Version 1.7 — effective 8 October 2026. Changes from 1.6: in step with Privacy Policy 1.13. One more recipient of what you write to the AI coach, for people who accepted the «AI coach» consent at the wording that names it (2026-10-08-v5, shown by app versions released after 8 October 2026): TypeSafe AI, Inc. receives the text of the message — which may concern your health — to tell a message that logs food from any other. Under an earlier wording nothing is sent to it.
Version 1.6 — effective 6 October 2026. Changes from 1.5: corrections in step with Privacy Policy 1.11, for what the app and our server do since 4 October 2026. The choice of what the AI coach may change and the separate «Change and tell me» consent are gone: Grif always changes and tells you, with a notification and a one-tap undo, within the same limits, and a lower calorie target is still only ever a proposal (§4, §6). The weekly check-in no longer has a consent of its own: a line on the Sunday sheet says the answers are kept as health data for your weekly review and your targets, answering is your choice, the answers reach the coach's providers only under the «AI coach» consent and are kept no longer than 400 days (§4, §5, §6, §8). The morning note follows your answer to the morning journal, or comes at 09:30 your time; on Monday the same slot carries the weekly review, written by the AI provider and always on (§4). §5 now names dictation in its own row: the voice clip goes to OpenAI to be turned into text and is kept neither by us nor in our logs.
Version 1.5 — effective 2 October 2026. Changes from 1.4: corrections in step with Privacy Policy 1.10. Every message to the AI coach now reaches the AI provider — the server-side check that answered questions about doses, diagnoses and symptoms with a fixed text is gone, and the rule against medical advice is an instruction to the model; when you ask the coach to record a dose, a side effect, a course, a period day or a lab value, what you stated — including the medication's name and dose — reaches the provider (§2, §5). An assistant you connect yourself (Claude or ChatGPT) receives the diary data it reads at your instruction (§5). Workout sessions from Apple Health / Health Connect are saved to our server without a tap once you grant the permission. A product name our catalogue does not know is looked up at Open Food Facts and through Google's Gemini API with Google Search, with nothing about you (§5).
Version 1.4 — effective 1 October 2026. Changes from 1.3.6: two optional categories the app already offers adults are named — weekly frames (two photos of your body a week, stored encrypted for your own film roll) and Body Scan estimates (a body-fat range from those frames) (§2); a new sharing row — for Body Scan only, the week's two frames with your sex and height go to Google (Gemini API) and, as a fallback, OpenAI; your tape measurements stay on our server (§5); their retention (§8); and a correction to §7 — the Android app no longer asks Health Connect for READ_NUTRITION. Voice recordings for dictation are sent to OpenAI to be turned into text and are not kept; what they say is not stored as health data unless you then send it (Privacy Policy §3). The Privacy Policy is updated to 1.9 in step.
Version 1.3.6 — effective 26 September 2026. Changes from 1.3.5: a new category — the optional weekly check-in: your Sunday answers about the week (hunger, how the plan and training felt, rest, stress, sense of progress and, where you track them, the effect of your cycle and of a week on a GLP-1 medication) and the outcome our code drew from them (§2); a new purpose — feeding the coach's weekly review and proposing, or on «Change and tell me» applying with a notification and undo, a change to your calorie, protein or step target within the limits of Privacy Policy §5, computed by our code and never by the model (§4); the answers reach the coach's providers only under both the «Weekly check-in» and the «AI coach» consent, and nothing else about them is shared with anyone (§5); a new right — switching the check-in off, which deletes the answers (§6); and one new retention period — while the consent stands and no longer than 400 days (§8). No answer reaches analytics. The Privacy Policy is updated to 1.8.6 in step.
