Loopa Privacy Policy

Last updated: Oct 9

Loopa Privacy Policy

Mobieus Partners LLC, doing business as Loopa Sheridan, Wyoming, United States

Effective: October 5, 2026 · Last updated: October 5, 2026 · Version 5.12

What changed in 5.12: Units & Measurements. You choose the units Loopa shows and asks for (Metric, Imperial (US), or a unit for each kind of measurement), at signup or anytime under Preferences. §3.1 now lists that choice, which is a setting like your other display preferences and not health information. Nothing you have logged changes when you change it. Separately, §5 now says that a coach you share body measurements with reads them in their own units, inches or centimeters, rather than yours; the measurements themselves, and who can see them, are unchanged.

What changed in 5.11: The AI coach now checks what you write, and what it writes back, before you see a reply. A message about harming yourself, a medical emergency, or eating far too little gets a fixed reply with crisis and emergency contacts and is not sent to the AI; a request to play a therapist or doctor is declined; and a reply that would diagnose you or give a dose is replaced. Once you have agreed to send a message to the coach or the habit builder, it is also read by Claude Haiku 4.5 at Anthropic for signs of a crisis the other checks missed (§6). §6 names the two models the coach uses and says the coach receives your last 8 messages in a conversation. §9 adds your coach conversations: kept for 365 days and then deleted automatically, and you can delete one, or all of them, in the app at any time.

What changed in 5.10: Three things. Metabolic Insights (Loopa Premium) lets you log blood ketone readings. §3.1 now lists them, with the context and note you give them, and §3.5 says what is worked out from them: the glucose ketone index and the patterns the relationship explorer finds in your own data. They are encrypted with your own key, they are never sent to analytics, and they go when your health data goes. A clinician report includes them only if you switch that section on (§11.1). Your estimated body fat is now worked out by the method you choose (Loopa Premium), or automatically as before if you have not chosen one. §3.5 says what is stored: which method you chose, and nothing new about you. What the Help Me coach receives now includes your estimated or recorded body fat percentage, which method produced it, and the fat and lean mass worked out from your weight, plus a few sentences describing the patterns Metabolic Insights found in your ketone data, never the readings themselves (§6). Separately, §6 and §6.1 now say exactly how long Anthropic keeps what we send it: deleted within 30 days, or kept up to 2 years if it is flagged for breaking Anthropic's usage rules. Earlier versions said it kept nothing, which overstated it; nothing about what we send changed.

What changed in 5.9: HeyCatch now runs on loopahealth.app for every visitor, on every page, wherever you are. It is no longer controlled by the cookie choice, and a Global Privacy Control signal does not switch it off. What it records there is unchanged (§7). Our Terms of Service now say that visiting loopahealth.app means you agree to it. Google Analytics and Google advertising on that site are unchanged: they still run only if you turn them on, and Global Privacy Control still keeps them off. HeyCatch in the iPhone and Android apps is unchanged. §4, §5 and §7 are updated to match. The Consumer Health Data Privacy Policy is now version 1.3: it lists the pages you view on loopahealth.app, which can include health topics, as data HeyCatch receives, and it no longer promises to tell you about a change before it takes effect.

What changed in 5.8: Loopa now uses HeyCatch to understand, in aggregate, how the apps and loopahealth.app are used. §3.4 and §7 say exactly what it receives. In the iPhone and Android apps that is your Loopa account number (never your name, email address or anything you log), the app and system version, the device model, a short fixed list of general screen names, a short fixed list of account events such as signing up or starting a purchase, and whether you are on Loopa Basic or Loopa Premium. If you are in the EU, the EEA, the UK or Switzerland it is off until you turn it on in the app's settings; everywhere else it is on by default and you can switch it off there. On loopahealth.app it runs only if you turn Analytics on in your cookie choice. HeyCatch never receives your health data. §4 gives the legal basis, §5 adds HeyCatch to the list of companies we send information to, §9 says how long it is kept, §10 says how to have it deleted, and §15 says why it is neither a sale nor sharing.

