Your app never touches anyone. It can still hurt them.Founded by a software developer who builds a fitness app.
We insure workout, nutrition, wellness and wearable-companion apps with technology E&O that includes contingent bodily injury, the grant that answers when a user follows your program and gets hurt, plus cyber for the health data you hold.
Tell us the situation.
One licensed human replies the same business day — not five agents, not an auto-responder. If the policy you have is already the right one, we will tell you.
We use this to quote and service your insurance, and we do not sell it or pass it to lead networks. Privacy policy.
The person placing your tech E&O is building a training app of his own.
Kevin Kelsey
Founder | Principal Agent
Boring’s founder, Kevin Kelsey, builds TrainRec, a workout and food app that runs training plans made with your own AI assistant, guides each workout one set at a time, logs food from a description and syncs with Apple Health, and it is coming to iPhone and Android. It carries the same exposure as your app, a plan or a calorie number a person acts on with their body, and its own footer says it is not medical advice. So the gap between a bodily injury exclusion and a professional services exclusion gets read here by someone who has to close it for his own product, rather than by someone matching a class code to a rate.
Send us what you have. We’ll tell you if it’s right.
Your current policy paperwork, a renewal notice, or nothing at all. A licensed agent reads it and replies the same business day.
What health and fitness app businesses actually need.
Technology E&O with contingent bodily injury
Claims that your app gave a user the wrong plan, target or reading, including a physical injury that followed from it once contingent bodily injury is added.
Without it — The standard tech E&O form excludes bodily injury, and injury is the claim a health app gets. Ask for contingent bodily injury by name.
Cyber & tech E&O
Breach response, ransomware and the notification costs that follow. Technology errors and omissions sits on the same policy and covers the software or service itself failing a client, which is the half most tech companies find out about too late.
Without it — Weight, heart rate, sleep, cycle and meal logs are health data under the FTC rule and several state laws even where HIPAA does not apply, and sharing them without consent can be a reportable breach on its own.
General liability
Third-party bodily injury and property damage. It is the line nearly every contract names by default.
Without it — The certificate app stores, gyms and brand partners ask for first. Read it for a professional services or technology exclusion, which is where a user injury claim usually gets pushed off it.
Media liability
Covers claims arising from what you publish (defamation, copyright and trademark infringement, invasion of privacy and misuse of a person’s likeness) on an annual policy for creators, podcasters, publishers and authors.
Without it — Workout videos, recipes, coach content and influencer programs are published material, and the copyright, likeness and false advertising claims they draw are media claims rather than tech ones.
Product liability
Injury or damage caused by a physical device you make or sell, such as a band, scale or ring.
Without it — Software coverage does not follow a device onto someone’s wrist, so the hardware needs a policy of its own.
Directors & officers
Protects the personal assets of the people running the company when they are sued over a management decision. It applies to private companies and nonprofit boards, not just public ones, which is a common and expensive misunderstanding.
Without it — Investors, a board and a regulator inquiry into how health data was used are all D&O territory, and a funding round will ask for it.
What the regulators actually wrote down.
The FTC says makers of health apps, connected devices and similar products must comply with its Health Breach Notification Rule, and gives the example of an app that collects names, weight, height, age and steps and can sync with a fitness tracker as likely covered.
Federal Trade Commission, Complying with FTC’s Health Breach Notification Rule (business guidance), 16 CFR Part 318 · checked 2026-10-23
Under the FTC’s Health Breach Notification Rule a breach is not limited to a hack: sharing users’ identifiable health information without their consent counts, and affected people must be told without unreasonable delay and no later than 60 calendar days after discovery.
Federal Trade Commission, Complying with FTC’s Health Breach Notification Rule (business guidance), 16 CFR Part 318 · checked 2026-10-23
HHS guidance on health apps says a developer is likely not a HIPAA business associate when the consumer chose the app independently and decides alone whether to send data to a provider, which is why HIPAA usually does not reach a consumer fitness app.
