Consumer Health Data Privacy Policy

Last updated: August 11, 2026  ·  Effective: August 11, 2026

This Consumer Health Data Privacy Policy explains how Thus And Also Technologies Private Limited, doing business as Trackr ("Trackr", "we", "our", or "us"), collects, uses, shares, and protects consumer health data.

It exists because Washington State's My Health My Data Act and Nevada's consumer health data law (NRS 603A.400–.550) require a separate policy for this category of information. It applies to everyone who uses Trackr, not only residents of those states — we did not think it right to give people different protections depending on where they live.

This policy sits alongside our Privacy Policy, which covers everything else. Where the two describe the same thing, they agree; where this one is more specific about health data, this one governs.

1. What counts as consumer health data

Consumer health data means personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status.

Two points about that definition matter in practice, and we want to be plain about both:

• It includes what you tell us in conversation. When you tell a coach that you slept badly, that your knee hurts, or that you are managing a condition, that is health data — exactly as much as a number imported from a device.
• It includes what we work out. Information we infer or derive about your health counts too. If our system concludes from your logs that you are likely under-eating protein, that conclusion is your health data even though you never typed it.

2. The health data we collect

These are the categories of consumer health data we collect. Not everyone has all of them — what we hold depends on which parts of Trackr you use.

• Body and measurement data — height, weight, body-fat percentage, body composition, circumference measurements, and readings from a connected smart scale.
• Demographic data used for health calculations — date of birth, age, and sex, which our calorie and nutrition calculations require.
• Life-stage information — including pregnancy status and expected due date, where you choose to tell us.
• Reproductive and menstrual-cycle data — period dates and flow, and ovulation-test results, where you record them. Washington's law names this category specifically, and so do we: it is among the most sensitive information we hold, we do not sell it, we do not use it for advertising, and you can delete it.
• Nutrition and eating data — meals and drinks you log, photographs of food, portion sizes, hydration, dietary rules, allergies, intolerances, and the meal plans and shopping lists we build for you.
• Movement and exercise data — workouts, sets and repetitions, exercise history, personal records, training programmes, and any pain or injury information you give us so a coach can work around it.
• Sleep data — sleep periods, stages and duration, sleep-related habits, and information you provide about what affects your sleep.
• Cardiovascular and physiological data — heart rate, resting heart rate, heart-rate variability, blood oxygen, respiratory rate, body temperature, blood glucose and blood pressure where you record them or your device shares them.
• Mental and emotional wellbeing data — mood entries, stress ratings, mindfulness sessions, and answers you give to any wellbeing questionnaire in the app.
• Health conditions and medications — conditions you tell us about and medications you record, including dose and schedule, and whether you took them.
• Habits and circumstances that affect your health — how often you drink alcohol, when you stop drinking caffeine, your working pattern including shift work, and caring responsibilities, where you tell us. We ask because these change what good advice looks like — particularly for sleep.
• Fitness measures — steps, floors climbed, distance, active and sedentary minutes, estimated VO₂ max and activity level.
• Documents you upload — laboratory reports, test results, and other health documents you choose to share, together with the values our system reads out of them.
• Photographs — progress photos and any images you send to a coach.
• Voice — recordings of your coaching calls, and written transcripts of what was said.
• Conversations and coaching memory — your messages with our AI coaches, and the durable notes our system keeps so a coach remembers your situation between conversations.
• Information we infer — calorie and nutrient targets, estimated energy expenditure, readiness and recovery estimates, adherence patterns, and other conclusions our system reaches about you.

Where you enter information about another person — a family member's age, allergies, or dietary needs — that is that person's health data, and we treat it with the same protections. Please only enter it if you are entitled to.

3. Where it comes from

We collect consumer health data from these sources, and no others:

• Directly from you — what you type, speak, photograph, upload, or select in the app.
• From Apple Health, with your permission — read access only. Trackr does not write anything into Apple Health.
• From Google Health Connect, with your permission — read access only.
• From devices you connect — such as a Bluetooth smart scale.
• From our own processing — the calculations and conclusions our system derives from the above.

We do not buy health data about you, and we do not collect it from data brokers, advertising networks, or public sources.

4. Why we collect it

We collect and use consumer health data for these purposes, and we will not use it for a new purpose without asking you first:

• To provide the coaching you asked for — building and adjusting your nutrition, movement, sleep, and wellbeing plans, and letting your coaches respond to your actual situation.
• To calculate targets — such as daily energy and nutrient goals based on your body data and stated goals.
• To let coaches work together — so that, for example, a run of poor sleep can change what your training coach suggests. This coordination is the core of the product.
• To keep your history — so you can see change over time and so a coach is not starting from nothing each week.
• To send you the notifications and check-ins you have turned on.
• To keep the service working and secure — diagnosing faults, preventing fraud and abuse.
• To improve accuracy — for example checking that a voice recording was transcribed correctly, which we only do if you have separately agreed to it.
• To meet legal obligations and to protect people's safety.

