Privacy Policy

Effective 2 October 2026. Replaces the policy dated 23 September 2026.

1. Who we are

RESISTX is operated by Qorsi Pty Ltd, trading as RESISTX (ABN 99 630 075 768), Sydney, Australia ("we", "us"). We are the data controller for the personal information described in this policy. This policy covers the RESISTX apps for iOS, Android and Apple Watch, and the website at resistx.com.

Questions about this policy or your data: support@resistx.com.

2. Information you give us

RESISTX is a tool for logging and analysing your training, nutrition and body composition. Almost everything we hold is data you enter or import because you want it tracked. Depending on which features you use, this includes:

Account

• Sign-in details: your email address, and your name and profile picture if you sign in with Google or Apple. We do not see your Google or Apple password.
• Guest accounts: if you try RESISTX without signing in, we create a temporary account identifier so your data can be stored and synced. Nothing links it to you until you choose to sign in.

Profile

• Sex, date of birth, height, weight, body fat percentage and blood type (all optional).
• Training experience, training phase (gaining, cutting, maintaining, competition prep) and preferences such as units, week start day and effort scale.
• Nutrition goals: calorie and macronutrient targets, goal weight and the rate you want to reach it.

Training

• Workouts, exercises, sets, reps, weights, effort ratings, rest times, notes, programs and routines.
• Custom exercises you create, including any demonstration photos you attach.
• Workout history you import from other apps (for example Hevy, Strong, FitNotes, Fitbod or JEFIT) as a file or pasted text.

Set recordings

If you record a set for form and rep analysis, we collect:

• The video, including audio. Audio is captured so the saved video has sound on playback. It is not analysed.
• Body pose landmarks extracted from the video on your device (the positions of your joints in each frame).
• Derived metrics such as rep count, tempo, range of motion, bar speed and how they change across the set.

Pose detection runs entirely on your device. Videos and landmark files are uploaded to your private storage in your RESISTX account so they sync across your devices and can be re-analysed as our algorithms improve. They are stored by our hosting provider as described in section 8 and are not sent to an AI provider.

Nutrition

• Foods and meals you log, recipes, custom foods, favourites, water and supplements.
• Photos of meals, nutrition labels, product packaging and recipe pages that you take or choose, and barcodes you scan.
• Messages you type when logging food by chat.
• Food and exercise search queries, which we keep to improve search ranking.

Body composition and health markers

• Bodyweight, circumference measurements, skinfold measurements and body fat estimates, including tables of measurements you photograph for import.
• Progress photos, plus body pose landmarks detected in them on your device to help line up comparisons.
• DEXA scan results you import from a report (body fat, lean mass, bone density and regional breakdowns).
• Blood test results you enter manually or import from a lab report, including hormone panels, lipids, metabolic and other markers. You choose whether RESISTX keeps a copy of the original report.
• Supplement and medication protocols you choose to track.

Feedback and support

If you send feedback from inside the app, we receive your message, an optional screenshot of the screen you were on, your account email and device details (model, OS version, app version). Emails you send to support are kept with our support records.

3. Apple Health and Health Connect

RESISTX can connect to Apple Health (iOS) and Health Connect (Android). This is optional. We only read the categories you approve in the system permission screen, and you can change or revoke that permission at any time in the Health app, Health Connect settings, or RESISTX Settings.

What we read

Each imported record keeps a note of the source app or device it came from (for example a smart scale or watch). We do not read date of birth, biological sex or blood type from the health platform. On Android, Health Connect limits apps to the last 30 days, so what we can read there begins when you connect rather than covering your full history.

Where it goes

Health data you authorise is uploaded to your RESISTX account on our servers in Sydney so that it is available across your devices, survives a reinstall, and can feed the features above. Access controls restrict which users can read it. Other users can only view the categories you choose to share with them. Our service providers process data as described in section 8. Data imported from Apple Health or Health Connect is never used for advertising or marketing, and never sold. It is sent to an AI provider only when you ask the in-app assistant a question that needs it (section 7).

What we write

The RESISTX Apple Watch app saves workouts you complete on the watch to Apple Health, if you allow it. RESISTX does not write weight, nutrition or any other data to Apple Health or Health Connect.

