Privacy Policy

Corio ("we", "our", or "the app") is a health, recovery and activity tracking application for iOS. We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains what data we collect, how we use it, and your choices.

Account information

• Email address (used for authentication)
• Display name and username (optional, set by you)
• Profile photo (optional, uploaded by you)

Health & fitness data (via Apple HealthKit)

• Heart rate and resting heart rate
• Sleep analysis
• Step count
• Workout sessions
• VO2 max (when available)

HealthKit data is used to calculate your recovery, readiness, and training metrics. When you use AI features (with your explicit consent), derived metrics (scores, averages — see Section 5) are processed by Anthropic (see Section 5). It is never shared with advertisers or sold, and never used for commercial purposes.

Wearable device data (via Oura API)

• Readiness score, sleep score, HRV, resting heart rate
• Sleep stages (hypnogram), body temperature
• Stress balance

This data is fetched from Oura's servers using your personal OAuth token and is stored on our secure backend (Supabase) solely to power your dashboard and analytics.

Location data

• GPS coordinates during active runs (for route tracking, distance, and pace)

Location is collected only when you start a run. We do not track your location in the background outside of active workouts.

Usage data

• Run records you create (distance, duration, route, heart rate zones)
• Food logs you create (meals, photos of meals, calories, macros)
• Habits, weight entries, and other lifestyle data you log
• Messages you send to the AI coach
• Shoes you add and their mileage
• App settings and preferences

• Display your personalized recovery dashboard (readiness, sleep, HRV)
• Calculate training load, form score, and recommendations
• Show your run history, statistics, and analytics
• Enable social features (friends, squad leaderboard, run feed) — only with people you choose to follow
• Send push notifications you have opted into (morning briefing, workout reminders)
• Sync data between your devices via our secure backend

We do not sell your data. We do not use your health data for advertising.

Your data is stored securely on Supabase infrastructure (hosted in the EU / US). All data in transit is encrypted via TLS. Authentication tokens are stored in the iOS Keychain. HealthKit data is primarily processed on-device; what syncs to our servers are derived metrics (scores, averages) and the workouts you save or import (including their route and heart-rate series), so they can appear on your dashboard across devices.

• Friends you add — they can see your readiness score, sleep score, and recent runs if you enable sharing in Settings → Privacy.
• Oura — we access your Oura data via OAuth on your behalf. We do not share your data back with Oura beyond what their API requires.
• Apple — if you use Sign in with Apple, Apple processes your authentication. We receive only your email (or a relay address).
• Anthropic (AI provider) — when you use the AI coach or photo food logging, the data described in Section 5 is processed by Anthropic, PBC (Claude API, acting as our data processor) to generate a response. Anthropic provides equivalent data protection and does not use this data to train its models. Data is sent only after you give explicit consent in the app.
• Sentry — crash and performance diagnostics. If the app crashes or freezes, technical reports (device model, OS version, stack trace) are sent to Sentry so we can fix the problem. These reports do not include your health data.
• No advertising networks — we do not integrate any ad SDKs or sell data to advertisers.

Corio's coach replies and insights are generated by artificial intelligence, not by a human or a physician.

AI features are off by default and activate only after you give explicit consent on the in-app screen ("Allow AI analysis"). You can withdraw consent anytime in Settings → Privacy — AI features turn off, the rest of the app keeps working.

To generate a reply, the following is sent securely (TLS) to Anthropic, PBC (Claude API), acting as our data processor:

• Your messages to the coach
• Derived health metrics powering your dashboard (readiness, sleep, HRV, activity scores, trends and averages)
• Lifestyle data you logged (meals, habits, weight) when relevant to your question
• Meal photos — only when you use photo food logging, to estimate calories and macros

Anthropic processes this data solely to produce the response and does not use it to train its models. We do not send your name, email, contacts, or precise location to Anthropic.

AI-generated guidance is informational wellness content and not medical advice, diagnosis, or treatment. Always consult a qualified physician about health concerns.

Corio accesses Apple HealthKit data only with your explicit permission. You can revoke HealthKit access at any time in Settings → Privacy & Security → Health → Corio.

HealthKit data is used exclusively to provide your in-app experience (including AI features, as described in Section 5). It is never used for advertising, never sold, and never shared with any third party other than the data processors listed in Section 4.

We may send you push notifications for: morning recovery briefing, workout reminders, and social interactions (friend requests, kudos). You can manage or disable notifications at any time in Settings → Notifications within Corio, or in iOS Settings → Corio → Notifications.

• Access — you can view all data we store about you in the app.
• Deletion — you can delete your account and all associated data from Settings → Account → Delete Account. This permanently removes all your data from our servers.
• Export — your run data can be exported in the app (Settings → Export Data).
• Opt-out — you can disable health data sharing with friends at any time in Settings → Privacy.

Corio is not intended for children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us to have it removed.

We may update this Privacy Policy from time to time. We will notify you of significant changes via a notification in the app. Continued use of Corio after changes constitutes acceptance of the updated policy.