2. Legal Basis for Processing

Under GDPR, we process your data based on the following legal grounds:

Health data, genetic data, biometric data, and lab test results you choose to upload are classified as "special category data" under GDPR Article 9. We ask for your explicit, granular consent before we process these, and you can withdraw it at any time (see section 11). Lab test results are used to display your results in the Health Hub and to personalise AI coaching responses; you can withdraw consent for lab report processing at any time by deleting the report.

3. Information We Collect

Personal Information

• Email address and name (for account creation)
• Health symptoms, conditions, and severity ratings
• Dietary preferences, restrictions, and food diary entries
• Current medications, supplements, and health conditions
• Lifestyle data (sleep, stress, exercise, water intake)
• Plan progress, daily check-in data, and symptom tracking
• AI chat conversations and feedback

Wearable Device Data (Whoop Integration)

If you choose to connect your Whoop device, we access:

• Recovery scores and trends
• Heart rate variability (HRV) data
• Sleep performance and duration
• Daily strain scores
• Resting heart rate

We do not access continuous heart rate data or raw sensor data. You can revoke Whoop access at any time in Settings.

Genetic Data (DNA Analysis)

If you upload a DNA file (from 23andMe, AncestryDNA, or similar), we process your genetic data to analyse specific health-relevant SNPs (single nucleotide polymorphisms). We store only the computed analysis results (risk assessments and recommendations). Raw genetic data is processed server-side and is not permanently stored. You may request deletion of your DNA analysis at any time.

Payment Information

Card payments on our website are handled by Stripe. Purchases inside the app are handled by Apple (App Store) or Google (Google Play), and RevenueCat keeps the record of your app subscription. We never store, process, or have access to your card numbers. We only store your Stripe customer ID or RevenueCat ID, and your subscription status.

4. How We Use Your Information

• Personalised Plans: Generate gut health suggestions based on your symptoms, diet, and health data
• AI Analysis: Provide contextual AI-powered troubleshooting and coaching using your health data
• Biometric Insights: Correlate Whoop wearable data with gut health patterns when connected
• Progress Tracking: Monitor your improvement journey over time through daily check-ins and food diary
• Safety Checks: Detect supplement contraindications and die-off reactions
• Genetic Insights: Analyse DNA data for health-relevant genetic variants when uploaded
• Emails: If you take our quiz, we email you your plan. Unless you tick "Just send my plan", we also send you follow-up emails about GutFix, and which ones you get can depend on your quiz result. Every email has an unsubscribe link.

5. AI Data Processing

Your health data (symptoms, medications, plan context, and wearable biometrics) is sent to Anthropic's Claude AI for analysis when you use AI features such as plan generation and the troubleshooting chat.

If you upload a lab report, the image or PDF file is also sent to Anthropic for automated text extraction, and is retained by Anthropic for up to 30 days (per its safety policy), then deleted. We instruct the AI to leave personal identifiers printed on the document (such as your name, date of birth, or ID numbers) out of the values it extracts. The file you uploaded is stored as it is, identifiers included, until you delete it.

• Anthropic does not use API data for model training
• Data sent to Anthropic is retained for up to 30 days for safety monitoring, then deleted
• We do not send your email address or payment information to Anthropic. We send the health context Gutty needs, and your first name so it can address you by it
• AI-generated content is clearly labelled and not a substitute for medical advice

Your messages, intake answers, lab report text and food photos are processed by third-party AI providers (Anthropic, OpenAI and Pinecone) to generate your plan, answer your questions and remember your history. We ask for your explicit permission before we do this.

Automated decisions and profiling

GutFix uses software, including AI, to group your answers into 1 of 9 digestive patterns and to build and adjust your plan. This is profiling. It does not decide whether you can buy or use GutFix, and you can question or ignore any part of your plan. We also use your quiz result to choose which of our emails you get. If you'd like a person to look at your plan or how it was made, email hello@gutfix.ai.

6. Data Storage and Security

Your data is stored securely on Supabase (hosted on AWS infrastructure) with encryption at rest and in transit (TLS 1.2+). All database tables are protected with Row-Level Security (RLS) policies, ensuring your data is only accessible to your authenticated account.

Wearable device tokens are stored securely and used only to fetch your data on your behalf. We never send your quiz answers, symptoms or other health details to advertising companies. If you accept marketing cookies, their pixels do learn that your browser finished our gut quiz or bought a plan, and when you take the quiz or buy we may send them a scrambled (hashed) copy of your email address. That tells them you are interested in gut health (see section 10).

