Rewrite Lifestyle
Get The App
Legal

Privacy Policy

REWRITE LIFESTYLE

PRIVACY POLICY

Version: 2.3 Effective Date: September 9, 2026
Previous Versions: 2.2 (effective August 19, 2026) · 2.1 (effective May 26, 2026) · 1.1 (effective March 5, 2026)


1. Introduction

Rewrite Lifestyle, LLC, a Nevada limited liability company ("we," "our," or "us"), operates the Rewrite Lifestyle mobile application and associated web services (collectively, the "Service"). Rewrite Lifestyle is an AI-powered food tracking and lifestyle coaching application designed for individuals pursuing nutrition, wellness, and lifestyle goals.

This Privacy Policy describes how we collect, use, disclose, and protect your personal information when you use our Service. We are committed to transparency about our data practices.

This Service is available to users in the United States, Canada, Australia, and New Zealand. If you are located outside these countries, please do not use the Service.

For Australian residents, this Privacy Policy constitutes our APP 1 privacy notice under the Privacy Act 1988 (Cth). For New Zealand residents, this Privacy Policy describes our handling of personal information in accordance with Information Privacy Principle 3 of the Privacy Act 2020.

2. Information We Collect

2.1 Information You Provide Directly

When you create an account, interact with the Service, and use our features, you may provide the following categories of information:

Category Data Elements Purpose
Account Information Name, email address, phone number, password Account creation and authentication
Wellness Profile Journey type and stage, personal conditions, goal weight, starting weight, height, sex, activity level, dietary restrictions Personalize AI coaching and nutritional guidance
Food and Nutrition Logs Meal descriptions, food photos, macro and calorie data, meal timing Track nutritional intake and provide AI-powered food analysis
Body Measurements Weight entries, body measurements (chest, waist, hips, arm, thigh, neck, abdomen, calf), progress photos Track physical progress over time
Supplement and Medication Logs Supplement names, medication names, dosage tracking, adherence records Track supplement and medication adherence
Mood and Wellness Logs Emotional state ratings, food noise levels, behavioral reflections, location at time of entry, bowel movement logs Track emotional and physical well-being and identify patterns
Movement Logs Activity type, duration, intensity Track physical activity
AI Conversations Messages you send to the AI coach, questions, goals discussed Provide personalized AI coaching responses
Questionnaire Responses Answers to onboarding and periodic lifestyle questionnaires, including date of birth, occupation, surgery history, medications, GLP-1 use, allergies, eating triggers, and mindset markers (freeform and structured) Tailor the Service to your specific needs
Payment Information Email address and payment card details (collected by Stripe on web checkout) or App Store / Google Play purchase records Process subscription payments
Shipping Information Recipient name and postal address Fulfil delivery of a promotional item you have requested. Collected only when you request such an item, never at signup, and deleted after the item has been delivered

2.2 Information Collected Automatically

Location Data. When you grant location permission, the Service collects and stores precise GPS coordinates (latitude and longitude to sub-meter precision). Specifically:

  • Each location update is stored as a record in your location history, including coordinates, accuracy, and a location name when available.
  • Your first location update is used to establish your home coordinates on your profile. This is used as a reference point for travel detection.
  • Each subsequent location update calculates the distance from your stored home coordinates. If you are more than 50 miles from home, your profile is flagged as traveling. This travel status persists between sessions.
  • Your travel status is shared with our AI coaching system to adjust recommendations (for example, suggesting travel-friendly meal options when you are away from home).
  • Mood and wellness log entries also capture your location at the time of each entry, independent of the location history described above.

You can control location tracking through the "Location & Travel Tracking" toggle in your app settings. When this toggle is off, we will stop collecting new location data, stop sharing travel context with the AI system, and clear your current travel status. Previously collected location data will be retained according to the retention schedule in Section 9 unless you request deletion.

Device and Usage Data. We automatically collect device type, operating system version, app version, session duration, feature usage patterns, IP address, user agent string, and error logs. This data is used to maintain and improve the Service, to meet our security and audit-logging obligations, and to investigate suspected misuse or unauthorized access.

Push Notification Identifiers. If you grant push-notification permission, your device's push token is registered with our notification service provider, OneSignal, and is associated with your Rewrite Lifestyle user identifier so that we can deliver coaching reminders, message notifications, and service updates to your device.

2.3 Information from Third Parties and Connected Devices

Coach Notes. If you are assigned a coach through Bariatric Rewrite's coaching program, your coach may record observations about your progress, eating behaviors, and wellness journey. These notes are used to personalize your AI coaching experience. Coach notes may be processed by our AI system to provide you with more relevant and personalized responses.

