Supamill Inc. dba Shifu Health (“Shifu Health”, “we”, “us”, or “our”) operates a website located at https://shifu.health/ (the “Site”), as well as a health and wellness platform, including our mobile applications, AI health assistant, text messaging features, and related technologies, through which users may obtain personalized wellness, fitness, and nutrition plans and recommendations, content, human coaching, and related features and services (collectively, the “Platform”).
This Privacy Policy describes how Shifu Health collects, uses, and shares personal information when you visit the Site, use the Platform, or otherwise interact with us (collectively, the “Services”). This Privacy Policy also describes your rights and choices under applicable laws. Our Consumer Health Data Policy, which supplements this Privacy Policy for residents of certain states, appears at the end of this document.
THE SERVICES ARE DESIGNED TO SUPPORT GENERAL HEALTH AND WELLNESS AND ARE PROVIDED FOR INFORMATIONAL PURPOSES ONLY. THE SERVICES ARE NOT INTENDED TO CONSTITUTE MEDICAL ADVICE. SHIFU HEALTH IS NOT A LICENSED MEDICAL PROVIDER OR HEALTHCARE PROVIDER. THE DO NOT CONSTITUTE, AND ARE NOT A SUBSTITUTE FOR, PROFESSIONAL MEDICAL ADVICE, DIAGNOSIS, OR TREATMENT.
We collect the following categories of personal information:
Contact details and account information, such as your first and last name, email address, mobile phone number, date of birth or age, city and state of residence, and account login credentials.
Profile, goals, and health history, such as your height, weight, and biological sex; fitness goals and activity level; dietary preferences, restrictions, allergies, and intolerances; nutritional targets; health conditions and diagnoses; injuries or physical limitations; pregnancy or nursing status; medications and supplements; training history; and equipment and schedule availability.
Activity, nutrition, and wellness logs, such as workout logs (exercise type, sets, reps, weight, and duration); food and nutrition logs (including calories, macronutrients, and micronutrients); meal photos you upload for nutrition logging and AI analysis; daily check-in scores; self-reported wellness, pain, and symptom ratings; and sleep data.
Communications and coaching data, including the content of messages, photos, and other information you exchange with us or our strength coaches, certified nutritionists, and registered dietitians; the written check-ins you request; and communications with us when you contact us with questions or feedback, request a consult, or respond to a survey.
Marketing data, such as your preferences for receiving our marketing communications, and details about your engagement with them.
Payment and transactional data. Purchases made through the Apple App Store, Google Play Store, or other distribution channels are processed by the applicable distribution channel, and other payments are processed by our third-party payment processors. We do not receive your full payment card number or bank account details.
Connected device and third-party service data. If you choose to login in using a third-party service or connect wearable devices or third-party health platforms (such as Apple Health, Fitbit, WHOOP, Garmin Connect, Oura, Strava, or Google Fit) or your calendar to the Services, we receive the data you authorize those services to share with us. This may include steps, distance traveled, active energy and calories burned, heart rate and heart rate variability, resting heart rate, sleep duration, quality, and scores, recovery and strain scores, weight, workout and exercise session data, and calendar events. You control what data is shared with us through your settings on the third-party service and you may disconnect these services at any time through the third-party platform or your account settings.
The Services help you analyze your own wellness, fitness and nutrition by deriving or generating information about you based on the information you provide. This includes:
Personal explanations and metrics such as workout explanations, basal metabolic rate, total daily energy expenditure, training activity metrics, plan adherence scores, and nutrition analyses.
Recommendations, plans and insights, such as macronutrient targets, fitness-goal classifications, meal plans and adherence, recovery summaries, and the AI-generated plans.
We automatically log information about your interactions over time with the Services, including via cookies and other similar technologies, such as software development kits and local storage technologies. This information includes:
Online activity data, such as pages or screens you viewed, how long you spent on a page or screen, navigation paths between pages or screens, information about your activity on a page or screen (such as button clicks), access times and duration of access, the date and time of account registration and login events, and whether you have opened our emails or clicked links within them.
Device data, such as your computer’s or mobile device’s operating system type and version, manufacturer and model, browser type, app version, screen resolution, device type (e.g., phone, tablet), IP address, unique identifiers, push notification tokens, language and time zone settings, and general location information (derived from IP address) such as city, state/province, or geographic area.
