Privacy Policy

1. Introduction

This Privacy Policy explains how Gifted Mind, LLC ("Gifted Mind," "we," "us," or "our") collects, uses, stores, shares, and protects your information when you use the Othletic mobile application and related services (the "App" or "Service").

Othletic is a nutrition recommendation app. It uses signals from your connected wearable devices and the information you provide to suggest meals that fit your body's current state and your goals, both from nearby restaurants and as recipes you can cook yourself with step-by-step guidance. Othletic is a wellness and fitness product. It is not a medical device and is not intended to diagnose, treat, cure, monitor, or prevent any disease or health condition.

By creating an account or using the App, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the App.

If you have questions, contact us at hello@othletic.com.

2. A note on our privacy approach

Othletic is built as a meal recommender that uses health signals to suggest food not a health tracker that permanently stores every sensor reading. Two design choices reflect this:

• Your location is never stored. Your coordinates are used at the moment you request recommendations, sent with that request so we can find restaurants near you and confirm they deliver to you, processed transiently, and never saved to our database. They are never shared with any analytics provider.
• Apple Health data is read in-session. When you use Apple Health as your data source, we read the data on demand from your device and use it in memory to generate your recommendations. We do not store your Apple Health readings on our servers, with two limited exceptions described below: a one-time onboarding profile pre-fill, and a small daily health summary that powers your progress trends.

The remainder of this policy explains, in detail, what we do collect and why.

3. Information we collect

3.1 Information you provide

Account information. When you create an account, we collect your email address and password. Authentication is handled through our infrastructure provider.

Profile and preferences. During onboarding and in settings, you may provide information such as: demographic details (weight, height, age, sex, and body fat percentage); activity level, primary goal, and, if you set one, a target weight and timeframe; number of meals per day; dietary restrictions; liked and disliked foods, cuisine preferences, spice tolerance, budget range, and any restaurant chains you choose to limit your recommendations to; which wearable devices you use; short optional answers about what you find difficult when ordering food and when you usually eat out; and notification preferences.

Meal photos (optional). If you log a meal using a photo, the image is sent once to our AI processing provider to estimate its nutrition and is then discarded. We do not store your meal photos.

Communications. If you submit a bug report or contact us, we collect the contents of your message, your contact email, and basic technical details such as app version and device platform.

3.2 Health and biometric information from connected devices

With your permission, Othletic connects to wearable and health data sources to read the signals that power your recommendations. The data we access and whether we store it depends on the source:

WHOOP (connected via your authorization). When you connect WHOOP, we store a digested set of your recent biometric data in our database to generate and refresh your recommendations. This cached data (refreshed on demand, on a short cycle) may include: recovery score, heart rate variability (HRV), resting heart rate, respiratory rate, sleep performance and efficiency, sleep totals (total sleep, awake, and in-bed time), strain, energy expenditure, your most recent workout summary, and body measurements (weight and height). We do not store skin temperature, blood oxygen (SpO2), or per-stage sleep detail (REM, deep, light): those fields arrive inside WHOOP's API responses, which cannot be narrowed further, and are discarded immediately. We also store the authorization tokens needed to access WHOOP on your behalf. WHOOP's own privacy practices are governed by their privacy policy at whoop.com/privacy.

Oura (connected via your authorization). When you connect your Oura Ring, we store a digested set of your recent Oura data in our database to generate and refresh your recommendations. This cached data (refreshed on demand, on a short cycle) may include: readiness and recovery indicators, sleep score, sleep efficiency and duration, heart rate variability (HRV), resting heart rate, respiratory rate, daily activity and workout summaries, and the body measurements and demographics Oura reports (weight, height, age, sex). We do not store per-stage sleep detail, body temperature, or stress metrics. During onboarding, with your confirmation, we may also use those values once to pre-fill your profile. We also store the authorization tokens needed to access Oura on your behalf.

Fitbit (connected through Google, via your authorization). Fitbit data is read through Google's Health API, so connecting requires a Google Account signed in to the Fitbit app. When you connect, we store a digested set of your recent Fitbit data in our database to generate and refresh your recommendations. This cached data (refreshed on demand, on a short cycle) may include: sleep duration and efficiency, heart rate variability (HRV), resting heart rate, respiratory rate, daily steps and active energy, your most recent workout summary, a recent daily history of HRV, resting heart rate and respiratory rate, your Google Health user identifier, time zone, and the time of your last device sync. We do not store per-stage sleep detail or blood oxygen (SpO2). We also store the authorization tokens needed to access your Fitbit data through Google on your behalf; those tokens are held only on our servers and are never sent to the App on your device. Othletic's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google's privacy practices are governed by their privacy policy at policies.google.com/privacy.