Version 1.3.5 — effective 26 September 2026. Changes from 1.3.4: a new category — the optional morning journal: bed and wake times (typed, or read from your health store if you switch that on), the time asleep derived from them, cups of coffee or strong tea and the hour of the last, drinks of alcohol and the hour of the last, and your journal settings (§2); a third case in which a health-store value reaches our server — the night's sleep times, only with the journal's own switch on (§3, §7); a new purpose — showing you positional patterns between your nights and your diary, weight and steps, computed by our code and never as advice, and naming the night's figures in the coach's morning note and weekly review (§4); those figures reach the coach's providers only under both the «Morning journal» and the «AI coach» consent, and nothing else about the journal is shared with anyone (§5); a new right — switching the journal off, which deletes the answers and settings (§6); and one new retention period — while the consent stands and no longer than 400 days (§8). The alcohol question is hidden from any profile under 18; no answer reaches analytics. In the same release a saved meal line for an alcoholic drink also keeps its grams of alcohol per 100 g, counted into its calories (§2), and §4 names the Sunday weekly report reminder, a fixed text with no health value in it. The Privacy Policy is updated to 1.8.5 in step.
Version 1.3.4 — effective 26 September 2026. Changes from 1.3.3: the optional medication tracker also records a testosterone therapy course prescribed by a doctor — §2's Medication data row names prescribed medication courses such as GLP-1 or testosterone therapy and the dose as you entered it with its unit; §2 states that a hormone therapy course may reveal sensitive information about you and that Grif asks no question about why it was prescribed and infers nothing; §4 names what the therapy diary computes (calendar dates only) and how the five therapy-related lab markers are shown; §6's medication deletion row covers a therapy course. No new sharing, recipient or retention period; the «Medication data» consent is re-worded and shown in its new version only when you start a therapy course. The Privacy Policy is updated to 1.8.4 in step.
Version 1.3.3 — effective 26 September 2026. Changes from 1.3.2: §5's lab-report row now says where the uploaded file rests — encrypted by our server, as ciphertext, in a private bucket of Cloudflare R2 object storage under a random object name, with Cloudflare, Inc. as our storage processor that never receives the key — and §5's note on what never receives a health value now covers our servers' error reporting, which is enabled with the same scrubbing as the app's crash reports. §6 and §8 now say that the nightly database backup is encrypted, kept for 30 days on our server and, as an encrypted copy, in a private storage bucket in the EU for the same 30 days, and readable only with a key we hold; and §6's deletion row lists what account deletion removes — your medication records, your push tokens and the lab files in storage among the rest — and that every consent is withdrawn with it. No new sharing, purpose or category; the Privacy Policy is updated to 1.8.3 in step.
Version 1.3.2 — effective 26 September 2026. Changes from 1.3.1: the AI coach may now write to you without a message from you — a morning note about the previous day and a contextual note (new lab results confirmed, a turned weight trend, a dose day), both written by the AI provider from figures our code selects (§4), so, while those switches are on, the consumer health data listed in §5 reaches the coach's providers on a day you have not written to Grif (§5); a quarterly vitamin D card is a fixed text with no model behind it (§4). The pushes announcing them are fixed neutral sentences and carry no health value (§5). §2 and §5 now also name the rolling summary of your conversations (written weekly, only while «Remember conversations» is on, deleted with «Delete all conversations» — §§6, 8), a meal scan you attach in the chat, and that the coach's diary reads include the names of dishes; §4 names the two model sizes. No new category, recipient or retention period; the «AI coach» consent is re-asked with a new version that names the notes, as §9 promises when the sharing terms change.
Version 1.3.1 — effective 25 September 2026. Changes from 1.3: §5 names your profile among what the AI coach's providers receive — sex, your birthday (day and month) and age, height, goal, target weight and pace, activity level, diet type, meals a day, cooking preference, food exclusions and allergies, training frequency and place, time zone and language; never your name, email or year of birth. Body measurements and food exclusions are consumer health data, so the «AI coach» consent is re-asked with a new version before the next message. No new recipient, no new retention. Push delivery on Android now goes through Google's Firebase Cloud Messaging and the Firebase SDK is in both apps; as before, no health value is sent to a push service (§5).
Version 1.3 — effective 25 September 2026. Changes from 1.2: three optional features add categories (§2) — AI coach data, lab results and cycle data, the first reproductive health data Grif collects — with their sources (§3), purposes (§4), what of them reaches the coach's and the transcription providers and on which consent (§5), our position on requests from authorities (§5), how each is withdrawn and deleted (§6), the new menstrual-flow read permission (§7) and their retention (§8).