Disconnecting

You can disconnect Apple Health or Health Connect in RESISTX Settings at any time. RESISTX stops reading new data immediately. Data already imported stays in your account as part of your history; deleting your account deletes it.

Our use of information received from Health Connect complies with the Health Connect Permissions Policy, including the Limited Use requirements.

4. Oura Ring and Apple Watch

Oura

If you connect an Oura account, you authorise Oura to share data with RESISTX through Oura's API. We receive your Oura profile details (such as age, height, weight and biological sex as recorded with Oura), ring configuration, sleep sessions and stages, daily readiness, sleep, activity, stress, resilience and cardiovascular age scores, blood oxygen, VO2 max, heart rate, workouts, sessions, tags and rest periods. We store this in your account (with your access token encrypted) and map it into the same sleep, vitals, activity and workout records described above. Disconnecting in RESISTX revokes our access at Oura and deletes the connection. High-frequency heart rate and blood oxygen records are kept in raw form for 90 days; the rest stays as part of your history.

Apple Watch

The RESISTX watch app reads your heart rate and active energy during a workout to show them on your wrist. Heart rate is displayed live and is not stored or sent to our servers. During recorded sets the watch also captures motion sensor data and sends it to your paired iPhone to help detect reps; this stays on your devices. Completed workouts can be saved to Apple Health as described above.

5. Information collected automatically

• App and device basics: app version, platform (iOS or Android) and a random install identifier that is generated on your device and reset if you reinstall. We do not collect your advertising ID.
• Usage events: which screens you view, session start and end, onboarding steps, imports, paywall views and purchase outcomes. These are used for product analytics and are never free text or content.
• Diagnostics and crash reports: when the app errors or hangs we send a report to Sentry (see below) that includes the error, recent app activity, your account ID and email, your IP address and, for a sample of sessions, a masked visual replay of the screens leading up to the problem. We also keep sync and migration diagnostics so we can repair data that failed to sync.
• Approximate location: if you allow it, RESISTX reads a coarse location (city level) while the app is open to show local weather and exact sunrise and sunset times. The coordinates are sent through our server to a weather provider and are never stored, logged or linked to your account.
• Purchases: if you subscribe in the app or on our website, we receive your subscription status, product, billing period and purchase history through RevenueCat. Apple and Google process in-app purchases; RevenueCat and its payment processor Stripe handle website purchases. We never see your payment card details.

6. How we use your information

• To provide RESISTX: store your logs, sync them across your devices, compute your trends, targets, energy expenditure, recovery and progress, and show them back to you.
• To personalise coaching and prescriptions using your own history, for example next-session load suggestions and adaptive nutrition targets.
• To run the AI features described in section 7 when you use them.
• To improve RESISTX. We use information from across our user base to understand how the app is used and to develop, train, test and calibrate the algorithms and models behind RESISTX's features, so they work better for everyone. Where practical we do this with aggregated or de-identified data. This never involves selling your information or giving it to anyone for their own purposes.
• To keep the service reliable and secure: diagnose crashes, repair failed syncs, enforce fair-use limits and prevent abuse.
• To manage subscriptions and provide support.
• To send service emails such as sign-in links and account changes. We do not currently send marketing emails from the app.
• To comply with the law.

If you are in the EEA, UK or Switzerland, our legal bases are: performance of our contract with you (providing the app); your explicit consent for health data, for sending your medical reports and photos to an AI provider, and for location; and our legitimate interests in securing, supporting and improving RESISTX. You can withdraw consent at any time by revoking the relevant permission or contacting us.

7. AI features and OpenAI

Some RESISTX features use large language and vision models hosted by OpenAI (United States). These features are opt-in: nothing is sent unless you use the feature, and you review the result before anything is saved. For medical reports we ask you to confirm before the report is sent. What is sent depends on the feature:

What OpenAI does with it. OpenAI processes this data for us as a service provider under its API business terms. Under those terms OpenAI does not use data submitted through the API to train its models, and may retain it for up to 30 days to monitor for abuse before deleting it. If we change AI provider we will update this policy first, and any provider we use must meet the same no-training commitment.

