Version: 2.4 Effective Date: [TO BE INSERTED — ON OR BEFORE THE REWARDS LAUNCH]
Previous Versions: 2.3 (effective September 9, 2026) · 2.2 (effective August 19, 2026) · 2.1 (effective May 26, 2026) · 1.1 (effective March 5, 2026)
Rewrite Lifestyle, LLC, a Nevada limited liability company ("we," "our," or "us"), operates the Rewrite Lifestyle mobile application and associated web services (collectively, the "Service"). Rewrite Lifestyle is an AI-powered food tracking and lifestyle coaching application designed for individuals pursuing nutrition, wellness, and lifestyle goals.
This Privacy Policy describes how we collect, use, disclose, and protect your personal information when you use our Service. We are committed to transparency about our data practices.
This Service is available to users in the United States, Canada, Australia, and New Zealand. If you are located outside these countries, please do not use the Service.
For Australian residents, this Privacy Policy constitutes our APP 1 privacy notice under the Privacy Act 1988 (Cth). For New Zealand residents, this Privacy Policy describes our handling of personal information in accordance with Information Privacy Principle 3 of the Privacy Act 2020.
When you create an account, interact with the Service, and use our features, you may provide the following categories of information:
| Category | Data Elements | Purpose |
|---|---|---|
| Account Information | Name, email address, phone number, password | Account creation and authentication |
| Wellness Profile | Journey type and stage, personal conditions, goal weight, starting weight, height, sex, activity level, dietary restrictions | Personalize AI coaching and nutritional guidance |
| Food and Nutrition Logs | Meal descriptions, food photos, macro and calorie data, meal timing | Track nutritional intake and provide AI-powered food analysis |
| Body Measurements | Weight entries, body measurements (chest, waist, hips, arm, thigh, neck, abdomen, calf), progress photos | Track physical progress over time |
| Supplement and Medication Logs | Supplement names, medication names, dosage tracking, adherence records | Track supplement and medication adherence |
| Mood and Wellness Logs | Emotional state ratings, food noise levels, behavioral reflections, location at time of entry, bowel movement logs | Track emotional and physical well-being and identify patterns |
| Movement Logs | Activity type, duration, intensity | Track physical activity |
| AI Conversations | Messages you send to the AI coach, questions, goals discussed | Provide personalized AI coaching responses |
| Questionnaire Responses | Answers to onboarding and periodic lifestyle questionnaires, including date of birth, occupation, surgery history, medications, GLP-1 use, allergies, eating triggers, and mindset markers (freeform and structured) | Tailor the Service to your specific needs |
| Payment Information | Email address and payment card details (collected by Stripe on web checkout) or App Store / Google Play purchase records | Process subscription payments |
| Peer Messages | Messages you choose to send to another coaching client through client-to-client messaging, message requests you send or receive, users you block, and reports you make about another user's messages (including a copy of the reported messages taken at the time of the report) | Let coaching clients message each other where both agree, and keep the feature safe |
Location Data. When you grant location permission, the Service collects and stores precise GPS coordinates (latitude and longitude to sub-meter precision). Specifically:
You can control location tracking through the "Location & Travel Tracking" toggle in your app settings. When this toggle is off, we will stop collecting new location data, stop sharing travel context with the AI system, and clear your current travel status. Previously collected location data will be retained according to the retention schedule in Section 9 unless you request deletion.
Mobile Attribution and Analytics Identifiers. When you install the app, our attribution provider, AppsFlyer, generates an identifier for your installation (the "AppsFlyer ID"), and our analytics provider, Google Analytics for Firebase, generates an app-instance identifier. On iOS, the app also reads Apple's identifier for vendors (IDFV), which identifies your device to Rewrite Lifestyle's apps only; we do not collect Apple's Identifier for Advertisers (IDFA) and do not display the App Tracking Transparency prompt. On Android, the Google Advertising ID is collected; you can reset or delete it at any time in your device settings. iOS attribution relies on Apple's SKAdNetwork framework, which reports advertising conversions in aggregate to AppsFlyer on our behalf. We use attribution data to understand which marketing channels lead to installs and subscriptions, and analytics data to understand how the app is used. Attribution and analytics data are never combined with your health information, and no food, weight, mood, symptom, health-device or coaching data is sent to AppsFlyer or Google Analytics. See Section 6 for the data shared.
Device and Usage Data. We automatically collect device type, operating system version, app version, session duration, feature usage patterns, IP address, user agent string, and error logs. This data is used to maintain and improve the Service, to meet our security and audit-logging obligations, and to investigate suspected misuse or unauthorized access.
