Privacy Policy for Sworkit by Nexercise, Inc

Introduction

This Privacy Notice provides you with information about how Sworkit Health handles your personal data. It is really important to us here at Sworkit Health that we handle your personal data carefully and in a way that is transparent, lawful and fair.

If you have not already, please read our Terms of Service. They accompany this Privacy Policy and must both be read.

Who we are

Nexercise, Inc, trading as Sworkit Health (referred to as ‘Sworkit’, ‘Us’ or ‘We’) is a premium digital health and fitness company founded in 2012. Sworkit Health provides a simplified total wellbeing solution, providing 4-in-1 support for Physical Activity, Mental Health (Mindfulness and Meditations), Musculoskeletal Health (Low-acuity MSK programs), and Nutrition.

We serve employers, health plans, community health initiatives, municipalities, and schools.

Our registered address is Nexercise, Inc. 7315 Wisconsin Avenue, Suite 400W, Bethesda, MD, 20814.

What this Privacy Policy covers

This Privacy Policy covers the processing of personal data when you use our Site or Service, including our Apps. It also covers how we may process personal data to promote our Service.

What personal information we process about you

The personal data we process about you will depend on the circumstances of our engagement with you.

Information you provide to us

• End user identity information: Such as your first name, last name and email address.
• Business contact information: Such as your first name, last name, professional title, work email address, work address, work mailing address, employee unique identifier, department, company name, phone number and office location.
• End user student information: Such as your first name, last name and student ID number.
• Payment information: Such as your name, card details, bank account details, billing address, shipping address and transaction records.
• End user account information: Such as your gender, birth year, password, profile photo, account preferences and settings, subscription details, work out preferences, and any content or video you share or activity on your account, including health information you provide as part of using Sworkit’s Services, such as workout logs or your completion of Sworkit challenges, and general activity and engagement information. This may also include information about unique identifiers, including your mobile device identification number.
• Communications information: Such as emails, messages, chats, requests for support or complaints. We may also process information about communication metadata.
• Feedback: Such as responses to surveys, user testimonials and general feedback.
• Any other information you choose to provide us.

Information we collect from third parties or automatically via technology

• Third party health app information: We offer integrations with wearables and fitness apps, so you can connect apps and services such as Apple Health, Health Connect on Google Fit, Fitbit, Strava, MyFitnessPal and Personify Health. As part of this, we may collect personal data about you from third party health apps. For example, we may collect unique identifiers, health information (such as exercise minutes, workouts, heart rate and weight), and contact information. If you use a health platform provided through your employer such as Personify Health, we may also process your business contact information.
• Sign in and social media information: If you choose to create an account or sign into our services using your Apple, Google or social media account, we may collect certain information about that account, such as your email address, unique identifiers and other account information.
• Information provided about you from an employer, health plan provider or other organization: For example, your email address and unique identifier.
• Direct marketing information: We may collect information such as your name, contact details, employment history, social media profiles and direct marketing preferences from third parties, including data brokers, to carry out business to business direct marketing activities.
• Log information: For example, how you use our Services, how often you visit, what pages you visit and what other sites you used prior to coming to the Site, as well as your IP address, internet service provider, date/time stamp and browser type.
• Device information: Such as your mobile device identification number, mobile network information, operating system and version, product registration number, app version, browser type, operating system, internet service provider, geolocation, IP address, domain name and date/stamp for your visit.

Information we collect from schools, youth clubs or your parent if you are a student

• End user student information: Such as your first and last name, student ID, email address, name of teacher and name of class.

Sensitive personal data we process about you

When you use our Services, we may process health information about you. For example, we may process health information about your fitness level, current weight, injuries and pain level.

Subject to the above paragraph, we ask that you not send us, and you do not disclose, any sensitive Personal Data (e.g., social security numbers, information related to racial or ethnic origin, political opinions, religion or other beliefs, health, biometrics or genetic characteristics, criminal background or trade union membership) on or through the Site, our Applications, or Services (the “Nexercise Properties”) or otherwise to us.

Information processed about children

Except for limited circumstances when a K-12 school or school district has registered for an account through our Youth Initiative, the Nexercise Properties are not intended for use by children under the age of 13.

K-12 schools or school districts (or their authorized personnel) (“K12 User”) may apply for a free account (a “K12 Account”) through our Youth Initiative for the use of our Apps and/or Service for educational purposes. Through the use of a K12 Account, we may collect information from students, including students under the age of 13 (collectively “Student Users”) as a services provider to, and at the direction of, a K12 User. In such instances, we rely on the K12 User to provide consent as necessary under the Children’s Online Privacy Protection Act (“COPPA”) to allow us to provide access to our Apps and/or Services for educational purposes.