5. How we ask permission

We ask for your permission before we collect consumer health data, and we ask again, separately before we share it with anyone. These are two different questions and we do not bundle them.

Our permission requests are kept separate from our terms of service and from this policy — agreeing to use Trackr is not the same as agreeing to any particular use of your health data, and we do not treat it as such. We do not use pre-ticked boxes, and we do not design these requests to push you toward yes.

Each request tells you, before you decide: what we want to collect or share, what we will use it for, who would receive it, and how to change your mind.

You can withdraw permission at any time, and withdrawing is as easy as giving it — the same number of taps, in the app's settings. Withdrawal stops future processing. It does not undo processing that already happened lawfully, and some parts of Trackr will stop working without the data they depend on; we will tell you which.

6. Who we share it with

We have no corporate affiliates. Thus And Also Technologies Private Limited has no parent, subsidiary, or commonly-controlled company, so no health data is shared with any affiliate.

We share consumer health data only with service providers who operate parts of Trackr for us, acting on our instructions and bound by contract. They may not use it for their own purposes. These are the categories, the specific companies, and what each receives:

• Cloud database, authentication, and file storage — Supabase (PostgreSQL on Amazon Web Services). Receives all stored data, including every category listed in section 2.
• Application hosting — Railway. Processes data in transit while the service runs.
• AI language models that generate coaching, plans, and replies — DeepSeek, established in China, with OpenAI (United States) reading uploaded documents and images. Receive the conversation and the health context needed to answer — which may include conditions, medications, body data, and values read from documents you upload.
• AI vision and document reading — OpenAI for food photographs and for reading uploaded health documents; Google (Gemini) for exercise form-check video. Receive the image or video and related context.
• Speech recognition — OpenAI (Whisper). Receives audio you record so it can be turned into text.
• Voice coaching calls — ElevenLabs and LiveKit. Receive live call audio and the transcript of the conversation.
• AI quality monitoring — Langfuse. Receives the prompts sent to and responses received from AI models, which include health context, so that we can check quality and cost.
• Product analytics — PostHog. Receives usage events and diagnostic session data. Health values shown on screen are masked.
• Crash and performance monitoring — Sentry and New Relic. Receive technical diagnostics and identifiers; not health content.
• App delivery and updates — Expo. Receives device and version information.
• Notifications — Expo and Google Firebase Cloud Messaging. Receive the device token and the text of the notification, which may reference your plan.
• Email — Cloudflare. Receives your email address and message content.
• Subscriptions — RevenueCat, with Apple and Google. Receive purchase and subscription status. No health data.
• Messaging, only if you turn it on — Meta (WhatsApp). Receives your phone number and the content of coaching messages.
• Grocery ordering, only if you connect it — the grocery provider you choose. Receives your basket and delivery address.
• Reference lookups — Open Food Facts (barcode), OpenStreetMap (a city name you type, sent through our servers so your device address is not exposed), OpenWeatherMap (your city), Tavily (research queries).

We may also disclose data where the law requires it, to protect rights and safety, or in connection with a merger, acquisition, or transfer of the business — in which case this policy continues to apply.

You can ask us for a current list of every third party we have shared your health data with, together with a way to contact each of them, by writing to privacy@healthtrackr.me.

7. We do not sell your health data

We do not sell consumer health data, and we have never sold it. We do not exchange it for money or for anything else of value.

Because we do not sell it, we do not ask you to sign an authorization to sell, and there is no circumstance in the current product in which we would. If that ever changed, we would have to ask you first, in a separate signed authorization, and you would be free to refuse.

We also do not use consumer health data for advertising of any kind, we do not share it for cross-context behavioural advertising, and we do not permit our service providers to use it to train their own models.

8. Automated decisions and AI

Trackr is an AI product, and much of what it produces is generated automatically, without a person reviewing it first. You should know which decisions those are:

• Your daily calorie, macronutrient, and micronutrient targets, and your estimated energy expenditure.
• The meals, recipes, and shopping lists in your plan, and portion sizes across a household.
• Your training programme, and adjustments to its intensity — for example, easing a session after a run of poor sleep.
• Readiness and recovery estimates.
• Nutrition estimates for foods we cannot match exactly, which are the AI's best estimate rather than a measurement.
• Notes our system keeps about you, drawn automatically from your conversations.
• Which health signals are surfaced to you, and when a coach suggests you speak to a doctor.
• When and how often we contact you, which adapts to how you have responded before.

