Privacy Policy

1. Categories of Personal Data We Collect

We process data:

(i) you directly provide to us (for example, when you create an account, set walking goals, or contact support),
(ii) we receive about you from third parties (for example, when you sign in via Apple or allow us to access Apple Health or Google Fit data),
(iii) automatically when you use our Service (for example, your IP address via cookies or SDK technologies).

1.1 Data Directly Provided by You

1. Identifiers
This includes your name, email address, and password. You provide this information when you register for the Service, subscribe to our newsletters, or contact us by any means.

2. Onboarding and Profile Data
You provide this information when you register and go through the onboarding process. This category includes:

• General information: Age, date of birth, gender, country, time zone
• Fitness and wellness information: Height, weight, fitness level, daily step goals, activity preferences, walking history, challenge participation
• Goals and preferences: Weight loss goals, motivation factors, preferred walking times, notification preferences

3. Special Wellness Data
Some information we collect may be considered a special category of personal data or sensitive data under certain data protection laws. When applicable, such as when we ask about health conditions that may affect your exercise routine, we will request your explicit consent before processing such data. You may withdraw consent at any time by adjusting your preferences in the app or contacting us at dpo@reaction-club.com.

4. Commercial Information
When you make payments through the Service, you provide financial information to our third-party payment processors. We do not collect or store full credit card numbers, though we may receive limited information such as transaction confirmations, last four digits of your card, and purchase history.

5. User-Generated Content
This includes any content you post within the Service, such as comments, progress updates, photos, achievements shared in the community feed, and any information you provide when contacting support.

6. Enterprise/B2B Service Data
We offer companies the option to obtain the Service as a corporate wellness program (WeMove). Company representatives may provide their name, company name, position, and email address. If your employer grants you access, we process your email address and professional details as provided by your employer.

1.2 Data Provided by Third Parties

1. Apple ID Account
When you sign in with Apple to register an account, we receive personal data from your Apple ID account, which may include your name and verified email address. You may choose to share your real email address or use Apple's private email relay service.

2. Apple Health / Google Fit / Health Connect
With your express permission, we may receive (read) and/or write (share) data with health platforms including:

• Step counts
• Distance walked
• Active calories burned
• Workout data (if you choose to share)

Important: We do NOT use health data from Apple Health, Google Fit, or Health Connect for advertising, marketing, or data mining purposes. Health data is used solely to provide fitness tracking features within the Service. You can withdraw access to health data at any time directly in your device's Health app settings or by disconnecting the integration in our app.

1.3 Data We Collect Automatically

1. Online Activity
We record how you interact with our Service, including:

• App launches, screen views, and feature interactions
• Time and duration of sessions
• Challenge participation and completion
• Points earned and rewards redeemed
• Subscription and purchase activity

2. Device and Technical Data
We collect data from your device, including:

• Language settings and time zone
• IP address
• Device type, model, and operating system
• Mobile carrier and Internet service provider
• Unique device identifiers (for push notifications and fraud prevention)

3. Advertising Identifiers
We may collect your Apple Identifier for Advertising (IDFA) or Google Advertising ID (AAID), depending on your device's operating system. You can typically reset or limit these identifiers through your device settings.

4. Cookies and Tracking Technologies
Our products use various technologies (cookies, SDKs, etc.) to enhance your experience, optimize advertising, and analyze traffic. These technologies include:

• Strictly Necessary: Required for the Service to function properly, including security features, session management, and content delivery
• Functional: Used to remember your preferences and provide enhanced features
• Performance/Analytics: Help us understand how users interact with our Service and identify areas for improvement
• Targeting/Advertising: Used by us and our partners to deliver relevant advertisements and measure campaign effectiveness

You can manage your cookie preferences through your browser settings or our privacy controls where available.

2. Purposes and Legal Bases for Processing Your Personal Data

We collect and use your data primarily to provide our services, enhance the quality of our fitness and wellness offerings, and continuously improve them. Below is a breakdown of how we use your information:

Provide and administer the Service
Create and manage your account, verify identity, enable access to features, process step tracking, calculate points, facilitate rewards.
Legal Basis: Contract performance

Personalize your experience
Customize walking goals, provide tailored coaching tips, recommend challenges based on your activity level.
Legal Basis: Contract performance; Consent (for special data)

Communicate with you
Send push notifications, reminders, account updates, password resets, subscription confirmations, respond to support requests.
Legal Basis: Contract performance; Legitimate interest

Process transactions
Process subscription payments, facilitate reward redemptions, manage billing.
Legal Basis: Contract performance

Research and analytics
Analyze usage patterns, conduct user research, improve features, develop new products.
Legal Basis: Legitimate interest