Version 1.2 — effective 22 September 2026. Changes from 1.1: the optional GLP-1 medication tracker adds a Medication data category (§2), names its source and purpose (§§3, 4), states that it is shared with nobody (§5), and states how it is deleted and how long a backup can hold it (§6).
Version 1.1 — effective 17 September 2026. Changes from 1.0: the operator is now 42 TAPS INC (§1).
This is the health-specific part of the Grif Privacy Policy. It exists as a separate page because the Washington My Health My Data Act (RCW 19.373), Nevada SB 370 and Connecticut's consumer-health-data provisions ask for one, and because Apple and Google both want a plain statement of what a health app reads and writes. It applies to everyone, not only to residents of those states.
Grif is not a medical device. It does not diagnose, treat, cure or prevent any condition, and nothing in it is medical advice. It computes calorie and macronutrient targets by published formulas, builds a training and meal programme, and keeps a diary.
42 TAPS INC, a Delaware corporation, 200 Continental Dr Ste 401, Newark, Delaware 19713-4337, United States. Contact: support@grif.fit.
| Category | Examples in Grif |
|---|---|
| Body measurements | Sex, date of birth, height, weight, neck / waist / hip circumferences, body-fat percentage (estimated from your circumferences, or read from your health store) |
| Nutrition and diet | Food exclusions (allergies and foods you do not eat), calories and macronutrients eaten (for an alcoholic drink, also its grams of alcohol, counted into calories at 7 kcal per gram), saved meals with their ingredients and grams, meal photographs and any note you type with them |
| Physical activity | Steps, workouts (type, minutes, sets, effort), active energy, the training programme and the week you are on |
| Derived data | Basal and total energy expenditure, calorie and protein targets, body-fat estimate, weekly averages — all computed by formula from the figures above |
| Medication data (optional) | The prescribed medication course you record — a GLP-1 medication or testosterone therapy — its form, the dose as you entered it with its unit, your schedule, where the prescription came from, each dose you log with its date and time, the injection or application site, and the side effects you record with their severity. A hormone therapy course may reveal sensitive information about you; it is kept only for this diary |
| Lab results (optional) | The laboratory report you upload (PDF or page photos, from the Labs screen, the chat or your phone's share sheet), with whatever the laboratory printed on it; the values transcribed from it with their units, the laboratory's reference ranges and where on the page each line was printed; values you type in by hand; your corrections; the note under a confirmed report, which our code assembles from fixed templates (no model is called for it); retest reminders (marker and date only) |
| Cycle data (optional, women's profiles) | Period start and end dates, flow on the days you mark, symptoms from a fixed list, the tracking mode, your typical cycle length, your answer about the last three months; menstrual-flow entries read from your health store if you switch that on (the last 12 months on iOS, the last 30 days on Android). Never free text, a method of contraception, a pregnancy record or a stored prediction — the cycle day, the phase and the fixed-rule notes («water, not fat», «worth seeing a doctor», «worth mentioning to your doctor») are computed each time you look and are not stored |
| Morning journal (optional) | Per night: when you went to bed and got up — typed on the morning screen or read from your health store if you switched that on, with its source — and the time asleep derived from them; cups of coffee or strong tea the day before and the hour of the last; drinks of alcohol and the hour of the last; whether you asked not to be asked about alcohol; your journal settings (questions on or off, not before what hour, daytime sleeper, morning screen on). No free text, no question about why. The alcohol question does not exist for a profile under 18 or while the coach is in its softer mode; the patterns shown on Progress (for example, how your time asleep compares on nights with a late cup) are computed by our code each time you look and are never stored as a judgement about you |
| Weekly check-in (optional) | Per week, on Sunday: how hungry you were, how the plan felt, how training felt, how rested you are, how much stress there was, whether you feel you are moving; if cycle tracking is on, whether the cycle affected the week; during a GLP-1 course, how the week on the medication went; chips for what got in the way or is coming (illness, travel, a holiday, a busy stretch); and the outcome our code drew — the rule that fired, the target proposed or applied, or the reason it waited. Answered by tap, no free text, no question about why; nothing about a hormone therapy course is asked |
