Long Haul: Cycling & Routes

U.S. consumer health privacy notice

Consumer Health Data Privacy Policy

This policy describes the consumer health data Long Haul collects, why we collect it, how it may be disclosed, and the choices available to you.

Effective July 16, 2026  ·  Version 2026-07-16
Health access is optional. Long Haul does not sell consumer health data or HealthKit data, and does not use it for advertising or cross-context behavioral advertising.

1. Scope

This policy supplements the Long Haul Privacy Policy. It applies to consumer health data handled by Long Haul in the United States, including information covered by the Washington My Health My Data Act and similar state laws. It also explains our handling of Apple HealthKit information. It does not cover information processed only by Apple under Apple's own terms.

Long Haul is a fitness service, not a medical device or healthcare provider. Ride, calorie, heart-rate, and training metrics are estimates and are not medical advice.

2. Categories of consumer health data

Depending on the features you choose and permissions you grant, Long Haul may process:

  • Activity and workout data: cycling workout status, timestamps, duration, distance, speed, cadence, power, elevation, energy, training load, and route summaries.
  • Physiological data: heart rate and heart-rate samples collected during a ride.
  • Body and profile data: age or birthday, height, weight, and sex or gender when you provide them for fitness calculations.
  • Precise location data: GPS coordinates, routes, start and end points, altitude, heading, speed, and live group-ride location.
  • Inferences: estimated calories, heart-rate zones, achievements, streaks, fitness trends, and competition rankings derived from the data above.
  • Health-feature support data: diagnostics and information you choose to include in a support request.

3. Sources of consumer health data

  • you, when you enter profile information or record, save, synchronize, or share a ride;
  • your iPhone, Apple Watch, connected cycling sensors, and device location services;
  • Apple HealthKit, only for the data types and access you authorize; and
  • calculations Long Haul performs from authorized ride, sensor, profile, and location data.

4. Why we collect and use it

  • record, display, synchronize, restore, and export rides and route history;
  • show live heart rate, heart-rate zones, speed, distance, elevation, cadence, power, and related ride metrics;
  • estimate calories and training metrics;
  • synchronize active workouts between iPhone and Apple Watch and write completed workouts to Apple Health when authorized;
  • provide features you select, such as live group location, route discovery, achievements, leaderboards, and social sharing;
  • secure, troubleshoot, maintain, and improve the requested health and cycling features; and
  • comply with law and respond to valid legal process.

We request separate affirmative consent before collecting consumer health data where required. A separate choice is presented before sharing health-related activity publicly or sharing live location with a group.

5. Categories of data shared and recipients

We disclose only the data reasonably necessary for the purpose you requested:

  • Hosting and infrastructure providers process account, ride, health-derived, and precise-location data to host and secure Long Haul.
  • Mapping providers may receive coordinates or route locations when a mapping, geocoding, or route feature requires them.
  • Other Long Haul users receive information you explicitly choose to publish or share, including public activity details, achievements, comments, rankings, or live group location.
  • Apple HealthKit receives completed workout data only when you authorize Long Haul to write it.
  • Professional advisers, authorities, or transaction participants may receive limited data when required by law, to protect rights and safety, or as part of a properly governed corporate transaction.
We do not sell consumer health data. We do not disclose HealthKit or consumer health data to advertising networks, data brokers, or for targeted advertising. Service providers may use it only to provide contracted services to Long Haul.

A current list of specifically named processors that may handle consumer health data is available by emailing the address below. We will also identify relevant third parties when responding to a verified access request.

6. Consent and your choices

  • You choose whether to grant each Apple Health permission in iOS.
  • You can grant or withdraw Long Haul consumer-health collection, public-activity sharing, and live-location choices in the App's Privacy controls.
  • Withdrawing consent stops future processing for that purpose. It does not make earlier processing unlawful and does not remove workouts already written to Apple Health.
  • You can revoke HealthKit access in the Health app or in iOS Settings → Privacy & Security → Health.
  • When live group location is withdrawn, Long Haul stops accepting new live locations for active group rides.

7. Your consumer health data rights

Subject to applicable law, you may ask us to:

  • confirm whether we collect, share, or sell your consumer health data;
  • access the data and receive a list of relevant sources and third parties;
  • correct inaccurate consumer health data;
  • delete consumer health data, including deletion from processors where required;
  • withdraw consent for collection or sharing; and
  • appeal a refusal to act on your request.

Submit a request through the App's Privacy controls, the authenticated privacy request API used by the App, or email kaelcao7@gmail.com. We may need to verify your identity. We aim to respond within 45 days; where legally permitted, we may extend once and will explain why. We will not discriminate against you for exercising a privacy right.

If an appeal is denied, you may contact your state attorney general. Washington residents can visit the Washington Attorney General complaint page.

8. Retention and deletion

  • Saved ride payloads, route histories, health-derived summaries, and associated precise location are retained while your account is active and until you delete the ride, request health-data deletion, or delete the account.
  • Live group-location points are retained for no more than 30 days after the group ride ends, unless a shorter period is required by your deletion request.
  • Consent and withdrawal evidence is retained for up to six years to demonstrate compliance, unless law requires a different period.
  • Open privacy requests and related correspondence are retained for up to six years after closure.
  • Encrypted backups age out under our backup cycle after deletion. Data may be retained longer only when required for security, fraud prevention, legal obligations, or legal claims.

9. Security and policy changes

We use access controls, encryption in transit, restricted administrative access, monitoring, and data-minimization measures designed to protect consumer health data. No system is completely secure.

We will post updates on this page and change the effective date. If a change requires new consent, Long Haul will ask before using the data for the new purpose.

10. Contact

Email kaelcao7@gmail.com for privacy questions, rights requests, or appeals. Please use the subject “Long Haul Consumer Health Privacy.”