Privacy Policy

1. Who we are

GLP-1 Coach is operated by an individual data controller based in Slovenia, European Union. As an EU-based business, this service is subject to the General Data Protection Regulation (GDPR) and we are committed to full compliance with its requirements.

For privacy-related questions or to exercise your rights, contact: hello@glp1coach.app

2. What data we collect

We collect only what is necessary to provide the service:

• Account data: Email address (required for authentication)
• Profile data: Therapy phase, medication type, dose, start date, weight goals — all optional, entered by you
• Check-in data: Daily logs including weight, protein intake, water intake, nausea, energy, appetite, mood scores, and free-text notes — submitted voluntarily by you each day
• Usage data: Basic server logs (request timestamps, HTTP status codes) for operational purposes — no third-party analytics, no session recordings

We do not collect location data, device identifiers, advertising identifiers, or any data from third-party platforms.

3. How we use your data

• AI coaching advice: Your check-in data (weight, symptoms, notes) is sent to Anthropic's Claude API to generate personalised coaching suggestions. This is the core function of the service. Only your most recent check-in data is included in each API call — we do not send your full history to Anthropic.
• Account management: Your email is used to authenticate you and send transactional emails (receipts, password resets). No marketing emails without explicit consent.
• Service improvement: Aggregated, anonymised patterns may be reviewed to improve the product. Individual records are not reviewed.

Your data is never sold to advertisers, pharmaceutical companies, insurers, or any third party. This is an unconditional commitment, not a policy subject to change.

4. AI processing disclosure (EU AI Act — Article 50)

GLP-1 Coach uses an artificial intelligence system (Anthropic Claude) to generate coaching suggestions based on your check-in data. This is disclosed clearly within the application, and you are required to acknowledge this before using the coaching feature during onboarding.

AI-generated advice is labelled as such within the app. You are not communicating with a human coach or a licensed healthcare professional. The AI system cannot diagnose conditions, prescribe treatments, or replace medical care.

The legal basis for processing your health-related data for AI coaching is your explicit consent, given during onboarding (GDPR Article 9(2)(a)).

5. Our data processors

We use a small number of trusted sub-processors:

• Supabase (database and authentication): Your data is stored in Supabase's EU-based infrastructure. Supabase is GDPR-compliant and acts as a data processor under a Data Processing Agreement.
• Anthropic (AI advice generation): Your check-in data is sent to Anthropic's API to generate coaching suggestions. Anthropic processes this data under their API terms. Anthropic does not retain API request data for model training by default.
• Stripe (payment processing): Billing data is handled by Stripe. We do not store card details. Stripe is a PCI-DSS compliant payment processor.

6. Data retention

Your data is retained for as long as your account is active. If you delete your account, all personal data is deleted within 30 days. Anonymised, aggregated data may be retained indefinitely for statistical purposes.

7. Your rights (GDPR)

As a data subject under GDPR, you have the right to:

• Access: Request a copy of the data we hold about you
• Rectification: Correct inaccurate or incomplete data
• Erasure: Delete your account and all associated data
• Data portability: Export your check-in data in a machine-readable format
• Restriction: Limit how we process your data in certain circumstances
• Objection: Object to processing based on legitimate interests
• Withdraw consent: Withdraw consent for AI processing at any time by deleting your account or contacting us

To exercise any of these rights, email hello@glp1coach.app. We will respond within 30 days (the GDPR maximum). You also have the right to lodge a complaint with your national data protection authority — in Slovenia, this is the Information Commissioner (IP RS).

8. Cookies

We use one essential cookie: an authentication session cookie required for you to stay logged in. We do not use advertising cookies, tracking pixels, or third-party analytics cookies.

9. Data transfers outside the EU

Anthropic's API infrastructure is based in the United States. When AI coaching advice is generated, your check-in data is transferred to Anthropic's US servers. This transfer is made under the EU–US Data Privacy Framework and Anthropic's standard contractual clauses with API customers. If you do not wish your data to be processed in the US, do not use the AI coaching feature (you may still use the tracking features).

10. Changes to this policy

We will notify registered users by email of any material changes to this policy at least 14 days before they take effect. The "Last updated" date at the top of this page reflects the most recent revision.