Rewards Activity. If you take part in Rewrite Rewards, we record the points you earn, your logging streaks, your level and badges, the featured tasks and goals suggested to you and whether you completed them, and any prizes you are awarded, redeem or gift, together with their status. Rewards activity is derived from whether and when you log, never from the content of what you log; symptom logs never appear in featured tasks. Nothing in Rewards involves chance: prizes are determined by fixed rules based on your subscription and coaching status.
Push Notification Identifiers. If you grant push-notification permission, your device's push token is registered with our notification service provider, OneSignal, and is associated with your Rewrite Lifestyle user identifier so that we can deliver coaching reminders, message notifications, and service updates to your device.
Coach Notes. If you are assigned a coach through Bariatric Rewrite's coaching program, your coach may record observations about your progress, eating behaviors, and wellness journey. These notes are used to personalize your AI coaching experience. Coach notes may be processed by our AI system to provide you with more relevant and personalized responses.
Apple Health and Google Health Connect Integrations. With your explicit, on-device permission, the Service may read health and activity data that your other connected devices and applications have written to Apple Health (HealthKit) on iOS or Google Health Connect on Android. The categories of data that may be read, only after you have granted permission for each category, include:
The Service does not OAuth directly into device manufacturer services (such as Fitbit, Oura, Garmin, Whoop, Withings, or Dexcom). All wearable data is read on-device from Apple Health or Google Health Connect, batched, and posted to our server only when you have granted the corresponding permission in your device's operating-system settings and in our app. You may revoke these permissions at any time through your device settings or via the app's health-integration controls, and you may delete any synced health data through your data-export and deletion controls.
For Australian residents, the data described in this Section 2.3 constitutes "sensitive information" (and specifically "health information") under section 6 of the Privacy Act 1988 (Cth). See Section 17.3 for our APP 3 consent statement. For New Zealand residents, this data is "health information" under the Privacy Act 2020 and is held subject to the Information Privacy Principles.
Some users of the Service are also enrolled in coaching programs operated by Bariatric Rewrite LLC ("Bariatric Rewrite"), an affiliated entity. If you are a Bariatric Rewrite coaching client, this section describes how your Rewrite Lifestyle data is shared with your coach.
What Your Coach Can See. During the term of your coaching program, your assigned Bariatric Rewrite coach has access to a coaching dashboard within the Service that displays your:
Members of the Bariatric Rewrite coaching team with administrator access to a coach web portal that we operate may also view your questionnaire answers there, under the same consent and for the same period; the portal enforces your consent on each request by coaching staff. Summaries of your AI coaching conversations are not shown in the dashboard or the portal; they reach the coaching team only through Bariatric Rewrite's coaching intelligence systems described in Sections 5.1 and 6, and only with the express data-sharing consent described there.
Your coach uses this information to provide personalized coaching guidance, monitor your progress, and coordinate between human coaching and AI coaching features.
Legal Basis and Consent. Coach access to your data requires your affirmative consent, which is obtained separately from your general consent to the Service's Privacy Policy and Terms. During onboarding, or when you are linked to a coaching program, you will be asked to specifically consent to sharing your Rewrite Lifestyle data with your assigned Bariatric Rewrite coach.
You may withdraw your consent to coach data access at any time through the app settings or by contacting us at support@rewritelifestyle.ai. Withdrawing consent will revoke your coach's dashboard access to your data but will not affect your ability to use the Service independently.
Duration and Scope of Access. Coach access is limited to the duration of your active coaching program with Bariatric Rewrite. When your coaching program ends (whether by completion, cancellation, or expiration), your coach's access to your data through the dashboard is revoked. Bariatric Rewrite coaches are bound by their own professional confidentiality obligations and Bariatric Rewrite's privacy practices regarding any data viewed during the coaching period.
Coach-time rewards for users who are not coaching clients. Some Rewrite Rewards prizes are delivered by a Bariatric Rewrite coach — for example a review of one day of your logs, a short coaching call, a 24-hour coach messaging window, a custom meal plan, or a pantry review. Any user can earn these, not only coaching clients. When you choose to redeem such a prize, we ask for your consent, at that moment, to give the coach temporary access to the specific information the prize needs — your food logs for a log review, call or messaging window; your saved food preferences for a meal plan. That access is limited to the prize, ends automatically when the prize is delivered (or after seven days at most), and is recorded in our audit log. Declining never costs you the prize: the session still happens using whatever you choose to share in it. You may withdraw the consent at any time before delivery.
Streak milestone events. If you reach a 30-day logging streak you may be invited to a monthly group video session hosted by a Bariatric Rewrite coach. To invite you, we give Bariatric Rewrite your name, email address and the fact that you hold a qualifying streak. Bariatric Rewrite sends the invitation and hosts the session on its own video-conferencing service under its own privacy practices; the session details also appear in your in-app calendar. Attending is optional.
