Fortis Salus Privacy Policy
Last updated November 1, 2026 · Fortis Salus LLC
Request deletion of your Fortis Salus account and associated data · Android app privacy details
Who this policy covers
This policy explains how Fortis Salus LLC handles information in the Fortis Salus iPhone and Android apps, the Apple Watch companion, the online Members service and the Fortis Salus informational website. Contact support@fortissalus.com about privacy, access to your information or deletion. Features and permissions are optional, and some features require Pro. Your local phone records and online account are separate.
Android app
The Android edition provides general fitness and wellness support for adults 18 and older. Its features and data flows differ from the iPhone and Watch features below. Android private workout notes, actual sets and results, route points, exercise choices, imported templates and custom Muscle Builder prescriptions stay in private on-device storage. Signing in does not upload this journal or these routes. Android cloud backup and device transfer are disabled for app data; removing the app removes its local data.
Outdoor recording requests location only when you start a session. A visible foreground-service notification includes a Stop control and supports recording with the screen locked. Device power controls or force stopping the app can interrupt recording. The app does not request background-location permission, restart recording at boot or upload route points. It does not use Google Maps tiles. You can stop recording or revoke location in Android Settings.
Importing or exporting a Fortis prescription uses the system file chooser after your action. Shared files contain planned instructions and any prescription or crew labels you enter, including optional planned sets, reps, load or duration. They exclude completed workout results and private notes. Recipients can retain copies you choose to share. Six original silent movement illustrations are packaged in the app rather than streamed from an external video host.
Optional registration and sign-in send your entered email, password and display name over HTTPS to the Fortis Members service. The Android app does not save or log your password. Remembering a session retains your email and validated session cookies encrypted using AndroidKeyStore; turning off remembered access removes saved cookies. Profile edits send the details you choose to save, including birth date, responder role, organization/division, station/shift/unit, schedule, time zone and measurement units. Approved community reading, reports and blocks contact the same service; reports send your text and the relevant account or content identifiers.
Signed-in nutrition features read saved preferences and daily nutrition/hydration totals. Pro meal and hydration logging sends only the details you explicitly save: meal name, supplied calories/macronutrients or water amount, and time. These records are linked to your online account. Missing nutrients remain unknown. This Android edition does not upload the private workout journal, support public posting, private messages or media uploads, or connect Wear OS, a recipe provider or an AI provider. No app analytics or advertising SDK is included.
Google Play processes Android subscription payments and product/purchase status. When Google purchases are available, Fortis server verification receives the purchase token, product ID and package name, associated with your authenticated account through an opaque purchase binding. The service retains purchase state and transaction records for access controls, subscription events and prevention of receipt reassignment. Fortis does not receive your payment-card details or Google account password. Purchases remain unavailable until Google product and server readiness are verified. Deleting your Fortis account does not cancel a Google Play subscription; manage it in Google Play subscription settings. The online account deletion and retention rules below apply to Android account records too.
Health Connect in Android development builds
The new Android Health Connect screen offers separate read permissions for steps today, sleep over the last 24 hours and average heart rate today. You choose categories, grant access in Android and explicitly refresh a temporary preview. Missing data is shown as unavailable. Readings are kept only in memory while the preview is active, cleared when it leaves the foreground, and never written to the journal, exported, uploaded or sent to AI. The disconnect control revokes this app’s Health Connect permissions; original records remain in Health Connect. Store rollout and device verification are still pending.
Records kept on your iPhone
The local journal stores the profile and entries you choose to save, including your shift schedule, check-ins, training choices, notes, workouts, meals, hydration, recipes and body measurements. Saved workout routes, private videos and saved workout or recipe video links use separate local storage. These records are not automatically uploaded to or synchronized with your Members account.
Local journal, route and video files use iOS file protection and are excluded from device backup. There is no automatic cloud recovery for these files. Exports and system sharing create copies under your control. Review exports and screenshots before sharing because they can contain personal information.
Apple Health and body measurements
When you choose Apple Health access, the app can ask to read steps, active energy, walking or running distance, flights climbed, exercise time, sleep, resting heart rate, heart-rate variability, respiratory rate and blood oxygen. Access depends on the choices you make in Apple’s permission screens. General connection-screen readings are held temporarily in memory and cleared when that screen is no longer active; they are not automatically added to your journal, exported or sent to the online service.
