Privacy Policy

Effective and last updated August 29, 2026

Palio uses the information you provide to deliver recovery tracking and, when you choose to use them, AI-powered insights. We do not sell personal information, use health information for advertising, or receive your payment-card details.

This Privacy Policy describes how Saif Khamis, doing business as Palio ("Palio," "we," "us," or "our"), collects, uses, discloses, and protects information when you use the Palio mobile application and related services (the "Services"). If you do not agree with this policy, do not use the Services.

1. Information we collect

Account information

We collect information used to create and manage your account, including your name, email address, authentication information, and an internal user identifier. If you sign in with Apple or Google, we receive the account information that provider makes available according to your choices.

Recovery, health, and fitness information

We collect information you enter into Palio, including injury type, injured side, surgery or injury date, exercises, sets, repetitions, weight, duration, workout dates, notes, pain and swelling ratings, post-workout check-ins, weekly goals, and calculated progress or symmetry measurements. This information may be considered sensitive health information.

User content

We collect content you choose to provide, including workout notes, optional progress photos, questions sent to Ask Palio, and AI conversation history. Photos are uploaded only when you choose to attach them and grant the applicable device permission.

Purchases and communications

We receive information about purchase status and Palio Pro entitlement from Apple and RevenueCat. Apple processes payment credentials; Palio does not receive your complete payment-card or bank-account information. We also process notification preferences and information needed to send account, security, and trial-related emails.

Technical information

Our service providers may process basic technical information needed to operate, secure, and troubleshoot the Services, such as request timestamps, IP address, device or application information, and service logs. Palio does not use third-party advertising trackers.

2. How we use information

We use information to:

• create, authenticate, and maintain your account;
• store workout history and calculate progress, trends, and symmetry;
• provide reminders and post-workout check-ins when you explicitly enable them;
• generate reports and other features you request;
• verify purchases, restore access, and administer Palio Pro;
• provide support, service notices, security communications, and trial reminders;
• protect the Services, prevent misuse, comply with law, and resolve technical problems; and
• generate AI features as described below.

3. AI features and automated processing

Palio offers optional AI-powered features, including Ask Palio and AI-generated weekly recovery summaries. When you use these features, Palio may send your question and relevant account context—such as recovery week, recent sessions, exercise data, symmetry, pain, swelling, and prior conversation turns—to Anthropic for processing. If you explicitly request analysis involving a progress photo, that photo may also be sent to Anthropic.

AI responses may be stored with your account so that conversations and summaries remain available in the app. AI output can be incomplete or inaccurate. It is provided for general informational purposes, is not a diagnosis or treatment recommendation, and is not a substitute for advice from a physician, surgeon, physiotherapist, or other qualified professional.

We do not use your health information or AI conversations for targeted advertising. We require service providers processing this information for us to protect it consistently with their contractual and legal obligations.

4. Service providers and disclosures

We disclose information only as needed to operate the Services, comply with law, protect rights and safety, or complete a business transaction. Our principal service providers are:

• Supabase — authentication, databases, server functions, and private photo storage;
• Anthropic — generation of optional AI responses and summaries;
• RevenueCat — purchase verification and entitlement management;
• Apple — App Store distribution, in-app purchases, and optional Sign in with Apple;
• Google — optional Google sign-in;
• Resend — delivery of account and service-related emails; and
• Cloudflare — hosting this website and legal pages.

We may also disclose information when required by law; to investigate fraud, abuse, or security incidents; to protect users or others; or in connection with a merger, financing, acquisition, or sale, subject to appropriate protections.

5. Legal bases and consent

Depending on where you live, we rely on your consent, performance of our agreement with you, our legitimate interests in operating and securing the Services, and compliance with legal obligations. Where consent is required for sensitive information, photos, notifications, or AI processing, you may withhold or withdraw that consent, although the related feature may then be unavailable.

6. Data retention and deletion

We generally retain account information, recovery records, photos, AI conversations, and summaries while your account remains active so we can provide the Services. We may keep limited records longer when reasonably necessary for legal compliance, fraud prevention, dispute resolution, security, or enforcement of our agreements. Service-provider backups may take additional time to expire.

You may permanently delete your account inside Palio under More → Settings → Delete Account. Account deletion removes your active account and associated Palio data, subject to limited legal or security retention. You may also request access, correction, or deletion by emailing [email protected].

7. Security and international processing

We use reasonable administrative, technical, and organizational safeguards, including authenticated access and access controls designed to limit users to their own records. No storage or transmission system can be guaranteed completely secure. Our providers may process information in Canada, the United States, or other jurisdictions where they operate, which may have different privacy laws than your jurisdiction.

8. Your privacy rights

Depending on your location, you may have rights to access, correct, delete, or obtain a copy of personal information; withdraw consent; restrict or object to processing; or complain to a privacy regulator. We will not discriminate against you for exercising applicable privacy rights. Contact us using the address below. We may need to verify your identity before completing a request.

9. Children

Palio is not directed to children under 13, or under the minimum age required by applicable local law. We do not knowingly collect personal information from a child below that age. If you believe a child has provided information without appropriate authorization, contact us so we can investigate and delete it.

10. Health information and advertising

We do not sell personal information. We do not use or disclose health, fitness, recovery, photo, or AI-conversation information for targeted advertising, advertising measurement, or data-broker purposes.

11. Changes to this policy

We may update this policy when our practices or legal obligations change. We will update the date above and provide additional notice when required by law. Continued use after an update is governed by the revised policy.

12. Contact us

Saif Khamis, doing business as Palio
Toronto, Ontario, Canada
Email: [email protected]