Crash and diagnostic reports, which contain technical details about the crash and your device.
We use personal information for the following purposes:
Service delivery. We use personal information to:
provide, operate, and improve the Services, including creating and maintaining your account, building and updating your personalized plan, and delivering food logging, workout logging, and related tracking tools;
generate AI-powered plans, recommendations, meal plans, grocery lists, workout explanations, and proactive notifications and insights based on your goals, preferences, health information, logs, and connected device data;
facilitate your interactions with coaches, nutritionists, and dietitians, as well as with AI-enabled features of the Services;
manage your subscription and complete transactions with you;
communicate with you about the Services, including by sending reminders, check-ins, announcements, updates, security alerts, and support and administrative messages;
understand your needs and interests, and personalize your experience with the Services and our communications; and
provide support for the Services, and respond to your requests, questions, and feedback.
Safety and quality. We may use personal information to identify usage patterns or content that signal warning signs or abuse in order to take appropriate action to protect our Services and our users. For example, we may review communications between you and your coach or your communications with AI features on the Services and we may escalate actions for further review.
Artificial intelligence. Certain features of the Services rely on AI, including to generate plans, recommendations, and other content for you. To do so, we send the portions of your information needed for a given task to third-party AI service providers, which process that information to return a response to us. We do not use your personal information, and we do not permit any third party to use your personal information, to train or fine-tune AI models.
Research and development. We may use personal information for research and development purposes, including to develop aggregated or de-identified statistics, to analyze and improve the Services, to identify usage trends, and to operate and expand our business activities.
Promoting our Services. We may use personal information for marketing and advertising purposes, including:
Direct marketing. We may send you newsletters and email marketing in accordance with your preferences, provide you offers, guides, events, webinars, and relevant promotions, and tailor communications with you to accommodate your areas of interest and focus;
Interest-based advertising. We may engage third-party advertising companies to display ads promoting our Services across the web. These companies may use cookies and similar technologies to collect information about interactions over time across the Internet and use that information to serve online ads that they think will be of interest.
To comply with law. We may use personal information as we believe necessary or appropriate to comply with applicable laws, lawful requests, and legal process, such as to respond to subpoenas or requests from government authorities.
Compliance, fraud prevention, and safety. We may use personal information to protect our or others’ rights, privacy, safety, or property (including by making and defending legal claims); enforce the terms and conditions that govern the Services; and protect, investigate, and deter against fraudulent, harmful, unauthorized, unethical, or illegal activity.
Anonymous statistics. We may make personal information into anonymous or de-identified data by removing information that makes the data identifiable. We may use this anonymous data for our lawful business purposes.
We may share personal information with the following parties:
Service providers, including companies and individuals that provide services on our behalf or help us operate the Services (such as hosting, videoconferencing, scheduling, chat, information technology, customer support, email delivery, and analytics services). We may also work with large language model and other AI service providers.
Advertising partners, including social media platforms, advertising platforms, and technology vendors that help us promote our business and Services on other websites and platforms. We do not share your health information with advertising partners.
Professional advisors, such as lawyers, auditors, bankers and insurers, where necessary in the course of the professional services that they render to us.
Authorities and others, including law enforcement, government authorities, and private parties, as we believe in good faith to be necessary or appropriate for the compliance and protection purposes described above.
Business transferees. Acquirers and other relevant participants in business transactions (or negotiations for such transactions) involving without limitation, a corporate divestiture, merger, consolidation, acquisition, reorganization, sale or other disposition of all or any portion of the business or assets of, or equity interests in, Shifu Health (including, in connection with a bankruptcy or similar proceedings) in accordance with applicable law.
Account information and push notifications. You may have the ability to access, update and delete account information within your profile on the Services. You can also manage push notifications through your device settings.
Device permissions and connected services. You may change your settings for access to other applications on your device, camera, and microphone at any time in your device settings, and you may disconnect wearable devices, health platforms, and calendars at any time in the Services or through the third-party platform. Disabling certain permissions or connections may limit features of the Services.