What changed in 5.7: §5 now says that if you install the Android app from a partner's link, Google Play passes the app the partner's code and the time you followed the link, and the app sends those two things to us once, when you first sign in. Nothing else from Google Play is read or kept.

What changed in 5.6: §5 now covers partner programs that give Lifetime Beta Access rather than an included period: the claim has no end date, and the record of your Lifetime Beta Access notes which program and partner it came through. §5 also says that claiming a program, and revoking one, is written to our administrative audit log, and that we email you if a claim is revoked. §9 and §10 say that the audit entry is kept after an account is deleted, like every administrative audit entry, and that deleting your account ends Lifetime Beta Access as it ends an included period. §6 now says that when you have a Low FODMAP protocol running, meal suggestions, recipes, the meal planner and the coach are told about it, lists what they receive, and says that your symptom scores, stool entries and notes are never sent.

What changed in 5.5: §5 now says what the body measurements and progress photos categories show a coach you switch them on for. Body measurements show your measurements from the last 90 days, each with its date and in the units you use. Progress photos show the photos themselves, with the day and the pose of each. Every photo your coach opens is checked against your switch at that moment and recorded in the list of who looked, and we instruct their browser or app not to keep a copy.

What changed in 5.4: §7 now lists every cookie on both of our websites. On loopahealth.app that is your cookie choice itself and, only if you turn them on, analytics and advertising cookies. On loopa.mobieus.io it adds the referral cookie a partner's link sets, what it holds, and that it lasts 90 days. §5 says that a partner's link counts only when you create your account within that partner's attribution window, while a code you type in counts whenever you enter it.

What changed in 5.3: §5 now describes joining Loopa through a partner: what we record when you use a partner's link or code or claim a partner program, and that a partner sees only counts about the people who joined through them as a group, never who they are and never anything from your health record. §9 says how long those records are kept, and §10 what deleting your account does to them.

What changed in 5.2: Loopa now asks a short set of digestive health questions, in setup and in your settings, and §3 names each of them: whether a clinician has diagnosed you with IBS and which kind, any other diagnosed digestive condition you tell us about (including one you type in yourself), how often you get gut symptoms, whether you have followed a Low FODMAP diet before and which phase you are in now, and whether a dietitian or doctor is working with you on your diet. Every one of those answers is encrypted with your own key, they sit in the same record as the conditions and medications you already give us, and §9 says they are kept while your account is open and go when your health data goes. Answering is optional and you can change or clear any of it at any time. The answers do one thing: they decide whether Loopa suggests the Low FODMAP protocol to you, and which phase a new protocol starts in. They never decide what you are allowed to do. The protocol stays available whatever you answer, and where Loopa does not suggest it we say so and show you one screen explaining what it is for before you start. If you start it anyway we record that you did, so a coach you have chosen to share with can see it.

Also in 5.2: if you run the Low FODMAP protocol you can now tell Loopa how each food group suits you - no limit, small amounts, or leave it out - and you can mark an individual food as one you get on with or one that bothers you. §3 names both. What we store is the setting you chose and the name of the food you marked, and any note you write on a mark is encrypted with your own key. These are your instructions to the app, not findings about you: they never overwrite what a reintroduction test found, they name no condition, and where a test result suggests a setting we show the suggestion beside the control for you to take or leave. §3.5 says what changes because of them - which foods the app flags for you, and what it suggests - and adds the one thing a "you get on with this" mark deliberately cannot do: turn a food Loopa has no measurements for into one it says is fine.

Also in 5.2: a Low FODMAP symptom entry can now carry how stressed you felt and how well you slept, each 0 to 10 and each optional, and §3 names both. Where you have a device connected and have not answered the sleep question yourself, a report shows the hours it recorded and says so - your own answer always wins, and a device figure is never written into it, because how long you slept and how well you slept are different measurements. §3.5 adds the fifth thing Loopa works out from the protocol: your own log placed side by side, which compares your average symptom scores on the days you ate more of a group than usual against your average on the other days, shows the number of days behind every figure, and shows nothing at all until you have fourteen days carrying both a checked meal and a symptom entry. It describes your diary; it does not say one thing caused another.

