Loopa Consumer Health Data Privacy Policy
Last updated: 2m ago
Loopa Consumer Health Data Privacy Policy
Effective: October 5, 2026 · Version 1.4
What changed in 1.4: blood ketone readings from Loopa Premium's Metabolic Insights, and what is worked out from them, are listed in §1.
This is a separate document, and it is separate on purpose. Washington's My Health My Data Act requires a consumer health data privacy policy that stands on its own, reached by its own link, and it requires that the document contain nothing beyond what the consumer health data laws ask for. So this page covers consumer health data and only consumer health data. Everything else about Loopa is in the Loopa Privacy Policy, which is the longer document and the one to read for anything not covered here.
It applies to you if you live in Washington, Nevada or Connecticut. Nothing stops anyone else reading it, and nothing in it is less true elsewhere.
Loopa is operated by Mobieus Partners LLC.
1. What consumer health data we collect, and what we use it for
In the apps, everything here is data you enter, connect or ask for, and the apps collect no health information about you in the background. The one exception is the last row: on loopahealth.app, the pages every visitor views are recorded automatically (§5).
| What we collect | What we use it for |
|---|---|
| Weight, height, age, sex, body measurements and progress photos | Working out your targets and showing you your own trend |
| Food and drink you log, including photographs of meals you choose to analyze | Counting calories, protein, carbohydrate, fat, fiber and fluid against those targets |
| Water and other fluid you log | Showing your daily fluid total |
| Activity, workouts, sets, reps and weights | Folding your training into the day and showing your records |
| Sleep, vitals, glucose and INR readings you enter or connect | Showing them back to you over time |
| Blood ketone readings (beta-hydroxybutyrate) you log in Metabolic Insights, with the context and note you give them, and what is worked out from them: the glucose ketone index, your own 30-day medians, and how your readings have tended to move with other things you log | Showing them back to you, working out those figures for you, and putting them in a clinician report only if you switch that section on |
| Menstrual cycle entries, if you switch the tracker on | Showing your cycle and its phases |
| Fasting start and end times | Timing a fast you started |
| Medications and supplements you record, their doses, schedules and the times you log taking them | Reminding you, and checking the combination for interactions |
| Interaction alerts we derive from that list | Telling you what FDA product labeling says about a combination you are taking |
| Medication protocol records: the protocol types you switch on, compounds you name, doses, injection sites, symptoms, wellbeing check-ins, lab results and supply figures | Running the reminders, the timeline and the summaries you asked for |
| Bariatric and weight-management track records: procedure or route, dates, stage, supplement plan and tolerance notes | Showing the stage you are on and the plan attached to it |
| Digestive health answers: whether a clinician has diagnosed you with IBS and which kind, any other diagnosed digestive condition you name, how often you get gut symptoms, whether you have followed a Low FODMAP diet before and which phase you are in, and whether a dietitian or doctor is working with you on your diet | Deciding whether Loopa suggests the Low FODMAP protocol to you, and which phase a protocol you start begins in. They are never used to refuse you anything |
| Low FODMAP protocol records: the phase you are in and its dates, which food groups you have tested and what each test found, and whether you started it when Loopa did not suggest it | Running the protocol, showing you which groups you can bring back, and letting a coach you share with see that you started it on your own judgement |
| Bowel and gastrointestinal symptom entries: abdominal pain, bloating, gas and urgency each 0-10, the Bristol stool type, the time of a bowel movement, and a five-question symptom score | Showing your own entries back to you and comparing them with your own baseline |
| The FODMAP load of food you log, worked out at the moment you log it | Telling you whether a meal crosses a published threshold at the serving you entered |
| How you told us each FODMAP group suits you (no limit, small amounts, or leave it out), including separately for wheat and grains, onion and garlic, fruit and vegetables | Rating foods the way you asked in search, the planner and the check before you eat. Your setting is an instruction, not a finding: it never changes what a test found, and a test never changes it |
| Foods you marked for yourself as ones you get on with or ones that bother you, and any note you add | Rating that food the way you asked, for you only. The published measurements Loopa holds for it are unchanged and are the same for everybody |
| Conditions, allergies, intolerances and foods you never want suggested | Keeping them out of meal plans and warning you in the food log |
| What you write in a note, a symptom entry or a question for your prescriber | Storing it for you and putting it in a summary you generate |
| Any report or summary you generate for a clinician | Producing the file at the moment you ask for it |
| Which pages you view on loopahealth.app, including pages about health topics such as GLP-1 medications, weight-loss surgery and hormone therapy, and what you click there | Understanding, in aggregate, how the site is used (§5) |
One thing we deliberately do not collect. Before you can start the Low FODMAP protocol Loopa shows you five questions about your relationship with eating. The answers are not stored, no score is stored, and the fact that the screen ran is not stored. There is no field in Loopa that could hold any of it. The only thing kept is the date you completed the screen.
