask us to delete them or delete your account. Section 8 covers both, and either request is free.
• Withdrawing costs you nothing else. The rest of Homestead, your plan, your logging, your check-ins and your messages, carries on working.

4. Why we are allowed to hold it

If you are in the UK or the EEA, these are our lawful bases.

• Health data: your explicit consent, under Article 9(2)(a), alongside Article 6(1)(a). Consent is the only basis we rely on for health data. We do not treat continuing to use the app as consent, and we do not infer it from a signed waiver.
• Your account, plans, logs, check-ins and messages: performance of a contract, under Article 6(1)(b). You cannot be coached through Homestead without them.
• Security, abuse prevention, image moderation, error logs and audit records: our legitimate interests, under Article 6(1)(f), in running a platform that is safe for the people on it.
• Signed waivers and PAR-Q+ records: kept as a record of the consent you gave, which is also what makes them worth having.

We do not sell your data. We do not share it with advertisers. We do not run it through third-party marketing or product-analytics tools. There is no version of Homestead where that changes without this page changing first.

5. Homestead is not a medical device

Homestead records readings and shows you what you recorded. It does not assess, screen, diagnose, monitor for a medical purpose, predict, treat or advise, and it is not a medical device or a clinical tool. Nothing in the app or the dashboard is medical advice.

Where a reading is shown next to a reference range, for example the American Heart Association blood pressure ranges or the American Diabetes Association fasting glucose ranges, that range is published reference information printed beside your number so you can see where it sits. It is not a result, an interpretation, or a judgement about your health. A number outside a reference range is a reason to speak to a doctor, and coaches are not doctors.

Never delay seeking medical advice because of something you saw in Homestead. If you feel unwell, contact a qualified healthcare professional or your local emergency service.

6. How we use your data

• To run the features you and your coach actually use: plans, logging, check-ins, health screens, documents and messaging.
• To show a coach their own clients, and nobody else’s. Homestead checks that ownership on the server on every single request, not just in the interface.
• To sign you in with a one-time code and keep your session secure.
• To moderate uploaded photos before they are stored.
• To send the notifications you have enabled, and service email such as sign-in codes.
• To keep the platform up, secure and debuggable.

7. Who can see your data

A client’s health data, training data, check-ins, messages and documents are visible to that client and to the one coach who owns their account. Coaches cannot see another coach’s clients. Homestead staff can reach data only where it is needed to operate, secure or troubleshoot the platform, or where the law requires it.

A small number of service providers process data on our instructions so the platform can work at all: our hosting, database and object-storage infrastructure; Resend, which delivers our email including sign-in codes; Apple’s and Google’s push notification services, reached through Expo’s push relay; and an automated image-moderation service for uploaded photos. An SMS provider remains configured but is used only if text-message features are active; none currently are. None of these providers are permitted to use your data for their own purposes.

Messaging is not end-to-end encrypted. Messages between a coach and their client are encrypted in transit with TLS and stored on our servers. Unlike an end-to-end encrypted messenger, our infrastructure is technically capable of reading message content. Keep that in mind for anything you would consider highly sensitive.

8. Your rights, and how to use them

If you are in the UK or the EEA you have the right to ask for a copy of your data, to have it corrected, to have it erased, to restrict or object to how we use it, to receive it in a portable format, and to withdraw consent for health data at any time. Nothing here takes away rights you have elsewhere.

• Delete everything, yourself. Open the app, go to Profile, choose Delete account. It is permanent and immediate: plans, logged workouts, health data, messages and photos are destroyed and cannot be recovered. The option is also on the document-signing screen, so a document you have not signed can never trap you in the app.
• Delete only your health data, or ask for a copy, correction or export: email hello@homestead.coach from the address or with the phone number on your account. We answer within 30 days, usually much faster, and we do not charge for it.
• Coaches can close an account by emailing the same address.
• Correcting profile details can also be done by asking your coach, who can edit them from the dashboard.

If you think we have handled your data badly, tell us first and we will try to fix it. You can also complain to your data protection regulator: in the UK that is the Information Commissioner’s Office at ico.org.uk, and in the EEA it is your national supervisory authority.

9. Where your data lives

Homestead data sits on database and object storage we run ourselves on rented server infrastructure, with encrypted off-site backups held by a separate storage provider. Traffic between the app, the dashboard and our servers is encrypted with TLS. Your data may be processed outside the country you live in, which for UK and EEA users means it can leave the UK or the EEA.

10. How long we keep it

• Intraday health samples, meaning the individual heart-rate and blood-pressure readings synced through the day, are deleted after about 180 days.
• Daily summaries, such as a day’s average heart rate or total sleep, are kept as part of your history until you delete your account or ask us to remove them.
• Messages, check-ins, logs and audit records are kept until you delete your account.
• Signed documents are kept for as long as the account exists, as the record of consent they are meant to be.
• Backups roll over on their own schedule, so a deleted record can persist in a backup for a short window after it is gone from the live system.

11. Children

Homestead is for people old enough to enter a coaching relationship on their own behalf, and is not intended for children under 16. If you believe a child holds an account without appropriate consent, contact us and we will act on it.

12. Changes to this policy

If we make material changes we will update the date at the top and, where it matters, tell you in the app. If a change affects what we do with health data, we will ask for your consent again rather than assume the old one still covers it.

13. Contact

Questions about this policy, or about your data, go to hello@homestead.coach.