FitLyfe Privacy Policy

BSoft Solutions, Inc. d/b/a FitLyfe
Effective date: November 5, 2026
Last updated: November 5, 2026

1. Scope and our role

BSoft Solutions, Inc., doing business as FitLyfe (“FitLyfe,” “we,” “us,” or “our”), provides wellness technology and services to employers, health plans, healthcare organizations, and other business customers. This policy covers our website, FitLyfe 360, Health2Go, and related services that link to it (the “Services”). It explains our handling of information about website visitors, business contacts, and program participants.

For customer-sponsored programs, we process participant information on the customer’s behalf under its lawful instructions and our agreement, subject to applicable law and connected-platform restrictions. The customer’s privacy notice may also apply. For our own activities, such as responding to business inquiries and operating our website, FitLyfe determines how information is used.

This policy is a notice, not consent to all processing. We obtain separate permissions or authorizations when required. It does not replace customer agreements or a required HIPAA Notice of Privacy Practices.

2. Information we collect

The information collected depends on your program, the features used, and your choices:

• Contact and account information: name, email, phone number, mailing address, account identifiers, credentials, and preferences, provided by you or an authorized program administrator.
• Program information: employer or program affiliation, participant or employee identifier, date of birth, gender, employment type, work region, health-insurance provider, eligibility, enrollment, participation, and incentive status, provided by you or your program administrator or generated through participation.
• Health and wellness information: assessment responses, health history, screening and laboratory results, health measurements, activity records, goals, and coaching information, provided by you or authorized providers, screening vendors, or health plans. Medical and pharmacy claims are included only where supplied for the relevant contracted service on a permitted basis.
• Connected-health information: authorized records from supported devices, applications, and integration providers, such as steps, exercise, sleep, heart rate, weight, or other measurements supported by the selected feature. The connection disclosure identifies the specific data requested.
• Government identifiers: Social Security numbers supplied by you or an authorized program administrator where needed for the applicable program’s identification or eligibility requirements. We restrict their use to those purposes and do not include them in routine exchanges with third-party wellness vendors.
• Location information: location records supplied by a connected device or application when you enable the relevant feature and grant the required permission, to support that feature.
• Communications: inquiries, support requests, survey responses, and information you submit through the Services.
• Technical information: IP address, browser, operating system, device identifiers, access times, usage activity, and diagnostic or security logs. An IP address may indicate approximate location.

We may derive progress indicators, wellness scores, recommendations, or participation status from program information. Health-related inferences retain applicable health-data and source-platform restrictions.

3. How we use information

We use information to operate accounts, verify eligibility, provide contracted wellness services, deliver assessments and results, support authorized tracking and coaching, administer permitted challenges and incentives, respond to requests, send service communications, maintain and improve the Services, protect security, and meet legal obligations. Each use remains subject to the restrictions below.

We may use business contact information to communicate about our services. You can unsubscribe from promotional messages using the instructions in the message; necessary service communications may continue.

We do not sell participant health or connected-device information, provide it to data brokers, or use it for advertising.

4. Connected devices and applications

You may voluntarily connect compatible wearables, fitness trackers, health applications, connected scales, or other supported services. This policy applies regardless of brand, including connections through an integration provider. Available connections and data types vary by program and device.

Before accessing connected information, we explain the requested data, purpose, relevant recipients, and permissions. We request only access needed for the feature you choose, including separate read or write permissions and background or historical access where applicable. We use connection tokens to maintain authorized access. Declining access may make the associated feature unavailable.

You may revoke access through the provider’s or operating system’s permission settings or contact privacy@gofitlyfe.com for assistance. To stop data access, revoke FitLyfe’s permissions at the source provider or operating system. An in-app unlink action may also require provider-side revocation. Contact us if you need help stopping a connection.

Revocation stops future access under the revoked permission. It does not automatically delete records already imported or records held independently by the original provider. You can request deletion of FitLyfe-held information as described in Section 9. Retention is explained in Section 8.

Google Health API Limited Use

FitLyfe follows the Google Health API Developer and User Data Policy, including its Limited Use requirements, when using information obtained through Google Health API or its Developer Tools.

These records, including derived and de-identified forms, are used only for permitted, prominent user-facing features. Transfers are limited to consented feature delivery or improvement, necessary security, legal requirements, or a corporate transaction with explicit prior consent. Human access is limited to specific consent, security, legal obligations, or permitted internal use of aggregated anonymous information. Advertising, data-broker sales, credit or lending decisions, and prohibited regulated medical-device uses are not allowed. Uses involving HIPAA-defined protected health information require prior written platform approval, beyond participant consent or a business associate agreement.

Other Google API information is subject to the applicable Google API Services User Data Policy, including Limited Use. Health Connect access is subject to the separate applicable Android health-permission requirements.

Information obtained through Google Health API is received and retained by BSoft Solutions, Inc. d/b/a FitLyfe on FitLyfe-owned servers located in a colocation data center. We do not share that information with outside companies.

