This Privacy Policy describes how The Company Chiro, LLC, doing business as GLP-1Exit ("GLP-1Exit," "Pepper," "we," "our," or "us"), collects, uses, discloses, and safeguards information about you when you use the GLP-1Exit / Pepper mobile application, the website at glp1exit.org, and related services (collectively, the "Service").
By using the Service you agree to the practices described here. If you do not agree, do not use the Service.
1. Who We Are
2. Information We Collect
2.1 Information you provide directly
- Account & identity: email address, password (hashed), and display name supplied at sign-up.
- Health intake: age, biological sex, height, weight, GLP-1 medication name and dose, start date, goal weight, dietary preferences, allergies, comorbidities you choose to disclose, and other lifestyle context.
- In-app inputs: daily check-ins, glucose readings you type in, meal logs, mood/energy ratings, free-text notes to Pepper.
- Communications: emails or messages you send us for support.
2.2 Information collected automatically
- Device & usage: device model, OS version, app version, IP address (truncated for storage), session timestamps, screens viewed, crashes, and diagnostic logs.
- Cookies / local storage: session tokens and feature flags stored locally to keep you signed in and remember preferences. We do not use cross-site advertising cookies.
2.3 Information from connected health sources (with your permission)
You may optionally connect any of the following. Each connection is opt-in, can be revoked at any time, and only the data scopes you explicitly authorize are read.
- Apple HealthKit: read access to selected metrics you grant — typically active energy, body mass, body fat percentage, heart rate, resting heart rate, heart rate variability, sleep analysis, steps, glucose (if logged), and workouts. HealthKit data is never used for advertising, sold, shared with third parties, or used for any purpose other than providing the Service to you. HealthKit data is processed on-device wherever possible and is not transmitted to our servers unless you enable cloud sync.
- Oura Ring: daily activity, heart rate, readiness, personal profile, sessions, workouts, and SpO2 — only the scopes you approve at the OAuth screen.
- Stripe: if you subscribe, Stripe (our payment processor) collects and stores your payment card details on our behalf. We receive only a subscription identifier, last 4 digits of the card, and billing status. We never see or store full card numbers.
2.4 Information we do not collect
- We do not collect precise GPS location.
- We do not collect contacts, photos, microphone, or camera data unless you explicitly use a feature that requires them (none currently do).
- We do not knowingly collect information from children under 13. See Section 9.
3. How We Use Your Information
- Provide, operate, and personalize the Service — generate your protocol view, meal plans, adaptive insights, and dashboard metrics.
- Power Pepper's AI conversational features (the assistant uses your intake context to give relevant responses).
- Process subscription payments and manage your account status.
- Send transactional emails (sign-in links, receipts, security alerts). We do not send marketing email unless you opt in.
- Diagnose crashes, debug issues, and improve reliability.
- Comply with legal obligations and enforce our Terms of Use.
We do not use your information to train third-party machine-learning models, and we do not sell or rent your personal information to anyone.
4. Third-Party Service Providers ("Sub-processors")
We share information only with vendors that help us run the Service, under contracts that bind them to confidentiality and limited-purpose use:
- Netlify, Inc. — application hosting and edge delivery.
- Neon, Inc. — managed PostgreSQL database (US region).
- Stripe, Inc. — subscription billing and payment processing.
- Anthropic, PBC — AI language model that powers Pepper's conversational responses. Conversation content is sent to Anthropic to generate replies; Anthropic does not retain it to train their models per our API agreement.
- ElevenLabs, Inc. — text-to-speech generation for Pepper's voice. Text we send is processed to return audio and is not retained for training under our API plan.
- Apple, Inc. — App Store distribution, in-app purchase processing, and (optionally) HealthKit on-device data exchange.
- Oura Health Oy — if you connect Oura, OAuth-scoped biometric data flows from Oura to us.
We may also disclose information when required by law, valid legal process, or to protect the rights, property, or safety of GLP-1Exit, our users, or the public.
If we are ever involved in a merger, acquisition, or asset sale, your information may be transferred — we will notify you before any transfer that materially changes how your data is handled.
5. How Long We Keep Your Information
- Account & health data: kept while your account is active and for up to 90 days after account closure (to allow recovery), then deleted.
- Billing records: retained for 7 years to meet US tax and accounting requirements.
- Diagnostic logs: 30 days, then deleted.
- Backups: rolling 35-day window; deletions propagate to backups within that window.
6. Security
We protect your data with TLS in transit, AES-256 encryption at rest (database and backups), least-privilege access controls, audit logging, and regular dependency review. No system is 100% secure; if we ever experience a breach affecting your information we will notify you and applicable regulators as required by law.
7. Your Privacy Rights
7.1 Everyone
- Access & export: request a copy of the personal information we hold about you.
- Correction: ask us to update inaccurate data — most fields are also editable in-app.
- Deletion: request that we delete your account and associated data; we will complete deletion within 30 days, subject to the retention exceptions in Section 5.
- Withdraw consent / disconnect integrations: revoke Oura, Apple HealthKit, or other connections at any time from the app or the source service.
7.2 California residents (CCPA / CPRA)
In addition to the rights above, California residents have the right to: know the categories and specific pieces of personal information collected; know the categories of sources and third parties; opt out of "sale" or "sharing" (we do not sell or share personal information as those terms are defined under CPRA); limit the use of "sensitive personal information"; and not be discriminated against for exercising these rights. To exercise these rights, email drkristy@thecompanychiro.com with the subject "CCPA Request."
7.3 EU / UK / Swiss residents (GDPR / UK GDPR)
Our legal bases for processing are: (a) performance of a contract with you to provide the Service; (b) your explicit consent for connecting health integrations and sending optional marketing email; (c) our legitimate interests in operating, securing, and improving the Service; and (d) compliance with legal obligations. You have the right to access, rectify, erase, restrict processing, port, and object to processing; and the right to lodge a complaint with your supervisory authority. Data is stored in the United States; we rely on Standard Contractual Clauses where applicable.
8. Apple HealthKit-specific disclosures
If you grant the app access to Apple HealthKit, the following always apply:
- We use HealthKit data only to provide and personalize the Service for you.
- We do not share HealthKit data with any third party for advertising or data-broker purposes.
- We do not use HealthKit data for any disallowed purpose under Apple's HealthKit policies.
- You can disconnect HealthKit at any time in iOS Settings → Health → Data Access & Devices → GLP-1Exit.
- If you disconnect or delete your account, we delete the HealthKit data we have stored within 30 days.
9. Children
The Service is not directed to, and we do not knowingly collect personal information from, individuals under 13 years of age (or under 16 in jurisdictions where that is the threshold). If you believe a child has provided us information, please contact us and we will delete it.
10. International Users
The Service is operated from the United States. If you access it from outside the US, you understand your information will be transferred to and processed in the US under US laws.
11. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be announced in-app or by email at least 7 days before they take effect. The "Effective date" at the top reflects the most recent version.
12. Contact Us