| Weekly frames and Body Scan (optional, adults only) | Two photos of your body a week — front and profile — with their thumbnails, stored encrypted and seen only by you; the Body Scan estimates made from them: the body-fat range, the range our code kept after cross-checking it with the circumference formula, its midpoint and confidence, or the reason no estimate was given |
| AI coach data (optional) | What you write to the coach and what it answers, the facts you asked it to remember, a rolling summary of your conversations (a weekly paraphrase without quotes, numbers or anything about illness, medication, lab results, your cycle or mood, kept only while «Remember conversations» is on), the journal of settings it changed or proposed, the meal and water reminders it set and the water you log through it, a record of which proactive notices were sent (type, day and the reason as a code — never text), the card of a meal scan you attach in the chat (dish name and the scanner's figures), a time-limited flag (14 days) our server sets when a message reads like disordered eating — set by fixed word patterns on our server, recording neither the message nor the pattern — and, for the coach, daily activity totals uploaded from your health store once a day (steps, active energy, workouts, body-fat %; at most 14 days per upload, none older than 90) |
| Consent records | Which health-related consents you gave, at which text version, when, and when you withdrew them |
We do not collect biometric identifiers, genetic data, precise location, or any diagnosis, and we ask no question about gender-affirming care and infer nothing about it: a testosterone therapy course is recorded as a prescription, never with its reason. Reproductive health data — your cycle — is collected only if you are on a women's profile and switch cycle tracking on with its own consent; it is never inferred from anything else, and Grif does not predict ovulation or fertility. The app asks no question about medical conditions: if you use the optional medication tracker it records the medication and dose you were already prescribed, and never why; a lab report is transcribed as printed and compared with your laboratory's own range, never read into a diagnosis; and the coach is instructed never to advise on a dose, a diagnosis or a treatment and to say that such a question is for your doctor — since 1 October 2026 the question itself does reach the AI provider, as every message does.
We do not use consumer health data for advertising, for profiling with legal effect, or for any purpose you did not ask for; neither we nor the AI providers that process it for us use it to train models.
| What is shared | With whom | Why | Their role |
|---|---|---|---|
| A meal or nutrition-label photograph, the note you typed with it, the meal slot, your language | Google LLC (Gemini API, primary) and, if the primary fails, OpenAI, L.L.C. (fallback) — both in the United States | To recognise the food and estimate portions. The providers may keep their copy for up to 55 days (Google) or 30 days (OpenAI) for abuse monitoring, and act only on our instructions | Processors under their data-processing terms; both are certified under the EU-US Data Privacy Framework |
| Your message to the coach and its context — or, while the morning or contextual notes are on and without a message from you, the figures our code selected for the note and the reason it picked — with the rolling summary of your conversations if «Remember conversations» is on and a meal scan you attached (dish name and the scanner's figures, never the photo): your profile as you filled it in (sex, birthday — day and month — and age, height, goal, target weight and pace, activity level, diet type, meals a day, cooking preference, food exclusions and allergies, training frequency and place, time zone and language — never your name, email or year of birth), your day and week — the meals by slot with the names of dishes and their totals — weight and its trend, nutrient totals, workouts and programme, targets and settings, memory facts, the fact of a medication course; your cycle day, phase and today's symptoms, and your confirmed lab values, only if those features are on. Since 1 October 2026 also what you ask the coach to record or show: a dose you took, a side effect, the course your doctor set (the medication's name, amount, site and time), a period day, a lab value you read out. Never a lab file or an unconfirmed draft | Google LLC (Gemini API) and OpenAI, L.L.C. — both in the United States; our code picks one by the kind of task | To generate the coach's answer and proposals. Each may keep the request for up to 55 days (Google) or 30 days (OpenAI) for abuse monitoring, acts only on our instructions and does not use it to train models | Processors under their data-processing terms; both certified under the EU-US Data Privacy Framework |
The text of the one message you have just written to the coach, which may concern your health — only if you accepted the version of the «AI coach» consent that names this recipient (2026-10-08-v5 or later); never earlier messages, your profile, your diary or an account identifier | TypeSafe AI, Inc. (Jev, a judgment model) — United States | To tell a message that logs food from any other, so that the right model answers it; it returns a probability and writes no text. It does not train models on what it receives and keeps it under its own terms, which name no fixed period | |