Gifting a coach-time prize. Coaching clients who earn a coach-time prize may gift it to another person instead. If you gift a prize to someone who is not yet a user, we collect the name and email address you give us for that person and use them only to send the invitation; if they join, they grant their own consent before any coach sees anything, and you never see their data. If you receive a gifted prize, the person who sent it is shown to you; they learn only whether you redeemed it. Gifts expire if unredeemed.
Public recognition (opt-in only). At the 100-day streak milestone you may choose to be recognised in Bariatric Rewrite's community group with your name and milestone. We do this only if you expressly opt in at that time; if you prefer, you receive a private message from a coach instead.
Coach Notes. Your coach may record notes about your progress, eating behaviors, and wellness journey within the coaching dashboard. These coach notes become part of your data within the Service and are used to personalize your AI coaching experience. Coach notes may be sent to OpenAI to improve the relevance of AI-generated coaching responses, as described in Section 5.1.
Peer Messaging. Coaching clients may message other coaching clients within the Service. A conversation starts only when one person sends a message request and the other accepts it; you may send up to ten requests a day, and a request that is declined cannot be repeated for 30 days. You can block another user at any time; the block is not announced to them, and if you later unblock them the earlier conversation reopens. You can report a conversation; when you do, we keep a copy of the reported messages (and only those messages and the details needed to investigate the report) as evidence while we review the report and for 12 months after it is closed, after which it is deleted automatically unless we are legally required to keep it; the copy is kept even if either account is deleted in the meantime, and only authorised members of our team can read it. Messages you send are visible to the person you send them to. Our coaching team does not read client-to-client messages except when a report is made or where the law requires it, and may remove a message or suspend messaging where our Terms or the law require.
Coaching Calls and Recordings. Coaching calls take place in the Zoom app, in your coach's room on Bariatric Rewrite's business account, not inside the Service. Calls are recorded. When you join a recorded call, Zoom shows you a notice that the session is being recorded, which stays on your screen until you acknowledge it, and your coach announces it at the start. The recording captures your image if your camera is on, your voice and anything you say or share. Who can see a recording depends on the call: the recording of a group coaching call is made available in the app only to the members of that group; community-call recordings to members of the coaching community; workshop recordings to anyone using the app, because workshops are open to all users. One-to-one coaching calls and peer-group calls are also recorded, for your coach's own use, and are never made available in the app or shared. The app shows a recording link only to the people it is meant for. We do not store the recordings ourselves and we do not control how long they are kept: Bariatric Rewrite holds them on its Zoom account under its coaching program agreement, and any request about a recording goes to Bariatric Rewrite (we will pass on a request you make to us). We store the link and a record of which members opened it. Your coach may also record your attendance at group calls and one-to-one calls, which is visible to the coaching team under your coaching consent, and you can see your own attendance.
We use your information for the following purposes:
Under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), certain categories of information we collect are classified as "sensitive personal information." These include:
We collect and use sensitive personal information solely to provide and improve the Service as described in this policy. We do not use or disclose sensitive personal information for purposes beyond those permitted under the CCPA/CPRA.
Your Right to Limit Use. You have the right to limit our use of your sensitive personal information. You can exercise this right through the "Privacy Settings" section of the app, which includes toggles for Location & Travel Tracking and AI Data Processing preferences. You may also contact us at support@rewritelifestyle.ai to request limitations on how your sensitive personal information is used.
The Service uses artificial intelligence to provide personalized food tracking, nutritional analysis, and lifestyle coaching. When you interact with AI features, the following data is sent to our AI service provider, OpenAI (operating in the United States):
OpenAI processes this data solely to generate responses within the Service. OpenAI's data processing agreement with us prohibits OpenAI from using your data to train its models or for any purpose other than providing the Service.
If you opt out of AI profiling through the "AI Data Processing" toggle in your Privacy Settings, your wellness profile, health data, weight, conditions and inferred facts are no longer sent to OpenAI with your coaching conversations, and responses are not personalized to them. The message you send and up to five recent conversation turns — or, in a longer conversation, a short summary of the conversation so far plus the three most recent turns — are still sent so that the coach can reply, and food, photo and insight features continue to send the data those features need. Core tracking features remain available.
