Privacy Policy | Othletic

1. Who we are

This Privacy Policy explains how Gifted Mind, LLC ("Gifted Mind," "we," "us," or "our") collects, uses, shares, stores, and protects personal information when you use the Othletic mobile app and related services (the "App" or "Service"). Gifted Mind is responsible for your personal information. Our Privacy Officer oversees how we handle it and can be reached at hello@othletic.com.

Othletic suggests meals from nearby restaurants, and recipes you can cook, based on signals from the wearable or health app you connect and the information you give us. It is a wellness product. It is not a medical service or medical device, and it is not intended to diagnose, treat, cure, monitor, or prevent any disease or condition.

2. The short version

We use your health and profile information to recommend meals. We never sell it and never use it for advertising.
Your health readings are never sent to our analytics provider.
We ask for your permission before anything goes to an outside AI service, and you can turn that off in Settings at any time.
Our database is hosted in Singapore. Some of our providers are in the United States.
Your location is used for each search and never stored.
You can delete your account in the App at any time.

If you live in Washington, Nevada, or Connecticut, or want the details on health information, see also our Consumer Health Data Privacy Policy, in Settings under Legal.

3. Information we collect

3.1 Information you give us

Account information. Your email address and password (the password is stored only in hashed form by our authentication provider). If you sign in with Apple or Google, we receive your name and email address from that provider; with Sign in with Apple you can hide your email, and we receive a private relay address instead. If you sign in with Apple, we also store your Apple account identifier and an authorization token so that, when you delete your account, we can ask Apple to disconnect Othletic from your Apple ID.

Profile and preferences. Your first name, if you choose to give one, used only to greet you in the App. Weight, height, age, sex, and body fat percentage if you enter it; activity level; goal, and a target weight and timeframe if you set one; meals per day; dietary restrictions; liked and disliked foods, cuisines, spice tolerance, budget, and any restaurant chains you limit recommendations to; which wearable you use; short onboarding answers about what you find hard when ordering food or cooking, and when you usually eat out or cook; and notification preferences.

Meals and check-ins. Meals you log (the text you type and the nutrition estimate), weight entries you record, items and recipes you save, your thumbs up and thumbs down on recommendations, and manual check-ins of how you feel. If you log a meal with a photo, the photo is sent once for a nutrition estimate and then discarded. We do not store meal photos.

Messages and requests. Bug reports and support messages (their contents, the contact email you give, and basic technical details such as app version and device type); restaurants you suggest; and, if you ask us to tell you when a wearable connection becomes available, your email address and, only if you tick the separate box, your choice to receive Othletic news. You can stop news emails at any time with the unsubscribe link in any of them or by emailing hello@othletic.com.

Your choices. We keep a record, with the date and the version of the text you saw, of your choices about the AI features, your acceptance of our terms when you create your account, and the health data permission you give before creating an account.

3.2 Health information from the sources you connect

You choose whether to connect a wearable or Apple Health. What we read, and what we keep, depends on the source.

WHOOP. With your authorization we read your WHOOP account identifier, recovery score, heart rate variability (HRV), resting heart rate, respiratory rate, sleep performance, efficiency and totals, strain, energy burned, your most recent workout summary, and weight and height. We keep only recent readings: each time we fetch new ones we delete any older than three days, and we delete all of them when you disconnect WHOOP or delete your account. The daily summary in Section 3.3 is separate and is kept for 30 days, even after you disconnect. Skin temperature, blood oxygen, and per-stage sleep detail arrive in WHOOP's responses and are discarded without being stored. WHOOP's own practices are governed by its privacy policy: whoop.com/privacy.

Oura. With your authorization we read readiness, sleep score, sleep efficiency and duration, HRV, resting heart rate, respiratory rate, daily activity and workout summaries, heart rate readings through the day (only a summary worked out from them is stored), and the weight, height, age, and sex Oura reports. We keep only recent readings, on the same terms as WHOOP. We do not store per-stage sleep detail, body temperature, or stress metrics. While Oura is your data source, nothing is sent to the AI service described in Section 5.