If you explicitly copy a sleep duration into a check-in and save it, that value becomes part of the local journal and its export. Body measurements have a separate import flow for authorized weight, height, waist and body-fat samples. Imported copies are stored locally and included in journal exports. You can explicitly save a selected manual measurement to Apple Health after granting write permission. Removing a local measurement does not delete the original in Apple Health; an identifier may remain locally to prevent reimporting that removed sample.
Fortis Salus does not sell Apple Health readings or use them for advertising, and does not send those readings to employers, departments, sponsors or other members. Online wellness entries that you separately type and save are account records, as described below. Apple applies its own Health data and device settings to the original Health records.
iPhone workout location and maps
In iPhone version 1.0, phone route recording runs in the foreground and pauses when you leave the app. Version 2.0 adds continuation of a route you explicitly start while the screen is locked or another app is visible, with the system location indicator. It does not start a route automatically. Recording can stop if you pause it, location access is lost or iOS ends the app. After an interruption or app termination, version 2.0 recovers the route paused from its last saved checkpoint; recent unsaved locations can be lost. Route points and recovery checkpoints remain on the phone and are not sent to the Members service. A route export or share happens only when you choose it. Apple supplies map content and handles requests made to its map services. You can stop recording or revoke location access in iPhone Settings.
Version 2.0 local backups and AirDrop
When you choose to prepare a private backup, version 2.0 copies your local journal, profile, check-ins, measurements, saved routes, workout templates, saved video links and private video files into a .fortisbackup file. These records can reveal health details and precise locations. Backups exclude Apple Health originals, online Members records, passwords, subscription access, permissions, active workouts and device preferences. A backup does not grant Pro access or synchronize an online account.
The backup file is not password-encrypted. Anyone with a saved copy can read it. You choose the recipient or storage destination in Apple's share menu; AirDrop protects the transfer, not later copies. Share only with trusted recipients and keep saved copies secure. The app keeps a prepared temporary copy until it is discarded or removed by the system; use Discard prepared copy when finished. Copies held by a recipient or another destination are not recalled by deleting the app or its local records.
Received backups open for local review and do not restore automatically. A separate confirmation schedules replacement of local records on the next launch, retaining a private copy of the previous records on the device. Restore does not replace online account records or Apple Health originals. Watch summary sharing is turned off until you choose it again. Received workout prescriptions are reviewed separately and do not automatically become completed workouts.
Live Sky location
In app versions with Live Sky, you can choose a city, state or ZIP code, or opt in to approximate device location while Fortis Salus is active on iPhone, or while Home is open on Android. The app saves the selected approximate coordinates, place name, location mode and time zone on your device for Sun and Moon calculations. City searches and place lookups use the operating system's location services, which may send the search or coordinates to its service provider. These sky settings and location are not uploaded to the Fortis Salus Members service. Android city selection includes a time-zone choice; following device location uses the device time zone. You can stop following location, choose another city or change location permission in system Settings.
Optional Garmin Connect integration
Garmin connection is optional in app versions that provide it and requires a Fortis Salus member account. Approval opens Garmin's authorization screen; Fortis Salus does not ask for or store your Garmin account password. Linking an account does not by itself confirm that Garmin has sent readings. Supported data arrives after Garmin Connect receives a sync and sends the records to our service; this is not continuous heart-rate or location monitoring.
You choose separately whether to receive health and wellness summaries, activity details, precise GPS routes associated with activities, and women's health cycle summaries. Route collection also requires activity consent. The service stores selected records with your Fortis Salus account, along with the provider account identifier, granted permissions, consent choices and sync dates. Access and refresh credentials are encrypted for server-side use. The native screens display available records for the signed-in account; they do not automatically copy them into your local workout journal.
Garmin sends callbacks through a Cloudflare relay to the Fortis Salus Members service, hosted by Floot using AWS and Neon infrastructure. Authorized service operators and these hosting providers may process the records to operate the service. Garmin data is not sold, used for advertising, shared with employers, departments, sponsors or other members, or sent to OpenAI or other AI services. Garmin data and derived information are not used to train, test, evaluate or improve AI models.