[[CONDITIONAL — POL-17 / REW-982 (v2.4 publication gate): publish the GATED paragraph only once (a) user-activity-feed, escalation-events and meal-notes/recent on the Lucille bridge return no per-user content for users without the coach data-sharing consent, and (b) the signup webhook to Lucille is deferred until that consent exists — all tested. Otherwise publish the CURRENT paragraph, which describes today's processing (every user has accepted the AI personalisation acknowledgment at sign-up; the CURRENT paragraph discloses what Bariatric Rewrite's systems receive under it). Counsel (14 Oct): "revise the disclosure to accurately describe the processing currently occurring rather than represent that the consent gate is already operational."]]
GATED: In addition, Bariatric Rewrite LLC, an affiliated entity, operates backend data-processing systems hosted on Amazon Web Services (US) — running on Amazon EC2 with scope-based API authentication — that support coaching intelligence and AI quality improvement. For users who are not coaching clients, these systems receive only anonymized, aggregated usage patterns with identifying information removed. For coaching program participants who have provided separate consent under Section 2A, Bariatric Rewrite's systems may also process per-user data (including wellness profile, food logs, weight data, meal notes, and summaries of your AI coaching conversations) to provide coordinated coaching support. Per-user data is released to these systems only where your coaching consent is in place; access is protected by scope-based access controls and API key authentication and is logged. These systems are operated solely by Rewrite Lifestyle and Bariatric Rewrite personnel and are not exposed to any external third party.
CURRENT: In addition, Bariatric Rewrite LLC, an affiliated entity, operates backend data-processing systems hosted on Amazon Web Services (US) — running on Amazon EC2 with scope-based API authentication — that support coaching intelligence and AI quality improvement. These systems receive anonymized, aggregated usage patterns. They also receive, for all users and labelled with your account identifier rather than your name: your email address, phone number and account identifier when you sign up, so that the coaching team can recognise its coaching clients; recent summaries of your AI coaching conversations and messages our AI has flagged as a possible crisis, so that a coach can be alerted where someone may need support; and the notes you attach to meals. For coaching program participants who have provided separate consent under Section 2A, these systems may also access your wellness profile, food logs, weight data, health data and AI coaching chat history to provide coordinated coaching support; those reads require your coaching consent and are logged. Access to these systems is protected by scope-based access controls and API key authentication. They are operated solely by Rewrite Lifestyle and Bariatric Rewrite personnel and are not exposed to any external third party.
[[/CONDITIONAL]]
In accordance with the Colorado Artificial Intelligence Act (SB 24-205), we disclose that the coaching, food analysis, and personalized recommendations provided through this Service are generated by an artificial intelligence system. You are interacting with AI, not a human, when you use the coaching features. You have the right to request information about how our AI system generates recommendations and to request human review of any AI-generated guidance.
Under the CCPA's regulations on automated decision-making technology (effective January 1, 2026), you have the right to:
Rewards automation. Featured bonus tasks and suggested goals in Rewrite Rewards are selected by an automated process from a pre-approved list, using your recent logging activity, so that we can encourage a habit you have not yet built. This affects only which activities earn bonus points; it never affects your access to the Service, your subscription or your health-related content. Prize eligibility is determined by fixed, published rules based on your subscription and coaching status, with no element of chance and no human or automated judgement about you.
When you opt out of AI profiling, the Service will still function but personalized AI coaching features will be limited. You can manage your ADMT preferences in the "Privacy Settings" section of the app or by contacting us at support@rewritelifestyle.ai.
We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising. We share personal information only with the following categories of service providers, each bound by contractual obligations (data processing agreements) to use your data solely for providing services to us:
| Provider | Data Shared | Purpose | Location | Safeguards |
|---|---|---|---|---|
| OpenAI | First name, user ID, wellness profile, conversation history, food photos, mood logs, travel status, coach notes | AI coaching and food analysis | United States | Data processing agreement; no model training on user data; retention limited to OpenAI's 30-day abuse-monitoring window |
| FatSecret | Food search queries (text only, no personal identifiers) | Food database and nutritional information | United States | API terms of service |
| Amazon Web Services (S3 + CloudFront + EC2 + RDS) | Progress photos, profile images, all server-side personal information | Cloud storage, content delivery, application hosting, and database hosting | United States | AWS Data Processing Addendum; encryption in transit (TLS); server-side encryption at rest for S3 and RDS; signed URL delivery for media |
| Stripe | Email address, payment card details (web checkout only) | Payment processing for web subscriptions | United States | PCI DSS compliant; Stripe privacy policy governs payment data |
