GLP-1 App Privacy Policy Checklist: 10 Things It Should Say

What should a GLP-1 app privacy policy tell you? In plain words: what it collects, why, who else receives it (by name), whether anything is used for ads or AI training, how long it is kept, and exactly how you export or delete it. If you finish reading and still cannot answer those questions, the policy is not doing its job.

A GLP-1 tracker can end up holding a detailed picture of your life: weight, medicine and dose dates, side effects, meals, photos, maybe your mood. That deserves better than "we may share data with partners to improve our services." Here is the checklist.

Why does this matter if the app is not covered by HIPAA?

Most consumer tracking apps you download yourself are not run on behalf of a doctor or health plan, so HIPAA often does not apply (our post on HIPAA and health apps myths explains why). What does apply is the FTC Act, which bans deceptive practices. In the FTC's words, companies must not mislead consumers about what is happening with their health information.

That makes the privacy policy more than paperwork. It is the promise the company can be held to. The FTC has acted on it: in 2023 it brought its first case under the Health Breach Notification Rule against GoodRx, which it said shared users' prescription and health information with advertising platforms. The proposed order included a $1.5 million civil penalty.

The 10-point checklist

1. What exactly is collected?

A good policy lists categories you would recognize from the app itself: weight, measurements, doses, symptoms, food logs, photos, journal entries. It should also cover what is collected automatically, like device type or a notification token.

2. Why is each thing collected?

Look for a purpose next to each category. "Weight entries are stored to show your trend chart and sync it across your devices" is a purpose. "To provide and improve our services" on its own is not.

3. Who else receives it, by name?

Apps rely on other companies for hosting, payments, notifications and AI. The better policies name them and say what each one receives. "Trusted third parties" tells you nothing.

4. Is anything used for advertising, or sold?

You want a direct sentence, such as "we do not sell personal data" and "we do not use your health data for advertising." If the app does use data for marketing, the policy should say which data and how to opt out.

5. What happens to photos?

Progress photos and meal photos are sensitive. The policy should say where they are stored, whether they are sent to an outside AI service, whether that service may keep or train on them, and whether location data is stripped from them. For the meal-photo side specifically, see what happens to your meal picture in AI food scanners.

6. If there is AI, what does it see?

For AI chat or analysis features, look for which of your logs are sent, whether your name or email goes along with them, and whether that data is used to train models. Optional extras (like letting an assistant read your journal) should be off by default and easy to switch off.

7. How long is data kept?

"As long as necessary" is the classic dodge. A useful policy gives real numbers or triggers: "while your account exists," "deleted 30 days after the scan," "purchase records kept for legal reasons."

8. How do you export and delete it?

The policy should name the actual menu path or email address, not just state that you "may have rights." Both Apple and Google now require apps that let you create an account to let you start account deletion from inside the app. Our guide to exporting and deleting GLP-1 tracking data covers what to test.

9. How is it protected, and what happens after a breach?

Look for encryption in transit and at rest, access controls, and how you would be told about a breach. Under the FTC's Health Breach Notification Rule, covered health apps must notify affected people no later than 60 calendar days after discovering a breach, and the FTC says a "breach" includes unauthorized sharing, not just hacking.

10. Who to contact, and how changes are announced

A real address or email for privacy questions, and a promise to tell you about material changes rather than quietly editing the page.

Vague vs clear: how the wording compares

Vague	Clear
"We may share information with partners."	"We use [named company] for hosting and [named company] for payments. Each receives only…"
"Data is retained as long as necessary."	"Logs are kept while your account exists. Meal photos are deleted 30 days after the scan."
"We may use data to improve our services."	"We do not use your health data or photos for advertising."
"Users may request deletion."	"Delete your account in More → Account → Delete account, or email us."
"AI features use third-party technology."	"Photos you scan are sent to [named provider] to estimate the food. They are not used to train models."

The right column is not legal magic. It is just specific, which makes it testable.

Are there state laws that add extra requirements?

Some. Two examples you may run into:

• Washington's My Health My Data Act covers consumer health data outside HIPAA. It requires consent to collect and share that data, bans selling it without the person's authorization, gives people a right to have it deleted (including from backups), and requires covered businesses to link a separate consumer health data privacy policy from their homepage.
• California's CCPA gives covered businesses' customers the right to know, delete and correct personal information, and to limit use of sensitive personal information, which includes health information. Businesses must generally respond to those requests within 45 calendar days.

Whether these apply depends on where you live and the size and reach of the company, so treat them as a sign of what "good" looks like rather than a guarantee.

Where does GLPily stand?

Fair question, since we wrote this list. Our privacy policy names each company that processes data and what it receives, says we do not sell personal data or use health data or photos for advertising, states that scanned food photos are deleted 30 days after the scan, and gives the in-app path for exporting a CSV and deleting your account. Read it with this checklist in hand and judge for yourself.

If you would rather not read full policies at all, our 5-minute privacy scorecard shows how to compare two apps quickly. And if you want to push further, ask whether an app needs each piece of data in the first place: see does a GLP-1 app need your weight?

Common questions

Is a long privacy policy a bad sign?

Not necessarily. Length often comes from listing every processor and purpose, which is good. What matters is whether you can find specific answers.

What if a policy does not mention AI at all but the app has AI features?

Ask the developer before using those features. Any data sent to an outside AI service is a data flow the policy should describe.

Does "we don't sell your data" mean nobody else sees it?

No. Apps still use service providers for hosting, payments and notifications. The question is whether those companies are named and limited to doing a job for the app.

Can a company change its privacy policy after I sign up?

Yes. Good policies promise notice of material changes. It is worth re-reading after big updates, such as when an app adds AI features.