Each K12 Account is subject to our Terms of Service. Each K12 User must agree to those Terms of Service as a condition of using our Apps and/or Services.

Sworkit Student Engagement Portal (SSEP)

With our Sworkit Student Engagement Portal (SSEP) we’ve created a tool that school personnel (for example, teachers and athletic staff) can use to monitor the use of Sworkit by their students. This allows school personnel engagement with the Services so that they can monitor student participation and award credit. The parameters for monitoring using the SSEP is determined at the discretion of the school and is solely under the control of the school.

If you are a parent or student and have questions about how your school uses the monitoring features, you should contact your school administration.

Why we process personal information about you

If you are a visitor to our website or social media

If you are a user of Sworkit Health

If you are an organisation

We may also process your personal information when necessary to:

• comply with our legal obligations;
• for compliance, fraud and safety purposes; and
• for the establishment, exercise and defence of legal claims.

How we share personal information about you

Like many service providers, we sometimes need to share your personal information with third parties. We only do so when we have a legitimate business interest, we have your consent, or it is necessary to perform a contract with you.

These third parties may include:

• Health professionals and certified trainers: For example, when you use our ‘ask-a-trainer’ feature, you can have direct access to trainers. As part of using this service, we need to share your information with them, such as your identity, contact and account information.
• Your employer, school or health plan provider: If your employer, school or health plan provider provided you with access to Sworkit Health (for example, as a workplace benefit or as part of Youth Initiative), we may share your personal data for the purpose of providing reporting on metrics, managing groups and access and monitoring engagement.
• Third Parties Designated by You: When you use the Services, the personal information you provide will be shared with the third parties that you designate to receive such information. This may include other websites, third party health apps, social media providers, your friends, relatives, team mates and other Sworkit Health users.

In addition, we may also share your personal data with:

• Affiliates: We may share your personal information with our corporate parent company, subsidiaries, and affiliates, for purposes consistent with this Privacy Policy.
• Service providers: We may share your personal information with third party companies and individuals that provide services on our behalf or help us operate the Services (such as customer support, hosting, analytics, email delivery, marketing, and database management services).
• Payment providers: We use a third party payment provider called Stripe to help process your payment.
• Professional advisors: We may disclose your personal information to professional advisors, such as lawyers, bankers, auditors and insurers, where necessary in the course of the professional services that they render to us.
• Law enforcement and regulatory authorities: We may share your personal data when required for legal reasons, such as tax compliance.
• Users: Depending on how you use our Services, we may share your information with other Users. For example, when you post content on the message boards of our Site or App(s), the content of your post and information that you choose to make available in your profile page will be able to be seen by other users.
• Corporate Restructuring and business transferees: We may share some or all of your personal information in connection with or during negotiation of any merger, financing, acquisition or dissolution transaction or proceeding involving sale, transfer, divestiture, or disclosure of all or a portion of our business or assets. In the event of an insolvency, bankruptcy, or receivership, personal information may also be transferred as a business asset.
• Social Networking Sites (SNS): Some of our Apps and Services may give you the option to post content to SNSs (e.g., Facebook or Instagram). If you choose to do this, we will provide information to such SNSs. You acknowledge and agree that you are solely responsible for your use of those websites and that it is your responsibility to review the terms of use and privacy policy of the third party provider of such SNSs. We will not be responsible or liable for: (i) the availability or accuracy of such SNSs; (ii) the content, products or services on or availability of such SNSs; or (iii) your use of any such SNSs.
• Advertising and analytics partners: We may share some of your personal data when we use cookies and other tracking technology on our Sites and App(s).

Use of third party analytics providers

We utilize third-party analytics providers to enhance our website's performance and user experience. These providers may collect information about your interactions with our site through cookies and similar technologies. This data helps us understand user behavior, improve our services, and deliver targeted advertising. Please note that under some data protection regulations, the sharing of personal information with third-party analytics providers may be considered a "sale" of personal information.

Third Party Websites and Apps

Nexercise or one of its Users may post links to third party websites or apps on the Site or in the Apps. These third party websites and apps are not screened for privacy or security issues by Nexercise, and you release us from any liability for the conduct of these third party websites or apps. Please be aware that this Privacy Policy, and any other policies in place, in addition to any amendments, does not create rights enforceable by third parties or require disclosure of any Personal Data relating to members of the Service or Site or App. Nexercise bears no responsibility for the information lawfully collected or used by any advertiser or third party website or app. Please review the privacy policy and terms of service for each site or app you visit through third party links.