| RevenueCat | User ID, subscription status, purchase receipts, platform (iOS/Android), AppsFlyer install identifier | Subscription entitlement management and receipt validation across Apple App Store and Google Play; forwards purchase and subscription events to AppsFlyer for attribution (install identifier only, no advertising identifier, partner forwarding disabled) | United States | SOC 2 Type II; Data Processing Addendum; no access to payment card details |
| OneSignal | User ID, device push token, notification content, notification preferences | Push notification delivery and engagement analytics | United States | Data Protection Addendum incorporating GDPR / CCPA terms; SCC-equivalent cross-border safeguards |
| Twilio | Phone number, one-time SMS authentication codes | SMS delivery for account verification and authentication | United States | Twilio Master Services Agreement; data processing addendum |
| Sentry | Error stack traces, request metadata (URL, status code, anonymized session ID, user agent) with credentials, tokens, payment fields and other sensitive payload contents redacted before transmission | Server-side error monitoring and reliability engineering | United States | Sentry Data Processing Addendum; configurable data residency; aggressive PII redaction at the SDK layer |
| AppsFlyer | AppsFlyer install identifier, platform (iOS or Android), device model, operating system and app version, IP address, Apple identifier for vendors (iOS), Google Advertising ID (Android), install and session events, account events (registration and sign-in), onboarding milestone events (tutorial and questionnaire completion, without their content), and subscription lifecycle events (trial started, subscribed, purchased, cancelled, refunded) including transaction amount and currency, and your account identifier | Marketing attribution — measuring which advertising channel led to an install or subscription | United States | AppsFlyer terms and data processing terms; no Apple advertising identifier (IDFA) is collected; events sent from our servers carry the AppsFlyer install identifier only, never an advertising ID; forwarding to advertising networks is disabled; no health information, food, weight, or wellness data is transmitted |
| Google (Google Analytics for Firebase) | Firebase app-instance identifier, Google Advertising ID (Android only), device model, operating system and app version, and the same account, onboarding and subscription events described for AppsFlyer, including transaction amount and currency | Product analytics — understanding how the app is used and where users need help | United States | Google's data processing terms; user-ID and Google Signals features are not enabled; no health information, food, weight, or wellness data is transmitted |
| GoHighLevel (HighLevel, Inc.) | Email address, name, phone number, subscription and coaching-program lifecycle tags; Rewrite Rewards coach-time redemptions, streak-milestone invitations and gift records (which prize, when, and for gifts, who sent it) | Customer relationship management for the Rewrite Lifestyle and Bariatric Rewrite businesses; scheduling and accounting for coach-time rewards | United States | HighLevel Data Processing Agreement; reward records are not used for marketing without your separate consent |
| Bariatric Rewrite LLC (Coaching) | Coaching clients, through the in-app coaching dashboard: food logs, weight, measurements, supplements, mood logs, progress photos, questionnaire completion status; through the coach web portal, under the same consent: additionally your questionnaire answers. Any user redeeming a coach-time reward: only the information the prize needs (food logs, or saved food preferences), for the prize's duration. Streak-milestone invitees: name, email address and streak status | Human coaching for enrolled coaching program participants; delivery of coach-time rewards and streak-milestone sessions | United States | Separate user consent (prize-scoped and time-limited for rewards); access limited to coaching program or prize duration; coach confidentiality obligations |
| Bariatric Rewrite LLC (Backend Data Processing — "Lucille" coaching intelligence platform) | Anonymized, aggregated usage patterns; [[CONDITIONAL — POL-17: GATED: "for coaching program participants with consent (see Section 2A):" / CURRENT: "for all users, labelled with an account identifier: sign-up email and phone, recent AI conversation summaries, crisis-flagged messages, meal notes; and for coaching program participants with consent (see Section 2A):"]] wellness profile, food logs, weight data, health data, AI coaching chat history and activity patterns | AI coaching quality improvement, including improving Bariatric Rewrite's own coaching models using anonymized data; coaching intelligence and knowledge base management; alerting a coach where someone may need support; per-user coaching support for enrolled participants (with consent) | United States (AWS EC2) | PII stripping on aggregate data; scope-based access controls; API key authentication; consented per-user reads logged |
Apple Inc. (HealthKit) and Google LLC (Health Connect) are not sub-processors of Rewrite Lifestyle. They are on-device data sources from which the Service reads, only with your explicit operating-system-level permission. Their handling of your data on your device is governed by Apple's and Google's own privacy policies.
We maintain a current list of sub-processors and will update this Privacy Policy and notify users in accordance with Section 13 before engaging any new sub-processor that materially changes our data flows.
We may also disclose personal information when required by law, to enforce our Terms & Conditions, to protect the rights or safety of our users or others, or in connection with a merger, acquisition, or sale of assets (with notice to you).
The following information constitutes "consumer health data" under Nevada law: food logs, macro and calorie tracking, weight and body measurement data, health conditions, surgery type and date, supplement and medication logs, mood and wellness logs, progress photos, wearable data synced from Apple Health or Google Health Connect, and AI coaching conversation history related to health topics.