Apple Health and Google Health Connect Integrations. With your explicit, on-device permission, the Service may read health and activity data that your other connected devices and applications have written to Apple Health (HealthKit) on iOS or Google Health Connect on Android. The categories of data that may be read, only after you have granted permission for each category, include:

  • Step counts and distance
  • Active and resting energy burned
  • Sleep duration, stages, and quality
  • Heart rate and heart rate variability
  • Body composition (body fat percentage, lean body mass)
  • Body mass index (BMI)
  • Blood glucose (where written to the platform by a connected device such as a continuous glucose monitor)
  • Blood pressure (where written to the platform by a connected device)
  • Weight and waist circumference

The Service does not OAuth directly into device manufacturer services (such as Fitbit, Oura, Garmin, Whoop, Withings, or Dexcom). All wearable data is read on-device from Apple Health or Google Health Connect, batched, and posted to our server only when you have granted the corresponding permission in your device's operating-system settings and in our app. You may revoke these permissions at any time through your device settings or via the app's health-integration controls, and you may delete any synced health data through your data-export and deletion controls.

For Australian residents, the data described in this Section 2.3 constitutes "sensitive information" (and specifically "health information") under section 6 of the Privacy Act 1988 (Cth). See Section 17.3 for our APP 3 consent statement. For New Zealand residents, this data is "health information" under the Privacy Act 2020 and is held subject to the Information Privacy Principles.

2A. Coaching Program Participants — Data Sharing with Bariatric Rewrite LLC

Some users of the Service are also enrolled in coaching programs operated by Bariatric Rewrite LLC ("Bariatric Rewrite"), an affiliated entity. If you are a Bariatric Rewrite coaching client, this section describes how your Rewrite Lifestyle data is shared with your coach.

What Your Coach Can See. During the term of your coaching program, your assigned Bariatric Rewrite coach has access to a coaching dashboard within the Service that displays your:

  • Food and nutrition logs (meals, macros, calorie data)
  • Weight entries and body measurements
  • Supplement and medication adherence records
  • Mood and wellness log entries
  • Progress photos
  • AI coaching conversation summaries
  • Questionnaire responses
  • Where you have granted the relevant permissions, synced data from your Apple Health or Google Health Connect integrations

Your coach uses this information to provide personalized coaching guidance, monitor your progress, and coordinate between human coaching and AI coaching features.

Legal Basis and Consent. Coach access to your data requires your affirmative consent, which is obtained separately from your general consent to the Service's Privacy Policy and Terms. During onboarding, or when you are linked to a coaching program, you will be asked to specifically consent to sharing your Rewrite Lifestyle data with your assigned Bariatric Rewrite coach.

You may withdraw your consent to coach data access at any time through the app settings or by contacting us at support@rewritelifestyle.ai. Withdrawing consent will revoke your coach's dashboard access to your data but will not affect your ability to use the Service independently.

Duration and Scope of Access. Coach access is limited to the duration of your active coaching program with Bariatric Rewrite. When your coaching program ends (whether by completion, cancellation, or expiration), your coach's access to your data through the dashboard is revoked. Bariatric Rewrite coaches are bound by their own professional confidentiality obligations and Bariatric Rewrite's privacy practices regarding any data viewed during the coaching period.

Coach Notes. Your coach may record notes about your progress, eating behaviors, and wellness journey within the coaching dashboard. These coach notes become part of your data within the Service and are used to personalize your AI coaching experience. Coach notes may be sent to OpenAI to improve the relevance of AI-generated coaching responses, as described in Section 5.1.

3. How We Use Your Information

We use your information for the following purposes:

  • Provide, maintain, and improve the Service, including AI-powered food tracking, coaching, and personalization.
  • Process your subscription and manage your account.
  • Generate AI coaching responses tailored to your wellness profile, dietary history, and goals.
  • Detect travel status and adjust AI recommendations accordingly.
  • Track supplement and medication adherence patterns.
  • Analyze mood and wellness trends to provide behavioral insights.
  • Communicate with you about your account, the Service, and updates to this policy.
  • Send push notifications, in-app messages, transactional emails, and SMS authentication codes via our communication service providers.
  • Improve the quality of AI coaching responses using anonymized, aggregated patterns from user interactions. Individual user data is never shared with other users. Aggregated patterns (such as common nutritional trends or recovery milestones) are used internally to improve the AI's general knowledge base.
  • Share your tracking data with your assigned Bariatric Rewrite coach if you are enrolled in a coaching program and have provided separate consent (see Section 2A).
  • Detect, investigate, and prevent fraud, security incidents, and breaches of these terms.
  • Comply with legal obligations and enforce our Terms & Conditions.

4. Sensitive Personal Information

Under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), certain categories of information we collect are classified as "sensitive personal information." These include:

  • Precise geolocation data (your GPS coordinates and location history)
  • Health information (surgery type and date, health conditions, body measurements, weight data, supplement and medication logs, and any wearable data synced through Apple Health or Google Health Connect)
  • Emotional and mental wellness data (mood logs, food noise ratings, behavioral reflections)

We collect and use sensitive personal information solely to provide and improve the Service as described in this policy. We do not use or disclose sensitive personal information for purposes beyond those permitted under the CCPA/CPRA.

Your Right to Limit Use. You have the right to limit our use of your sensitive personal information. You can exercise this right through the "Privacy Settings" section of the app, which includes toggles for Location & Travel Tracking and AI Data Processing preferences. You may also contact us at support@rewritelifestyle.ai to request limitations on how your sensitive personal information is used.