Automated decision-making and profiling

We do not make decisions about you based solely on automated decision-making, including profiling, that would have legal or similarly significant effects.

Some of our features do use artificial intelligence (AI), including Motion Tracking Fitness Assessments and AI-powered Custom workouts. As part of these features, we may use AI to recommend and generate personalised workout routines or analyze user movement through your device’s camera.

We may also use profiling as part of our data analytics to better understand how our Site and Service, including our Apps are used.

For more information on how we may use AI and profiling, please get in touch with us.

How long we keep your personal data for

We will only retain your Personal Data as long as reasonably required for you to use our App(s) and Services, or until you close your account (unless a longer retention period is required or permitted by law, including, for example, for regulatory purposes).

To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal requirements.

When we no longer require your personal data, we either securely delete or anonymise your information.

How we keep your personal information secure

We take the confidentiality and security of the Personal Information we collect very seriously. We have implemented physical, technical, and administrative measures designed to enhance the security of our Site, our Apps, and Service. Such measures include the use of SSL Certificates. Unfortunately, no system is 100% foolproof or secure; therefore, we recommend that you use anti-virus software, firewalls, and other precautions to protect yourself from security threats.

In the event we become aware of a data breach impacting your Personal Information, we will provide notification in compliance with applicable laws. For example, we may post a notice on the Site and may send you an email to the email address you have provided to us. Depending on where you live, you may have a legal right to receive notice of a security breach in writing.

We have implemented procedures designed to stop threats that may expose your Personal Information, restore our Site, Apps, and/or Service to full functionality, and document and take proactive steps to minimize the risk that an incident could be repeated. We also have measures in place to preserve relevant evidence for investigation by security professionals and law enforcement as appropriate. In the unlikely event of an unauthorized disclosure, we will follow our internal procedures. If you have any information about the security features of our Services, please contact us.

United States Residents

The information provided in this section of the Privacy Policy applies to users in the United States. If you are a resident of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Florida, Utah, or Virginia, you may have the following rights under state privacy laws:

• The right to know what personal information we collect, use, disclose, and sell or share.
• The right to request deletion of your personal information.
• The right to correct inaccurate personal information.
• The right to request a portable copy of your information.
• The right to opt-out of the sale or sharing of your personal information.
• The right to request that we limit our use of sensitive personal information (where applicable).
• The right not to be discriminated against for exercising these rights.
• The right to opt out of certain automated decision-making and/or profiling.

To exercise these rights, or to opt-out of the sale/sharing of your information, please contact:

• Call: 818-514-0798 (US)
• Email: privacy@sworkit.com

The CCPA requires us to verify the identity of the individual submitting a request to access or delete personal information before providing a substantive response to the request. We may attempt to verify your identity by asking you to confirm information that we have on file about you or your interactions with us. Where we ask for additional personal information to verify your identity, we will only use it to verify your identity or your authority to make the request on behalf of another consumer.

California residents can empower an “authorized agent” to submit requests on their behalf. We will require the authorized agent to have a written authorization confirming that authority.

Notice to California Residents

We are required by the California Consumer Privacy Act of 2018 (“CCPA”) to provide to California residents an explanation of how we collect, use and share their personal information, and of the rights and choices we offer California residents regarding our handling of the personal information.

What categories of personal information will we collect about you and what personal information have we collected in the last 12 months?

We collect the following CCPA-defined categories of personal information:

• (A) Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers.
• (B) Personal information described in subdivision (e) of Section 1798.80.
• (C) Characteristics of protected classifications under California or federal law.
• (D) Commercial information including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
• (F) Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer’s interaction with an internet website application, or advertisement.
• (G) Geolocation data.
• (H) Audio, electronic, visual, thermal, olfactory, or similar information.
• (I) Professional or employment-related information.
• (J) Education information, defined as information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act (20 U.S.C. Sec. 1232g; 34 C.F.R. Part 99).
• (K) Inferences drawn from any of the information identified in this subdivision to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

You can find more information on the categories of personal information we have collected about you in the last 12 months, the purposes this data is used for and how we sourced this information, under the headings ‘What personal information we process about you’ and ‘Why we process personal information about you’.

What business or commercial purposes do we collect, sell or share your personal information?

For information on how we may share your personal information, please visit the section of our Privacy Policy entitled “How We Share Personal Information About You.”

