Consumer Health Data Privacy Policy

Effective Date: August 28, 2026  |  Last Updated: August 28, 2026

This policy applies to residents of Washington State (under the My Health My Data Act), Nevada (under SB 370), and other US states with consumer health data laws. It describes how Gryter — operated by Abid Waqar, a sole proprietor doing business as Gryter — collects, uses, shares, and lets you control your consumer health data.

This is a separate policy, as those laws require. Our general Privacy Policy covers everything else.

Gryter is a fitness coaching service, not medical care. It is not a medical device, and it does not diagnose, treat, cure, or prevent any condition. When we adjust your training around something you have told us, or suggest you speak to a healthcare professional, that is a precaution — not a medical assessment, and not clearance to train. See Terms of Service, section 3.

1. Categories of consumer health data we collect

• Bodily measurements — height, body weight, weigh-ins over time, and the bodyweight trend calculated from them.
• Health conditions, injuries, and symptoms — injuries, medical conditions, physical limitations, and any other health information you choose to tell us, including in your own words.
• Pain and discomfort reports — pain you report during or after a workout, and the record of when that happened.
• Exercise and fitness activity — workouts you complete, exercises performed, sets, reps, loads, perceived effort, self-reported readiness, and session duration.
• Nutrition and diet information — food log entries including calories, macronutrients, and meal descriptions; calorie and protein targets we calculate for you; and meal photos you submit for estimation.
• Demographic information used for health calculations — year of birth and gender, used to calculate training and nutrition guidance.
• Health-related inferences — training adjustments and safety restrictions we derive from the above, and whether we have suggested you consult a healthcare professional.

2. Where this data comes from

• Directly from you — everything you type, select, log, or photograph in the Gryter app. This is the source of substantially all consumer health data we hold.
• Generated by us — calculations, trends, targets, and training adjustments derived from what you gave us.
• From our website — if you join the waitlist at gryter.com, whatever you choose to write in the free-text "goal" field. That field is optional and we do not ask for health information in it, but anything you write there is treated as consumer health data.

We do not collect consumer health data from Apple Health, Google Fit, wearables, biosensors, data brokers, advertising networks, healthcare providers, or any other outside source.

3. How we use it, and why

We use your consumer health data only to provide the coaching service you asked for. Specifically:

• to build, adapt, and explain your training plan;
• to adjust training around injuries, conditions, and limitations you tell us about, and to prompt you to consult a healthcare professional where that is appropriate;
• to calculate and track nutrition targets and your bodyweight trend, if you use those optional features;
• to estimate calories and macronutrients from a meal description or photo, if you use that feature;
• to show you your own progress and history.

We do not use consumer health data for advertising, marketing, profiling for advertising, or research, and we never sell it.

One exception you control. If you switch on the optional usage-analytics setting — off by default — some workout events we send to our analytics provider include training details such as the exercise, the load, and the reps, linked to your account. That is product analytics on fitness activity, and it happens only while you have that setting on. Turning it off stops it immediately. Nothing you have told us about injuries or conditions, and no nutrition or body-composition data, is ever sent to analytics.

4. Categories of consumer health data we share

We share the following categories with the third parties named in Section 5, and only as necessary to operate the service:

• bodily measurements;
• health conditions, injuries, and symptoms you have told us about;
• exercise and fitness activity;
• nutrition and diet information, including meal photos where you use that feature;
• demographic information used for health calculations;
• health-related inferences.

We never share your name, email address, profile photo, or account identifier with our AI providers alongside this data.

5. Third parties we share it with

We share consumer health data only with service providers and processors acting on our behalf, limited to our instructions and purposes under the terms that govern the paid services we use. The current status of our formal agreements with each is on our subprocessors page:

• AI providers — our approved set is OpenAI, Anthropic, and Google; which one is in use today is listed on our subprocessors page. They generate coaching content and nutrition estimates, and the paid API tiers we use exclude training on customer data by default.
• Cloud infrastructure and database providers — currently Google (Firebase), which stores your account data and runs our servers.
• Email delivery providers — currently Resend, which delivers your data export to you if you request one. Your export contains your health data.
• Analytics providers — currently Google (Firebase Analytics and Crashlytics), and only if you switch on the optional diagnostics setting, which is off by default. Receives the workout events described in section 3.
• Website form providers — currently Google (Apps Script, Sheets, and Gmail), which receive and store waitlist sign-ups including the free-text goal field described in section 2.

The current list, with what each provider receives and where it processes it, is maintained on our subprocessors page.

We may also disclose consumer health data where legally compelled to do so, or where necessary to protect against a serious threat to health or safety.

6. We do not sell your consumer health data

Gryter does not sell consumer health data, and has never sold it. We do not exchange it for money or other valuable consideration with anyone. We do not share it with advertisers, data brokers, social networks, or analytics companies for their own purposes.

Because we do not sell consumer health data, we do not collect the separate written authorization that Washington law would require for a sale. If that ever changes, we would obtain a valid signed authorization from you first, in the form the law prescribes.

7. Consent

Collection and sharing. We collect your consumer health data, and share the parts our AI provider needs, because both are necessary to provide the coaching service you asked us for — the basis Washington's My Health My Data Act provides at RCW 19.373.030(1) and (2).

We also ask for your explicit, opt-in permission before coaching begins, given separately from your acceptance of our Terms of Service, and we show you what it means before you agree. You can withdraw it at any time in Settings; withdrawing stops further collection and sharing.

Usage analytics and crash diagnostics are a separate, optional choice, switched off by default. Declining them does not affect your access to coaching.

8. Your rights

You have the right to:

• Confirm whether we are collecting, sharing, or selling your consumer health data, and access that data — including a list of the third parties it has been shared with.
• Withdraw your consent to our collection and sharing of your consumer health data, at any time.
• Delete your consumer health data.
• Appeal a refusal to act on a request.

How to exercise them

• Access: in the app, Profile → Download my data. We email you a copy of everything stored in your Gryter account, usually within a minute. It does not include data held by our AI provider, your purchase records, analytics, our server logs, or support emails — email us for those.
• Withdraw consent: in the app, in your privacy settings. Withdrawal takes effect immediately and stops further collection and sharing. Because health information is essential to coaching, withdrawing it means coaching features stop working.
• Delete: in the app, Profile → Account → Delete Account. Deletion is immediate and permanent. If you have uninstalled the app, email [email protected].
• Or email us at [email protected] for any of the above.

Deleting your account erases your consumer health data from Gryter's own systems immediately. Some copies are outside our reach and we would rather say so plainly: data already sent to our AI provider stays in that provider's systems until it ages out on their schedule, at least 30 days, and we cannot delete it on demand; analytics data, if you had opted in, expires on its own schedule; and data may persist briefly in encrypted backups before they roll over. If you want us to chase a specific record with a provider, email [email protected] and we will do what that provider's process allows.

We respond to requests within 45 days, and will tell you if we need a further 45 days because a request is complex. There is no charge, and we will not treat you differently for making a request.

Appeals

If we decline a request, we will tell you why and how to appeal. To appeal, reply to our decision or email [email protected] with "Appeal" in the subject line. We will respond within 45 days. If we deny your appeal, you may contact the Washington State Attorney General at atg.wa.gov/file-complaint, or the attorney general of your own state.

9. How long we keep it

We keep your consumer health data while your account is active, and delete it when you delete your account. Full retention periods are in Section 12 of our Privacy Policy.

10. Changes to this policy

If we change this policy, we will update the date above and notify you before the change applies to your previously collected consumer health data, as the law requires.

11. Contact

Abid Waqar, doing business as Gryter
Consumer health data requests and questions: [email protected]