5. AI-Powered Features and Automated Decision-Making

5.1 How Our AI Features Work

The Service uses artificial intelligence to provide personalized food tracking, nutritional analysis, and lifestyle coaching. When you interact with AI features, the following data is sent to our AI service provider, OpenAI (operating in the United States):

  • Your first name and a numeric user identifier
  • Your wellness profile, including journey type, surgery type and date, surgery stage, weeks post-op, personal conditions, dietary restrictions, and activity level
  • Your current weight, goal weight, starting weight, recent body measurements, and macro intake data
  • Recent food log entries and meal timing patterns
  • Your conversation history with the AI coach
  • Food photos you upload for analysis (processed by GPT-4o vision)
  • Mood and wellness log entries (mood ratings, food noise levels, behavioral reflections)
  • Your travel status (whether you are currently away from home)
  • Coach notes about your progress (if you are a coaching program participant)
  • Where you have synced wearable data, summary metrics derived from that data (such as average steps, average sleep duration, or recent heart-rate trends), but never raw waveforms or device-identifying data

OpenAI processes this data solely to generate responses within the Service. OpenAI's data processing agreement with us prohibits OpenAI from using your data to train its models or for any purpose other than providing the Service.

If you opt out of AI profiling through the "AI Data Processing" toggle in your Privacy Settings, only your first name and user identifier are sent to OpenAI, and AI coaching responses are not personalized to your wellness profile or behavioral history. Core tracking features (food logging, weight logging, AI photo analysis of an isolated food image) remain available.

In addition, Bariatric Rewrite LLC, an affiliated entity, operates backend data-processing systems hosted on Amazon Web Services (US) — running on Amazon EC2 with scope-based API authentication — that support coaching intelligence and AI quality improvement. For general users, only anonymized and aggregated usage patterns are processed by these systems, with all personally identifiable information removed before processing. For coaching program participants who have provided separate consent under Section 2A, Bariatric Rewrite's systems may also process per-user data (including wellness profile, food logs, weight data, and AI coaching summaries) to provide coordinated coaching support. Per-user data access is gated by your coaching consent status, protected by scope-based access controls and API key authentication, and all access is audit-logged. These systems are operated solely by Rewrite Lifestyle and Bariatric Rewrite personnel and are not exposed to any external third party.

5.2 Disclosure of AI Interaction (Colorado AI Act)

In accordance with the Colorado Artificial Intelligence Act (SB 24-205), we disclose that the coaching, food analysis, and personalized recommendations provided through this Service are generated by an artificial intelligence system. You are interacting with AI, not a human, when you use the coaching features. You have the right to request information about how our AI system generates recommendations and to request human review of any AI-generated guidance.

5.3 Automated Decision-Making Technology (ADMT) Rights

Under the CCPA's regulations on automated decision-making technology (effective January 1, 2026), you have the right to:

  • Receive notice before AI-based profiling is used to make recommendations that affect your dietary or wellness decisions.
  • Opt out of AI-based profiling through the "AI Data Processing" toggle in your app settings.
  • Request information about the logic involved in automated decision-making that affects you.

When you opt out of AI profiling, the Service will still function but personalized AI coaching features will be limited. You can manage your ADMT preferences in the "Privacy Settings" section of the app or by contacting us at support@rewritelifestyle.ai.

6. Service Providers and Data Sharing

We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising. We share personal information only with the following categories of service providers, each bound by contractual obligations (data processing agreements) to use your data solely for providing services to us:

Provider Data Shared Purpose Location Safeguards
OpenAI First name, user ID, wellness profile, conversation history, food photos, mood logs, travel status, coach notes AI coaching and food analysis United States Data processing agreement; no model training on user data; retention limited to OpenAI's 30-day abuse-monitoring window
FatSecret Food search queries (text only, no personal identifiers) Food database and nutritional information United States API terms of service
Amazon Web Services (S3 + CloudFront + EC2 + RDS) Progress photos, profile images, all server-side personal information Cloud storage, content delivery, application hosting, and database hosting United States AWS Data Processing Addendum; encryption in transit (TLS); server-side encryption at rest for S3 and RDS; signed URL delivery for media
Stripe Email address, payment card details (web checkout only) Payment processing for web subscriptions United States PCI DSS compliant; Stripe privacy policy governs payment data
RevenueCat User ID, subscription status, purchase receipts, platform (iOS/Android) Subscription entitlement management and receipt validation across Apple App Store and Google Play United States SOC 2 Type II; Data Processing Addendum; no access to payment card details
AppsFlyer Device and advertising identifiers, app install and in-app event data, IP address Mobile app install attribution and marketing analytics United States AppsFlyer Data Processing Agreement; no data is forwarded to third-party advertising partners
Google LLC (Google Analytics for Firebase) Device and app identifiers, usage and engagement event data Product analytics United States Google Firebase Data Processing Terms
OneSignal User ID, device push token, notification content, notification preferences Push notification delivery and engagement analytics United States Data Protection Addendum incorporating GDPR / CCPA terms; SCC-equivalent cross-border safeguards
Twilio Phone number, one-time SMS authentication codes SMS delivery for account verification and authentication United States Twilio Master Services Agreement; data processing addendum
Sentry Error stack traces, request metadata (URL, status code, anonymized session ID, user agent) with credentials, tokens, payment fields and other sensitive payload contents redacted before transmission Server-side error monitoring and reliability engineering United States Sentry Data Processing Addendum; configurable data residency; aggressive PII redaction at the SDK layer
GoHighLevel (HighLevel, Inc.) Email address, name, phone number, subscription and coaching-program lifecycle tags Customer relationship management for the Rewrite Lifestyle and Bariatric Rewrite businesses United States HighLevel Data Processing Agreement
Bariatric Rewrite LLC (Coaching) Food logs, weight, measurements, supplements, mood logs, progress photos, AI conversation summaries, questionnaire responses (coaching clients only) Human coaching for enrolled coaching program participants United States Separate user consent; access limited to coaching program duration; coach confidentiality obligations
Bariatric Rewrite LLC (Backend Data Processing — "Lucille" coaching intelligence platform) Anonymized, aggregated usage patterns; for coaching program participants with consent (see Section 2A): wellness profile, food logs, weight data, AI coaching summaries, and activity patterns AI coaching quality improvement; coaching intelligence and knowledge base management; per-user coaching support for enrolled participants (with consent) United States (AWS EC2) PII stripping on aggregate data; per-user data gated by coaching consent (Section 2A); scope-based access controls; API key authentication; access audit-logged