Fitbit, through Google. Fitbit data is read through Google's Health API, so connecting needs a Google Account signed in to the Fitbit app. We read sleep duration and efficiency, HRV, resting heart rate, respiratory rate, daily steps and active energy, your most recent workout summary, and a recent daily history of HRV, resting heart rate, and respiratory rate, along with your Google Health user identifier, time zone, and the time of your last sync. We keep only recent readings: each is deleted once it is more than three days old, and all of them when you disconnect Fitbit or delete your account. We do not store per-stage sleep detail or blood oxygen. The authorization tokens for Google stay on our servers and are never sent to your device. Othletic's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google's privacy policy: policies.google.com/privacy.

Garmin. With your authorization, Garmin sends your data to our server. We receive daily summaries (resting heart rate, stress level, Body Battery, steps, calories, and activity minutes), sleep (duration, sleep stages, respiratory rate, and sleep score), overnight HRV, body composition (weight and body fat), and workout summaries (type, time, duration, calories, heart rate, and the Garmin device model), along with your Garmin user identifier, the permissions you gave Garmin, and the time of your last sync. We keep only recent readings: each is deleted once it is more than three days old, and all of them when you disconnect Garmin, remove Othletic in Garmin Connect, or delete your account, at which point we also ask Garmin to end our access. The daily summary in Section 3.3 is separate and is kept for 30 days, even after you disconnect. Other fields in Garmin's summaries are discarded without being stored. Garmin data is processed only by our hosting and database provider, Supabase (Singapore), and, with the AI permission in Section 5, by the AI service named there; no other third party receives it, and it is never sold. Garmin's own practices are governed by its privacy notice: garmin.com/privacy/connect.

Apple Health. The types we ask to read are sleep, heart rate, heart rate variability, resting heart rate, respiratory rate, workouts, active energy, and step count, plus, once during onboarding, your date of birth, biological sex, height, weight, and body fat percentage. We read the data you allow on your device, when you use the App, and use it in memory; the App keeps your latest reading on your device so it can show it at once the next time you open it, and removes it when you sign out. We do not store your Apple Health readings on our servers, with three exceptions: during onboarding, with your confirmation, we read your weight, height, sex, age, and body fat percentage once to fill in your profile; the daily summary in Section 3.3 is saved for Apple Health users too; and your feedback on a recommendation is saved with the one-word state of your body at the time (for example "recovering"). Per-stage sleep detail is used on your device only to tell sleep from awake time. Apple Health permissions are granted per type of data; anything you decline is simply not used. Apple Health data is never used for advertising or sold, and is shared with a third party only as described in this policy, with your permission, to provide the Service.

Before you have an account. If you connect a wearable during onboarding, before signing up, we read your recent data through our server to build your sample recommendations. The connection is held on your device in a sealed form for up to one hour and is saved to your account only when you sign up. You are asked for your permission before this read.

For every source, we store the authorization tokens needed to read your data on your behalf, and delete them when you disconnect or delete your account.

3.3 Information created as you use the App

Recommendation history. The recommendations shown to you and what you did with them, used to personalize future recommendations.

Daily summary. To power your progress trends we save one row per day with the values you saw in the App: recovery score, sleep performance, strain, HRV, resting heart rate, and your profile weight, labelled with the source that produced them. This applies to every source, including Apple Health. Each day's row is deleted 30 days later, or sooner when you delete your account.

Operational records. Usage records tied to your account, which keep the Service running and protect it from abuse.

3.4 Location and device information

Location. When you ask for recommendations or search for food, the App sends your current coordinates with that request so our servers can find restaurants near you. The coordinates are used for that request only. We do not store them, and we never send them to our analytics provider or the AI service.

Device and connection information. Like any internet service, our providers receive your device's IP address when the App connects to them. The App tells our analytics provider not to look up a location from it. We also receive basic technical details such as app version, device model, and operating system.

3.5 Our website

Our website, othletic.com, counts visits with a cookie that expires after 30 minutes. It has no advertising trackers. If you join the waitlist there, we keep your email address to send your launch invite, and the company that hosts the website stores it for us. You can ask us to delete it at any time at hello@othletic.com.

3.6 What we do not collect

We do not collect allergy information, and we do not screen recommendations for allergens. See the Terms of Service.
We do not collect or store payment card details. Apple handles payment.
We do not use your device's advertising identifier and do not track you across other companies' apps or websites.
We do not ask for or store medical conditions or medications.