What changed in 5.1: Loopa now carries a Low FODMAP protocol, and §3 names what it records: the phase you are in and the dates around it, symptom entries you make yourself (abdominal pain, bloating, gas and urgency each on a 0-10 scale, the Bristol stool type, the time of a bowel movement and a note), a five-question symptom score you answer at the start and the end of the restriction phase, which food groups you have tested and what each test found, and the FODMAP load worked out from the food you log. The symptom entries, the scores, the stool information, the notes and the meal loads are encrypted with your own key. The five questions on the enrollment screen are not stored at all - not the answers, not a score, not the fact that it ran - and there is no field in Loopa that could hold them; all that is kept is the date you completed it. §3.5 says what Loopa works out from it: whether a meal's FODMAP load crosses a published threshold at the serving you entered, whether several servings add up across a meal or three hours, whether your symptom score moved by the amount the research treats as meaningful, and what your own challenge days suggest about a food group - and says that none of it is medical advice and none of it diagnoses anything. §5 adds one coach category, Low FODMAP support, and lists item by item what it shows and what it never shows.

What changed in 5.0: Consumer health data now has its own document, at /consumer-health-data. Washington's My Health My Data Act requires that policy to stand alone and to carry nothing beyond what the consumer health data laws ask for, so folding it into §15 of this policy was never going to satisfy it. §15 now points there. Nothing about what Loopa collects, shares or does has changed; what changed is where the consumer health data disclosures live and that they are now reachable in the app as well as on the web.

What changed in 4.9: §4.4 widens the description of a shared family meal to match where you can now start one. You can share a whole meal or a single food out of your food diary, turn on a switch to offer a food at the moment you log it, or send one of your saved meals without logging it at all. What travels is unchanged. The same frozen copy of the same fields, held for the same seven days, deleted the same way. The one addition to the description is that a meal's date is the day you sent it when it came from a saved meal you had not logged.

What changed in 4.8: Loopa now carries a bariatric and medical weight-management track, and §3 names what it records: which procedure or route you tell us you are on and the dates you enter, which stage of the eating plan you are in, the supplement reminders you set, symptoms you flag with a severity and, on some of them, the food that preceded one, and a list of foods you mark as sitting well or not. The severities, the notes, the food names and any question you write for your care team are encrypted with your own key. §3.5 says what Loopa works out from it, where the published reference calendar would put you, whether a supplement schedule you set has two doses too close together, and how far your weight has moved from its lowest point since your procedure, and says that none of it is medical advice. §5 adds one coach category, bariatric support, and lists item by item what it shows and the longer list of what it never shows. Loopa does not decide whether surgery is right for you, does not recommend a procedure, and never sets a dose.

What changed in 4.7: A medication protocol now records four more things you choose to enter, and §3 names each: a food-noise slider on the daily check-in (offered with a GLP-1 protocol or the Off-Ramp program), a question for your prescriber you can write beside a symptom, a check-in or a lab result, a refill date and pharmacy lead time on a compound's supply record, and DEXA and bone-density results among the lab markers. §3.5 describes what Loopa works out from your protocol logs: a pattern of your own days across the dose cycle, a weekly lean-mass protection score, which foods you logged in the hours before a symptom, and a weekly plan, and says that every one of them describes what you recorded and none of them is advice about the medication. §5 says that each coach protocol category now carries two more items, which calendar days are dose days and which of your days your logs put among your strongest and roughest, as labels only, and that a category you switched on before this change stays exactly as it was until you confirm it again. §8 lists the one new piece of ordinary text: the version of the disclosure you confirmed.