Apple Inc. (HealthKit) and Google LLC (Health Connect) are not sub-processors of Rewrite Lifestyle. They are on-device data sources from which the Service reads, only with your explicit operating-system-level permission. Their handling of your data on your device is governed by Apple's and Google's own privacy policies.

We maintain a current list of sub-processors and will update this Privacy Policy and notify users in accordance with Section 13 before engaging any new sub-processor that materially changes our data flows.

We may also disclose personal information when required by law, to enforce our Terms & Conditions, to protect the rights or safety of our users or others, or in connection with a merger, acquisition, or sale of assets (with notice to you).

7. Nevada Consumer Health Data Privacy (NRS 603A.430–.540)

The following information constitutes "consumer health data" under Nevada law: food logs, macro and calorie tracking, weight and body measurement data, health conditions, surgery type and date, supplement and medication logs, mood and wellness logs, progress photos, wearable data synced from Apple Health or Google Health Connect, and AI coaching conversation history related to health topics.

Affirmative Consent. We collect consumer health data only after you provide affirmative, voluntary consent. At registration, you are presented with a dedicated consent acknowledgment for our collection and use of consumer health data, separate from your general acceptance of our Terms & Conditions. You may withdraw consent at any time through your account settings or by contacting us. Withdrawal of consent will limit certain features of the Service but will not affect data collected before the withdrawal.

Your Rights. Under Nevada law, you have the right to:

  • Access the consumer health data we have collected about you.
  • Request deletion of your consumer health data.
  • Know whether your consumer health data has been shared and with whom.

No Sale of Health Data. We do not sell consumer health data. We do not share consumer health data for advertising purposes. Consumer health data is shared only with the service providers listed in Section 6, solely for the purpose of providing the Service.

Security. We maintain reasonable security measures appropriate to the sensitivity of consumer health data, as described in Section 11.

8. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:

  • Right to Know: You may request a copy of the personal information we have collected about you in the preceding 12 months, including the categories and specific pieces of information, the sources, the business purposes, and the categories of third parties with whom we shared it.
  • Right to Delete: You may request that we delete your personal information. See Section 10 for our account deletion process.
  • Right to Correct: You may request correction of inaccurate personal information.
  • Right to Opt Out of Sale/Sharing: We do not sell your personal information or share it for cross-context behavioral advertising.
  • Right to Limit Use of Sensitive Personal Information: You may limit our use of sensitive personal information (including precise geolocation, health data, and emotional wellness data) to what is necessary to provide the Service. Use the toggles in the Privacy Settings section of the app or contact us.
  • Right to Non-Discrimination: We will not discriminate against you for exercising any of these rights.

To exercise any of these rights, contact us at support@rewritelifestyle.ai or use the in-app Privacy Settings. We will verify your identity before processing your request and respond within 45 days as required by law.