Marketing communications
Send promotional emails, special offers, and newsletters (with your consent or where permitted).
Legal Basis: Consent; Legitimate interest (where permitted)

Advertising and measurement
Deliver relevant ads, measure ad effectiveness, create custom audiences for marketing campaigns.
Legal Basis: Consent; Legitimate interest

Fraud prevention and security
Detect fraudulent activity, prevent abuse of points/rewards system, protect against unauthorized access.
Legal Basis: Legitimate interest

Legal compliance
Comply with tax regulations, respond to legal requests, enforce our Terms and Conditions.
Legal Basis: Legal obligation; Legitimate interest

Legitimate Interests Explained

Where we rely on legitimate interests as a legal basis, we have balanced our interests against your rights and freedoms. Our legitimate interests include:

• Improving our Service: Understanding user preferences to provide a better experience
• Marketing our products: Promoting our Service in a measured and appropriate way
• Protecting our business: Preventing fraud, enforcing our terms, and defending against legal claims
• Analytics: Understanding how our Service is used to make data-driven improvements

3. With Whom We Share Your Personal Data

We engage partners to carry out specific services or business functions on our behalf. This may involve processing your data using their technologies and resources. We maintain data processing agreements with all such parties to establish rules for processing your data on our behalf.

Categories of Service Providers

1. Cloud Storage and Hosting Providers
We use Amazon Web Services (AWS) and similar providers to host our Service and store your data securely.

2. Analytics and Performance Monitoring
We use services such as Firebase Analytics, Amplitude, Google Analytics, and crash reporting tools (Crashlytics, Sentry) to understand how users interact with our Service and to identify and fix technical issues.

3. Payment Processors
We use third-party payment processors (such as Stripe) to process subscription payments. Your payment information is transmitted directly to these processors and is not stored on our servers.

4. Communication Services
We use services for push notifications (Apple Push Notification Service, Firebase Cloud Messaging), email communications, and customer support (such as Intercom or Zendesk).

5. Marketing and Advertising Partners
We may share data with advertising platforms (such as Meta/Facebook Ads, Google Ads, TikTok) to deliver relevant advertisements and measure campaign effectiveness. This may include creating custom audiences based on user activity.

6. Rewards Fulfillment Partners
When you redeem points for gift cards or donations, we share necessary information with our rewards fulfillment partners to process your redemption.

Other Disclosures

We may also disclose your personal data:

• To law enforcement and authorities: When required by law or to respond to legal requests
• In business transfers: In connection with a merger, acquisition, bankruptcy, or sale of assets
• To protect rights and safety: To enforce our Terms, protect our rights, privacy, safety, or property, and that of our users
• With affiliates: We may share data with companies in our corporate group that will use it in accordance with this Privacy Policy

4. How You Can Exercise Your Privacy Rights

A. General Privacy Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request erasure of your personal data (subject to legal retention requirements)
• Portability: Receive your data in a machine-readable format
• Objection: Object to processing based on legitimate interests
• Restriction: Request limitation of processing in certain circumstances
• Withdraw consent: Withdraw consent at any time where processing is based on consent

Managing Your Data in the App

You can:

• Update your profile information directly in the app
• Disconnect Apple Health/Google Fit integrations via your device settings
• Opt out of marketing emails via the unsubscribe link in any email
• Manage push notification preferences in your device settings

How to Delete Your Account

To permanently delete your account and all associated data:

1. Open the MoveTogether app
2. Tap the Menu (☰) in the top left corner
3. Scroll to the bottom of the menu
4. Tap "Delete Account"
5. Confirm your decision

Important: Deleting your account does NOT automatically cancel your subscription. You must cancel your subscription separately in Profile → Subscription before deleting your account to stop future charges.

B. United States Privacy Rights

If you are a resident of a US state with specific privacy legislation (including California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and others), you may have additional rights:

• Right to opt out of sale/sharing: You can opt out of the processing of your personal data for purposes of "sale" or "sharing" for targeted advertising as defined under applicable state laws
• Right to opt out of targeted advertising: You can opt out of processing for cross-contextual behavioral advertising
• Right to limit sensitive data use: You can direct us to limit our use of sensitive personal information
• Right to non-discrimination: We will not discriminate against you for exercising your privacy rights

California-Specific Rights (CCPA/CPRA): California residents have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to know: Request disclosure of the categories and specific pieces of personal information collected, the purposes for collection, and the categories of third parties with whom we share data
• Right to delete: Request deletion of personal information we have collected
• "Shine the Light" Law: California Civil Code Section 1798.83 permits California residents to request information about our disclosure of personal data to third parties for their direct marketing purposes

We may share certain information with advertising partners for purposes of targeted advertising, which may be considered "selling" or "sharing" under California law. To opt out, contact us at dpo@reaction-club.com with the subject line "California Privacy Rights Request."