What changed in 4.6: Loopa now supports medication protocols you switch on for yourself. GLP-1, testosterone therapy, hormone therapy, and multi-compound and peptide protocols you define yourself. Loopa does not give medication advice. It records what you report and shows it back to you, and every question about the medication itself belongs with your prescriber. §3 says what each protocol records: the schedule you set, the compound names, amounts and notes you type, every dose you log with the place on the body map, symptoms with a severity, a daily wellbeing check-in, lab results you enter, and your answers to the Off-Ramp check-ins: all of it encrypted with your own key. §5 adds three coach categories, each of which shows a symptom pattern as counts, which days your doses fall on, and 14-day wellbeing averages, and never a compound name, an amount, a lab value, a note or libido; peptide protocols are never shared with a coach and have no toggle. §6 says what the coaching AI is told and what it is never told. §8 lists what is stored as ordinary text and why, §9 says how long the record is kept, §11 covers the summary you can generate for your prescriber, and §§12 and 13 cover reading lab results from Apple Health. Progress photographs now carry the time they were taken, so a comparison lines up in the right order.

What changed in 4.5: An organization inside Loopa is a group with a private room and its own challenges, and §5 now describes one as it works. You can belong to as many as you like and own more than one; each has a single owner, who can hand it to another member or delete it; and a challenge shares one total, for one measure, over one stretch of dates, with the other members of that organization, and only if you enter it. No role in an organization can reach your health record, in any part, by any route. There is no permission for it in the system. §3 says what we record about your membership, describes the picture an organization's owner or administrator can give it, and describes a second record: every administrative act on an organization, which holds no health data, which §9 keeps for 90 days and then deletes, and which §8 names among the things stored as ordinary text. An organization inside Loopa holds no partner account and no purchase of yours is recorded against one. A gym that runs Loopa for its own members at its own address is a separate arrangement, and §5 now sets it apart in its own paragraph.

What changed in 4.4: When you photograph a meal, Loopa now shows you what it read from the picture and you correct it before any of it is logged. Two things follow, and §3 and §9 both say so. While that screen is open we hold what was read from your photograph (the foods and their portions) encrypted with your own key, for 24 hours, so you can come back and finish; it goes the moment you log the meal or the day after, whichever is first, and when you do log it we keep the pair (what we read, and what you said it actually was) so we can tell how often the estimate is wrong and in which direction. It is encrypted like the rest of your food record and it goes when your health data goes. The photograph itself is still processed and discarded, exactly as before.

What changed in 4.3: Two small, honest corrections rather than any new collection. Your hydration goal can now count every liquid you log rather than plain water alone, and when it does, the daily total Loopa writes back to Apple Health and Health Connect is that whole fluid total: §4 says so, because more of what you logged leaves the app for your other health apps than before. Separately, if you set Focus targets. Up to three kinds of drink, or saved items, that you want tracked on their own: the list of what you chose to watch is stored as ordinary text, and §8 now names it among the things that are not encrypted. The volumes themselves stay encrypted where they always were, and nothing new is collected about you.

What changed in 4.2: Two additions. You can now show your coach a single workout or activity session. One item at a time, with a note if you want one, and take it back whenever you like. §3 says what that creates, §5 says how it works, and the first time you share with a coach we show you what they will see and record that you agreed. Separately, §5 now sets out what belonging to an organization inside Loopa gives you: a private room and its challenges, and nothing else. No role in an organization can see your health record, because there is no permission in the system that would allow it.

What changed in 4.1: Two settings (a high protein target, and a fast of 48 hours or longer) now show you a health notice and record that you read it and chose to continue. §3 says what that record holds, §6 says how long it is kept, and §8 says it is not encrypted. It is yours to see and to withdraw at any time, and it goes when your health data goes.

What changed in 4.0: Loopa can now be run by an organization: a gym, a club, an employer, an association. §3 says that your membership of one is recorded, and §5 has a new section stating exactly what an organization can see about you: counts, for a month at a time, and nothing else. No role in an organization can see your health record, including the person who owns it, because the permission does not exist. Joining one is your choice, leaving is one tap, and neither affects your subscription, your history or your data.