What we keep. The copy sent for analysis is not stored by RESISTX. Meal, label, recipe and measurement photos are handled as described in section 12. Blood test reports are kept on your device by default so you can tap any value and see where it came from; you choose per report whether to also keep a copy in your account, or none at all. DEXA reports are not kept; only the values you confirm are. The values the model reads out are stored in your account once you confirm them. Separately, to check that these features stay accurate and to fix failures, we keep the structured output of each request for up to 180 days, the text of a report that failed to parse for up to 30 days, and metadata about the request (feature, model, timing, token counts, but no content) for 12 months. Nutrition label and recipe photos are kept with the food or recipe they belong to so it can be re-read as extraction improves. Health, sleep and heart data from Apple Health, Health Connect or Oura is not sent to OpenAI by any of the import or generation features above. The in-app assistant is the one exception, and only for a question you ask: it fetches the records needed to answer and sends them with your question. RESISTX reminds you of this the first time you open the assistant, and nothing is sent unless you ask a question.

The assistant. Each answer is kept in your account for up to 180 days with the question and the records it was given, so the feature can be checked and improved, and it is deleted when you delete your account. Your conversations are visible only to you. The assistant describes your own data; it does not diagnose, treat or give medical advice.

Barcode scanning, text recognition, background removal and pose detection run on your device using Apple or Google on-device frameworks; those images are not sent anywhere.

8. Who we share information with

The following service providers process personal information on our behalf. We provide each with the information needed for its role:

We may also disclose information if required by law or a valid legal request, to protect the rights and safety of our users or the public, or as part of a merger, acquisition or sale of assets, in which case this policy continues to apply to your data.

Sharing with people you choose

You can invite someone by email to see your data in a read-only web portal. You choose which categories they can see: body composition, progress photos, training, nutrition, recovery and activity, bloodwork, and supplements. Progress photos stay off unless you turn them on. The person you invite can see only those categories, cannot change anything, and loses access as soon as you revoke it in RESISTX.

To run the portal we keep the email address you invited for as long as the share exists, and a record of each time the portal is opened and by which email. We keep that access record for 12 months, so there is a record of who viewed your data and when, then delete it. Invitations and related notifications are sent by email through Resend.

The portal at share.resistx.com uses Microsoft Clarity to understand how it is used: clicks, scrolls, page navigation, heatmaps and session replays. Clarity sets cookies and reads device and browser details. Replays are fully masked in the viewer's browser before anything is uploaded, so no text or images on the page, including the shared health data and photos, are sent to Microsoft. Clarity does record the address of each page viewed, which on the portal includes the sharing user's account ID (a random identifier, not a name or email address). Clarity does not run on invitation links.

You can also export your data, share workout cards and set videos, and send a blood test report through your phone's share sheet. Revoking access in RESISTX does not remove copies a recipient has already saved.

9. YouTube API Services

RESISTX's internal publishing tools use YouTube API Services. We use them to upload, schedule, edit and remove videos on YouTube channels operated by RESISTX and its founder, and to read those channels' analytics. These tools are not offered to the public, and no RESISTX app user's data is ever sent to YouTube.

When one of our own YouTube accounts is connected, the tools access that channel's video details (titles, descriptions, privacy settings and publish times), its analytics (views, watch time, retention and subscribers gained), and the comments people leave on its videos (the commenter's public display name and the comment text). We use this only to publish, edit and remove our own videos, to measure how they perform, and to alert us to new comments so we can reply. We do not share YouTube data with anyone.

We store YouTube data on our own systems. Raw data is refreshed or deleted within 30 days; we may keep summary statistics we calculate from it for up to 36 months. The access token for a connected account is stored on our systems with access restricted to the operator, and is deleted when the account is disconnected.

Google's handling of this data is covered by the Google Privacy Policy: https://www.google.com/policies/privacy. Anyone whose YouTube account is connected can revoke our access at any time from the Google security settings page: https://myaccount.google.com/permissions. Questions about this go to the privacy contact in this policy.

