Consumer health data privacy policy

Gutlog is run by Meter. It is a food and gut diary: what you eat, how you feel and the elimination programs you follow are consumer health data. This policy is our consumer health data privacy policy under the Washington My Health My Data Act, Nevada Senate Bill 370 and Connecticut's consumer health data provisions, and our privacy notice under the GDPR and UK GDPR. It covers the site, the web app, the API, the MCP server, the CLI and our emails.

In short

• We collect health data only with your explicit consent, and only to run Gutlog for you.
• We never sell it, never share it with advertisers and never send it to analytics, ad platforms or pixels.
• Photos are kept in private storage. You can delete any photo, entry or your whole account, and export everything first.
• Gutlog is for adults: you must be 18 or older.
• Gutlog is not medical advice and does not diagnose anything.

Consumer health data we collect

• Meals: what you ate and when, items, portions, ingredients with their confidence, nutrients, and your corrections.
• Photos and text: meal photos, label photos and descriptions you send through the web app, the CLI, the API or email.
• Products you scan: barcodes and labels, linked to your diary.
• Symptoms and scores: bloating, pain, reflux, stool form and frequency, energy, severity, tummy scores, and the suspected triggers we compute from them.
• Programs: elimination diet phases and challenges, your answers to the safety screen (which can include conditions such as pregnancy, celiac disease or a history of disordered eating), and weekly check-ins.
• Preferences that reveal health information: allergens, known triggers, your clean-ingredient profile and review threshold.
• Inferences: suspected triggers, food tummy scores and summaries derived from the above.

We also hold account data that is not health data: your email address, name, sign-in records, plan and payment status, API keys, feedback you send us, and technical logs. Optional: the text of your requests to your assistant, only if you opt in to help us improve it.

Where it comes from

• From you, in the web app, the CLI, the API or email.
• From the AI assistant you connect (ChatGPT, Claude or another MCP client), when you ask it to log or read your data. You choose the assistant and approve the connection; the assistant's provider handles your conversation under its own terms and privacy policy, not this one.
• Computed by us from what you logged (nutrients, scores, suspected triggers).

Why we use it

• To provide Gutlog: store your diary, compute nutrients, clean verdicts, tummy scores and triggers, and run the programs you start.
• To show it back to you and to the assistants and keys you connect, and to send the reminders and reports you turn on.
• To improve accuracy: aggregate confirm and reject rates of ingredient suggestions, and correction patterns seen across many people (never linked to you, and only once at least 20 different people made the same correction).
• To keep Gutlog secure, fix errors and comply with the law.

We do not use your health data for advertising, for profiling unrelated to the service, or to train third-party AI models.

Consent

• We ask for your explicit consent to collect and process consumer health data when you create your account, separately from accepting the terms. Without it we cannot run a food and gut diary for you.
• In the European Economic Area, the United Kingdom and Switzerland, our legal basis for health data is your explicit consent (GDPR Article 9(2)(a)); for account data it is the contract with you and our legitimate interest in running and securing the service.
• You can withdraw consent at any time by deleting your account (in the web app, with delete_account where available, or by email). We would ask for separate consent before any sharing not described here; there is none today.

Who we share it with

• Never sold. We do not sell consumer health data or any other personal data, and we do not share it for advertising.
• Processors that run Gutlog for us, under contracts that limit them to our instructions (table below).
• Assistants and keys you connect: when you connect ChatGPT, Claude, another MCP client or create an API key, it can read and write your data within the access you approved, until you disconnect it or revoke the key.
• When the law requires it: a valid legal order, after checking it and, where allowed, telling you first.
• If Meter is sold or merged: only under this policy, and with notice to you first.

Barcode lookups may query public food databases (Open Food Facts, USDA FoodData Central) with the barcode only, never who scanned it.

Analytics carry no health data

Our product analytics (Google Analytics) see events such as “page viewed”, “signed up” or “meal logged” with the surface it came from (web, MCP, CLI). They never receive what you ate, an ingredient, a symptom, a score, a program or a photo. There are no advertising pixels on the site or in the web app. Our own usage statistics of which features are used stay in our database.

Photos

Meal and label photos you send us are stored in a private storage bucket, readable only through short-lived signed links for your account. Photos you share inside ChatGPT or Claude are seen by that assistant, not uploaded to us; it sends us a structured description instead. You can delete any photo at any time.

Your rights

Wherever you live, you can:

• Access and export your data: every entry, in JSON and CSV with a data dictionary, from the web app or with export_data where available, or by email.
• Delete any entry or photo, or your whole account. Deleting the account deletes your consumer health data from our systems and instructs our processors to delete it; backups roll off within 30 days.
• Correct anything: every value can be edited, and your edits always win over estimates.
• Withdraw consent and know who we shared it with (the processors above, and any assistant you connected).
• Appeal a refusal: reply to our answer asking for an appeal. If we deny it, you can contact your state attorney general (in Washington, the Attorney General's office) or your data protection authority.

Email jonathan@getgutlog.com from the address on your account. We answer within 45 days (extendable once by 45 days when needed, with notice), free of charge, and never treat you differently for using a right.

How long we keep it

• Your diary while your account exists, on every plan.
• Deleted entries and photos are removed at once from the service and from backups within 30 days.
• Billing records as long as tax law requires; they contain no health data.
• Technical logs up to 30 days, error reports up to 90 days.

Security

Data is encrypted in transit and at rest. Every table is locked down by default and read only through server code that checks your account; staff access is limited to what operating and supporting the service requires, and logged. API keys are stored hashed.

If something goes wrong

We keep an incident plan for breaches of security involving health data, following the FTC Health Breach Notification Rule (16 CFR Part 318) and state breach laws: contain and investigate, then notify the people affected without unreasonable delay and no later than 60 calendar days after discovery, notify the FTC (at the same time for 500 or more people, otherwise in our annual log) and, where 500 or more residents of a state are affected, prominent media in that state.

Age

Gutlog is for people 18 and older. We do not knowingly collect data from anyone younger; if we learn we have, we delete it.

Cookies and analytics on the site

We use cookies that are needed to keep you signed in and to record how you first found us (a first-party referral cookie kept 90 days at most, holding the link's ref or campaign, the referring site without its query string and the first page you opened; never set when your browser sends Do Not Track or Global Privacy Control). Your light or dark theme is kept in your browser's storage.

Google Analytics, with advertising features, ad personalization and Google signals off, counts visits, sign-ups and purchases. It receives your IP address and browser details and never loads when your browser sends Do Not Track or Global Privacy Control. In the European Economic Area, the United Kingdom and Switzerland it runs in Google's Consent Mode with every storage signal denied until you choose Accept in the cookie banner: before that it sets no cookies and Google receives only cookieless pings. If you accept, it sets its first-party cookies (_ga and _ga_*, up to two years). Elsewhere it sets those cookies by default. Advertising storage, ad user data and ad personalization stay denied everywhere.

Two small cookies hold your choice: consent (kept one year, set only when you click Accept or Reject) and consent_region (shows the banner where it is required; ends with your browser session). Change your choice at any time with the “Cookie settings” link at the bottom of every page.

We do not set geofences around health care facilities or use location data. Gutlog does not ask for your location.

Where it is processed

In the United States. For people in the EEA, the UK and Switzerland, transfers rely on the European Commission's standard contractual clauses and the UK addendum with our processors.

Changes and contact

We will email account holders before a material change takes effect and ask for consent again before any new use or sharing of consumer health data. Questions or requests: jonathan@getgutlog.com, Meter.