Apple HealthKit

With your permission, we access the specific HealthKit data needed for supported health and fitness features. We do not sell HealthKit information or use or disclose it for advertising, marketing, or prohibited use-based data mining. Health-management or research uses must satisfy Apple’s conditions and permission requirements. We do not write false or inaccurate information to HealthKit or store personal health information in iCloud.

HealthKit-based employer or insurance incentive reporting is permitted only if Apple’s conditions are met. Its direct-benefit exception requires the benefit-providing entity to submit the app and prohibits sharing the data with a third party. Participant consent alone does not override those limits. See Apple’s health-data rules.

These platform restrictions control over broader provisions in this policy concerning improvement, reporting, sharing, or corporate transactions.

5. Information sharing and employer access

We disclose information only for the purposes described here and subject to applicable law, required permissions, customer agreements, and platform restrictions:

• Program administrators: limited information needed for authorized administration, such as eligibility or completion status. Program disclosures identify the actual recipients, fields, and purpose before reporting, with authorization where required.
• Service providers: hosting, support, security, communications, screening, and other contracted providers that need information to perform their services under appropriate confidentiality and use restrictions.
• Providers and recipients you select: coaches, healthcare or screening providers, connected services, or other recipients involved in a service you request, with required permissions.
• Other participants: information you choose to display in a supported challenge or sharing feature after the audience is explained.
• Legal or transaction recipients: where legally required or otherwise permitted for security, legal claims, or a corporate transaction, with required safeguards, notice, and consent.

An employer does not receive unrestricted access to individual screening results, assessment answers, diagnoses, or device records merely because it sponsors the program. We do not provide participant health information for hiring, termination, or other employment decisions. An employer’s employment role is distinct from authorized health-plan administration. Even a completion flag or score can reveal health information and remains subject to applicable restrictions.

We may provide appropriately de-identified program statistics with safeguards against identifying participants. Removing names alone does not establish de-identification, and source-platform restrictions continue to apply.

6. HIPAA applicability

HIPAA applicability depends on the program and the organizations’ roles. Health data is not automatically protected by HIPAA merely because it comes from a wearable or wellness program.

Where FitLyfe acts as a business associate or subcontractor business associate for a covered health plan or healthcare provider, we handle protected health information under applicable HIPAA requirements and the business associate agreement. The covered entity’s Notice of Privacy Practices explains its practices and individual rights. Contact us for help identifying that entity or routing a request.

Website information and programs outside HIPAA may be governed by other privacy laws. A HIPAA relationship does not establish that all FitLyfe information is exempt from other laws. This policy does not expand the uses permitted by a business associate agreement.

7. Cookies and website choices

We use cookies and similar technologies for account access, security, and service functions. Our public website also uses optional analytics and advertising technologies to understand website use and present relevant content. These technologies may collect browser and device information, identifiers, page visits, and interactions, and may allow third parties to recognize activity across websites. Our cookie preference panel describes the categories and available choices. HubSpot provides our website chat service; when you use it, your messages and related technical information are processed to operate and support the conversation.

You can manage cookies through browser settings and the website’s cookie preference controls. Blocking necessary technologies may affect features. You may also contact us to exercise applicable opt-out rights. We honor legally required opt-out preference signals where applicable. Browser settings do not by themselves disconnect a wearable or delete information already provided to FitLyfe.

Health and connected-device information is subject to the restrictions in Sections 3 and 4, including when tracking technology could reveal such information.

8. Data retention and deletion

9. Your choices and privacy requests

Contact privacy@gofitlyfe.com to request access, correction, deletion, withdrawal of consent, or assistance with other privacy choices. Depending on applicable law, rights may also include confirmation of processing, a portable copy, information about recipients, limits on sensitive-data use, or opt-outs from sale, sharing, targeted advertising, or certain consequential profiling.

We use proportionate verification where needed, recognize authorized agents where required, and respond within applicable deadlines. When processing on a customer’s behalf, we assist or route the request to the responsible organization and explain how to proceed; we do not automatically route every request to an employer. We explain a lawful refusal or extension. Withdrawal may affect features that depend on the information; it does not automatically erase earlier records or override lawful recordkeeping requirements.

Where an appeal right applies, reply to our decision or email privacy@gofitlyfe.com with “Privacy Appeal.” We respond within the applicable deadline and provide the required regulator contact information if an appeal is denied. You may also complain to the appropriate regulator. We do not unlawfully discriminate or retaliate for exercising privacy rights.

10. Changes and contact

We update the date above when this policy changes and provide additional notice for material changes where required. We obtain new consent when required; continued use alone does not replace that consent. Independent device providers and websites have their own privacy notices governing their separate processing.

BSoft Solutions, Inc. d/b/a FitLyfe
Attn: Privacy Officer
Email: privacy@gofitlyfe.com
Mail: P.O. Box 8491, Algonquin, IL 60102