HHS Office for Civil Rights, Health App Use Scenarios & HIPAA (February 2016), as summarized by Hunton Andrews Kurth, March 1, 2016 · checked 2026-10-23
Washington’s My Health My Data Act defines consumer health data to include bodily functions, vital signs, symptoms and measurements, biometric data, and health information inferred from non-health data by algorithms or machine learning.
RCW 19.373.010(8), Washington My Health My Data Act · checked 2026-10-23
A violation of Washington’s My Health My Data Act is treated as an unfair or deceptive act under the state Consumer Protection Act, chapter 19.86 RCW, which commentators read as giving consumers a private right to sue.
RCW 19.373.090; Sidley Austin, Washington State Enacts My Health My Data Act (May 2023) · checked 2026-10-23
Nevada’s consumer health data law, Senate Bill 370 of 2023, took effect on March 31, 2024 and requires consent before a business collects or shares consumer health data.
Nevada Legislature, SB 370 (82nd Session, 2023); Bass, Berry & Sims, Nevada Consumer Health Data Law Takes Effect on March 31, 2024 · checked 2026-10-23
Apple’s App Review Guidelines say an app that behaves in a way that risks physical harm may be rejected, that medical apps which could give inaccurate data get greater scrutiny, and that apps should remind users to check with a doctor before making medical decisions.
Apple, App Review Guidelines, sections 1.4 and 1.4.1 · checked 2026-10-23
Under the 21st Century Cures Act, software intended for maintaining or encouraging a healthy lifestyle, and unrelated to diagnosing or treating a disease, is not a medical device, and the FDA revised its General Wellness guidance in January 2026.
U.S. Food and Drug Administration, General Wellness: Policy for Low Risk Devices (January 2026), citing FD&C Act section 520(o)(1)(B) · checked 2026-10-23
At least one technology E&O program publishes that a contingent bodily injury and property damage sublimit is available on its tech E&O coverage.
Tokio Marine HCC, Cyber & Professional Lines Group, TechGuard highlight sheet (12/18/20) · checked 2026-10-23
The claims we actually see.
Ordered by how often we see them, not by how dramatic they are. Each one names the coverage that answers it — and the policy people wrongly assume already does.
Most common
A user follows your training program and is injured
Covered by Technology E&O with contingent bodily injury
The tech E&O form usually excludes bodily injury, and general liability written for a software company often excludes harm arising from your professional services. Without a contingent bodily injury grant both policies can point at each other.
Common
Calorie, macro or fasting guidance makes someone ill
Covered by Technology E&O with contingent bodily injury
A disclaimer that the app is not medical advice helps the defense and does not stop the claim being filed. The cost of answering it is what the coverage is for.
Less common, severe
A wearable or in-app reading is wrong and someone relies on it
Covered by Technology E&O with contingent bodily injury, plus product liability for any hardware
A bad heart rate, blood pressure or oxygen reading sits between software and device. Whose policy answers depends on whether your company made the sensor or only the app reading it.
Common
User health data is shared or leaked
Covered by Cyber, first-party response and privacy liability
An analytics or advertising tool sending health data to a third party can be a breach under the FTC rule with no hacker involved. Some cyber forms cover regulatory defense and fines and some do not, so read that section.
What our health and fitness app clients ask us.
Does tech E&O cover a user who got hurt following my app?
Often not, unless the policy says so. Technology E&O is written for financial loss, and most forms exclude bodily injury in plain words. The fix is a contingent bodily injury grant or endorsement on the tech E&O, which covers an injury that results from an error in your app’s advice or output even though you never physically caused it. Ask for it by name and read whether it has its own, smaller limit.
What is contingent bodily injury coverage?
It covers physical injury that someone claims came from relying on your product, service or advice, rather than from anything you did to them directly. For an app, the user who followed the program, the calorie target or the reading is the case it exists for. It is usually added to a technology E&O policy as an endorsement, often at a sublimit inside the main limit.
Doesn’t my general liability policy cover injuries?