Affirmative Consent. We collect consumer health data only after you provide affirmative, voluntary consent. At registration, you are presented with a dedicated consent acknowledgment for our collection and use of consumer health data, separate from your general acceptance of our Terms & Conditions. You may withdraw consent at any time through your account settings or by contacting us. Withdrawal of consent will limit certain features of the Service but will not affect data collected before the withdrawal.
Your Rights. Under Nevada law, you have the right to:
No Sale of Health Data. We do not sell consumer health data. We do not share consumer health data for advertising purposes. Consumer health data is shared only with the service providers listed in Section 6, solely for the purpose of providing the Service.
Security. We maintain reasonable security measures appropriate to the sensitivity of consumer health data, as described in Section 11.
If you are a California resident, you have the following rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:
To exercise any of these rights, contact us at support@rewritelifestyle.ai or use the in-app Privacy Settings. We will verify your identity before processing your request and respond within 45 days as required by law.
We retain your personal information for as long as your account is active and as needed to provide the Service. Specific retention periods by data category:
| Data Category | Retention Period | Notes |
|---|---|---|
| Account information | Duration of account + 30-day grace period after deletion request | Permanently deleted after the 30-day grace period |
| Lifestyle, nutrition and wellness data (food logs, weight, measurements, supplements, mood, wearable data, personal conditions) | Duration of account + 30-day grace period | Fully deleted upon account deletion |
| Location history | Duration of account + 30-day grace period | Fully deleted upon account deletion; you may also disable location collection at any time through the "Location & Travel Tracking" toggle |
| AI conversation history | Duration of account + 30-day grace period | Fully deleted upon account deletion |
| Rewards records (points, streaks, levels, badges, prize and gift records, prize-scoped consent records) | Duration of account + 30-day grace period | Deleted upon account deletion, except the limited compliance record described below; unredeemed gifts expire automatically |
| Limited compliance record of prize-scoped consent and coach access (a protected account reference, the consent version and scope, the prize or access event, the date and time, any expiry or withdrawal, and the related access-log entries; no food, weight, health, questionnaire, coaching or AI-conversation content) | For as long as reasonably necessary to document that consent was given and access was authorised, to meet our legal obligations, or to resolve a dispute [PERIOD TO BE SET IN THE RETENTION SCHEDULE — counsel] | Kept separately from your account data and used only for those purposes; we can connect it to you only to establish whose consent it was [[CONDITIONAL — REW-955: delete this row and the "except…" clause in the Rewards row if the record-keeping is not on main at publication]] |
| Peer-message report evidence (copy of reported messages, reporter and reported user, outcome) | Life of the report + 12 months after it is closed | Retained after account deletion as a record needed to resolve a dispute (Section 10); longer only under a legal hold |
| Recording-link open log (which member opened which call recording, and when) — held by Rewrite Lifestyle | Duration of account + 30-day grace period | Deleted upon account deletion. The recordings themselves are held by Bariatric Rewrite on its Zoom account under its coaching program agreement, not by us; deleting your Rewrite Lifestyle account does not delete a recording you appear in (see Section 2A) |
| Progress photos | Duration of account + 30-day grace period | Deleted from cloud storage (AWS S3) upon account deletion |
| Marketing attribution and analytics records (AppsFlyer install identifier and the events sent to AppsFlyer and Google Analytics) | Duration of account + 30-day grace period | Deleted from our systems upon account deletion; AppsFlyer and Google retain data under their own terms |
| Payment and billing records | As required by law (typically 7 years) | Tax and accounting compliance |
| Audit and activity logs | Duration of account + 30-day grace period, after which identifying fields are anonymized | Anonymized records may be retained for up to 7 years for compliance, security, and fraud-prevention purposes |
| AI token-usage statistics | Indefinite, in anonymized form only | User identifier is removed upon account deletion; retained for cost tracking and capacity planning |
You may request deletion of your account and all associated personal information at any time through the account settings in the app or by contacting us at support@rewritelifestyle.ai.
When you request account deletion:
We implement reasonable technical and organizational security measures designed to protect your personal information, including:
However, no method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security.
The Service is intended only for individuals aged 18 years or older. We do not knowingly collect personal information from individuals under 18.
We require a self-declaration of age at registration, and collect date of birth in onboarding. If we become aware that we have collected information from a person under 18, we will promptly delete that information. If you believe a person under 18 has created an account, please contact us immediately at support@rewritelifestyle.ai.