10. What we never do

• We never sell, rent or trade your personal information.
• We never use your data for advertising and we do not show ads. The app contains no advertising, attribution or tracking SDKs and does not request the advertising identifier.
• We never share your health data, progress photos, videos, blood results or body composition with data brokers, insurers, employers or anyone else for their own purposes.
• We never send Apple Health, Health Connect or Oura data to an AI provider.
• We never collect precise location, contacts, or the contents of your photo library beyond the photos you pick.

11. International transfers

Your account data is stored in Australia. Some providers listed in section 8 process data in the United States, the United Kingdom, Finland or wherever Apple and Google operate. When we transfer personal information outside the country you live in, we rely on the provider's contractual commitments to protect it, including standard contractual clauses where they are required, and we only send what each provider needs. Under the Australian Privacy Act these are disclosures to overseas recipients in the countries named above.

12. How long we keep your data

After deletion we may keep aggregated or de-identified information that can no longer be linked to you, and records we are legally required to keep, for only as long as the law requires.

13. Security

All data is encrypted in transit. Data at rest on our servers is encrypted by our hosting provider. Every record in your account is protected by row-level access controls so that only your authenticated account can read or change it, and your photos, videos, reports and backups are stored in private storage that requires your credentials. Third-party access tokens (such as Oura) are stored encrypted. Photos you attach to custom foods, recipes and custom exercises are served from unguessable web addresses so the app can display them quickly; treat them as not confidential.

A copy of your data is also kept on each device you sign in on, so the app works offline. Protect your devices with a passcode. No system is completely immune to risk; if we become aware of a breach affecting your data we will notify you and the relevant regulator as required by law.

14. Your rights and choices

• Access and export: Settings → Data & Privacy → Export your data gives you a copy of everything you have logged as CSV files.
• Correct: edit any entry or your profile in the app.
• Delete: delete individual entries in the app, or delete your whole account in the app: open Settings, tap Privacy, and use Delete account under Danger Zone. Deletion is immediate and permanent. You can also email support@resistx.com from your account email. See Deleting your account for details.
• Control permissions: revoke camera, microphone, photo, location, Apple Health or Health Connect access in your device settings at any time. Disconnect Oura in RESISTX Settings.
• Control AI features: they only run when you use them. Don't use them and nothing is sent.

Depending on where you live you may also have rights to restrict or object to processing, to data portability, to withdraw consent, and to complain to a regulator. In Australia you can complain to the Office of the Australian Information Commissioner (oaic.gov.au). In the EEA or UK you can complain to your local supervisory authority. We would rather hear from you first: support@resistx.com. We respond to requests within 30 days and will not discriminate against you for exercising your rights.

15. Our website

resistx.com uses Google Analytics and Microsoft Clarity to understand how visitors use the site. Both set cookies. Google Analytics sends usage data (pages viewed, approximate location derived from IP, device and browser type) to Google. Clarity records clicks, scrolls, page navigation, heatmaps and session replays, with device and browser details, and sends them to Microsoft; it masks what you type into form fields. If you join the waitlist, your email address is stored in a Google Sheet we control and used only to invite you to RESISTX and tell you about launch. You can ask us to remove it at any time. The site is hosted by Cloudflare, which processes request logs to serve and protect it.

Cookies and your choice

If you visit from the EU, the EEA, the UK or Switzerland, resistx.com and the share portal at share.resistx.com ask before loading Google Analytics or Microsoft Clarity, and neither runs until you accept. Visitors from other countries get them by default. Wherever you are, you can accept or decline at any time using Cookie settings at the bottom of resistx.com, or in the share portal. Your choice is saved for 12 months in a cookie called rx_consent and applies to both resistx.com and share.resistx.com, so you are only asked once. To work out which country you are visiting from, the page asks Cloudflare, which reads it from your IP address; we do not store it. If you decline after accepting, we stop loading both tools and remove the analytics cookies they set.

16. Age requirement

You must be at least 16 years old to use RESISTX. We do not knowingly collect personal information from anyone under 16. If you believe a child has created an account, contact us and we will delete it.

17. Changes to this policy

We will update this policy as RESISTX changes. The effective date at the top tells you when it last changed. For significant changes, especially to how we use health data or AI, we will tell you in the app or by email before they take effect.

18. Contact

RESISTX (ABN 99 630 075 768), Sydney, Australia.
support@resistx.com