| A voice clip you dictate — in the chat with Grif, when you describe a meal or read out lab values — and your Grif language as a hint; what you say may concern your health | OpenAI, L.L.C. — United States | To turn speech into text in the field you were typing in. Our server holds the clip in memory for that one request; neither the clip nor the text that comes back is stored or logged by us, and the text is kept only if you then send it. OpenAI may keep the request for up to 30 days for abuse monitoring and does not use it to train models | Processor under its data-processing terms, as above |
| The lab report file exactly as you uploaded it, with whatever the laboratory printed on it | Google LLC (Gemini API, primary) and, if the primary fails, OpenAI, L.L.C. (fallback) — United States | To transcribe the printed lines; retention and training as above. The file itself then rests for 12 months, encrypted by our server (AES-256-GCM, key held only by us), in a private bucket of Cloudflare R2 object storage, under a random object name that says nothing about you: Cloudflare, Inc. (United States) is our storage processor and holds ciphertext it cannot read | Same; Cloudflare — processor, storage only |
| The week's two frames, your sex and your height — only when you start a Body Scan, under the «Body Scan» consent; never your tape measurements, name, email or age | Google LLC (Gemini API, primary) and, if the primary fails, OpenAI, L.L.C. (fallback) — United States | To estimate a body-fat range from the frames; retention and training as for meal photos (kept for abuse monitoring for up to 55 / 30 days, never used to train models) | Processors |
| The figures of your morning journal — the night's sleep, cups and drinks with the hours of the last, the patterns our code found — only while the «Morning journal» consent stands and you accepted the version of the «AI coach» consent that names the journal | Google LLC and OpenAI, L.L.C. — the coach's providers, United States | For the morning note, the Monday review and a question you ask the coach about your nights; the same retention and no-training terms as the coach's other context. A journal row without an answer is sent as «not asked», never as «no alcohol» or «slept well» | Processors, as above |
| Your weekly check-in answers and the outcome our code drew from them — only while your «AI coach» consent stands | Google LLC and OpenAI, L.L.C. — the coach's providers, United States | For the weekly review and a question you ask the coach about your week; the same retention and no-training terms as the coach's other context. A week without an answer is sent as «not asked», never as «went well» | Processors, as above |
| The weight, calories and macronutrients you confirmed; body-fat % once released | Apple Health or Health Connect on your own phone | To keep your health store in step with the diary | Your device; not a transfer to a third party |
| Nothing else about your medication, your cycle, your lab reports, your morning journal or your weekly check-in | — | Beyond the coach's context, the report file above and an assistant you connected yourself (which receives the diary data it reads at your instruction, under its own terms with you), medication data, cycle data, lab reports, the morning journal and the weekly check-in are shared with nobody: not with analytics, crash reporting or push services, not with Apple Health or Health Connect (we never write them back), and not with our own support staff, who cannot see them in the cabinet. The medication's name and dose and your period dates reach the coach's AI provider only when you ask the coach to record or show them; a value you typed in by hand on a screen and the note under a report are never sent to one either. The period reminder is scheduled on your phone; a lab retest reminder names a marker, never a value; the morning screen's push, widget and lock-screen lines carry no answer, and the analytics events for the journal say only that a morning screen was shown, answered or skipped, and the weekly check-in's that it was shown, answered or skipped and which rule fired — never an answer | — |
| Nothing else | — | — | — |
Specifically: no consumer health data is shared with Apple, Google or Apphud for billing; no health value is sent to analytics, error reporting (the app's crash reports and our servers' error reports alike — both scrubbed of personal fields before they leave), or push services (the pushes for the coach's morning note, contextual note, vitamin D card and weekly report reminder are the same fixed sentences for everyone); a barcode lookup sends only the product's digits to Open Food Facts, and a product our catalogue does not know is looked up by its name alone at Open Food Facts and through Google's Gemini API with Google Search — in both cases with nothing about you. We have no affiliates, and we do not sell consumer health data and never have.
