Privacy Notice

Who we are and what this covers

Capably Health, LLC is a Georgia company developing a strength-and-conditioning planner for adults with physical disabilities and chronic conditions. Contact us at hello@capably.health.

This notice covers our website, early-access email list, correspondence, software-usability testing, and the current local-first Capably Next consumer preview. Capably is pre-launch; joining the email list does not provide workout access, enroll you in testing, or start a paid subscription.

The separate Consumer Health Data Privacy Policy explains health-related categories, purposes, sharing, and rights. It controls if the two notices differ about consumer health data.

Website visits and email updates

Visiting the website

Squarespace hosts this website. When you visit, it processes technical information such as your IP address, browser, device and network information, referring pages, pages viewed, and timestamps. Website analytics can also include clicks, scrolling, searches, and approximate location derived from an IP address. We use site information to operate the website, understand traffic, and improve how people find and use it.

Squarespace uses cookies and similar technologies for site operation, security, and, depending on settings and visitor choices, analytics. You can use any cookie controls displayed on the site and your browser’s controls. Blocking some technologies may affect site features. We do not claim that every cookie or technical request is blocked before a choice is made.

Joining the early-access list

We receive your email address, any name you choose to provide, and subscription records such as signup source, confirmation status, and unsubscribe status. The list uses Squarespace’s newsletter and email services. We use these records to manage the updates you requested and send signup-related messages, which may include confirmation and welcome emails.

No diagnosis or workout history is required to join. Contacting us or volunteering to test does not automatically add you to marketing emails. You can unsubscribe through a marketing email or contact us directly.

Email measurement

Emails sent through Squarespace Email Campaigns can report delivery, bounces, unsubscribes, opens, and link clicks. Open measurement uses a small invisible image, and links can be tracked. These records can be associated with your subscription; they are not necessarily anonymous. Email-provider privacy features and security scanners can make the measurements inaccurate. We use this information to understand delivery and engagement, not to infer a diagnosis or target health-based advertising.

The website and mailing list are separate from the app’s local storage. Loading a hosted page or submitting a signup sends information over the internet; it is not a device-only action.

App data, reports, and backups

The current consumer preview processes the information entered into it on the device being used. It stores a profile name if entered, selected conditions and related details, answers about physical abilities, equipment, preferences, generated plans, session records, exercise logs, feedback, and notes. Records can also include dates, app/content versions, and the explanations behind planning decisions.

The app uses a browser database called IndexedDB, with localStorage as a fallback. If persistent storage is unavailable, it can run with temporary memory that does not survive closing or reloading the page. The current app does not provide a cloud account or automatic cross-device synchronization, and it does not automatically upload your profile or workout history to Capably.

Programmed rules use the entered information to screen movements, generate plans, and explain results. That is automated processing on the device—not a clinician reviewing you, a diagnosis, or an advertising profile. The consumer app has no research/study mode and does not automatically send health records to a generative-AI service.

Reports you choose to share

You can preview and download monthly or custom-date exercise reports in HTML or CSV, and use your browser’s print function to save a report as a PDF. Reports can contain conditions, exercise activity, and feedback. Profile-name and feedback options are shown before export; written notes and free-text reasons are off by default unless you choose to include them. A report without your name can still be sensitive or identifiable.

Creating a report does not send it to anyone. You decide whether to send it to a clinician, another recipient, or Capably. There is no connected clinician, automatic notification, or confirmation that anyone has reviewed it. If you send a report to us, that copy becomes company-held correspondence covered by this notice.

Backups and deletion

The app can export a JSON backup and restore a file you select. Importing it is a local app action, not an upload to Capably. These app-storage and export features do not add encryption. Protect your device, browser profile, downloads, and any storage or email service you use to keep or share a file.

In the preview, Settings → Start over → Delete local preview data removes the profile and workout records held by that preview in the current browser. Clearing the relevant browser site data can also remove local records. Neither action deletes downloaded files, your own device/cloud backups, copies already sent to someone, data in another browser, or records in older Capably builds. We cannot remotely access or recover records that only exist on your device.

Contacting us and software testing

Messages and requests

Our correspondence uses Google Workspace. We receive your address, message, attachments, and normal message metadata. We use them to reply, troubleshoot an issue, manage requests, and follow up. Please send only what is needed; do not include medical records or an entire app backup in an initial support or privacy request.

Volunteering and participating

Testing recruitment may use Google Forms in our Workspace account or direct correspondence. We may ask for contact details, general location or time zone, adult eligibility, device or assistive-technology needs, equipment access, and limited condition, mobility, or accommodation information relevant to participation. The form or invitation explains what is requested and why. You may decline a question or participation; we will explain when missing information prevents arranging a particular session.

Our current usability-testing scope uses fictional profiles and no exercise. We take notes about navigation, comprehension, access barriers, and feedback to improve the product. This does not enroll you in clinical research or establish that a workout is suitable for you.

Optional recording

You will be offered a clear choice about recording. Audio, screen, and/or video are recorded only after you expressly agree to the stated recording scope. You can participate without recording, decline camera use, or ask us to stop recording without losing agreed testing compensation. Your invitation and consent materials identify the call service and what will be captured.

A recording can reveal your face, voice, surroundings, screen content, and health information you discuss. Avoid showing unrelated messages, records, or other people’s information. The current published recording-retention period remains 12 months, then deletion; a shorter applicable consent commitment takes precedence.

How we use information

We use company-held information to operate the website and requested email updates; reply to correspondence; arrange accessible testing; document consent and choices; investigate and fix product problems; and handle privacy, security, or legal obligations. We do not use health details to select advertising audiences.