Text messaging. By providing your mobile phone number and agreeing to text with us, or by sending a message to our designated number, you consent to receive text messages from us. Message frequency varies, and your carrier’s standard message and data rates may apply. You may reply STOP to any text message you receive from us to stop receiving text messages (you will receive a single message confirming your opt-out), and HELP for support information. If you change or deactivate your mobile phone number, please promptly update your account information so that messages are not sent to a person who acquires your old number. We do not sell your mobile phone number or the contents of your messages when you agree to our text messaging.
Opt out of marketing communications. You may opt out of our marketing-related email communications by following the opt-out or unsubscribe instructions contained in the marketing communication we send you, or by contacting us as provided in the “Contact Us” section below. You may continue to receive service-related and other non-marketing communications.
Personal information requests. Where such rights apply, based on your state of residence and the laws applicable to our Services, you may request the following in relation to your personal information:
Information about how we have collected and used your personal information. We have made this information available to you without having to request it by including it in this Privacy Policy.
Access to a copy of the personal information that we have collected about you. Where applicable, we will provide the information in a portable, machine-readable, readily usable format.
Correction of personal information that is inaccurate or out of date.
Deletion of personal information that we no longer need to provide you access to the Services or for other lawful purposes.
Opt out of interest-based advertising. Our disclosure of personal information to advertising partners, including through the use of cookies and similar technologies, may constitute “selling,” “sharing” or “targeted advertising” under applicable US privacy laws. Where applicable, you can opt out by using the “online tracking opt out” options described above, or by contacting us as provided below.
To make a request, please email us as provided in the “Contact Us” section below. We may ask for specific information from you to help us confirm your identity.
Your choices above may be limited, such as where fulfilling your request would impair the rights of others, our ability to provide a service you have requested, or our ability to comply with our legal obligations and enforce our legal rights. If you are not satisfied with how we address your request, you may submit a complaint by contacting us as provided in the “Contact Us” section below.
Online tracking opt out. There are a number of ways to opt out of having your online activity and device data collected on our Sites, which we have summarized below:
Blocking cookies in your browser. Most browsers let you remove or reject cookies, including cookies used for interest-based advertising. To do this, follow the instructions in your browser settings. Many browsers accept cookies by default until you change your settings. For more information about cookies, including how to see what cookies have been set on your device and how to manage and delete them, visit www.allaboutcookies.org.
Blocking advertising ID use in your mobile settings. Your mobile device settings may provide functionality to limit use of the advertising ID associated with your mobile device for interest-based advertising purposes.
Using privacy plug-ins or browsers. You can block our websites from setting cookies used for interest-based ads by using a browser with privacy features, like Brave, or installing browser plugins like Privacy Badger, Ghostery, or uBlock Origin, and configuring them to block third party cookies/trackers. You can also opt out of Google Analytics by downloading and installing the browser plug-in available at: https://tools.google.com/dlpage/gaoptout.
Platform opt outs. The following advertising partners offer opt out features that let you opt out of use of your information for interest-based advertising:
Google: www.adsettings.google.com
Facebook: www.facebook.com/about/ads
Advertising industry opt out tools. You can also use these opt out options to limit use of your information for interest-based advertising by participating companies:
Digital Advertising Alliance for Websites: optout.aboutads.info
Network Advertising Initiative: optout.networkadvertising.org/?c=1
Note that because these opt out mechanisms are specific to the device or browser on which they are exercised, so you will need to opt out on every browser and device that you use.
Do Not Track. Some Internet browsers may be configured to send “Do Not Track” signals to the online services that you visit. We currently do not respond to “Do Not Track” signals. To find out more about “Do Not Track,” please visit http://www.allaboutdnt.com.
We retain your personal information for as long as your account is active and as needed to provide the Services. If you delete your account or request deletion of your personal information, we will take steps to remove, delete or de-identify your personal information once we no longer have a business purpose for its continued retention in accordance with this Privacy Policy. The length of time we retain personal information will be determined based upon the following criteria: the length of time your personal information remains relevant; the length of time it is reasonable to keep records to demonstrate that we have fulfilled our duties and obligations; any limitation periods within which claims might be made; any retention periods prescribed by law or recommended by regulators, professional bodies or associations; the type of contract we have with you, and our business interest in keeping such information as stated in this Privacy Policy.