7. Data Retention

8. Third-Party Data Processors

We share your data with the following processors. We rely on each provider's standard data processing terms where it offers them. Telegram, which we use only for internal alerts, does not, so it never receives your name, email or anything you wrote. Our complete and dated sub-processor list is published at /sub-processors.

9. International Data Transfers

Your data is processed by services located in the United States. For transfers of personal data from the UK/EEA to the US, we rely on the following safeguards:

• EU-US Data Privacy Framework (DPF): Where processors are DPF-certified (e.g., Stripe, Vercel)
• Standard Contractual Clauses (SCCs): For processors not covered by DPF, we ensure SCCs are in place
• UK International Data Transfer Agreement (IDTA): For UK-specific transfers, we apply the UK addendum to SCCs where required
• Telegram (United Arab Emirates): No transfer safeguard is in place, so we send it only an 8-character member code, the type of alert and simple numbers, never your name, email or anything you wrote

We regularly review the data protection practices of our processors to ensure ongoing compliance with applicable transfer mechanisms.

10. Cookies and Tracking

GutFix uses the following categories of cookies:

PostHog: When you consent to analytics cookies, we load PostHog to understand how users navigate our app and identify areas for improvement. PostHog is hosted on EU servers (Frankfurt) and only activates after you opt in via the cookie banner. Data collected includes page views, button clicks, and funnel progression. With your consent, we also record how visitors move through our public pages (session replay). Anything you type is masked in these recordings, your assessment answers and any health details are excluded from capture, and the logged-in member area is never recorded. In your browser, nothing is collected before you consent. You can opt out at any time by clearing your cookie preferences.

Product events our server records: Our server separately sends PostHog a small set of product events whatever your cookie choice: that Gutty replied (and which AI model), safety-check outcomes (codes only, never your words), plan changes (the type of change), that you finished onboarding (how many symptoms you picked, not which), checkout and purchase details (plan, price, currency), and the events the app sends through our server. They are linked to your account ID, or at checkout on our website sometimes to your email address, and to your IP address, which PostHog uses to estimate your country. They rest on our legitimate interest (Art. 6(1)(f)) in keeping GutFix working and knowing what sells. You can object by emailing hello@gutfix.ai.

In the GutFix mobile app: we use PostHog (EU-hosted, Frankfurt) to understand where people get stuck during sign-up, onboarding and checkout, including session replay of those screens. Replay is strictly limited: any screen that shows your health information — coach chat, your protocol, check-ins, lab results, progress and achievements — is never recorded, and within recorded onboarding screens your answers and your personalised results are masked or excluded from capture. Anything you type is always masked. Recordings are retained for 30 days and are used solely to improve the product. Usage analytics in the app are on by default and rest on our legitimate interest (Art. 6(1)(f)) in understanding and fixing product friction. Session replay in the app is off until you switch it on. You can switch either off at any time in Settings → Privacy, or object via hello@gutfix.ai. Both are designed so that no special-category (health) data is ever captured.

Vercel Web Analytics: We use Vercel Web Analytics for basic performance monitoring. This tool is cookie-less and does not use any tracking cookies or collect personally identifiable information. It operates under our legitimate interest (Art. 6(1)(f)) and does not require consent.

Meta Pixel: When you consent to marketing cookies, we load the Meta (Facebook) Pixel to measure the effectiveness of our advertising campaigns. The Pixel may collect your IP address, browser information, and page views. When you buy, we also use the Meta Conversions API (server-side) to send your hashed email address for conversion attribution. This data is processed by Meta Platforms, Inc. in accordance with their Privacy Policy. You can opt out at any time by clearing your cookie preferences or using the cookie banner.

Reddit Pixel: When you consent to marketing cookies, we load the Reddit Pixel to measure the effectiveness of our advertising campaigns on Reddit. The Pixel may collect your IP address, browser information, and page views. We also use the Reddit Conversions API (server-side) to send hashed email addresses for conversion attribution. This data is processed by Reddit, Inc. in accordance with their Privacy Policy. You can opt out at any time by clearing your cookie preferences or using the cookie banner.

X Pixel: When you consent to marketing cookies, we load the X (Twitter) Pixel to measure the effectiveness of our advertising campaigns on X. The Pixel may collect your IP address, browser information, and page views. We switch off its automatic reading of form fields and button clicks. When you buy, we also use the X Conversion API (server-side) to send your hashed email address and the X click ID, if you arrived from an X ad, for conversion attribution. This data is processed by X Corp. in accordance with their Privacy Policy. You can opt out at any time by clearing your cookie preferences or using the cookie banner.

