Consumer Health Data Privacy Policy

• Medication and dose history: medication names, doses, dose dates, injection sites, and supply details you enter, used to show your history, schedule, and next dose.
• Body measurements: weight, height, and any weight target you set, used to show your progress and trends.
• Side effects, symptoms, and notes: used to show patterns alongside your doses.
• Nutrition and hydration entries: used to show your daily totals and trends.
• Questions for your clinician, reports, and trends: generated from your entries to help you prepare for appointments.
• Progress photos (optional): used only to show your private photo timeline.
• AI meal estimates (optional): the meal description or photo you submit, used only to return a macro estimate.
• Dose-reminder settings (optional): the time and channel you choose, used to send the reminder you asked for.
• Service records that reflect health activity: milestone records such as your first weight or medication entry, used to understand how the service is used. They contain no health values.

We use consumer health data only to provide the features you request, keep your account and the service secure, respond to support requests, and meet legal obligations. We do not use it for advertising, and we do not sell it.

• Directly from you, when you enter it in MyGLP1App.
• From Withings or Android Health Connect, only if you connect them. Both provide body weight readings only.
• Generated by MyGLP1App from your entries, such as trends, summaries, and reports.

We share consumer health data only with service providers that process it on our behalf to run MyGLP1App, and with people you choose to share it with. We have no affiliates that receive consumer health data.

• Supabase (database and private file storage): all of the consumer health data listed above.
• Vercel (website hosting): the data carried in requests between your browser or app and MyGLP1App while it is being delivered.
• Anthropic (AI meal estimates): only the meal description or photo you submit for an estimate.
• Resend (email): your email address and the fact that you asked for a dose reminder. Reminder emails do not include your medication name or dose.
• Firebase Cloud Messaging and Apple Push Notification service (push notifications): a device token and a generic reminder that does not include your medication, dose, or other tracked health detail.
• People you share a report with: if you create a report share link, anyone who has that link can view the report until it expires or you revoke it.

The categories of consumer health data shared with each recipient are limited to what is listed for it. Other providers named in our privacy policy, such as RevenueCat, the app stores, and Vercel Web Analytics, do not receive your tracked health entries.

Depending on where you live, you have the right to:

• confirm whether we collect, share, or sell your consumer health data, and access it;
• receive a list of every third party and affiliate we have shared your consumer health data with, with an email address or other way to contact each one;
• have your consumer health data deleted;
• withdraw your consent to our collection and sharing of it; and
• appeal if we decline to act on your request.

In Settings, signed-in users can export a copy of their data, delete all tracked entries, or delete their account. You can also email support@myglp1app.com with any request. We may need to verify your identity before acting on it, and we will respond within the time required by law. Someone you authorize can also make a request for you, with proof that you gave them permission. We will not discriminate against you for exercising these rights.

To appeal a decision, reply to our response or email us with “Appeal” in the subject line, and we will tell you the outcome and our reasons. If we deny your appeal, you can contact your state Attorney General. Washington residents can file a complaint with the Washington Attorney General.

When you delete data, it is removed from our active systems right away. Encrypted backups are kept for up to about six months and then permanently deleted, and if a backup is ever restored, your deletion is applied again before the data is used.

• We do not sell consumer health data.
• We do not use geofencing or location tracking around healthcare facilities, and we do not collect precise location.
• We do not allow third parties to collect consumer health data about your activity in MyGLP1App over time or across other websites and apps.