9. Data Retention

We retain your personal information for as long as your account is active and as needed to provide the Service. Specific retention periods by data category:

Data Category Retention Period Notes
Account information Duration of account + 30-day grace period after deletion request Permanently deleted after the 30-day grace period
Lifestyle, nutrition and wellness data (food logs, weight, measurements, supplements, mood, wearable data, personal conditions) Duration of account + 30-day grace period Fully deleted upon account deletion
Location history Duration of account + 30-day grace period Fully deleted upon account deletion; you may also disable location collection at any time through the "Location & Travel Tracking" toggle
AI conversation history Duration of account + 30-day grace period Fully deleted upon account deletion
Progress photos Duration of account + 30-day grace period Deleted from cloud storage (AWS S3) upon account deletion
Shipping information (recipient name and postal address) Deleted after the promotional item has been delivered Collected only on request for a promotional item; not retained for any other purpose
Payment and billing records As required by law (typically 7 years) Tax and accounting compliance
Audit and activity logs Duration of account + 30-day grace period, after which identifying fields are anonymized Anonymized records may be retained for up to 7 years for compliance, security, and fraud-prevention purposes
AI token-usage statistics Indefinite, in anonymized form only User identifier is removed upon account deletion; retained for cost tracking and capacity planning

10. Account Deletion

You may request deletion of your account and all associated personal information at any time through the account settings in the app or by contacting us at support@rewritelifestyle.ai.

When you request account deletion:

  • Your account is immediately deactivated and you will no longer be able to log in.
  • Your data is held in a soft-deleted state for a 30-day grace period, during which you may contact us to recover the account.
  • After the 30-day grace period, we permanently delete all personal information associated with your account, including your lifestyle and nutrition data, food logs, location history, AI conversation history, mood logs, supplement logs, body measurements, wearable health data, and progress photos.
  • Progress photos are permanently removed from our cloud storage (AWS S3).
  • Audit logs are anonymized (your identity removed) but retained as described in Section 9.
  • AI token-usage statistics are anonymized (your identity removed) but retained for cost tracking.
  • Inputs and outputs sent to OpenAI are subject to OpenAI's 30-day abuse-monitoring retention period, after which they are deleted from OpenAI's systems automatically. OpenAI does not retain or build per-user profiles from your data and does not use your data to train its models.
  • Payment and billing records will be retained as required by law (typically 7 years).
  • If you are a Bariatric Rewrite coaching client, records held by Bariatric Rewrite in its capacity as your coaching provider (which is a separate legal entity from Rewrite Lifestyle) are governed by Bariatric Rewrite's own retention practices and are not deleted by the Rewrite Lifestyle account deletion process. You may submit a separate deletion request to Bariatric Rewrite by contacting support@rewritelifestyle.ai with the subject line "Bariatric Rewrite Coaching Records Deletion."

11. Data Security

We implement reasonable technical and organizational security measures designed to protect your personal information, including:

  • Encryption in transit using TLS 1.2 or higher for all communications between the mobile application, our APIs, and our service providers.
  • Encryption at rest for our primary database (Amazon RDS with AWS-managed encryption) and our object storage (Amazon S3 with server-side encryption).
  • Signed URL delivery for progress photos and profile images, time-limited and tied to your authenticated session.
  • Authentication using industry-standard practices: passwords are hashed with bcrypt; sessions are issued as signed JSON Web Tokens; SMS one-time codes via Twilio for phone verification.
  • Rate limiting on authentication endpoints to prevent credential-stuffing and brute-force attacks, with automatic temporary blocks after repeated failures.
  • Role-based access controls and principle-of-least-privilege for all internal staff. Production access to user data is restricted to a small number of named personnel and is logged.
  • Audit logging on all data-modifying API endpoints, including the actor, the action, the affected user, the time, the requesting IP address, and the user agent.
  • Sensitive data redaction in our error-monitoring pipeline: credentials, session tokens, payment details, and other sensitive request body or header fields are redacted by the SDK before any error report is transmitted to our error monitoring provider.
  • Coaching dashboard access is gated by per-user consent, scope-based authorization, API key authentication, and audit logging, with all access recorded.
  • Documented breach response. We maintain a written Data Breach Response & Notification Procedure that defines our incident-response team, harm-assessment process, regulator notification timelines for each jurisdiction in which we operate (including the OAIC for Australian residents and the Office of the Privacy Commissioner of New Zealand for New Zealand residents), and our user-notification template. The procedure is owned by our Privacy Officer and reviewed at least annually.
  • Regular review of our security controls in line with industry standards.

However, no method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security.

12. Age Restriction

The Service is intended only for individuals aged 18 years or older. We do not knowingly collect personal information from individuals under 18.

We require a self-declaration of age at registration, and collect date of birth in onboarding. If we become aware that we have collected information from a person under 18, we will promptly delete that information. If you believe a person under 18 has created an account, please contact us immediately at support@rewritelifestyle.ai.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the app and, where required by law, request your renewed consent before continuing to process your data under the updated terms. We will provide at least 30 days' notice before material changes take effect. Your continued use of the Service after the effective date of a revised Privacy Policy constitutes acceptance of the revised terms.

14. Contact Us

If you have questions about this Privacy Policy, wish to exercise any of your privacy rights, or have a concern about our data practices, please contact us at:

Rewrite Lifestyle, LLC 2935 Ainslie Lake Ave, Henderson, NV 89044 Email: support@rewritelifestyle.ai

Privacy Officer: Daniel Green — operations@rewritelifestyle.ai

For California residents: You may also designate an authorized agent to submit requests on your behalf. Authorized agents must provide written proof of authorization.

15. Canadian Privacy Rights

This section applies to residents of Canada and supplements the Privacy Policy above. In the event of any conflict between this section and the rest of this Privacy Policy, this section governs for Canadian residents.

