Consumer Health Data Privacy Policy
Who we are
Treuwin (say it TROO-win) is a wellness coaching app at treuwin.com, run by the Treuwin team. Your coach is an AI. Every message carries a label saying who wrote it: "Your coach" (the AI) or "Treuwin" (the app itself), and both are tagged AI. No person writes in the chat. The Treuwin team can read your thread, and each time someone opens it you see it under You in the app, in Access record.
This policy covers the consumer health data the app holds about you. The Privacy notice covers everything else, and says how long each kind of data is kept.
Consumer health data we collect
- Check-ins: sleep, mood, energy, weight and an optional note. Source: you, in the app. Purpose: the coaching, and showing your days back to you.
- Meals: the meals you log, typed or as photos, with the foods, portions and estimated calories and nutrients. Source: you, and the foods Google Gemini finds in a photo or a typed meal if you tick the second consent box, or our food list if you do not. Purpose: your food log, Today and the coaching. The estimates are not medical advice.
- The Day 0 health questions: the conditions you name, the number of yes answers to the SCOFF eating questions, the coaching level they give (0, 1 or 2) and, for level 2, its end date, and whether you take a GLP-1 medicine. Source: your answers to the Treuwin team on Day 0, on a call or in person, which the team records. Purpose: keeping the coaching safe for you; for example, level 2 hides calorie numbers. The answers are never sent to an AI, and the AI coach is told only the level and, if it applies, that you are "on a GLP-1 plan".
- What you write about your health in messages, in a check-in note or in a typed meal, and what the coach remembers about you. Source: you. Purpose: the coaching. Please do not send lab results, diagnoses, medication names or doses.
- Your goal, commitments and ticks, such as a commitment about sleep or meals. Source: you, agreed with the Treuwin team. Purpose: the coaching.
- Safety records: that a safety card was shown, and when, never what was said. Source: the app's safety check. Purpose: keeping you safe, and the yearly crisis-referral counts we report.
We use this data only to run this test of the coach and to keep you safe. We use no ad or analytics tools.
Who we share it with
These companies process data for us. We give these companies your data only to run this test. We use no ad or analytics tools, and we never sell or share your data for marketing. The medical conditions, allergies and medications in your health profile are never sent to an AI. What you type in a message is, so please do not send lab results, diagnoses, medication names or doses.
- Anthropic (Claude API). Writes the coach's AI messages and screens messages for safety. Receives your messages and a summary we build for each reply: your check-ins (sleep, mood, energy, weight), commitments and ticks, what the coach remembers about you, your dietary pattern and risk tier (never the conditions behind it), that you are on a GLP-1 plan if you told us so, and the meals you log. Only with your agreement to the coach. When we test the coach, Claude grades anonymised cases only. If Claude is unavailable, no other AI replies: you get a fixed message instead.
- Google. Google Gemini (Gemini API) reads meal photos and meals you type to find the foods, only if you tick the second consent box; please avoid faces and documents in photos. On the paid tier we use, Google keeps the prompts Gemini receives, meal photos included, and its responses for 55 days. Google Cloud (Cloud Run, Cloud Tasks, Cloud Scheduler) runs our server in the US, so your messages, check-ins and meals pass through it. Cloud Logging keeps server logs for 30 days, without message text, food names or health values. Firebase Cloud Messaging delivers notifications to Android phones; it receives the notification text, which never contains health words.
- USDA. If Gemini finds a brand, we look up the brand and food in USDA's food database, with nothing about who you are.
- Apple. So that the test app installs without TestFlight, your iPhone's device identifier is registered through Expo's registration link in the Treuwin team's Apple developer account, so Expo and Apple keep it. Apple's push service delivers notifications to iPhones; it receives the notification text, which never contains health words. TestFlight comes later, and then delivers the iPhone test app and receives the email address you are invited with.
- Expo. Builds the app, and delivers notifications and app updates. Its registration page receives your iPhone's device identifier. Its push service passes notifications to Apple and Google; it receives your device's push token and the notification text. When the app opens, it asks Expo for an update, sending technical details about the app and your phone (such as the app version and the platform), never your health data.
- Supabase. Our database and sign-in, in the US. Stores your account (your email address) and everything you send: messages, check-ins, commitments and ticks, and your meals.
- Cloudflare. R2 stores meal photos and our encrypted backups. Pages hosts these web pages, which run no scripts.
- Resend. Sends sign-in codes by email; receives your email address and the code.
- GitHub. Runs the nightly backup job, which encrypts the backup before it is stored in Cloudflare R2. Backups never hold the record of what was sent to an AI.
- UptimeRobot. Checks every 5 minutes that our server is up.
Not used yet
These are added in later versions of the app, each named here when it starts:
- Apple HealthKit and Google Health Connect: data sources on your phone, read only with your consent.
- Apple WeatherKit: receives a coarse area, never your precise location.
- RevenueCat: purchase data only, no health data.
How long the AI companies keep it
The Privacy notice says how long we keep each kind of data. Anthropic and Google keep what we send them as each vendor's API data terms state:
- Anthropic: Anthropic deletes API inputs and outputs from its backend within 30 days of receipt or generation, but may keep them longer to enforce its Usage Policy (including up to 2 years, with classification scores up to 7 years, if its automated trust and safety systems flag them as violating that policy) or to comply with the law. Source: Anthropic's privacy center, read 2026-11-06.
- Google Gemini: On the paid tier, Google keeps text prompts, other context sent with them and responses for 55 days to detect and prevent policy violations and for any required legal or regulatory disclosures. Google's usage policies page for the Gemini API does not name images, but Google's Terms count them as part of prompts, so we treat meal photos as kept for those 55 days too. Source: that page, read 2026-11-06.
No sale
We never sell your consumer health data, and we never share it for marketing.
Your rights
You can see, take and delete your consumer health data, and withdraw your consent, from the app:
- See and take it: in You, Export my data gives you a file of your data, without the photos. "What your coach knows" shows what the coach remembers, and you can edit or delete any line.
- Delete it: delete a meal (Delete this meal, with its photo), use Forget everything under "What your coach knows", or delete your account in You. Support says what deleting your account erases and what stays.
- Withdraw consent: in You, under Consents. Without the second box, your meals no longer go to Google Gemini.
To reach the Treuwin team, contact the person who invited you.