We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the app and, where required by law, request your renewed consent before continuing to process your data under the updated terms. We will provide at least 30 days' notice before material changes take effect. Your continued use of the Service after the effective date of a revised Privacy Policy constitutes acceptance of the revised terms.
If you have questions about this Privacy Policy, wish to exercise any of your privacy rights, or have a concern about our data practices, please contact us at:
Rewrite Lifestyle, LLC 2935 Ainslie Lake Ave, Henderson, NV 89044 Email: support@rewritelifestyle.ai
Privacy Officer: Daniel Green — operations@rewritelifestyle.ai
For California residents: You may also designate an authorized agent to submit requests on your behalf. Authorized agents must provide written proof of authorization.
This section applies to residents of Canada and supplements the Privacy Policy above. In the event of any conflict between this section and the rest of this Privacy Policy, this section governs for Canadian residents.
Rewrite Lifestyle is operated from the United States. Your personal information is collected, processed, and stored on servers located in the United States. By using the Service, you acknowledge that your personal information will be transferred to and processed in the United States, which may have privacy laws that differ from those of your province or territory. We take reasonable steps to ensure your information receives an equivalent level of protection through contractual data processing agreements with our service providers.
Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation, Canadian residents have the following rights:
If you are a resident of Quebec, you have additional rights under the Act Respecting the Protection of Personal Information in the Private Sector (Law 25):
We have designated a Privacy Officer responsible for overseeing compliance with this section and applicable Canadian privacy legislation. To exercise any of the rights described above, or with questions about our Canadian privacy practices, please contact: support@rewritelifestyle.ai with the subject line "Canadian Privacy Request." We will acknowledge your request within 10 business days and respond fully within 30 days.
Pour les résidents du Québec, en cas de conflit entre la version anglaise et la version française de la présente section, la version française prévaut. Les autres sections de la présente Politique de confidentialité ne sont publiées qu'en anglais.
La présente section s'applique aux résidents du Canada et complète la Politique de confidentialité ci-dessus. En cas de conflit entre la présente section et le reste de la Politique de confidentialité, la présente section s'applique aux résidents canadiens.
Rewrite Lifestyle est exploité depuis les États-Unis. Vos renseignements personnels sont collectés, traités et stockés sur des serveurs situés aux États-Unis. En utilisant le Service, vous reconnaissez que vos renseignements personnels seront transférés et traités aux États-Unis, dont les lois sur la protection de la vie privée peuvent différer de celles de votre province ou territoire. Nous prenons des mesures raisonnables pour assurer un niveau de protection équivalent.
En vertu de la Loi sur la protection des renseignements personnels et les documents électroniques (LPRPDE) du Canada et de la législation provinciale applicable, les résidents canadiens disposent des droits suivants :
Si vous êtes résident du Québec, vous disposez de droits supplémentaires en vertu de la Loi sur la protection des renseignements personnels dans le secteur privé (Loi 25) :
Nous avons désigné un responsable de la protection des renseignements personnels chargé de superviser la conformité à la présente section et aux lois canadiennes applicables. Pour exercer l'un des droits décrits ci-dessus ou pour toute question relative à nos pratiques en matière de confidentialité au Canada, veuillez nous contacter à : support@rewritelifestyle.ai en indiquant « Demande de confidentialité canadienne » en objet. Nous accuserons réception de votre demande dans un délai de 10 jours ouvrables et y répondrons dans un délai de 30 jours.
This section applies to residents of Australia and supplements the Privacy Policy above. In the event of any conflict between this section and the rest of this Privacy Policy, this section governs for Australian residents. For the purposes of the Privacy Act 1988 (Cth), this Privacy Policy is our APP 1 privacy policy in respect of personal information of individuals in Australia.
Rewrite Lifestyle is operated from the United States. Your personal information is collected, processed, and stored on servers located in the United States. Our service providers also process data outside Australia, predominantly in the United States. These include:
Before disclosing your personal information to an overseas recipient, we take reasonable steps to ensure that the overseas recipient does not breach the Australian Privacy Principles (APPs) in relation to your information, in accordance with APP 8.1. These steps include written data processing agreements with each of the providers listed above that require them to handle your personal information in a manner consistent with the APPs, with restrictions on secondary use, with security obligations, and with audit and breach-notification commitments. You acknowledge that, by consenting to this Privacy Policy at registration, you provide informed consent for the purposes of APP 8.2(b) to the cross-border disclosure of your personal information to the recipients listed above.
Under Australia's Privacy Act 1988 and the Australian Privacy Principles (APPs), you have the following statutory rights. In addition, Rewrite Lifestyle voluntarily provides deletion and data export capabilities as described below.