What changed in 3.9: §6's description of the per-account AI usage record now names every field it holds, including which plan you were on when the feature ran. That row still holds no health content, and it is what makes the free tier's daily limits knowable.

What changed in 3.8: mobieusVerified (the optional identity check) now has its own description. §3 says what you hand over when you choose to do it and how long the document is kept, and §5 says exactly what crosses to the other Mobieus communities you belong to: that you are verified, and nothing else. Verification is optional and nothing in Loopa requires it.

What changed in 3.7: §6 now describes two things that were true and undescribed: the per-account record of how often you use an AI feature (no health content in it, and it is what makes the free tier's daily limits knowable), and the shared estimate cache, which stores a fingerprint of foods rather than anything of yours.

What changed in 3.6: Loopa records structured workouts now: sessions, exercises, sets, reps and weights, and §5 states how that is shared. Workouts, body measurements and progress photos are each their own category on the coach consent screen, so sharing one shares only that one, and all three start off like every other category. §3 already listed workouts, measurements and progress photographs among what we collect, and that is unchanged.

What changed in 3.5: Loopa has friends now, and §5 describes exactly what one can see: your display name, your profile photo, and your streak badge if you leave that switched on. Nothing you log. Sharing anything from your health record still takes a separate accountability-partner grant, category by category, which §5 already described and which is unchanged. §3 records the small amount of new information a friendship creates, §5 states that we never read your contacts and that no search here matches an email address or a phone number, and §10 lists what a deleted account takes with it.

What changed in 3.4: the record of who has read your health data is now a screen you can open. More → Preferences → Your Data in the app, Settings → Your Data on the web. It shows what is encrypted and what is not, every coach and staff member who opened your record and the reason they gave, everyone you are currently sharing with and a button that stops each of them, and exactly what each AI feature sends. §8 is rewritten to describe it, including what it still does not cover.

Version 3.3, below, replaced the version dated August 20, 2026. What changed there, and why it was a correction rather than an addition: three statements in the previous version did not match how the system actually works, and we would rather say that plainly than quietly reword it.

We said your health data was encrypted with a key that belonged to you alone. Each member does have their own key and it is stored wrapped, both true, but the key that unwraps it is ours, held on the server, not derived from anything you know. So the encryption defeats a stolen database, backup or disk, and it does not put your record beyond our reach. §8 now says who holds the key, and lists what is not encrypted at all.

We said meal photographs are discarded unless you turn photo history on, in which case they are stored encrypted. There is no photo-history setting, and the retention mode that exists in our code does not encrypt. Photographs are discarded, which was the operative half and remains true; the rest is gone.

We said you could see the record of who read your health data. You cannot yet. There is no screen for it, and §8 now says so and tells you to ask us. We also narrowed the claim about administrator access to what the log actually covers, and said which routes it does not.

Separately, §6.1 now describes the one case where a direct message reaches an AI: after somebody reports it.

The previous entry, for version 3.2, is unchanged and still describes §5: you can now join a coach at any time rather than only when you sign up, so the coach section no longer applies just to people who arrived through a link; every control it describes is now in the app as well as on the web; the record of when your coach opened your data now distinguishes them glancing at a list of clients from them opening you and reading, and you can read that record yourself; and we say plainly what a coach is shown about your identity. Version 3.1 introduced Loopa Coach; version 3.0 rewrote this policy for Loopa rather than for the Mobieus platform generally.

The short version

Loopa is a health and fitness app. You tell it what you ate, what you weigh, how you slept and how you moved, and it works out what that means for your goal.