Scheduled cleanup removes health summaries and activities older than 365 days, GPS routes 90 days after receipt, and women's health summaries 180 days after receipt. Health summaries without a source start time use their receipt date. Service interruptions can delay scheduled cleanup; these are retention targets rather than deletion at an exact instant.
Turning a data category off removes its active service records. Disconnecting Garmin or deleting your Fortis Salus account removes active Garmin records and requests revocation of Garmin access. If revocation cannot finish immediately, encrypted credentials and minimal retry details remain while the service retries or until both credentials expire. You may also remove Fortis Salus access in Garmin Connect. Copies held by Garmin follow Garmin's own controls.
Your online account export includes your Garmin connection and consent choices, sync dates and stored Garmin records. Account export and deletion controls require account ownership verification. Contact support@fortissalus.com for access, correction or deletion questions; do not send passwords or unnecessary health details. Active deletion does not erase managed database recovery history immediately; our paid Floot service keeps recovery history covering the last seven days. Service logs follow the periods described below.
Where a supported app screen offers sending a planned workout or course to Garmin, that requires your action and Garmin's permission. Route maps and sending workouts or courses are not available in the current Android edition.
Apple Watch
If you enable daily-summary sharing, the iPhone sends the current duty status, chosen training intensity, water total, workout count and display-unit choice to your paired Watch through Apple’s device connection. It does not send your full journal, private notes or Apple Health readings. Turning sharing off queues a clear request. A disconnected Watch can retain its last received summary until it reconnects; summaries are hidden after six hours or when the day changes.
Watch workout recording is separate. Starting a workout requests Health access for workout recording and readings such as heart rate, active energy and distance. You choose whether to save the workout summary to Apple Health or discard it. Apple may retain sensor samples independently of that choice. Minimal workout recovery and save-status details remain on the Watch to avoid losing a session or saving it twice.
If you enable live phone display on the Watch, workout heart rate, energy, distance and elapsed time are sent to your paired iPhone and held temporarily in memory. They are not added automatically to your journal, export or online account. The iPhone retains display-hiding choices without those health readings. Hiding the display does not stop the Watch workout or transmission; stop phone display on the Watch to stop transmission.
Photos, private videos and saved video links
Camera and microphone permissions are requested when you choose to record a private workout video. A system Photos or Files picker gives the app the items you select rather than uploading your library. Private video imports and recordings stay in the phone’s video library. A separate system share action sends a copy to the destination you choose. Deleting a library copy does not delete its original in Photos or Files; if file cleanup fails, the app retries cleanup when the library opens.
Saved workout and recipe video links stay on the phone. Opening one visits the original site or app, which applies its own privacy practices and may require an account. Fortis Salus does not download the linked video merely because you save its link. Public photo and video file uploads to the Fortis Salus community are not enabled. Private imports never become public submissions automatically.
Apple Music, contacts and reminders
Music access is optional. With your permission, the app can show your Apple Music library and control playback. Preferred workout playlists are saved locally; song and library details are not uploaded to the Members account. Apple manages music availability, playback and its subscriptions. A playlist link you explicitly save or share through Members is a separate online record. Provider playback views and external links can connect directly to the provider and use its cookies.
The system contact picker provides only the phone number or email detail you select. Fortis Salus does not upload your address book. Opening a Members conversation sends the selected or typed email to the account service to find that member. A phone message draft stays in Apple’s Messages flow until you choose to send it.
Daily reminders are optional local notifications with generic text, without health values, notes or shift details. Widgets and Shortcuts open app workflows without displaying private wellness values. New iPhone development builds add optional Live Activities showing only workout recording status and elapsed time. Live Activities exclude routes, heart rate and personal labels, and can be seen by anyone who can view your Lock Screen. WorkoutKit previews share only an explicitly selected walk/run type, indoor/outdoor setting and planned duration with Apple’s workout interface; private titles, notes and completed results are excluded. Saving to Apple Watch requires the user’s choice in Apple’s interface and a supported device.
Message push delivery is being configured and is not yet verified. When enabled, opting in registers an Apple device token with the Members service, encrypted at rest and linked to the signed-in account and session. Apple receives a fixed generic alert, without sender names, message text or health readings. A registration stops being eligible after 24 hours unless refreshed during app use. Turning off message notifications removes the session’s registration; account or session deletion also removes it. Expired registrations are removed on a subsequent registration operation; service backups and logs follow the retention limits below. Missing service configuration does not register a device or start delivery.