We employ a number of technical, organizational, and physical safeguards designed to protect the personal information we collect, including encryption, access limitations, and logging. However, no security measures are failsafe and we cannot guarantee the security of your personal information. If you believe your account has been compromised, please contact us immediately as provided in the “Contact Us” section below.
Our Services are intended for adults and are not intended for children under the age of 18. If we learn that we have collected personal information from children without parental consent where required by applicable laws, we will take reasonable measures to promptly delete such data from our records. If you become aware of any data we have collected from children, please contact us as provided in the “Contact Us” section below.
We may modify this Privacy Policy at any time. If we make material changes to this Privacy Policy, we will notify you by updating the date of this Privacy Policy and posting it on the Site.
If you have questions regarding our Privacy Policy or wish to exercise your rights, please contact us by email at support@shifu.health, by telephone at (443) 994-7726, or by mail at Supamill Inc. dba Shifu Health, Attn: Privacy, 77 Van Ness Avenue, Mailbox #2018, San Francisco, CA 94102.
This Consumer Health Data Policy explains how Shifu Health collects, uses, shares, and protects “consumer health data” as defined under applicable U.S. state laws, and the privacy rights and choices you have, in connection with our Services.
This Consumer Health Data Policy supplements our Privacy Policy and applies only to consumer health data relating to Connecticut, Nevada, and Washington state residents to the extent required by applicable laws.
Consumer health data includes personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status. It includes information about or regarding:
Individual health conditions, treatment, diseases, or diagnosis;
Social, psychological, behavioral, and medical interventions;
Health-related surgeries or procedures;
The use or purchase of prescribed medication;
Bodily functions, vital signs, symptoms, or measurements (such as weight, heart rate, heart rate variability, sleep, and activity data);
Diagnoses or diagnostic testing, treatment, or medication;
Gender-affirming care information;
Reproductive or sexual health information;
Biometric data;
Genetic data;
Precise location information that could reasonably indicate a consumer’s attempt to acquire or receive health services or supplies;
Data that identifies a consumer seeking health care services; or
Any information that can be associated with or identify a consumer with the data described above or that is derived or extrapolated from non-health related information, including the derived metrics and AI-generated plans, recommendations, and Pulses described in our Privacy Policy.
We may collect this information directly from you, from wearable devices and third-party health platforms you authorize, or from other third-party sources authorized by you.
We collect, use, and share consumer health data with your consent or as reasonably necessary to provide the Services you have requested, including to generate your personalized plans, recommendations, and insights; to facilitate your consults and communications with coaches, nutritionists, and dieticians; and to facilitate your use of AI-powered features. We may also use and share consumer health data to help us meet regulatory obligations, and to detect, investigate, and help prevent security incidents and other malicious, deceptive, fraudulent, or illegal activity and help protect the rights and property of Shifu Health and others, and to comply with applicable laws.
The categories of third parties to which we may disclose consumer health data include: service providers, including cloud hosting, AI, messaging, video calling, crash reporting, and compliance review providers; third parties to whom you direct us to disclose information; professional advisors; and government authorities. We may also disclose consumer health data in connection with or during negotiations concerning any merger, sale of company assets, financing, or acquisition of all or a portion of our business by another company. We do not sell consumer health data, and we do not share consumer health data with advertisers.
If you are a Connecticut, Nevada, or Washington state resident, you may request the following in relation to your consumer health data:
Confirm whether we are collecting, sharing, or selling consumer health data, and access a copy of the consumer health data, including a list of the third parties and affiliates with whom we have shared it and their contact information;
Delete consumer health data; and
Withdraw consent for our collection or sharing of consumer health data.
Please note that these rights may be limited in accordance with applicable laws. For example, we may not be able to delete consumer health data where we are required to maintain it for our legal and regulatory purposes.
To submit a request, please contact us at support@shifu.health or through the Mobile App. We may ask for specific information from you to help us confirm your identity. We will not discriminate against you for exercising your rights described above.
If your request to exercise any of the rights described above is denied, you may appeal this decision by emailing us within a reasonable time at support@shifu.health. If your appeal is denied, you may issue a complaint with the appropriate regulatory enforcement authorities, including the attorney general of your state.