Privacy Policy

Introduction

ONE BRO ENTERPRISES LLC ("Company," "we," "us," or "our") operates the K.A.N.E. – Kinetic Alignment & Nutrition Engine mobile application (the "App"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the App. Please read this policy carefully. If you do not agree with the terms of this privacy policy, please do not access the App.

We reserve the right to make changes to this Privacy Policy at any time and for any reason. We will alert you about any changes by updating the "Effective Date" of this Privacy Policy. You are encouraged to periodically review this Privacy Policy to stay informed of updates.

Information We Collect

We collect information in the following categories when you use the App:

How We Use Your Information

We use the information we collect for the following purposes:

• Provide, maintain, and improve the App's functionality
• Personalize your wellness journey, meal plans, and fitness recommendations
• Calculate and display nutritional information using the USDA FoodData Central database
• Generate progress reports and health insights
• Send push notifications and email communications (with consent)
• Process transactions and manage subscriptions
• Detect, prevent, and address technical issues and security threats
• Comply with legal obligations
• Conduct anonymized research and analytics to improve our services

Data Sharing and Disclosure

We may share data with the following parties under the stated circumstances:

• Service Providers: Cloud hosting (AWS/Azure), analytics (anonymized only), payment processors — all bound by data processing agreements.
• Legal Requirements: When required by law, subpoena, court order, or government request.
• Business Transfers: In connection with a merger, acquisition, or sale of all or a portion of our assets. You will be notified via email and/or a prominent notice in the App.
• With Your Consent: When you explicitly authorize sharing (e.g., sharing progress data with a personal trainer or nutritionist).
• Aggregated/Anonymized Data: May be shared for research or marketing purposes in a form that cannot reasonably be used to identify you.

Data Retention

• Active account data is retained for as long as your account remains active.
• Upon account deletion request, all personal data is deleted immediately and permanently upon confirmation. This action cannot be undone.
• Anonymized and aggregated data may be retained indefinitely for research and service improvement.
• Financial transaction records are retained by our payment processor (Stripe) for 7 years per tax and legal requirements. We do not retain these records ourselves.

Data Security

We take reasonable and appropriate measures to protect your information against unauthorized access, alteration, disclosure, or destruction:

• Data at rest is stored on encrypted infrastructure provided by established cloud service providers (AWS) that maintain their own industry-standard security certifications
• Data in transit is protected using TLS (Transport Layer Security) encryption
• Access to user data is restricted to authorized personnel on a need-to-know basis using role-based access controls
• We conduct periodic reviews of our security practices and work to address identified vulnerabilities
• Incident response procedures are in place to address data security events promptly

While we use commercially reasonable efforts to protect your information, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security and encourage you to use strong, unique passwords and to notify us promptly if you believe your account has been compromised.

Your Rights and Choices

You have the following rights regarding your personal information:

• Access: Request a copy of your personal data in a portable format.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal data, subject to legal retention requirements.
• Portability: Request your data in a machine-readable format (JSON or CSV).
• Opt-Out: Opt out of marketing communications at any time via in-app settings or email links.
• Withdraw Consent: Revoke consent for data processing at any time.
• Do Not Track: We honor Do Not Track (DNT) browser signals and Global Privacy Control (GPC) signals.

Children's Privacy (COPPA Compliance)

The App is intended for users who are 13 years of age or older. We do not knowingly collect personal information from children under 13. If we discover that a user under 13 has provided us with personal information, we will delete such information from our servers immediately. K.A.N.E. is rated 17+ on the App Store for compliance purposes, and users are required to confirm their age group during onboarding.

Users between the ages of 13 and 17 may use the App with parental or guardian awareness. Users in this age group experience a modified, wellness-focused version of the app with certain features restricted. Parents or guardians who believe their child has provided personal information without consent should contact us at support@kanefitnessapp.com.

California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to Know what personal information is collected, used, and disclosed
• Right to Delete your personal information
• Right to Opt-Out of the sale or sharing of personal information (Note: We do not sell personal information)
• Right to Non-Discrimination for exercising your privacy rights
• Right to Correct inaccurate personal information
• Right to Limit Use of sensitive personal information

To exercise these rights, contact us at support@kanefitnessapp.com or use the in-app privacy dashboard. We will respond to verified requests within 45 days.

State-Specific Disclosures

In addition to California, the following state privacy laws may apply to our users:

• Virginia Consumer Data Protection Act (VCDPA): Virginia residents may exercise rights to access, correct, delete, and opt out of data processing for targeted advertising or profiling.
• Colorado Privacy Act (CPA): Colorado residents have similar data access, deletion, and opt-out rights, including the right to a universal opt-out mechanism.
• Connecticut Data Privacy Act (CTDPA): Connecticut residents may exercise data rights consistent with the CTDPA, including specific protections for health data.

We monitor emerging state privacy legislation and will update this policy and our practices as new laws take effect.

International Users

If you access the App from outside the United States, your data will be transferred to and processed in the United States. By using the App, you consent to this transfer. We comply with applicable data protection laws and will implement Standard Contractual Clauses (SCCs) or other appropriate safeguards for international transfers if and when we expand to EU/UK markets.

If you are located in the European Economic Area (EEA) or the United Kingdom, we will process your data in accordance with applicable GDPR requirements upon our expansion into those markets.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

• Posting the updated Privacy Policy within the App
• Sending an in-app notification
• Sending an email to your registered email address (for material changes)

The "Effective Date" at the top of this policy indicates when the latest revisions were made. Your continued use of the App after the posting of changes constitutes your acceptance of such changes.