How to Exercise Your Rights

To exercise any privacy rights, please:

• Email us at dpo@reaction-club.com
• Use the privacy features available within the app
• Submit a request through our support system

Verification: We will need to verify your identity before processing your request. This typically involves confirming that the request comes from the email address associated with your account. We may request additional information to verify your identity.

Authorized Agent: You may designate an authorized agent to exercise your rights on your behalf. We will require proof of authorization and may contact you directly to confirm.

Appeal: If your privacy request is denied, you have the right to appeal our decision. To appeal, contact us at dpo@reaction-club.com with "Privacy Appeal Request" in the subject line.

C. Managing Advertising Preferences

You can limit personalized advertising through:

• iOS: Go to Settings → Privacy & Security → Tracking → disable "Allow Apps to Request to Track," or Settings → Privacy & Security → Apple Advertising → disable "Personalized Ads"
• Android: Go to Settings → Privacy → Ads → enable "Opt out of Ads Personalization" or delete your advertising ID
• Industry opt-outs: Visit the Network Advertising Initiative or Digital Advertising Alliance for additional opt-out options

D. Right to Lodge a Complaint

If you believe we have not adequately addressed your concerns, you have the right to lodge a complaint with a competent data protection supervisory authority. For EU residents, this includes your local data protection authority. For California residents, you may contact the California Attorney General.

5. Age Limitations

Our Service is intended for users aged 18 and over. We do not knowingly collect personal data from anyone under 18 years of age. If you learn that anyone younger than 18 has provided us with personal data, please contact us immediately at dpo@reaction-club.com. If we learn that we have collected data from a minor without parental consent, we will promptly delete that information.

6. International Data Transfers

We may transfer personal data to countries other than the country in which the data was originally collected in order to provide the Service and for purposes indicated in this Privacy Policy. These countries may include Israel, the United States, and European Union member states.

If these countries do not have the same data protection laws as your country, we deploy appropriate safeguards, such as:

• Standard Contractual Clauses approved by the European Commission
• Data processing agreements requiring equivalent protections
• Adequacy decisions where applicable
• Other appropriate safeguards under applicable law

7. Changes to This Privacy Policy

We may modify this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or service features. If we make material changes, you will be notified through our Service or by other available means (such as email) and will have an opportunity to review the revised Privacy Policy.

Material changes will be notified at least 14 days before they take effect unless applicable law requires otherwise. By continuing to access or use the Service after changes become effective, you agree to be bound by the revised Privacy Policy.

8. Data Retention

We retain your personal data only as long as reasonably necessary to achieve the purposes set forth in this Privacy Policy and our Terms and Conditions of Use. Specific retention periods include:

• Account and Profile Data: Retained while your account is active and for up to 24 months after deactivation, then securely deleted or anonymized
• Health and Activity Data: Retained for up to 24 months after your last activity, then aggregated or anonymized for analytics
• User-Generated Content: Retained while your account is active; deleted within 90 days after account deletion
• Usage and Performance Data: Retained for up to 24 months, then deleted or anonymized
• Transaction Records: Retained for up to 7 years to comply with tax and financial regulations
• Marketing Communications: Retained until you unsubscribe or for 24 months after your last interaction

Even if you request deletion, we may retain certain data as required by law or to support legitimate business purposes such as resolving disputes or enforcing our agreements.

9. Data Security

We implement industry-standard technical and organizational measures to protect your personal data, including:

• Encryption of data in transit (TLS/SSL) and at rest
• Access controls and authentication requirements
• Regular security assessments and vulnerability testing
• Employee training on data protection practices
• Secure storage of health data in compliance with Apple HealthKit requirements
• Incident response procedures

HealthKit Data Security: Health and fitness data from Apple HealthKit is stored securely on your device and in our secure systems. We do not store HealthKit data in iCloud or share it with third parties for advertising purposes.

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your personal data, we cannot guarantee absolute security.

10. Personal Data Controller

The data controller for your personal information is:

Reaction Wellness Ltd.

Registration Number: 516079506

Address: Sapir 7, Herzeliya, Israel

11. Contact Us

You may contact us at any time for questions regarding this Privacy Policy, previous versions, or our data practices:

General Support: hello@reaction-club.com

Privacy/Data Protection: dpo@reaction-club.com

Mailing Address: Reaction Wellness Ltd., Sapir 7, Herzeliya, Israel

To exercise any of your available privacy rights, you may also use the privacy features within the app or contact us using the information above.

Last Updated: December 25, 2025