Separate consent for sharing. Sending a photo to a vision provider needs your specific "Food diary photographs" consent; a message to the coach, the "AI coach" consent; a lab report, the "Lab reports" consent; your cycle context reaches the coach's provider only when both "Cycle tracking" and "AI coach" are on, and your morning-journal figures only when both "Morning journal" and "AI coach" are on. Each names the providers and the retention period on the card you accept, each is separate from the "Health data processing" consent that covers collection, and none is bundled into the Terms of Service. All can be withdrawn in Profile → Consents.
Requests from authorities. We disclose consumer health data only on a legally binding request addressed to 42 TAPS INC and reviewed by us, and we tell you about it where the law allows. Because 42 TAPS INC is a Delaware corporation, it answers to United States legal process wherever the data is stored; our protection is therefore what we do not hold — no location, no free text about your cycle, no method of contraception, no pregnancy record, no stored prediction — and that cycle data is deleted whole the moment you switch tracking off.
| Right | How |
|---|---|
| Confirm whether we collect, share or sell your consumer health data, and access it | Profile → Data and privacy → Export my data (one JSON file), or email support@grif.fit |
| Obtain the list of third parties with whom we shared it | This page, section 5. On request we will confirm which of the two vision providers handled a given scan, where our records allow |
| Withdraw consent to collection | Profile → Consents → Health data processing → "Withdraw consent and erase data" |
| Withdraw consent to sharing | Profile → Consents → Food diary photographs → off. Further scans stop at once; cached results are deleted |
| Delete your consumer health data | Profile → Erase my data (keeps the account) or Profile → Delete account. We erase it from our systems immediately — conversations with the coach, your medication records, the lab reports with their files in storage, the cycle data and your push tokens included — and withdraw every consent; the AI providers' own copies expire within their stated retention (55 / 30 days); an encrypted nightly backup — on our server, and as an encrypted copy in a private storage bucket in the EU, both deleted after 30 days and readable only with a key we hold — may hold the erased rows for up to 30 days (Privacy Policy §8) |
| Withdraw the AI coach consent | Profile → Consents → AI coach → off, or Profile → Grif. The chat closes; conversations, memory facts, proposals awaiting your answer, health summaries, the softer-coach flag, the reminders it set, the water it logged, the record of its proactive notices and its settings are deleted; the journal of applied changes and the proposals you already answered stay; changes already applied stay until you undo them |
| Delete conversations or a memory fact without leaving the coach | Profile → Grif → «Delete all conversations» (the rolling summary is deleted with them); «What Grif knows about me» → delete a fact; «Remember conversations» off stops the summary being written or read |
| Withdraw consent to lab processing, or delete a report | Profile → Consents → Lab reports → off (uploads and manual entry stop; saved reports stay until you delete them); any report → Delete, which removes its file, its note and the default retest reminders of markers with no value left; a marker's retest reminder → «Don't remind me»; all retest reminders → Profile → Notifications → «Lab retest reminders» off |
| Turn cycle tracking off | Profile → Cycle → «Turn tracking off», or Profile → Consents → Cycle tracking → off — the same thing: all cycle data is deleted at once, with no retention period. Changing your sex in the profile does the same |
| Switch the morning journal off | Profile → Consents → Morning journal → off, or Profile → Grif → Morning journal → off — the same thing: every answer and every journal setting is deleted in the next nightly pass, the Progress patterns disappear, and the server refuses a new answer; an encrypted nightly backup may hold the deleted rows for up to 30 days (Privacy Policy §8) |
| Delete your weekly check-in answers | Erase your data or delete the account, or ask support@grif.fit — every answer is deleted and the review stops quoting them; answering is your choice each week, and an unanswered week changes nothing; a target change already applied stays until you undo it in «What Grif changed»; an encrypted nightly backup may hold the deleted rows for up to 30 days (Privacy Policy §8) |
| Delete your medication data | Profile → Consents → Medication data → off, or Profile → Erase my data / Profile → Delete account. Every course — a therapy course included — with the dose log and the side effects is deleted at once and the dose reminders are cancelled; an encrypted nightly backup may hold the deleted rows for up to 30 days (Privacy Policy §8) |
| Appeal | If we refuse a request, reply to our answer within 30 days and say you are appealing. A different person will review it and answer in writing within 45 days with the reasons. Washington residents may also contact the Washington Attorney General; other states' residents, their Attorney General |
We will not discriminate against you for exercising these rights. Requests by email are verified by asking you to write from the account's address.
