Privacy Policy

Carius Privacy Policy Effective Date: August 25, 2026 Last Updated: August 25, 2026 Carius ("Carius," "we," "us," or "our") respects your privacy. This Privacy Policy explains how information is collected, used, stored, disclosed, and protected when you use the Carius mobile application, website, and related services (collectively, the "Service"). By using the Service, you acknowledge the practices described in this Privacy Policy. 1. Information We Collect Depending on how you use Carius, we may collect the following categories of information. A. Account Information We may collect information necessary to create and maintain your account, including: • Name or username; • Email address; • Account identifiers; • Authentication information; and • Subscription or account status. We do not intentionally store complete payment-card information. Payments may be processed by Apple, Google, Stripe, or another payment provider, as applicable. B. Fitness and Workout Information Carius may collect information you voluntarily provide or generate through use of the Service, including: • Exercise selections; • Workouts completed; • Sets, repetitions, and weights; • Estimated or reported strength levels; • Repetitions in reserve ("RIR") or similar effort measurements; • Workout frequency; • Exercise history; • Personal records; • Training goals; • Available equipment; • Training experience; • Workout preferences; • Progress and performance information; and • Other fitness-related information you choose to provide. This information may reveal information about your physical condition, fitness, or wellness and will therefore be treated as sensitive information where required by applicable law. C. Profile and Personalization Information To personalize training recommendations, we may collect information such as: • Age or age range; • Height; • Weight; • Training experience; • Fitness goals; • Exercise preferences; • Available equipment; • Scheduling preferences; and • User-selected physical or training limitations. You should not provide Carius with medical diagnoses, detailed medical records, or other medical information unless a feature specifically requests that information. D. Device and Usage Information We may automatically collect certain technical information, including: • Device type; • Operating system; • Application version; • IP address; • Crash information; • Diagnostic information; • Feature usage; • Session information; and • General interaction data. We use this information primarily to operate, secure, troubleshoot, and improve Carius. E. Connected Health or Fitness Services If Carius offers integrations with services such as Apple Health, HealthKit, wearable devices, or other fitness platforms, we will access such information only after obtaining the permissions required by the applicable platform and law. The specific information accessed will depend upon the permissions you grant. You may revoke those permissions through the applicable device or service settings. Information obtained through health or fitness integrations will not be sold or used for targeted advertising. 2. How We Use Information We may use information collected through Carius to: • Create and maintain your account; • Generate workouts and exercise recommendations; • Personalize training programs; • Adjust exercise selection, volume, intensity, repetitions, and suggested loads; • Track workout history and progress; • Detect training trends and plateaus; • Provide achievements, streaks, levels, and other gamification features; • Operate subscriptions; • Provide customer support; • Maintain and secure the Service; • Diagnose technical problems; • Improve Carius's algorithms, features, and user experience; • Prevent fraud, abuse, or misuse; • Communicate important account or Service information; and • Comply with applicable law. Carius may use aggregated or de-identified information to understand how the Service is used and improve its programming systems, provided such information cannot reasonably be used to identify you. 3. Automated Workout Recommendations Carius uses software algorithms to generate and modify workout programs based upon information such as workout history, reported performance, goals, equipment, preferences, and other inputs. These systems are designed for fitness programming and are not medical diagnostic or treatment systems. Carius does not use your information to diagnose disease, determine whether you are medically capable of performing an exercise, or replace evaluation by a qualified healthcare professional. 4. How We Share Information We do not sell your personal information or health or fitness information. We do not share health or fitness information with advertisers for targeted advertising. We may disclose information to service providers that perform functions necessary to operate Carius, such as: • Cloud hosting and database providers; • Authentication providers; • Payment processors; • Error-monitoring and application-performance services; • Customer-support providers; • Email or notification providers; and • Security and fraud-prevention providers. These providers may access information only as necessary to perform services for us and are required to handle information in accordance with applicable contractual and legal requirements. We may also disclose information where reasonably necessary to: • Comply with applicable law, regulation, subpoena, or legal process; • Protect the security or integrity of Carius; • Investigate fraud or misuse; • Protect the rights or safety of Carius, our users, or others; or • Complete a merger, financing, acquisition, reorganization, or sale of some or all of our business, subject to applicable law. 5. Health and Fitness Information We recognize that fitness information may be sensitive. Carius will not use information obtained through Apple's HealthKit APIs or similar health integrations for advertising or marketing purposes where prohibited by applicable platform rules or law. We will not sell health or fitness information to data brokers. Where legally required, we will obtain consent before collecting or processing sensitive health or fitness information. 6. Data Security We use reasonable administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, disclosure, alteration, loss, or destruction. However, no application, network, database, or method of electronic transmission can be guaranteed to be completely secure. We therefore cannot guarantee absolute security. Users are responsible for maintaining the confidentiality of their account credentials and should notify us if they believe their account has been compromised. 7. Data Retention We retain personal information for as long as reasonably necessary to: • Provide the Service; • Maintain your account; • Fulfill the purposes described in this Privacy Policy; • Meet legitimate business requirements; • Resolve disputes; • Enforce agreements; and • Comply with applicable legal obligations. When information is no longer reasonably necessary, we may delete, anonymize, or de-identify it, subject to legal retention requirements and reasonable backup cycles. 8. Account and Data Deletion You may request deletion of your account and associated personal information through the functionality provided within Carius or by contacting us at the address listed below. Following a valid deletion request, we will delete or de-identify information associated with your account unless retention is required or permitted by applicable law. Some information may remain temporarily in encrypted backups or security records before being deleted through normal retention cycles. 9. Your Choices and Rights Depending upon your jurisdiction, you may have rights regarding your personal information, including rights to: • Access personal information; • Correct inaccurate information; • Delete information; • Obtain a copy of certain information; • Withdraw consent; • Restrict certain processing; or • Opt out of certain uses of information. We will honor applicable privacy rights as required by law. You may also revoke permissions for device-level health, fitness, notification, or similar information through your device settings. 10. Children's Privacy Carius is not intended for children under 13, and we do not knowingly collect personal information from children under 13 without legally sufficient parental consent. If we learn that we have collected information from a child in violation of applicable law, we will take reasonable steps to delete it. Certain features may be restricted to older users where required by law or platform requirements. 11. HIPAA Carius is a consumer fitness application and is not intended to provide healthcare services on behalf of a healthcare provider or health plan. Unless expressly stated otherwise in connection with a particular service, Carius is not a HIPAA-covered healthcare provider, health plan, or healthcare clearinghouse, and information submitted to Carius should not be assumed to constitute a HIPAA-protected medical record. Other federal or state privacy laws may nevertheless apply to information handled by Carius. 12. Security Incidents and Breach Notification If we discover a security incident involving personal information, we will investigate and provide notices to affected users, regulators, or other parties when required by applicable law. This may include obligations applicable to consumer health and fitness applications under federal or state law. 13. Changes to This Privacy Policy We may update this Privacy Policy periodically. If we make material changes, we may notify you through the Service, by email, or through another appropriate method. Continued use of Carius following the effective date of an updated Privacy Policy constitutes acknowledgment of the updated policy to the extent permitted by law. 14. Contact Us Questions, privacy requests, and deletion requests may be directed to: Carius Atlara Firm LLC hello@atlarafirm.com