With the exception of the use of cookies and other tracking technologies as set out in this Privacy Policy, we do not sell your personal information for business or commercial purposes. If you would like to opt out of our (and our third party advertising partners’) use of cookies and other tracking technologies, please review the instructions below in our Online Tracking Opt-out Guide.

Personal information collected from students

We do not sell any Personal Information of consumers under the age of 16 or serve advertisements to Student Users. We only use Personal Information from Student Users for purposes related to providing and/or improving our services. Please note that we may use aggregated and de-identified data derived from Student Users (such as school-level usage data) to provide information to our K12 Users that may help them to better utilize our services for their educational purposes.

Personal Information we collect from Student Users may be subject to additional federal and state student privacy laws, including the Family Educational Rights and Privacy Act (“FERPA”). Under FERPA, the K12 User (as the school or the school’s authorized representative) must control Personal Information of Student Users. If you are a parent or legal guardian of a Student User and want to request access to or deletion of Personal Information regarding your child, you must contact the appropriate personnel at your school. We are unable to respond to such requests directly due to our obligations under FERPA and our contractual arrangements. If you would like more information on FERPA, please visit the U.S. Department of Education’s FERPA General Guidance for Parents (last updated July 2021).

ONLINE TRACKING OPT-OUT GUIDE

Like many companies online, we use services that use tracking technology. These services rely on tracking technologies – such as cookies and web beacons – to collect directly from your device information about your browsing activities, your interactions with websites, and the device you are using to connect to the Internet. There are a number of ways to opt out of having your online activity and device data collected through these services, which we have summarized below:

• Blocking cookies in your browser. Most browsers let you remove or reject cookies, including cookies used for interest-based advertising. To do this, follow the instructions in your browser settings. Many browsers accept cookies by default until you change your settings. For more information about cookies, including how to see what cookies have been set on your device and how to manage and delete them, visit www.allaboutcookies.org.
• Blocking advertising ID use in your mobile settings. Your mobile device settings may provide functionality to limit use of the advertising ID associated with your mobile device for interest-based advertising purposes.
• Using privacy plug-ins or browsers. You can block our websites from setting cookies used for interest-based ads by using a browser with privacy features, like Brave, or installing browser plugins like Privacy Badger, Ghostery or uBlock Origin, and configuring them to block third party cookies/trackers.
• Advertising industry opt-out tools. You can also use these opt-out options to limit use of your information for interest-based advertising by participating companies:
  • Digital Advertising Alliance: https://digitaladvertisingalliance.org/
  • Network Advertising Initiative: https://thenai.org/how-to-opt-out/

Note that because these opt-out mechanisms are specific to the device or browser on which they are exercised, you will need to opt-out on every browser and device that you use.

European Union and United Kingdom Residents

Overview

The information provided in this section of the Privacy Policy applies to users in the United Kingdom and Europe.

Nexercise, Inc. is the controller of your personal information covered by this Privacy Policy for purposes of UK and European data protection legislation.

We are registered as a data protection fee payer with the Information Commissioners Office. Our registration number is ZB817957.

We have appointed a Data Protection Officer. You can contact them at privacy@sworkit.com

What is our lawful basis for processing your personal information?

In addition to the information set out in this Privacy Policy, we rely on the following lawful bases when we process your personal information.

If you are a visitor to our website or social media

If you are a user of Sworkit Health

If you are an organisation

When we share your personal data outside the UK/EEA

Where we need to store your personal information outside of the UK and the EEA, we make sure your personal information remains subject to the same robust protections as it would be in the United Kingdom and the EEA. For example, we either ensure the country we are transferring the personal information to has been recognised as having adequate privacy regulations or that there are appropriate safeguards in place (as per Article 46, 47 or 49 of the UK GDPR). For a copy of the safeguards relied on to transfer your personal information outside of the United Kingdom, please get in touch with us.

Your Rights

You may have certain rights protected by law over how your personal information is processed (subject to certain exceptions):

• Right to access: You have the right to ask us if we process your personal information and for copies of your personal information
• Right to be informed: You have the right to be informed about how we process your personal information
• Right to rectification: You have the right to ask us to correct personal information you think it inaccurate
• Right to erasure: You have the right to ask us to delete your personal information in certain circumstances
• Right to restrict processing: You have the right to ask us to restrict the processing of your personal information in certain circumstances
• Right to information portability: You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances
• Right to object to processing: You have the right to object to the processing of your personal information in certain circumstances
• Right to withdraw consent: You have the right to withdraw your consent at any time.