| Platform | Read | Write | How the permission is asked |
|---|---|---|---|
| iOS — HealthKit | Steps, weight, body-fat %, dietary energy / protein / fat / carbohydrates, workouts, active energy burned; menstrual flow, only if you switch on reading for cycle tracking (the last 12 months when you switch it on, then new entries); sleep analysis (in-bed and asleep intervals of the last night), only if you switch on reading sleep for the morning journal | Weight; dietary energy, protein, fat, carbohydrates of a meal you confirmed; body-fat % (once released) | From Profile → Health, behind a screen that explains why; never at first launch. Menstrual flow is asked separately, from the cycle step of onboarding or Profile → Cycle |
| Android — Health Connect | READ_STEPS, READ_WEIGHT, READ_BODY_FAT, READ_EXERCISE, READ_ACTIVE_CALORIES_BURNED; READ_MENSTRUATION, only for cycle tracking and only where Health Connect is available on the device (the last 30 days — we do not ask for READ_HEALTH_DATA_HISTORY); READ_SLEEP, only for the morning journal and only after you switch its sleep reading on (the last night) | WRITE_WEIGHT, WRITE_NUTRITION (and body fat once released) | Same; Health Connect can open our rationale screen at any time |
Rules that hold on both platforms: nothing is written without your confirmation; nothing we compute (targets, programme) is ever written back; we never read back what we ourselves wrote; steps and workouts are never written by us because the phone already records them; menstrual flow and sleep are never written. Two things are stored on our server from your health store, each behind its own switch: the coach's 7-day activity totals in Privacy Policy §3, uploaded once a day and kept for 90 days, and the morning journal's sleep start and end for the night, kept with the journal record (400 days at most, deleted with the journal).
See the Privacy Policy §3 for the full table. In short: consumer health data is kept while your account exists and you have not erased it; it is deleted immediately on erasure, withdrawal of the health consent, or account deletion. Conversations with the coach: 90 days, or at once on «Delete all conversations»; the rolling summary of them: until its next weekly rewrite, deleted with the conversations, never written or read while «Remember conversations» is off; memory facts: until you delete them; health summaries for the coach: 90 days. The disordered-eating flag: 14 days after the last signal. A lab report's original file: 12 months after confirmation (7 days if never confirmed); the provider's raw transcription: 90 days; the values, including those you typed in: until you delete the report; a retest reminder: until its date passes, you clear it, or the marker's last value is deleted. The morning journal: while its consent stands and no longer than 400 days per record (a nightly job deletes older ones); answers and settings are deleted whole on withdrawal, erasure or account deletion. The weekly check-in: no longer than 400 days per record; answers deleted whole on erasure, account deletion or your request. Weekly frames: while your account and the «Weekly frames» consent stand; a deleted frame leaves our storage within 24 hours, and withdrawing the consent deletes every frame and every estimate. Body Scan estimates: while both consents stand. Cycle data: for as long as tracking is on, deleted whole when you switch it off, withdraw the consent, change your sex in the profile, erase or delete the account — no retention period. What survives is not health data: purchase records, the consent history, and append-only journals of event types. An encrypted nightly backup of the database — on our server and, as an encrypted copy, in a private storage bucket in the EU, both deleted after 30 days and readable only with a key we hold — can hold an erased row for up to 30 days (Privacy Policy §8, §9).
We will update this page whenever a category, a purpose or a recipient changes, and the in-app consent will be re-asked with a new version when the sharing terms change.
Website footer of grif.fit, the app's sign-in and paywall screens, and Profile → Legal → "Health data policy".
Terms · Privacy · Health data · Subscriptions · Third-party notices · Delete account · Home