These outputs are estimates for general wellness purposes. They are not medical advice, not a diagnosis, and not a clinical interpretation of your health data. They can be wrong — and they can be wrong while sounding confident and specific. Trackr is not a medical device and does not diagnose, treat, cure, or prevent any medical condition. Please consult a qualified healthcare professional for medical advice, diagnosis, or treatment.

If an automated decision affects you and you disagree with it, you can ask a person at Trackr to look at it, tell us your view, and challenge the outcome. Write to privacy@healthtrackr.me and a person — not a system — will review it.

9. How long we keep it

Different kinds of health data have different lifespans:

• Recordings of coaching calls — deleted within 30 days. We only keep a recording at all if you have separately agreed to it, and we delete it automatically within 30 days. If you withdraw that permission, existing recordings are deleted straight away.
• Transcripts of those calls are kept as part of your coaching history. The recording and the transcript have different lifespans and we would rather say so plainly than let you assume otherwise.
• Your health and coaching history — logs, measurements, plans, conversations, documents, and photographs — is kept for as long as your account is open, because it is what lets your coaches see change over time. You can delete individual items whenever you like.
• When you delete your account, we delete this data, including stored files and images, subject to the narrow legal exceptions in our Privacy Policy.
• Diagnostic and security records are kept for a limited period for security and legal purposes.

When you ask us to delete health data, we also delete it from our backup systems, and we tell our service providers to delete their copies. Backups may take up to six months to cycle out completely.

10. Your rights, and how to use them

Wherever you live, you can:

• Confirm whether we are collecting, sharing, or selling your consumer health data (we do not sell it).
• Access the health data we hold about you, and get a list of the third parties we have shared it with.
• Correct it if it is wrong.
• Withdraw your permission for us to collect it, and separately, to share it.
• Delete it.
• Be treated the same either way. We will not degrade your service, charge you more, or refuse you anything because you exercised a right.

Most of this you can do yourself in the app. Otherwise, write to privacy@healthtrackr.me. We reply within 45 days. If a request is complex we may take one further 45 days, and we will tell you inside the first 45 if that happens.

You may use an authorised agent. We may need to verify your identity before we act — not to obstruct you, but because handing health data to the wrong person is the harm we are trying to prevent.

11. If we say no: appeals

If we refuse a request, we will tell you why, and you can appeal by replying to our decision or writing to privacy@healthtrackr.me with the word "Appeal". A different person will review it and we will respond in writing within 45 days, explaining our reasoning.

If we deny your appeal, you may complain to your data protection authority. Residents of Washington State may submit a complaint to the Washington State Attorney General at atg.wa.gov/file-complaint. Residents of India may escalate to the Data Protection Board of India. Residents of the EEA or UK may complain to their local supervisory authority.

12. Things we do not do

Some commitments are clearer stated as refusals:

• We do not sell consumer health data.
• We do not use it for advertising, targeted advertising, or cross-context behavioural advertising.
• We do not transfer or sell it to advertising platforms, data brokers, or information resellers.
• We do not use it to determine credit-worthiness, insurance eligibility, employment suitability, or lending decisions, and we do not provide it to anyone who does.
• We do not let our AI providers train their models on it.
• We do not use data from Apple Health or Google Health Connect for anything other than the coaching features you can see in the app.
• We do not store Apple Health data in iCloud.
• We do not use geofencing around any health facility, and we do not collect data about where you seek care.
• We do not require you to share health data in order to pay for Trackr, and no paid feature is conditioned on granting health access.

13. Children and family members

Trackr is intended for adults. Where an adult manages a household, they may enter information about family members, including children, so that meal planning works for the whole household.

If you enter another person's health information, you are telling us you are entitled to do so — as a parent or guardian, or with that person's agreement. A parent or guardian may review, correct, or delete a family member's information at any time in the app, or by writing to us.

We do not use children's data for advertising, tracking, or behavioural monitoring.

If you believe a child's information has reached us without proper authority, write to privacy@healthtrackr.me and we will delete it.

14. Changes to this policy

If we change how we handle consumer health data, we will update this page and change the date at the top. We will not collect, use, or share consumer health data in a way this policy does not describe without asking your permission first.

For material changes we will tell you in the app or by email before they take effect, and where the law requires it, ask for your consent again.

15. How to reach us

For anything about your health data or this policy:

• Privacy and health data: privacy@healthtrackr.me
• Grievance Officer (India): Himanshu Garg — privacy@healthtrackr.me
• General support: support@healthtrackr.me

Thus And Also Technologies Private Limited
CIN: U74999DL2017PTC310852
19/13, West Patel Nagar, Central Delhi, Delhi — 110008, India

We aim to acknowledge any complaint within 72 hours.