To exercise any of your rights in respect to the personal information we process, please get in touch with us and we will respond to you as soon as we can (usually, within one calendar month).

Direct marketing

Please note that you have an absolute right to object to any direct marketing you receive from us. You can also withdraw your consent to receive direct marketing at any time.

International residents

Canada (PIPEDA)

If you are located in Canada, you have the right to request access to and correction of the personal information we hold about you, and to withdraw your consent to our processing of your personal information at any time.

Brazil (LGPD)

If you are located in Brazil, you have the right to access, correct, delete, restrict, or object to our processing of your personal data. You also have the right to portability of your data and to withdraw your consent at any time.

Japan (APPI)

If you are located in Japan, we will provide information about how your personal data is shared with third parties and obtain your consent where required. Where we transfer your personal data outside Japan, we will ensure the recipient provides an equivalent level of protection as required by the Act on the Protection of Personal Information (APPI).

United Arab Emirates (PDPL)

If you are located in the UAE, you may have the right to access, correct, delete, or object to the processing of your personal data. Where your data is transferred outside the UAE, we will ensure appropriate safeguards are in place.

Saudi Arabia (PDPL)

If you are located in Saudi Arabia, you have rights to access, correct, and request deletion of your personal data, and to withdraw consent where we rely on consent. We will only transfer your data outside Saudi Arabia in accordance with applicable law and with appropriate safeguards.

China (PIPL)

If you are located in China, we will collect and process your personal information only for the purposes described in this Privacy Policy. We will clearly explain the categories of personal information we collect, the purposes for which we use it, and how long we retain it. Where we transfer your personal information outside China, we will obtain your separate and explicit consent before doing so and ensure that the recipient provides an equivalent level of protection as required under the Personal Information Protection Law (PIPL). If we process any sensitive personal information (such as financial information or precise location data), we will provide a clear explanation of the necessity for such processing and obtain your separate consent.

As a resident of China, you have the right to access, copy, correct, or delete your personal information; to withdraw your consent at any time; to request an explanation of how your personal information is processed; and to refuse certain automated decision-making.

To exercise these rights, please contact us at the details set out in this Privacy Notice. If you are not satisfied with our response, you also have the right to raise a complaint with the Cyberspace Administration of China (CAC).

Other Countries

If you are located outside the countries listed above, you may still have rights under your local data protection laws. These may include the right to access, correct, delete, or withdraw consent for the processing of your personal data. To exercise these rights, please contact us at the details set out in this Privacy Notice.

How to contact us or make a complaint

Please get in touch with us if you have any complaints or queries about how your personal information is processed. In certain jurisdictions, including the UK and the EU, you have the right to raise a complaint with the supervisory authority in the jurisdiction you live, work or where the infringement took place.

In the UK, this is the Information Commissioner’s Office. If you need support, you can get in touch with the ICO here. If you are in the EEA, you can find your data protection regulator here.

If you do have a query or a complaint, we would really appreciate the opportunity to respond to your concern in the first instance so please get in touch with us.

Amendments

We may amend this Privacy Policy from time to time. When we amend this Privacy Policy, we will update this page and we will notify you by sending an e-mail to the last e-mail address you provided to us.

Any changes to this Privacy Policy will be effective upon the earlier of thirty (30) calendar days following our dispatch of an e-mail notice to you or thirty (30) calendar days following our posting of notice of the changes on our Site. These changes will be effective immediately for new users of our Service.

If you do not wish to permit changes in our use of your Personal Data, you must notify us prior to the effective date of the changes that you wish to deactivate your Account with us. Continued use of our Apps, Site or Service, following notice of such changes means that you agree with those changes.

Definitions

Throughout this privacy notice, we may use certain words or phrases, and it is important that you understand the meaning of them.

• “App(s)” refers to our mobile and web applications made available to you through Apple iTunes, Google Play, the Apple TV App Store, the Android Marketplace, and the world wide web, including the Nexercise App and the Sworkit App;
• “Sworkit” refers to our company, known as “Nexercise, Inc.”; our Site; our Apps; our Service; or a combination of all or some of the preceding definitions, depending on the context in which the word is used;
• “Privacy Policy” refers to this Privacy Policy;
• “Service” refers to the services that we provide, including our Apps, our Site, and referring you to third parties that provide goods and services you may be interested in;
• “Site” refers to any website controlled by us where this privacy policy appears, including www.nexercise.com and www.sworkit.com;
• “User” refers to users of our Apps and visitors to our Site;
• “You,” refers to you, the person who is governed by this Privacy Policy.