15.1 Cross-Border Data Transfers

Rewrite Lifestyle is operated from the United States. Your personal information is collected, processed, and stored on servers located in the United States. By using the Service, you acknowledge that your personal information will be transferred to and processed in the United States, which may have privacy laws that differ from those of your province or territory. We take reasonable steps to ensure your information receives an equivalent level of protection through contractual data processing agreements with our service providers.

15.2 Your Rights Under PIPEDA

Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation, Canadian residents have the following rights:

  • Access: You may request access to the personal information we hold about you, including how it has been used and disclosed.
  • Correction: You may request correction of personal information that is inaccurate or incomplete.
  • Withdrawal of consent: You may withdraw consent to the collection, use, or disclosure of your personal information, subject to legal or contractual restrictions. Withdrawal may affect our ability to provide certain features of the Service.
  • Complaints: You have the right to lodge a complaint with the Office of the Privacy Commissioner of Canada at www.priv.gc.ca.

15.3 Additional Rights for Quebec Residents (Law 25)

If you are a resident of Quebec, you have additional rights under the Act Respecting the Protection of Personal Information in the Private Sector (Law 25):

  • Data portability: You may request a copy of your personal information in a structured, commonly used technological format for transfer to a third party.
  • De-indexation: Where applicable, you may request that personal information about you be de-indexed from search results or that its dissemination cease where it is causing you harm.
  • Profiling: We use your personal information to personalize your coaching experience, which constitutes profiling under Law 25. You may withdraw consent to profiling at any time. We will cease personalizing your experience based on such data upon withdrawal.
  • Automated decisions: Where we use automated processes that produce decisions affecting you, you have the right to be informed and to request human review.

15.4 Designated Privacy Officer

We have designated a Privacy Officer responsible for overseeing compliance with this section and applicable Canadian privacy legislation. To exercise any of the rights described above, or with questions about our Canadian privacy practices, please contact: support@rewritelifestyle.ai with the subject line "Canadian Privacy Request." We will acknowledge your request within 10 business days and respond fully within 30 days.

16. Droits en matière de confidentialité pour les résidents canadiens

Pour les résidents du Québec, en cas de conflit entre la version anglaise et la version française de la présente section, la version française prévaut. Les autres sections de la présente Politique de confidentialité ne sont publiées qu'en anglais.

La présente section s'applique aux résidents du Canada et complète la Politique de confidentialité ci-dessus. En cas de conflit entre la présente section et le reste de la Politique de confidentialité, la présente section s'applique aux résidents canadiens.

16.1 Transferts transfrontaliers de données

Rewrite Lifestyle est exploité depuis les États-Unis. Vos renseignements personnels sont collectés, traités et stockés sur des serveurs situés aux États-Unis. En utilisant le Service, vous reconnaissez que vos renseignements personnels seront transférés et traités aux États-Unis, dont les lois sur la protection de la vie privée peuvent différer de celles de votre province ou territoire. Nous prenons des mesures raisonnables pour assurer un niveau de protection équivalent.

16.2 Vos droits en vertu de la LPRPDE

En vertu de la Loi sur la protection des renseignements personnels et les documents électroniques (LPRPDE) du Canada et de la législation provinciale applicable, les résidents canadiens disposent des droits suivants :

  • Accès : Vous pouvez demander l'accès aux renseignements personnels que nous détenons à votre sujet, notamment la façon dont ils ont été utilisés et divulgués.
  • Correction : Vous pouvez demander la correction de renseignements personnels inexacts ou incomplets.
  • Retrait du consentement : Vous pouvez retirer votre consentement à la collecte, à l'utilisation ou à la divulgation de vos renseignements personnels, sous réserve de restrictions légales ou contractuelles. Ce retrait peut affecter notre capacité à fournir certaines fonctionnalités du Service.
  • Plaintes : Vous avez le droit de déposer une plainte auprès du Commissariat à la protection de la vie privée du Canada à www.priv.gc.ca.

16.3 Droits supplémentaires pour les résidents du Québec (Loi 25)

Si vous êtes résident du Québec, vous disposez de droits supplémentaires en vertu de la Loi sur la protection des renseignements personnels dans le secteur privé (Loi 25) :

  • Portabilité des données : Vous pouvez demander une copie de vos renseignements personnels dans un format technologique structuré et couramment utilisé pour transfert à un tiers.
  • Désindexation : Le cas échéant, vous pouvez demander que vos renseignements personnels soient désindexés des résultats de recherche ou que leur diffusion cesse lorsqu'ils vous causent un préjudice.
  • Profilage : Nous utilisons vos renseignements personnels pour personnaliser votre expérience de coaching, ce qui constitue un profilage au sens de la Loi 25. Vous pouvez retirer votre consentement au profilage en tout temps. Nous cesserons de personnaliser votre expérience à partir de ces données dès le retrait de votre consentement.
  • Décisions automatisées : Lorsque nous utilisons des processus automatisés produisant des décisions vous concernant, vous avez le droit d'en être informé et de demander un examen humain.