We treat that as what it is: some of the most personal information you will ever put into an app. So:

Loopa is for adults. You must be 18 or older. We do not knowingly collect anything from anyone younger.
Your health data is encrypted with a key of your own. Every member gets their own key, so a stolen copy of our database is unreadable on its own. There is a limit worth stating plainly: we hold the second key that unwraps yours. That is what lets a small number of our staff reach your record when there is a real reason to, and it means we cannot honestly tell you nobody here is able to read it. What we can tell you is what §8 sets out, who, when, and under what control.
Deleting your account destroys that key. Not "marks a row deleted": destroys it, which makes everything you ever stored permanently unreadable, including by us.
We do not sell your information, and we never will. No advertising network receives it. No data broker receives it. Your health data is never used to target an advertisement, on Loopa or anywhere else.
We do not use your data to train anybody's AI model. Our AI provider is contractually barred from training on it.
The apps send usage analytics, never your health data. Which general screens are opened and a few account events like signing up, under your account number and not your name. In the EU, the EEA, the UK or Switzerland nothing is sent unless you turn it on; elsewhere you can switch it off in the app's settings (§7).
A friend sees your name, your photo and your streak badge. That is the whole list. Friends never see what you log: sharing any of that is a separate decision you make category by category, and you can stop it at any time.
We never read your contacts. There is no address-book permission in either app, and no search in Loopa matches an email address or a phone number.
You can take it all with you in a spreadsheet, any time, without asking us.

The rest of this page is the detail. If any of it is unclear, write to privacy@mobieus.io and a person will answer.

1. Who we are

Mobieus Partners LLC ("we", "us", "our") is a Wyoming limited liability company. We operate Loopa at loopa.mobieus.io and loopahealth.app, and the Loopa apps for iPhone, iPad, Android and Wear OS.

For everything described here we are the controller of your personal information. We decide what is collected and why, and we are accountable for it.


Privacy contact	privacy@mobieus.io
Postal	Mobieus Partners LLC, Sheridan, WY, United States
Data protection contact	The privacy address above reaches the person responsible for privacy at Mobieus. Under Quebec's Law 25 that person is our designated Privacy Officer.
EU / UK residents	We are established only in the United States. If you are in the EU, EEA, Switzerland or the UK, you may contact us at the address above, and you may also complain to your local supervisory authority. See §14.

2. Loopa is for adults

You must be at least 18 years old to create a Loopa account or use any part of Loopa. This is a condition of the Terms of Service, not a suggestion.

We do not knowingly collect personal information from anyone under 18. Loopa is not directed to children, is not listed in any children's category on the App Store or Google Play, and contains no content or feature designed to appeal to children.

If we learn that an account belongs to someone under 18, we close it and delete the data. If you believe a person under 18 has given us information, write to privacy@mobieus.io and we will act on it.

A Loopa Family Group is a billing and sharing arrangement between adults. Every member of a Family Group must independently be 18 or older, and the app will not admit a member whose account does not meet that bar.

3. What we collect

3.1 What you give us

Account. Your email address, a username, and optionally a display name, a profile photo and a short bio.

Your password is never stored. Not by us, not anywhere, in any form: not even as a hash. Loopa signs you in with OPAQUE (RFC 9807), a modern authentication standard in which your password computes a proof of who you are rather than being handed over to be checked. On the web, that proof is computed on your own device and your password never leaves it. In the iOS and Android apps, your password is sent once over TLS, used to compute the same proof on our servers, and discarded immediately. It is never written to a database, a log or a backup. Either way there is no password in our database to steal, which is exactly why we chose OPAQUE over a conventional password hash.

Health and wellness information. Only what you choose to record, and only for the features you switch on:

Food and drink you log, including meals, portions, macronutrients, calories and photographs of meals
What a meal photograph was read as, and what you corrected it to. Photographing a plate produces a list of foods and portions you review before anything is logged. We hold that list for 24 hours while you are deciding, and once you log the meal we keep what was read alongside what you said it actually was, so we can measure how good the estimate is. Both are encrypted with your own key and both go when your health data goes. The photograph is not kept
Body weight, body fat percentage, waist and other body measurements
Vital signs: blood pressure, heart rate, resting heart rate, blood glucose, blood oxygen, body temperature
Blood ketone readings (beta-hydroxybutyrate), if you use Metabolic Insights, with the time you took them, the context you choose (for example fasting or after exercise), an optional note, the name of the meter if you give it, and which glucose reading you paired with it. Encrypted with your own key
Sleep, steps, exercise minutes and workouts
Water intake, fasting windows, habits, goals and progress photographs
Supplements you take and their doses
Medications you add to your list, including the name, strength, dose, how often you take it, and the date and time of each dose you log
A medication protocol, if you switch one on. Loopa carries four kinds. GLP-1, testosterone therapy, hormone therapy, and multi-compound and peptide protocols you define yourself. What we record is which kind you turned on, the schedule you set for it, and the compound names, amounts and notes you type in. The names, the amounts and the notes are encrypted with your own key
Each dose you log against a protocol, with the date and time you recorded it and, where the route has a body map, the site you tapped
Symptoms you record against a protocol, with the severity you chose from one to five and anything you wrote in the note
Your daily wellbeing check-in. Energy, mood, sleep quality and motivation, each on a five-point scale, libido only if you switch that slider on yourself, and food noise on the same scale when you run a GLP-1 protocol or are in the Off-Ramp program. It is treated exactly as the symptom journal is: encrypted with your key, yours to change or delete, and never part of what a coach is shown
A question for your prescriber, if you write one beside a symptom, a check-in or a lab result. It is your own words (Loopa never suggests one) encrypted with the entry it sits on, listed for you in the order you wrote them, and placed on the first page of the summary you generate for your prescriber (§11.1)
A refill date and a pharmacy lead time, if you enter them on a compound's supply record. Loopa works out a reorder-by date from them and from the run-out date it already computes, and reminds you on that day unless you switch the reminder off
Lab results you type in: the marker, the value, the unit you used, and a note if you add one. The markers now include DEXA lean mass, DEXA fat mass, bone mineral density and a T-score. Loopa keeps the numbers exactly as you entered them, converts nothing, and holds no reference ranges of any kind
A bariatric or medical weight-management track, if you switch one on. What we record is which of the thirteen routes you told us you are on: from exploring surgery, through each of the procedures, to the non-surgical and long-term tracks: along with the dates you enter for a procedure, a scheduled operation, the start of a pre-operative program or a balloon removal, and which stage of the eating plan you are in. You choose all of it; Loopa never infers a procedure from anything else
Your supplement schedule on that track, meaning which of the published nutrient lines you have switched on or off, any amount you set yourself in place of the published range, and the times of day you asked to be reminded. There is no product or brand anywhere in it, and no field to put one in
Symptoms you flag on that track, with the severity you chose from one to five, anything you wrote in the note, and (on the symptoms where the app offers the field) the food that preceded it. The severity, the note and the food are encrypted with your own key
Foods you mark as sitting well or not, with the stage you were in when you first answered and when you last did. The food name is encrypted with your own key, and the app keeps one answer per food rather than a running list, so a later answer replaces an earlier one
A protocol your care team sends in, if you invite them to and then accept it. It replaces the published reference schedule for you, you can see exactly what it changes before you accept it, and you can withdraw it at any time. What they write is encrypted with your own key
Your Off-Ramp check-in answers, if you join the Off-Ramp program: the answers you give to that week's prompts, week by week, and where you have got to in it
Digestive health questions, if you answer them. Loopa asks a short set in setup and keeps them in your settings: whether a clinician has diagnosed you with IBS and, if so, which kind; any other diagnosed digestive condition you pick from a list, including one you type in yourself; how often you get gut symptoms such as bloating, pain or urgency; whether you have followed a Low FODMAP diet before and which phase you are in now; and whether a dietitian or doctor is working with you on your diet. All of it is encrypted with your own key, in the same record as the conditions and medications above. Every question is optional, you can change or clear any answer at any time, and clearing one clears anything that depended on it. They are used for two things and nothing else: whether Loopa suggests the Low FODMAP protocol to you, and which phase a protocol you start begins in. They are never used to refuse you anything