4. How we use your information

We use it to: create and run your account; calculate your daily and per-meal targets and recommend meals and recipes that fit them and your preferences; find restaurants near you and hand you off to a delivery service to order; show your progress; estimate the nutrition of meals you log; personalize recommendations from your feedback; run your subscription and free trial; send the notifications you turn on; answer support requests and fix problems; keep the Service secure and prevent abuse; understand how the App is used so we can improve it; and meet legal obligations.

We do not sell your personal information, we do not use it for advertising, and we do not use your health information to make decisions about you other than which meals to suggest.

5. AI features

Two optional features use an outside AI service, Claude, run by Anthropic in the United States, and only after you give permission in the App:

The short note on why each recommended meal fits you. For this we send your meal options and the meal size you chose, your goal, weight, age, food preferences and dislikes, a short summary of how you slept and trained (including your hours of sleep, HRV, resting heart rate, and whether you worked out recently), and your progress toward today's target. If halal or kosher is among your dietary restrictions, it is not sent.
The nutrition estimate for a meal you log, which sends the text you type or the photo you take.

The request never includes your name, email address, or location. Your wearable data goes to the AI service only to write that note, and neither Othletic nor the AI service uses it to train any AI model.

Garmin data and AI. If Garmin is your data source and you have given the AI permission, the short summary described above is made from your Garmin data. Othletic never uses Garmin data, or anything made from it, to train, test, evaluate, benchmark, or improve any AI model, and the AI service (Claude, run by Anthropic) does not use it to train any AI model. You can withdraw the AI permission at any time in Settings under Account & security, and from then on nothing read from Garmin goes to the AI service.

While Oura is your data source, the App writes the meal note itself and sends nothing read from Oura; a meal estimate sends only the text or photo you give it. The AI service processes the request to return the result to us, may keep it for a limited period for safety and abuse monitoring, and does not sell it. If you say no, or later turn the permission off in Settings under Account & security, the App writes a simpler note itself and meal estimates from text or photos are unavailable. AI output can be wrong, so treat it as a guide.

6. How we share information

We share personal information only as described here. We never sell it, and we never share it for cross-context behavioral advertising.

6.1 Service providers

We use service providers who process information on our instructions and may not use it for their own purposes. Each is bound by contract to protect your information with the same or equal protection as this policy requires:

Hosting, database, and sign-in (Singapore): all the information described in this policy.
AI processing (Anthropic, United States): only what Section 5 describes, only with your permission.
Product analytics (United States): the actions you take in the App, for example screens viewed, recommendations shown and ordered, searches you type, that you logged a meal or submitted a check-in, which wearable you use and which kind of source a score came from, your onboarding answers about ordering or cooking habits, and counts about the recommendations you were shown, linked to a random account identifier, with basic device details such as model, operating system, time zone, and language. It never receives your health readings or scores, weight, body measurements, meal nutrition, or coordinates. You can turn analytics off in Settings under Account & security, which stops it from that moment. Session replay is disabled.
Error monitoring: crash, error, and performance reports tagged with a random identifier, with food text, health values, and addresses in web requests removed, never your email or coordinates.
Subscription management: your account identifier and your purchase records from Apple.
Email delivery: sign-in emails such as confirmation and password reset codes, the notice you asked for about a wearable connection, and internal alerts to our team, which can include the text of a bug report you send.
The wearable platforms you connect: we send them only requests for your data and, when you disconnect or delete your account, a request to end our access.

A list of the specific providers we use is available on request at hello@othletic.com.

6.2 Ordering

When you tap to order, we open the restaurant's page in a third-party delivery app or website. We do not send it any of your information. Whatever you do there is governed by that service's terms and privacy policy.

6.3 Legal, safety, and business transfers

We may disclose information when the law requires it, or where we believe in good faith that disclosure is needed to protect the rights, property, or safety of you, others, or Gifted Mind, or to investigate fraud or security issues. If Gifted Mind is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of it, and we will tell you before your information becomes subject to a different privacy policy.

7. Where your information is stored

Our database and sign-in service are hosted in Singapore. Our analytics provider is in the United States, and other providers may process information in the United States or other countries. Information stored outside your province, state, or country is subject to the laws of the place where it is stored, and courts, law enforcement, or national security authorities there may be able to obtain access to it. Where the law of your country requires a safeguard for these transfers, we rely on the data processing terms our providers offer.