16.4 Responsable de la protection des renseignements personnels

Nous avons désigné un responsable de la protection des renseignements personnels chargé de superviser la conformité à la présente section et aux lois canadiennes applicables. Pour exercer l'un des droits décrits ci-dessus ou pour toute question relative à nos pratiques en matière de confidentialité au Canada, veuillez nous contacter à : support@rewritelifestyle.ai en indiquant « Demande de confidentialité canadienne » en objet. Nous accuserons réception de votre demande dans un délai de 10 jours ouvrables et y répondrons dans un délai de 30 jours.

17. Australian Privacy Rights

This section applies to residents of Australia and supplements the Privacy Policy above. In the event of any conflict between this section and the rest of this Privacy Policy, this section governs for Australian residents. For the purposes of the Privacy Act 1988 (Cth), this Privacy Policy is our APP 1 privacy policy in respect of personal information of individuals in Australia.

17.1 Cross-Border Data Transfers (APP 8)

Rewrite Lifestyle is operated from the United States. Your personal information is collected, processed, and stored on servers located in the United States. Our service providers also process data outside Australia, predominantly in the United States. These include:

  • OpenAI (United States) — AI coaching and analysis
  • Amazon Web Services (United States) — application hosting, database, and media storage
  • Stripe (United States) — payment processing for web purchases
  • RevenueCat (United States) — subscription entitlement management
  • OneSignal (United States) — push notifications
  • Twilio (United States) — SMS authentication
  • Sentry (United States, with optional EU residency) — error monitoring
  • HighLevel, Inc. (United States) — CRM
  • FatSecret (United States) — food database lookup
  • Bariatric Rewrite LLC (United States) — coaching dashboard and coaching intelligence platform

Before disclosing your personal information to an overseas recipient, we take reasonable steps to ensure that the overseas recipient does not breach the Australian Privacy Principles (APPs) in relation to your information, in accordance with APP 8.1. These steps include written data processing agreements with each of the providers listed above that require them to handle your personal information in a manner consistent with the APPs, with restrictions on secondary use, with security obligations, and with audit and breach-notification commitments. You acknowledge that, by consenting to this Privacy Policy at registration, you provide informed consent for the purposes of APP 8.2(b) to the cross-border disclosure of your personal information to the recipients listed above.

17.2 Your Rights and Our Commitments

Under Australia's Privacy Act 1988 and the Australian Privacy Principles (APPs), you have the following statutory rights. In addition, Rewrite Lifestyle voluntarily provides deletion and data export capabilities as described below.

  • Access: You may request access to the personal information we hold about you (APP 12). We will respond within 30 days.
  • Correction: You may request correction of personal information that is inaccurate, out of date, incomplete, irrelevant, or misleading (APP 13).
  • Account Deletion: While the Privacy Act 1988 does not provide a standalone right to erasure, Rewrite Lifestyle offers you the ability to delete your account and associated personal information at any time through the app or by contacting us. Upon deletion, your data is soft-deleted with a 30-day grace period, after which it is permanently purged from our systems.
  • Data Export: While the Privacy Act 1988 does not provide a standalone data portability right, Rewrite Lifestyle offers you the ability to export your personal information in a structured, machine-readable format through the data export feature in your account settings or by contacting us.
  • Anonymity and Pseudonymity (APP 2): Because the Service is a personalized coaching application, the use of a pseudonym is not practicable; you must register with your real identifying information.
  • Complaints: If you believe we have breached the APPs, you may lodge a complaint with us at operations@rewritelifestyle.ai. We will acknowledge your complaint within 10 business days and respond fully within 30 days. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

17.3 Sensitive Information (APP 3)

Under section 6 of the Privacy Act 1988, "sensitive information" includes health information. The following data we collect constitutes health information, and therefore sensitive information, under Australian law:

  • Surgery type, surgery date, weeks post-op
  • Health conditions and personal medical history captured at onboarding
  • Body measurements (chest, waist, hips, arm, thigh, neck, abdomen, calf), weight, and weight history
  • Supplement and medication adherence logs
  • Mood, food noise, and behavioral reflection logs
  • Bowel movement logs
  • Wearable and connected-device data synced from Apple Health or Google Health Connect, including (where you have granted permission) heart rate, sleep, blood glucose, blood pressure, body composition, and activity metrics
  • AI coaching conversation history relating to your health

We collect this sensitive information only with your express consent for the purposes of APP 3.3. During account registration, you are presented with a dedicated consent acknowledgment to the collection and use of your health and wellness data, separate from your general acceptance of this Privacy Policy. Your acceptance of this Privacy Policy at registration, which describes in detail the categories of sensitive information collected and the purposes for which we collect them, together with the dedicated consent acknowledgment, constitutes your express consent for the purposes of APP 3.3. You may withdraw consent at any time through the app settings, though this may limit certain features of the Service.

We use sensitive information only for the purposes set out in Section 3 of this Policy and only as reasonably necessary for those purposes (APP 3.2).