Under section 6 of the Privacy Act 1988, "sensitive information" includes health information. The following data we collect constitutes health information, and therefore sensitive information, under Australian law:
We collect this sensitive information only with your express consent for the purposes of APP 3.3. During account registration, you are presented with a dedicated consent acknowledgment to the collection and use of your health and wellness data, separate from your general acceptance of this Privacy Policy. Your acceptance of this Privacy Policy at registration, which describes in detail the categories of sensitive information collected and the purposes for which we collect them, together with the dedicated consent acknowledgment, constitutes your express consent for the purposes of APP 3.3. You may withdraw consent at any time through the app settings, though this may limit certain features of the Service.
We use sensitive information only for the purposes set out in Section 3 of this Policy and only as reasonably necessary for those purposes (APP 3.2).
In accordance with the Privacy and Other Legislation Amendment Act 2024, we disclose that the Service uses automated decision-making to generate AI coaching responses, nutritional analysis, and personalized recommendations. These automated decisions are based on the personal information you provide (including your wellness profile, food logs, and conversation history) and are processed by our AI service provider, OpenAI.
Rewrite Rewards uses an automated process to select featured bonus tasks and suggested goals from a pre-approved list based on your recent logging activity. It affects only which activities earn bonus points. Prize eligibility follows fixed rules based on your subscription and coaching status.
You have the right to request information about how automated decisions are made and to request human review of any AI-generated guidance. You may opt out of automated decision-making through the "AI Data Processing" toggle in your Privacy Settings. Contact us at support@rewritelifestyle.ai for more information.
Under the Privacy and Other Legislation Amendment Act 2024, individuals in Australia have the right to bring court proceedings for serious invasions of privacy. We are committed to protecting your personal information and take reasonable steps to prevent unauthorized access, use, or disclosure. If you believe your privacy has been seriously invaded in connection with the Service, you may contact us at operations@rewritelifestyle.ai or exercise your rights under the Act.
We have designated a Privacy Officer responsible for overseeing compliance with this section and applicable Australian privacy legislation.
Privacy Officer: Daniel Green Email: operations@rewritelifestyle.ai Subject line for Australian requests: "Australian Privacy Request"
We will acknowledge your request within 10 business days and respond fully within 30 days.
Under Part IIIC of the Privacy Act 1988 (Notifiable Data Breaches scheme), if we experience an eligible data breach involving your personal information that is likely to result in serious harm, we will notify both you and the Office of the Australian Information Commissioner (OAIC) as soon as practicable after we form that belief, in the manner the Privacy Act requires.
Our written Data Breach Response & Notification Procedure sets out our incident-response team, our harm-assessment process, the regulators we notify (including the OAIC), and the information we include in user and regulator notifications. The procedure is owned by our Privacy Officer and is reviewed at least annually. Our notification will include a description of the breach, the kinds of information involved, the steps we have taken in response, and the recommended steps you should take in response.
This section applies to residents of New Zealand and supplements the Privacy Policy above. In the event of any conflict between this section and the rest of this Privacy Policy, this section governs for New Zealand residents.
Your personal information is transferred to and processed in the United States, which may have different privacy laws from those of New Zealand. In accordance with Information Privacy Principle 12 (IPP 12) of the Privacy Act 2020, we ensure that any overseas recipients of your personal information are subject to comparable privacy safeguards to those available under New Zealand law. We achieve this through written data processing agreements with each of the providers listed in Section 17.1, which require those providers to handle your personal information in a manner consistent with the New Zealand Information Privacy Principles.
Under New Zealand's Privacy Act 2020 and the Information Privacy Principles (IPPs), you have the following rights:
Health information collected by the Service is also subject to the Health Information Privacy Code 2020. This includes wearable data synced from Apple Health or Google Health Connect (with your permission), surgery type and date, health conditions, body measurements, weight history, supplement and medication adherence logs, mood and wellness logs, and bowel movement logs.
Under Part 6 of the Privacy Act 2020, if we experience a privacy breach that is likely to cause serious harm to any affected individual, we will notify both the Office of the Privacy Commissioner and the affected individuals as soon as practicable. Our internal breach assessment, notification, and remediation process is set out in our written Data Breach Response & Notification Procedure, which is owned by our Privacy Officer and reviewed at least annually.
We have designated a Privacy Officer responsible for overseeing compliance with this section and applicable New Zealand privacy legislation.
Privacy Officer: Daniel Green Email: operations@rewritelifestyle.ai Subject line for New Zealand requests: "New Zealand Privacy Request"
We will acknowledge your request within 10 business days and respond fully within 20 working days.
Track food, mood, water, supplements, progress and patterns in one bariatric lifestyle app built for real life after surgery and GLP-1s.