Online accounts and the Members service
Creating or signing into Members sends your email, password and relevant registration details to the Fortis Salus service over HTTPS. The service stores a password hash, account identifier, display name and sign-in session records. If you choose Remember me, the iPhone retains your email and session cookies, not the password you typed. A session can still expire; signing out clears the app’s saved session.
Information entered online can include your profile, birth date, role or affiliation, station or shift assignment, time zone, preferences, readiness and recovery entries, workout and nutrition records, meal plans, recipes, community content, playlist links, conversations, reports and block choices. It is linked to your account to provide those features. The service uses account and subscription identifiers to apply access controls and respond to requests. Sign-in attempts and rate-limit records help protect account and service access.
Private wellness records are not automatically shared with employers, departments, sponsors or other members. Content you explicitly submit to a community audience can be seen by members of that audience after approval. Authorized service operators and hosting providers can process account data to operate and support the service. Community reviewers receive submissions and reported material needed to make review decisions.
Community review, reporting and age controls
New public posts, comments and shared playlist links remain unpublished while server checks and human review are pending. Automated rules can flag material for review; a human makes the approval decision. Reviewers inspect the submitted text and linked destinations and can reject or remove content or restrict an account. Approved content is visible to its applicable community audience. Apple Music playlists are an allowed category, while member captions remain subject to community rules.
The service stores your acknowledgment of the rules, submission status and rejection reason, reports, blocks and account restrictions. Review history records account and content identifiers, dates, actions and reasons. Reasons can include information supplied by a member. Internal review history is restricted to authorized reviewers and administrators. Report and Block controls are available without a Pro purchase; urgent reports can be emailed to support@fortissalus.com. This contact route is not an emergency service.
Public links are inspected during review and rechecked when the content is next requested after its checks expire. Changed or unavailable destinations can return a submission to review. The service records destination-check results; these checks do not guarantee that an external site will never change.
Fortis Salus is intended for adults 18 and older. Community access and messaging are disabled for accounts identified as minors or that do not meet current account eligibility checks. Self-reported birth dates do not verify age or parental consent. A guardian relationship must be established by an administrator before a linked guardian can change protected media, messaging or public-posting controls. These restrictions also apply on the server. This does not make a children’s community experience available.
Private messages and expiration
Member messages are stored by the online service and are available to conversation participants, subject to membership and blocking controls. They are not public community posts. Authorized reviewers can inspect a reported message and its report. The service processes messages and is not presented as providing end-to-end encryption.
A new conversation uses its creator’s selected message lifetime: 7, 30, 90 or 365 days, with 30 days as the default. Changing your default affects new conversations, not existing ones. Each message expires according to its conversation’s setting. Expired messages are excluded from normal reading and account export. Cleanup is configured to run hourly and also occurs when a conversation is opened. Service interruptions can delay physical cleanup; this is not a promise of deletion at an exact minute. Separate moderation history can remain as described under account deletion.
Optional meal estimates
Manual meal entry and the recipe library do not send dish photos or descriptions for AI analysis. The native meal assistant is currently unavailable. Where a meal estimate is offered through the service, requesting it sends that meal’s description, portion and any selected dish photo to Fortis Salus and OpenAI for an estimate. It does not send your private check-in notes, full journal or Apple Health readings. The photo preparation flow in the iPhone app renders a new image to remove original location metadata before sending.
An estimate does not create a nutrition log until you review and save the values. The service requests that OpenAI not store the generated response as application state; that setting is not a guarantee of zero provider retention. OpenAI’s applicable API data controls and safety-processing rules still apply. Avoid including people, patient information or other unnecessary private details in a meal request. See OpenAI API data controls.
Apple subscriptions and purchase verification
Supported iPhone and Android app versions can recognize an administrative complimentary Pro grant associated with your authenticated Members account. The service stores the account identifier, grant reason, grant date and any revocation, and returns a short-lived account-bound verification response. This is not an Apple or Google purchase and creates no payment or automatic renewal. Signing out, switching accounts or losing valid verification removes that account-based local unlock; independently verified store-purchase access is separate. A local backup cannot transfer this grant. Complimentary account verification is not implemented in the separate Watch workout-start flow.