OpenAI Pixel: When you consent to marketing cookies, we load the OpenAI Pixel to measure the effectiveness of our advertising in ChatGPT. The Pixel may collect your IP address, browser information, page views and, if you arrived from a ChatGPT ad, the ad click ID, and stores a browser identifier on your device for up to 1 year. If you are signed in to ChatGPT in the same browser, OpenAI may link this to your account. We block its automatic reading of form fields. When you buy, we also use the OpenAI Conversions API (server-side) to send your hashed email address and the ChatGPT ad click ID, if you arrived from a ChatGPT ad, for conversion attribution. This data is processed by OpenAI in accordance with their Privacy Policy. You can opt out at any time by clearing your cookie preferences or using the cookie banner.

Emails: Our marketing emails record whether you opened them and which links you clicked. Our account and service emails record link clicks only. Links in our emails pass through links.gutfix.ai so we can count those clicks.

You can manage your cookie preferences with the Cookie settings link at the bottom of our website's pages, via the cookie banner shown on your first visit, or by clearing your browser's localStorage.

11. Your Rights Under GDPR

Under UK GDPR and EU GDPR, you have the following rights:

• Right of Access (Art. 15): Request a copy of all data we hold about you
• Right to Data Portability (Art. 20): Download all your data as a JSON file: Settings → Privacy & Security → Download My Data on the website, or Settings → Request data export in the app
• Right to Erasure (Art. 17): Request permanent deletion of your account and all associated data, except the payment and refund records the law makes us keep (section 7), via Settings or by emailing us. Individual lab reports can be deleted instantly in-app (Health Hub → Labs); deleting your account removes all lab report files and extracted data
• Right to Rectification (Art. 16): Update or correct inaccurate information via Settings or by contacting us
• Right to Restrict Processing (Art. 18): Request we limit how we use your data
• Right to Object (Art. 21): Object to processing based on legitimate interests
• Right to Withdraw Consent (Art. 7): Withdraw consent at any time. In the app, Settings → Privacy switches usage analytics and session recordings off. On the website, the Cookie settings link at the bottom of our pages reopens your cookie choices. To withdraw consent for your health data or its AI processing, delete your account or email hello@gutfix.ai. Withdrawal does not affect the lawfulness of processing prior to withdrawal

To exercise these rights, use the Data Management options in Settings or email us at hello@gutfix.ai. We will respond within 1 month.

12. Consent Management

We collect granular consent for each type of special category data processing:

• Health data processing: Required to use the app (symptoms, conditions, diet, lifestyle)
• AI data processing: Required for AI-powered features (data sent to Anthropic, OpenAI and Pinecone)
• DNA data processing: Collected when you first upload a DNA file
• Biometric data processing: Collected when you connect Whoop

Consent records are stored with timestamps and version numbers for audit purposes. To withdraw consent, see section 11.

13. Account Deletion

You can permanently delete your account at any time in the app (Settings → Delete Account), on the website (Settings → Privacy & Security → Delete Account), or by emailing us at hello@gutfix.ai.

Deletion permanently removes your authentication record, profile, symptom logs, daily check-ins, AI chat history, generated plans, consent records, push notification tokens, and any connected integrations (Whoop, DNA) within 30 days. Active Stripe subscriptions are cancelled immediately at the time of deletion. Deletion also removes your quiz answers, your contact in our email tool (Resend) and your analytics profile (PostHog). We keep payment, refund and lifetime-purchase records, because the law makes us keep financial records (section 7). Deleting your account does not cancel an App Store or Google Play subscription: cancel it in the store too.

Anonymised, aggregated analytics that cannot be linked back to you (e.g. cohort-level outcome statistics) may be retained for service improvement.

14. Age Restrictions

GutFix is intended for users aged 18 and older. We do not knowingly collect personal information from children under 18. If we become aware that we have collected data from a minor, we will promptly delete it.

15. Health Data Disclaimer

16. Data Breach Notification

In the event of a personal data breach:

• We will notify the relevant supervisory authority (ICO for UK users) within 72 hours of becoming aware of the breach, as required by GDPR Article 33
• If the breach is likely to result in a high risk to your rights and freedoms, we will notify you directly without undue delay (GDPR Article 34)
• Notifications will include the nature of the breach, the data affected, likely consequences, and the measures taken to address it

17. Right to Lodge a Complaint

If you believe we have not handled your data in accordance with data protection law, you have the right to lodge a complaint with a supervisory authority:

18. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. For significant changes affecting your data rights, we will provide notice via email and may request renewed consent where required.

19. Contact Us

If you have questions about this Privacy Policy, your data, or wish to exercise your rights, please contact us: