Consumer health data privacy policy
Velodex Consumer Health Data Privacy Policy
Velodex is an independent app and is not affiliated with, endorsed by, or sponsored by Peloton Interactive, Inc.
1. Categories of consumer health data collected
With your explicit, separate consent (a dedicated health-data consent step you must affirmatively check before any data is imported — recorded with the exact consent text, version, and timestamp), Velodex collects, onto your device only:
- Biometric/physiological measurements: average heart rate for each workout, where your workout file includes it.
- Exercise and fitness data: for each workout in the file you import — date and start time, workout type, length, total output (cycling only), average cadence, calories, class title, and instructor name; plus workouts you enter by hand, the FTP value you set, and your FTP test results.
- Health-related inferences derived on-device from the above: fitness metrics computed by the app for you (e.g., training load/fatigue trends, personal records, streaks, training recommendations). These are generated and kept only on your device.
Velodex does not store the workout file’s other columns (class type, live/on-demand, watts, resistance, speed, distance, incline, pace) and does not keep a copy of the file.
Related non-health data handled to make this work: your consent record and your App Store purchase status. Velodex holds no Peloton login, session, or account identifier.
2. Sources
- A workout file you import. Peloton lets members download their workout history as a CSV file from Peloton’s website. Velodex collects consumer health data from that file only after you download it yourself and choose to import it. Velodex never signs in to Peloton and never connects to Peloton’s service.
- You. Workouts you enter by hand and the FTP value you set.
Velodex collects no health data from any other source — no sensors, no purchases of data, no inference from third parties.
3. Purposes of collection and use
Your consumer health data is collected and used solely to provide the services you request:
- Importing your own workout history onto your own device, and adding newer files you import later;
- Computing and displaying analytics about your training (training load, trends, streaks, PRs, milestones, comparisons);
- Generating rule-based training recommendations from your own data;
- CSV export and share cards that you initiate.
It is never used for advertising, marketing, profiling for third parties, or any purpose beyond the app’s stated features.
4. Where the data is processed and stored
All consumer health data is stored and processed on your device. No Velodex server receives any copy of your health data, and we have no ability to access it. The app’s data store is configured never to sync to iCloud (CloudKit).
The app does periodically download a small, cryptographically signed configuration file from a
Velodex-controlled address (velodex-config.quietfieldllc.com), which lets us show a
notice or update prompt, or switch off a feature with an explanation if something breaks. That
request contains
no consumer health data, no account information, no identifiers, and no cookies
— it sends nothing about you. Like any internet request, the hosting provider (Google LLC,
via Firebase Hosting) can observe your IP address to deliver the file; we do not receive it, have
enabled no logging of these requests, and do not use it to identify you or infer anything about
your health.
5. Sharing and disclosure of consumer health data
None. Velodex does not share, disclose, or provide access to your consumer health data to any third party — not to affiliates, processors, advertisers, data brokers, Peloton, or anyone else. We do not sell consumer health data, and under MHMDA we could not do so without your separate, distinct authorization, which we will never request.
For completeness: Velodex sends nothing to Peloton (you download your file from Peloton yourself, in Safari); Apple processes any purchases; and share cards or CSV exports go only where you choose to send them. None of these is a disclosure of your health data by us to a third party.
6. Affiliates and processors
MHMDA requires that this policy list the affiliates and the processors with which consumer health data is shared:
- Affiliates: none. Velodex is published by QuietField LLC, which has no affiliated entities; other apps published by QuietField LLC are products of the same entity, not affiliates, and none of them receives any Velodex data.
- Processors: no processor receives consumer health data. For completeness: Google LLC hosts the app’s configuration file on Firebase Hosting (Section 4) and transiently processes network metadata (your IP address) to deliver it. That request carries no consumer health data, and it is our position that it does not constitute collection or sharing of consumer health data under MHMDA; we disclose it here for transparency. There are no analytics SDKs, no crash-reporting vendors, and no cloud processors with access to health data.
7. Your rights under the My Health My Data Act
If you are a Washington resident (or your health data is collected in Washington), you have the right to:
- Know / access: confirm whether we are collecting, sharing, or selling your consumer health data, and access that data, including a list of third parties with whom it has been shared (that list is empty). Everything Velodex holds about you is visible in the app on your device, and a CSV export is built in.
- Withdraw consent: withdraw your consent to collection at any time. In-app: Settings › Delete all Velodex data. Processing stops immediately and everything is deleted.
- Delete: have your consumer health data deleted. In-app: Settings › Remove imported workouts deletes everything that came from an imported file; Settings › Delete all Velodex data removes all workout data (imported and hand-entered), FTP data, derived analytics, and the consent record from your device. Because we hold no server copies and have shared with no one, that single action is a complete deletion — there are no affiliates, processors, or third parties to propagate the request to.
We will never discriminate against you (deny features, change pricing) for exercising these rights. Note: the free/paid feature split is based on purchase status only, never on your privacy choices.
8. How to exercise your rights
- In-app (fastest, self-service): access and export via the app itself; deletion via Settings › Remove imported workouts; withdrawal and full deletion via Settings › Delete all Velodex data.
- By email: info@quietfieldllc.com with the subject “Health Data Request.” We will authenticate the request and respond within the timelines MHMDA requires (in general, within 45 days). Because we hold no copy of your data, an emailed request will usually be answered with the in-app steps above.
Appeals
If we decline or fail to act on a request, you may appeal by replying to our response (or emailing the address above with subject “Health Data Appeal”). We will respond to an appeal in writing within the MHMDA-required period, with an explanation. If your appeal is denied, you may contact the Washington State Attorney General at www.atg.wa.gov to raise a concern.
9. Changes
Material changes to how consumer health data is collected, used, or shared will be reflected here before they take effect, with in-app notice, and — where MHMDA requires — new consent obtained first. Collecting additional categories of health data, collecting from a new source (such as Apple Health), or sharing with new parties without new consent is prohibited by MHMDA, and we will comply.