We also collect the account and device information any app needs to work, and that is described in the Loopa Privacy Policy rather than here.
2. The manner in which consumer health data is processed
It is stored in a database we operate, in the United States. Every item listed above is encrypted at rest under an encryption key belonging to your account, except for a small number of fields that have to be readable for the app to function at all: the cadence of a reminder schedule, the route and body site of a protocol compound, your fasting times, your habit check-ins, the plans the app generates for you, and two facts about a Low FODMAP protocol you started: that you started it when Loopa did not suggest it, and which phase you told us you were already in. None of those names a substance, an amount or a condition. Your digestive health answers themselves are encrypted like everything else. The Loopa Privacy Policy §8 lists them in full.
It is processed to run the features you switched on, and for nothing else. It is not used to build a profile of you for anyone, it is not used for advertising, and it is not used to train anybody's model.
3. Where we collect it from
- You, through the app or the website.
- Your visits to loopahealth.app, recorded by our analytics provider HeyCatch (§5).
- Apple Health or Android Health Connect, if you connect one and choose which kinds of data may pass.
- A connected device account you link yourself: Withings, Oura or iHealth.
- A file you import from another tracker.
- Your care team, where you accepted a protocol they sent you.
There is no other source. We buy no health data, and we receive none from a data broker, an advertising network or a social network.
4. What consumer health data is shared, and who with
We do not sell consumer health data. We have never asked anyone to authorize a sale, because there is nothing to authorize.
In the apps, sharing happens only where you switched it on, and every one of these is off until you do. The exception is HeyCatch, which receives what you view on loopahealth.app for every visitor (last row).
| Category of third party | What they receive |
|---|---|
| An AI provider (Anthropic, through its API) | Only when you use an AI feature, and only what that feature needs. Never your name, email address, username or account identifier. Never a photograph you took in the app. |
| A Loopa Coach, if you have one | Only the categories you switched on, one at a time, each shown to you before you turn it on. A protocol category shows a pattern, dose days and averages, and never a substance name, an amount, a lab value or a note. |
| Members of your Loopa Family Group, if you join one | Only a meal you choose to share, or the shared pantry if you opt in. |
| A clinician you send a summary to | Only the summary you generated, at the moment you generated it. |
| Our hosting and infrastructure providers | They store and transmit the encrypted record in the course of running the service. They do not use it. |
| HeyCatch, Inc., our analytics provider | For every visitor to loopahealth.app: the pages viewed and what is clicked there, with the IP address, browser and device type, and a random identifier kept in the browser. Never anything you log in the apps, and never joined to a Loopa account. |
We share consumer health data with no affiliate, because Mobieus Partners LLC has none that processes it.
Collecting or sharing a category not listed here, or for a purpose not listed here, would require us to tell you first and obtain your consent.
5. Cross-site tracking
Third parties do not collect consumer health data across websites or over time when you use the Loopa apps. The apps contain no advertising SDK and no third-party analytics that receives health data.
On loopahealth.app, our analytics provider HeyCatch records, for every visitor, the pages viewed and what is clicked there, as our service provider. Some of those pages are about health topics, such as GLP-1 medications, weight-loss surgery and hormone therapy, so which pages you view can indicate an interest in a health condition or treatment. It is not joined to your Loopa account or to anything you log in the apps, HeyCatch's contract bars it from selling or sharing it or using it for anything but its service to us, and the Loopa Privacy Policy (§7) describes exactly what it records.
6. Your rights, and how to use them
If you live in Washington, Nevada or Connecticut you may:
- Confirm whether we collect, share or sell your consumer health data, and access it;
- Obtain a list of the third parties with whom we have shared it;
- Withdraw consent to our collection and to our sharing, separately;
- Have it deleted, including by our notifying anyone we shared it with;
- Review and request changes to what we hold, by correcting it in the app or asking us;
- Appeal a decision if we refuse a request.
How to make a request. Email privacy@mobieus.io, or use the request form. You can also delete your health record yourself at any time, in the app under More › Preferences › Your Data, and delete your whole account under More › Delete Account.
We answer within 45 days and may extend once by a further 45 days where a request is complex, telling you why before the first period ends. Two requests a year are free. If we refuse, we will say why and how to appeal; email privacy@mobieus.io with "appeal" in the subject and a different person will review it.
Withdrawing consent. Turning a feature off in the app withdraws consent for it from that moment. Deleting the data removes what was already collected.
7. Geofencing
Loopa does not use a geofence around any health care facility, or anywhere else. Neither app requests location permission, and the service contains no geofencing capability.
8. Changes to this policy
When we change this document we publish the new version here and update the effective date and version at the top. We may also tell you in the app or by email, but we do not promise to.
9. Who to contact
Mobieus Partners LLC privacy@mobieus.io
Washington residents: this policy is published under RCW 19.373.020. Nevada residents: under NRS 603A.495. Connecticut residents: under the consumer health data provisions of the Connecticut Data Privacy Act.
