Consumer Health Data Privacy Policy

This policy covers the health information GI Studio keeps about you. It is written for Washington's My Health My Data Act and applies to every user, wherever you live. Our general Privacy Policy covers everything else.

1. What we collect, and why

Meals: what you eat, meal photos, and what you say or type about them.
Bathroom visits: stool type and the details you log.
Symptoms: the symptoms you log, including any you add yourself.
Medicines: the medicines you log, and when.
Connected data, only if you connect it: sleep, resting heart rate, heart rate variability and weight from Apple Health; weight and sleep data, including heart rate and breathing rate during sleep, from Withings; activities from Strava.
Patterns drawn from these logs, such as how often symptoms followed a type of meal.
Meal planning: your weekly meal plan, the recipes and ingredients you choose or avoid, and your grocery list.

Voice dictation for meals is turned into text on your phone. The audio is not sent to us or to Apple.

We use this to show you your own patterns, build the reports you choose to create, and keep your logs on all your devices. We do not use it for advertising, we do not sell it, and we do not use it to train AI models.

2. Where it comes from

You, through what you log in the app.
Apple Health, Withings and Strava, only if you connect them.
The app itself, when it draws patterns from your logs.

3. What we share

All of the categories in section 1 are stored and handled for us by the service providers in section 4. Beyond that, your health data is shared only when you choose it:

A clinician report you create and send yourself, after you authorize it in the app.
Meal text and photos sent to Claude or ChatGPT, only if you add your own key and agree in the app.
Your household meal plan, if you invite someone to it. They see and can edit the meal plan, the recipe and ingredient choices, and the grocery list. They never see your meals, symptoms, bathroom visits, medicines or patterns.
A grocery list link, if you create one. Anyone who has the link can see the list, including the FODMAP marking on each item, and add items to it, without signing in. Email us to replace the link or turn it off; the old link then stops working.

To look up foods, the app sends the name of an ingredient or the barcode you scan to public food databases. These lookups carry no account details.

4. Who we share it with

Service providers that store or handle it for us: Supabase (database and sign-in), Vercel (website hosting) and Postmark (email).
AI providers you choose with your own key: Anthropic or OpenAI. The data goes from your phone to them under your own account.
A clinician you choose, when you send them a report.
People you invite to your household, and anyone you give a grocery list link to.
Public food databases, for food lookups only: the USDA FoodData Central and Open Food Facts.

We have no affiliates.

5. Your rights, and how to use them

Know and access: see what we hold about you and who we have shared it with.
Withdraw consent: in the app under Settings, Privacy, at any time.
Delete: in the app under Settings, Delete Account & Data, or by email. We delete from our systems and ask our service providers to delete too. Copies in our database backups expire on their own within two weeks.

To make a request, email bill@gistudio.app from the address on your account. We answer within 45 days, free of charge.

Appeal:if we turn down a request, reply to our answer with “appeal” and we will review it and answer within 45 days. If we still turn it down, you may contact the Washington State Attorney General at atg.wa.gov.

6. Changes