Apple Health (HealthKit). When you use Apple Health, we read your data on demand from your device and use it in memory. We do not store your Apple Health readings on our servers, with two exceptions: during onboarding, with your confirmation, we read your weight, height, sex, and age a single time to pre-fill your profile; and the daily health summary described in Section 3.3 is saved for Apple Health users too. We read your sleep sessions to compute total sleep duration and efficiency only; per-stage sleep detail (deep, REM, core) is used transiently on your device to tell sleep from awake time and is never stored or transmitted. Apple Health permissions are granted per-metric, so you may see several individual permission prompts; any metric you decline simply returns no data and is not used.

3.3 Information generated through your use of the App

Recommendation and meal history. We store the meals you log and your recommendation activity, including meals you accept ("thumbs up") and reject ("thumbs down"). After you have logged a number of meals, this history is used to personalize future recommendations.

Daily health summary. To power your progress trends, we save one summary row per day containing the derived values you saw in the app: your recovery score, sleep performance, strain, heart rate variability (HRV), resting heart rate, and your profile weight at the time, with labels recording which source produced them. This applies to every connected data source, including Apple Health. Deleting your account permanently removes this history.

Limited operational data. To manage costs and protect the Service, we keep internal records such as API usage and rate-limit counts associated with your account. These are deleted when you delete your account.

3.4 Information we do not collect or store

• We do not store your GPS location.
• We do not store your Apple Health readings (other than the one-time onboarding profile pre-fill and the daily health summary described above).
• We do not collect allergy information, and we do not screen or filter recommendations for allergens. See the Terms of Service for important information about allergens.
• We do not store your payment card details. All payment information is handled by Apple, Google, and our subscription management provider.

4. How we use your information

We use the information we collect to:

• Create and manage your account
• Generate personalized meal recommendations based on your body state, goals, dietary needs, and preferences
• Connect you to nearby restaurants and hand you off to a delivery provider to place an order
• Personalize and improve recommendations over time based on your feedback
• Process and manage your subscription and free trial
• Send notifications you have enabled
• Respond to your support requests and fix bugs
• Monitor, secure, and improve the Service
• Comply with legal obligations

We do not sell your personal information.

5. How we share your information

We share information only as described below. We do not sell personal data, and we do not share your data for third-party advertising.

5.1 Service providers

We work with a limited number of trusted third-party service providers who process information on our behalf so that we can operate the Service. They are permitted to use your information only to provide their services to us, and not for their own purposes. These providers fall into the following categories:

• Infrastructure and hosting: for our database and authentication.
• Subscription management and payments: to manage your subscription and process payments. We do not receive or store your payment-card details; payments are handled by the applicable app store.
• Wearable data sources: to retrieve, with your authorization, the health and biometric data that powers your recommendations (WHOOP, Oura, Fitbit through Google's Health API, and Apple Health).
• AI recommendation processing: to generate the reasoning behind a recommendation and to estimate nutrition for meals you log, our server sends a limited set of information (such as your goal, age, weight, dietary restrictions, disliked foods, your current body-state classification and current recovery indicators such as HRV and resting heart rate values, and the candidate meals with their nutrition information; for photo logging, the photo itself). This request does not include your name, email, account identifier, location, or biometric history.
• Analytics: to understand how the Service is used and to debug problems, we use a third-party analytics service. Analytics events are tied to your account identifier and may include app usage events, recommendation and order events, in-app search text, bug reports, restaurant suggestions, and the body-state values behind a recommendation, such as recovery, sleep and strain indicators and calculated macro targets. We use this data only to operate, debug, and improve the Service. It is never sold and never used for advertising. Session replay is disabled.
• Error and performance monitoring: to detect and fix crashes and bugs. Reports are tagged with an identifier only and do not include your email or location.
• Operational email: to send internal alerts to our team (for example, when a bug report is filed) and, only if you ask for it, one notice when a wearable connection you are waiting on becomes available. We keep that request with your email address. This is not used to send you marketing unless you separately tick the box for Othletic news, which you can withdraw at any time by emailing hello@othletic.com.