It covers bodily injury caused by an accident, which is why people assume it answers. General liability sold to software companies often carries a professional services or technology exclusion, such as ISO’s CG 21 16, that removes injury arising from the service you provide. For a health app the service is the advice, so the exclusion lands right on the claim. Read the endorsements list on your policy before you rely on it.
Our app says it is not medical advice. Isn’t that enough?
No. A clear disclaimer, a prompt to see a doctor and sensible limits in the program all make a claim easier to defend, and Apple asks medical apps to remind users to check with a doctor. None of them stops someone filing suit, and the legal cost of the defense arrives either way. The disclaimer and the coverage do different jobs, and you want both.
Does HIPAA apply to our fitness app?
Usually not, if consumers download it themselves and no doctor or health plan hired you to provide it. HIPAA binds health care providers, health plans, clearinghouses and their business associates. The rules that do reach a consumer health app are the FTC’s Health Breach Notification Rule and state laws such as Washington’s My Health My Data Act and Nevada’s consumer health data law. Your cyber policy should cover regulatory defense under those, not just HIPAA.
What does the FTC Health Breach Notification Rule mean for our app?
If your app holds identifiable health information and can draw it from more than one source, such as user entries plus a synced tracker, the FTC says you are likely covered. A breach includes sharing that data without consent, through an analytics or advertising tool for example, and users must be told within 60 days. Breach notification and regulatory defense are what the cyber policy pays for.
An app store, gym or brand partner wants us to indemnify them. What should we check?
Read what the indemnity covers, then check that your insurance covers the same thing. Partnership and white-label agreements commonly ask you to defend the partner against claims arising from your app, and a user injury is one of those claims. If your tech E&O excludes bodily injury, you have promised something no policy stands behind. Send us the agreement before signing.
Do we need media liability as well?
If the app publishes workout videos, recipes, articles or programs from named coaches and influencers, probably yes. Those are content claims: a photo used without a license, a likeness used without consent, an endorsement that overstated a result. Media liability answers them, and some technology E&O forms include a media section, so check before buying twice.
Injury claims from content, and the media version of this coverage
We added an AI coach. Does that change the insurance?
Yes. An AI coach that writes plans or answers health questions is your app giving advice, and its wrong answer is the claim this page is about. Tell the carrier what it does and which model it calls, and get wording that covers AI output affirmatively, because some 2026 forms exclude it. The contingent bodily injury grant has to reach AI output too.
Is there a real app like this you can point to?
Yes, and we should say plainly that it is ours. TrainRec is a workout and food app our founder, Kevin Kelsey, built: it runs training plans made with your own AI assistant, guides each workout one set at a time, logs food from a description and syncs with Apple Health. It carries exactly the exposure on this page, and its footer says it is not medical advice. It is at www.trainrec.app.
What do you need to quote a health or fitness app?
What the app does in a sentence or two, whether it gives plans, nutrition targets or readings, whether you sell any hardware, how many users you have, your revenue, which states or countries your users are in, and any partner or app store agreement with an insurance clause. Send your current policy too, so we can tell you whether bodily injury is excluded today.
Guides on health and fitness app.
- Bodily Injury vs Contingent Bodily InjuryGeneral liability pays for injuries you cause by accident, and E&O pays for money lost to your mistakes. An injury caused by a mistake in your app, software or advice falls between them, and contingent bodily injury on the E&O is how that gap is closed.
- Vibe-Coded App InsuranceA vibe-coded app carries the same liability as any other, and the documented failures are security ones: open databases, exposed keys and an agent that deleted data. Here is which policy answers which failure, what the AI tool providers say about who is responsible, and what to check before you buy.
Commercial insurance is 96% of what we do — it is not a department here, it is the whole business. Not ready to talk? The guides answer the questions this page raises in more depth. Already insured with us and need a certificate or a policy change? Ask the service team rather than starting a quote — it is faster and it goes to the people whose job it is. We also write home and auto, which is usually cheaper alongside the business policy than apart from it.
Handed a lease, a vendor packet or a client contract with insurance requirements? Paste it into the COI Requirements Decoder to see what each one means for your business, or read what the requirements mean.