We may share genuinely non-identifying testing summaries with clinical reviewers, advisors, or potential investors. Removing a name alone is not enough: a rare condition, quotation, or combination of details can identify someone. Material that can reasonably be linked to you remains protected as personal information. Tell us if you do not want to be quoted at all, and we will not use direct quotations from you.

The current app is not a channel for silently collecting data for product improvement or AI training. Feedback you deliberately provide can be used for the testing or support purposes explained when it is collected. Your email signup or participation does not authorize new research, external AI-model training, or public promotion. Any future proposal involving different data uses will be explained separately, with consent obtained where required.

We do not sell personal information or consumer health data. We do not provide it to data brokers, use advertising or remarketing pixels, or upload subscriber or tester lists to advertising audiences. These statements do not mean that the website has no hosting analytics or that campaign emails have no open/click measurement.

Service providers and other recipients

Squarespace

Website hosting, technical site data and analytics, newsletter submissions, subscriber records, and email delivery/engagement records for our requested updates.

Google Workspace

Email, recruitment forms, documents, and information or attachments you deliberately send to us.

Google Meet, when used for a testing session

Call participation and any audio, screen, or video recording separately agreed to. The invitation identifies the actual service before the session.

Recipients you choose

A person or service you choose to send an exported report or file to. Their handling of the copy is outside the app’s local-storage controls.

Squarespace’s built-in features may use Google reCAPTCHA for spam prevention or Google/Adobe font services for display. Where enabled, these services can receive technical information such as an IP address and browser or page details. These platform features are different from Capably uploading an app profile. See Squarespace’s privacy policy, Google’s privacy policy, and Adobe’s privacy policy for their own processing.

Providers handle information needed for their stated role under the applicable service terms and agreements. They can also process service-usage or security information for their own platform operations. We do not claim that every provider processes every category solely on our instructions.

We do not currently share consumer health data with a corporate affiliate. Apart from the providers and authorized uses described here, we disclose identifying information only with your permission or when legally required. We limit legally required disclosures to what is required.

External websites and social platforms have their own privacy practices when you visit them. Our providers may process information in the United States and other countries; this notice does not promise U.S.-only storage.

How long information is kept

Email-list records

While you receive requested updates or a signup is awaiting verification. Unconfirmed signup records are used for verification, not marketing. After unsubscribe, we retain only the records needed to respect the opt-out and document subscription choices, subject to applicable deletion rights.

Tester signup responses

Until you ask for deletion, or 12 months after the relevant testing round ends, whichever comes first.

Session recordings

12 months from recording, then deletion, or earlier when a valid deletion request or a shorter applicable consent commitment requires it. A new policy alone does not extend this period.

Testing notes and findings

Identifiable notes follow the testing-record schedule above. Genuinely non-identifying findings may be kept as product-development records. A coded or name-removed record that can still be linked to you is not treated as anonymous.

Email and support correspondence

24 months, or earlier where a valid deletion request requires it. This includes attachments you send to us. Health information remains subject to the separate health-data policy.

App records and your exports

Local records remain until you delete them, clear the relevant browser data, or the browser removes them. Temporary-memory records can disappear when the page closes. Downloaded exports and copies you share have their own storage and deletion lifecycle.

These periods do not override an applicable right to deletion. If a specific law requires us to keep a limited record, we will explain what remains and why rather than treating all records as exempt. Where providers hold a copy for us, deletion requests are passed through as required. Platform backup limitations are handled under applicable law, not used as a blanket reason to keep active copies.

Your choices and requests

Anyone can ask what information we hold about them, request access or correction, request deletion, withdraw consent to optional processing, or ask us to stop contacting them. Email hello@capably.health. We do not charge for these requests, and exercising a privacy choice does not reduce agreed tester compensation or penalize you in future testing invitations.

Use the email address you used with us where possible, and describe the request. We may ask for the minimum information needed to verify it before releasing or deleting records. Do not send a diagnosis, full medical history, government ID, or an app backup just to make an initial request.

We will respond within 30 days and confirm the action taken or explain any limitation in writing. Health-data rights, deletion handling, and our 45-day appeal response are described in the Consumer Health Data Privacy Policy. Applicable legal deadlines still govern.

Unsubscribing stops marketing updates; it does not erase a support conversation or locally stored workout. Likewise, deleting app data does not unsubscribe your email address. Tell us which records you want addressed, and we will explain any steps that must be taken on your own device.

Security and adult scope

We use business accounts protected by two-factor authentication and limit access to people working on the purposes described here. We do not move identifiable health information into personal accounts or unlisted external tools for unrelated use. No system is perfectly secure, and ordinary email is not a secure patient portal.

If a breach affects personal information we hold, we will investigate and explain what happened, what information was affected, and what protective steps are being taken. We will provide required notices promptly and meet the deadlines that apply. This is not a claim of security certification or that browser-local data is encrypted by Capably.

Capably’s product and testing activities are intended for adults aged 18 or older. We do not knowingly collect personal or health information from anyone under 18 through our website, email list, or testing activities. If you believe a child has submitted information to us, contact us so we can identify and delete it.

Changes to this notice

We update the date on this page when the notice changes. For material changes to how we handle health information, we will directly notify people who have provided it and whose contact details we hold, rather than relying only on a changed webpage. Users with only local app records would need notice in the relevant app release before new processing begins.

Future accounts, payments, cloud synchronization, clinician connections, new testing arrangements, research, or AI features are not silently covered as though they already exist. Before introducing different collection, sharing, or uses, we will describe the actual practice and obtain consent where required. Continued website use or a revised notice alone does not authorize incompatible new uses of previously collected data.