8. How long we keep information

Account, profile, meal log, weight entries, and saved items: until you delete them or your account.
Meal feedback: until you delete your account.
Daily summaries: 30 days.
Permission records: until you delete your account.
WHOOP, Oura and Fitbit readings: deleted once they are more than three days old, and all of them when you disconnect or delete your account.
Garmin readings: deleted once they are more than three days old, and all of them when you disconnect Garmin, remove Othletic in Garmin Connect, or delete your account.
Apple Health readings: not stored, apart from the profile fill-in and daily summary.
Operational records: until you delete your account, at the latest.
Location: not stored.
Meal photos: not stored.

9. Deleting your account

You can delete your account in Settings under Account & security. We then permanently delete your profile, your wearable and Apple Health data and authorization tokens, your daily summaries, meal log, weight entries, saved items, recommendation history, permission records, and operational records, and we ask each connected wearable platform and Apple to end our access.

Some information remains after deletion:

Bug reports and restaurant suggestions you sent stay, with your account link and contact email removed.
Analytics events stay with our analytics provider, linked to the random account identifier they were recorded under.
Error reports stay with our error-monitoring provider until its retention period ends.
Your purchase records stay with Apple and our subscription provider, as billing and tax rules require.
Short internal security alerts that may include your account identifier stay in our records.
If you connected Fitbit, a one-way coded version of your Google Health identifier stays, so we can keep within the limits Google sets on our access. It contains no name, email, or Othletic account.

You can ask us to delete the analytics events and the other remaining records at hello@othletic.com, and we will do so where the law allows. Deleting your account does not cancel your subscription; cancel it in your iPhone Settings, under your Apple ID, Subscriptions.

10. Your rights and choices

In the App you can: see and correct your profile; turn the AI permission and usage analytics on or off in Settings under Account & security; disconnect WHOOP, Oura, Fitbit, or Garmin, or change Apple Health permissions in the Health app; manage notifications; and delete your account.

Depending on where you live, you may also have the right to: confirm whether we process your personal information and get a copy of it; correct it; delete it; receive it in a portable format; withdraw a consent you gave; object to or restrict some processing; and not be treated differently for using these rights.

To make a request, email hello@othletic.com from the address on your account, or tell us how to verify that you hold the account. We answer within 30 days for residents of Canada and within 45 days everywhere else, and we may extend once when the law allows, telling you why. An authorized agent may make a request for you with your signed permission.

Appeals. If we decline your request, you can appeal by replying to our answer with the word "appeal" within 45 days. We answer appeals within 45 days and explain our decision. If you are still not satisfied, you can contact your state Attorney General, or the privacy regulator where you live.

10.1 United States

California residents: see "Do Not Sell or Share My Personal Information" in Settings under Legal. We do not sell or share personal information and do not use sensitive personal information for purposes that would give you a right to limit it. Because we do not sell or share, there is nothing for a Global Privacy Control signal to opt you out of. Residents of Washington, Nevada, and Connecticut have the health-data rights set out in our Consumer Health Data Privacy Policy.

10.2 Canada

We rely on your consent, which you can withdraw at any time, subject to legal or contract limits; withdrawing may mean part of the Service no longer works for you. You can complain to our Privacy Officer at hello@othletic.com, and to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information.

10.3 European Economic Area, United Kingdom, and Switzerland

We process your information to perform our contract with you (providing the Service), with your explicit consent (for your health information and the AI features), and for our legitimate interests in keeping the Service secure and understanding how it is used (analytics, which you can turn off). You can lodge a complaint with your local data protection authority.

11. Security

We protect information with encryption in transit, access controls that limit each account to its own data, server-only storage of wearable and Google tokens, and encrypted storage of your session on your device. No system is completely secure. If a security breach affects your information, we will notify you and the authorities as the law requires.

12. Children

Othletic is for adults. You must be at least 18, or the age of majority where you live, to use it. We do not knowingly collect information from anyone younger. If you believe a child has given us information, contact hello@othletic.com and we will delete it.

13. Changes to this policy

We may update this policy. For a material change we will update the date above and tell you in the App before the change takes effect. We will ask for your consent again before using your health information in a new way.

14. Contact

Gifted Mind, LLC
131 Continental Dr, Suite 305
Newark, DE 19713, United States
Privacy Officer
Email: hello@othletic.com