17.4 Automated Decision-Making

In accordance with the Privacy and Other Legislation Amendment Act 2024, we disclose that the Service uses automated decision-making to generate AI coaching responses, nutritional analysis, and personalized recommendations. These automated decisions are based on the personal information you provide (including your wellness profile, food logs, and conversation history) and are processed by our AI service provider, OpenAI.

You have the right to request information about how automated decisions are made and to request human review of any AI-generated guidance. You may opt out of automated decision-making through the "AI Data Processing" toggle in your Privacy Settings. Contact us at support@rewritelifestyle.ai for more information.

17.5 Statutory Tort for Serious Invasions of Privacy

Under the Privacy and Other Legislation Amendment Act 2024, individuals in Australia have the right to bring court proceedings for serious invasions of privacy. We are committed to protecting your personal information and take reasonable steps to prevent unauthorized access, use, or disclosure. If you believe your privacy has been seriously invaded in connection with the Service, you may contact us at operations@rewritelifestyle.ai or exercise your rights under the Act.

17.6 Designated Privacy Officer

We have designated a Privacy Officer responsible for overseeing compliance with this section and applicable Australian privacy legislation.

Privacy Officer: Daniel Green Email: operations@rewritelifestyle.ai Subject line for Australian requests: "Australian Privacy Request"

We will acknowledge your request within 10 business days and respond fully within 30 days.

17.7 Notifiable Data Breaches

Under Part IIIC of the Privacy Act 1988 (Notifiable Data Breaches scheme), if we experience an eligible data breach involving your personal information that is likely to result in serious harm, we will notify both you and the Office of the Australian Information Commissioner (OAIC) as soon as practicable, and in any event within 72 hours of becoming aware of reasonable grounds to believe the breach has occurred.

Our written Data Breach Response & Notification Procedure sets out our incident-response team, our harm-assessment process, the regulators we notify (including the OAIC), and the information we include in user and regulator notifications. The procedure is owned by our Privacy Officer and is reviewed at least annually. Our notification will include a description of the breach, the kinds of information involved, the steps we have taken in response, and the recommended steps you should take in response.

18. New Zealand Privacy Rights

This section applies to residents of New Zealand and supplements the Privacy Policy above. In the event of any conflict between this section and the rest of this Privacy Policy, this section governs for New Zealand residents.

18.1 Cross-Border Data Transfers (IPP 12)

Your personal information is transferred to and processed in the United States, which may have different privacy laws from those of New Zealand. In accordance with Information Privacy Principle 12 (IPP 12) of the Privacy Act 2020, we ensure that any overseas recipients of your personal information are subject to comparable privacy safeguards to those available under New Zealand law. We achieve this through written data processing agreements with each of the providers listed in Section 17.1, which require those providers to handle your personal information in a manner consistent with the New Zealand Information Privacy Principles.

18.2 Your Rights Under the Privacy Act 2020

Under New Zealand's Privacy Act 2020 and the Information Privacy Principles (IPPs), you have the following rights:

  • Access: You may request access to the personal information we hold about you (IPP 6). We will respond within 20 working days.
  • Correction: You may request correction of personal information that is inaccurate, misleading, or incomplete (IPP 7).
  • Deletion: You may request deletion of your personal information where there is no reason for its continued retention.
  • Data Export: You may request an export of your personal information in a structured, machine-readable format through the data export feature or by contacting us.
  • Complaints: You have the right to lodge a complaint with the Office of the Privacy Commissioner of New Zealand at www.privacy.org.nz.

18.3 Health Information

Health information collected by the Service is also subject to the Health Information Privacy Code 2020. This includes wearable data synced from Apple Health or Google Health Connect (with your permission), surgery type and date, health conditions, body measurements, weight history, supplement and medication adherence logs, mood and wellness logs, and bowel movement logs.

18.4 Notifiable Privacy Breaches

Under Part 6 of the Privacy Act 2020, if we experience a privacy breach that is likely to cause serious harm to any affected individual, we will notify both the Office of the Privacy Commissioner and the affected individuals as soon as practicable. Our internal breach assessment, notification, and remediation process is set out in our written Data Breach Response & Notification Procedure, which is owned by our Privacy Officer and reviewed at least annually.

18.5 Designated Privacy Officer

We have designated a Privacy Officer responsible for overseeing compliance with this section and applicable New Zealand privacy legislation.

Privacy Officer: Daniel Green Email: operations@rewritelifestyle.ai Subject line for New Zealand requests: "New Zealand Privacy Request"

We will acknowledge your request within 10 business days and respond fully within 20 working days.

Stop Guessing.
Start Rewriting.

Track food, mood, water, supplements, progress and patterns in one bariatric lifestyle app built for real life after surgery and GLP-1s.

Download on the App Store Get it on Google Play
Rewrite Cookbook screen showing community recipes including Squash Stir Fry
ASMBS Membership
ASMI
Our Membership
Find Out More
Bariatric Coaching Our Programs Testimonials Resources
Info
FAQs Contact Us Support Terms Of Use Privacy Policy Log In
Social
Copyright 2026 Bariatric Rewrite. All Rights Reserved.