Apple handles App Store payments. Fortis Salus uses StoreKit and its server verification service to confirm purchases, restores, renewals, expiry and revocation. The service keeps a purchase-binding identifier, Apple transaction and product identifiers, relevant dates and status, renewal and notification records and verification hashes. The binding associates the verified purchase with your Fortis Salus account. These service records do not contain your Apple account password or payment-card details.
Deleting the Fortis Salus account does not cancel an Apple subscription. Manage or cancel it in your Apple account’s subscription settings. Restoring a purchase verifies access; it does not restore a deleted local journal or deleted online account data.
Hosting, providers, cookies and logs
Floot hosts the online Members service using AWS and Neon infrastructure. The public informational website is delivered through Cloudflare. Apple provides the device, Health, Maps, Music, Watch and purchase services you choose to use. OpenAI processes an optional meal estimate as described above. Email support uses our business email service. External links and provider playback views apply their own privacy practices. Floot security and data information describes its hosting infrastructure.
The public website does not intentionally include advertising trackers or behavioral advertising scripts. Optional Floot visitor analytics are disabled for the online Members service. Necessary account-session cookies remain enabled. The native app does not upload its local journal for advertising or cross-app tracking. Opening an external provider can involve that provider’s cookies or analytics.
Floot documents 90-day retention for application logs and 30-day retention for CDN edge logs. Application logs include request method/path and information application code writes to logs; edge logs contain limited delivery and billing information. These logs are not individually erased by deleting an app account. See Floot’s privacy policy for its current infrastructure and logging practices.
The informational website has no separate contact form, account-registration form, payment page or newsletter database. If you email us, we receive the information you send voluntarily. The separate Members account and store purchase flows are described above. Do not send passwords or unnecessary health information in support email.
Export, deletion and retained records
You can export the local journal and erase it in Settings. Saved routes, private videos and saved video links have separate deletion controls. Deleting local data does not delete Apple Health originals, original media in Photos or Files, or copies already exported or shared. Removing a local journal or app does not delete your online Members account.
Online account export includes your saved account records, community settings and acknowledgments, owned submissions and their status or rejection reason, and reports you filed. It excludes other members’ private records, guardian identities and internal reviewer notes. Export and account deletion are available without a Pro subscription. Account deletion requires reauthentication.
A successful online account deletion removes the account, profile, private wellness records and plans, authored community content and messages, current account controls and acknowledgments, and active sign-in sessions from the operational account database. Owned link-check records are removed. Current public-content report rows tied to a deleted reporter or subject are removed. Message reports can retain the reported message and sender identifiers after the message content or sender account is deleted; reports filed by a deleted reporter are removed. Identifiers for a deleted reviewer are cleared from current review records.
Limited purchase records remain. The connection from the purchase binding to the deleted Fortis Salus user is cleared, but the binding identifier and transaction history are retained to prevent reassignment of the same purchase to another account and to handle subscription events. Limited safety review history also remains to preserve reports and moderation decisions. It can contain internal account/content identifiers, dates, actions and narrative reasons; it is not anonymous.
Operational retention limitation: retained purchase and safety-history records currently have no automatic expiry. Account deletion also does not directly erase historical provider backups or logs. Our paid Floot database service keeps continuous recovery history covering the last seven days. Deletion from active tables does not immediately remove those recovery copies. Application and CDN logs follow the separate retention periods described above. Contact us with questions about retained information. Email correspondence and copies held by other people or services are not removed by the in-app account-deletion action.
Your choices and privacy requests
You can use available local features without an online Members account, subject to any applicable Pro requirement. You can decline optional Apple permissions or change them in device Settings; stop route recording; turn off Watch sharing; choose manual meal entry; avoid public posting; use reporting and blocking; sign out; export your data; or delete local and online records separately. These actions do not recall copies you already shared or cancel an Apple subscription.
Use the app’s editing controls to correct saved information where available. Contact support@fortissalus.com to request help with access, correction or deletion, or to raise a privacy concern. We may need to verify your account before handling a request. Fortis Salus is a personal wellness and planning tool, not an emergency service or a fitness-for-duty reporting system.
Policy updates and provider information
We will update this page when the app’s data practices change. The date at the top identifies this version. Provider policies explain the handling of information by those services; they do not replace the Fortis Salus controls described here.