When you choose to place an order, we connect you to a third-party delivery service by opening a link to the relevant restaurant. We do not share your personal information in this hand-off.

We do not sell your personal information, and we do not share it for third-party advertising.

A current list of the specific service providers we use is available on request by emailing hello@othletic.com.

5.2 Legal and safety

We may disclose information if required by law, regulation, legal process, or governmental request, or where we believe disclosure is necessary to protect our rights, your safety or the safety of others, or to investigate fraud or security issues.

5.3 Business transfers

If Gifted Mind, LLC is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any change in ownership or use of your information.

6. Data retention and account deletion

We keep your information for as long as your account is active or as needed to provide the Service.

When you delete your account, we permanently remove: your profile, your WHOOP, Oura and Fitbit (Google) authorization tokens and stored WHOOP, Oura and Fitbit data, your daily health summaries, your meal and recommendation history, and your internal usage and rate-limit records.

What survives account deletion (in de-identified form): To maintain our records and improve the Service, two categories of data are retained after deletion but are disassociated from you (your user identifier is removed):

• Bug reports you submitted the report contents and basic diagnostic details are kept, with your account link removed.
• Restaurant/chain suggestions you submitted: the requested restaurant's name and any location details or notes you typed (city, state, address, reason) are kept, with your account link removed.

These retained items no longer identify you. If you would like to request deletion of these residual records as well, contact hello@othletic.com and we will address your request as required by applicable law. Analytics events recorded before deletion are retained in our analytics service but are no longer connected to an active account.

7. Your rights and choices

Depending on where you live, you may have rights regarding your personal information, including the right to access, correct, delete, or port your data, and to object to or restrict certain processing.

• Access and correction: You can view and edit most of your profile information directly in the App.
• Deletion: You can delete your account from within the App, which triggers the deletion described in Section 6.
• Wearable disconnection: You can disconnect WHOOP, Oura or Fitbit (through Google), or revoke Apple Health permissions, at any time, through the App or your device settings. Disconnecting Fitbit revokes our Google access and deletes the stored Fitbit data.
• Notifications: You can manage notification preferences in the App or your device settings.

To exercise any right, contact hello@othletic.com. We will respond as required by applicable law. We will not discriminate against you for exercising your privacy rights.

California residents (CCPA/CPRA) and residents of the EU/EEA and UK (GDPR) have specific rights, including those described above. For EU/EEA/UK users, our legal bases for processing include performing our contract with you (providing the Service), your consent (for connecting health data sources), and our legitimate interests (securing and improving the Service). You may have the right to lodge a complaint with your local data protection authority.

8. Biometric and health data

Health and biometric signals (such as HRV, heart rate, sleep, and recovery data) are sensitive. We:

• Collect and use them only to provide the recommendation features you request
• Access them only after you grant permission, and only from the sources you connect
• Do not sell them and do not use them for advertising
• Allow you to disconnect a data source or delete your account at any time

If you are located in a jurisdiction with specific biometric privacy laws, you may have additional rights and protections regarding this data. Connecting a wearable or granting health-data access is voluntary and based on your consent, which you may withdraw at any time.

How recovery is computed: recovery score is computed from your heart rate variability (HRV), resting heart rate, and respiratory rate, weighted against a personalized rolling baseline. For Apple Watch users, HRV is measured as SDNN (Apple's time-domain HRV metric); for WHOOP users, the recovery score is the value WHOOP's own algorithm returns. The number may differ from recovery scores in other apps: each uses proprietary algorithms with different inputs and weighting. Othletic's score is optimized for nutrition recommendation, not clinical interpretation.

9. Data security

We use technical and organizational measures to protect your information, including encrypted connections, access controls, and authentication safeguards provided through our infrastructure providers. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

10. Children's privacy

Othletic is not directed to children, and you must be at least 18 years old (or the age of majority in your jurisdiction) to use it. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact hello@othletic.com and we will delete it.

11. International users and data transfers

Othletic is operated from and primarily intended for users in the United States. If you access the Service from outside the United States, your information may be transferred to, stored, and processed in the United States and other countries where our service providers operate, which may have different data-protection laws than your country.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date and, where appropriate, notify you in the App or by email. Your continued use of the Service after an update means you accept the revised policy.

13. Contact us

If you have questions or requests regarding this Privacy Policy or your information, contact:

Gifted Mind, LLC
Email: hello@othletic.com