A Low FODMAP protocol, if you switch one on. What we record is which of the four phases you are in and the dates around them, including the date your restriction phase is scheduled to end. You choose to start it and you can stop it at any time
Whether you started the Low FODMAP protocol when Loopa did not suggest it, and which of its three answers it gave when you did. The first of those is stored as a plain yes or no on the protocol record, because it names no condition; the second is encrypted with your own key, because one of the three answers could only ever apply to somebody who told us about a specific condition. It is what lets a coach you have chosen to share with see that you started it on your own judgment. It changes nothing about what the protocol does or what you can reach
Which phase you told us you were already in, if you said you were mid-protocol. Loopa still starts everyone at the beginning, because the assessment at the end has nothing to compare against otherwise, and it records what you said and why it started you earlier rather than quietly overruling you
The five questions on the Low FODMAP enrollment screen are not stored. Not the answers, not a score, not the fact that the screen ran. There is no field in Loopa that could hold them. All that is kept is the date you completed it
Symptom entries you make on that protocol, meaning abdominal pain, bloating, gas and urgency each on a scale of 0 to 10, the Bristol stool type if you enter one, the time of a bowel movement if you enter one, how you would describe the day overall, how long it had been since you ate, and anything you write in the note. You can also add how stressed you felt and how well you slept, each on a scale of 0 to 10; both are optional, leaving either blank is not the same as answering zero, and a blank one is left out of every average rather than counted as a low score. All of it is encrypted with your own key
Sleep hours a connected device recorded, where you have one. If you have not answered the sleep question yourself, a Low FODMAP report shows the hours your watch or phone already recorded in your vitals and says that is what it is showing. A device figure is never written into your own answer and never replaces it: how long you slept and how well you slept are different measurements, and Loopa keeps them apart and labels which one you are looking at
A five-question symptom score you answer once at the end of the baseline period and once at the end of the restriction phase, each question on a scale of 0 to 100. The answers and the total are encrypted with your own key
Which food groups you have tested and what each test found, along with the largest serving that produced no reaction where there was one, when you tested it, and when a retest is due. The name of the food you used to test with is encrypted with your own key
The FODMAP load of the food you log, worked out at the moment you log it from published measurements of that food, and encrypted with your own key exactly as the food entry itself is
How you have told us each food group suits you, if you set it: no limit, small amounts, or leave it out, for each of the six groups, and separately for wheat and grains, onion and garlic, fruit and vegetables within the fructans group. Stored as the setting you chose. A setting is your instruction and never a finding about you - it does not change what a reintroduction test found, and a test result never changes a setting you made. Where the two differ we show you the test's suggestion beside the control and leave the choice to you. You can clear any of them at any time, which puts that group back to the protocol's own judgment
Foods you have marked for yourself, if you mark any: the name of the food as you gave it, and whether you get on with it or it bothers you. Any note you add is encrypted with your own key. A mark changes how Loopa rates that food for you and changes nothing about the published measurements the app holds for it, which are the same for everybody. You can remove a mark at any time
The time a progress photograph was taken. A progress photograph now carries a capture time, read from the picture's own information or sent by the app at the moment you take it, and left blank where neither says, so a comparison lines up in the right order
Medical conditions, prescription medications, allergies and foods you avoid, and whether you are pregnant or nursing. Used to keep the app's suggestions safe for you
Menstrual cycle information, if you track it
Your age and sex, which the calorie and macro calculations require
Health notices you accepted. Two settings show you a health notice first: a protein target above 1.2 g per pound of your goal weight, and a fast planned for 48 hours or longer. When you choose to continue we record which notice it was, the version of its wording, the date and time, whether it came from the app or a browser, and the figure you were looking at when you decided (the g/lb target, or the planned hours). It is what makes "you were told" a fact rather than an assertion, and you can see the whole of it in the app under Your Data and withdraw any entry.

Your units. The units you choose for each kind of measurement (body weight, height, body measurements, food portions, liquids, distance, energy, temperature and blood glucose), so every device you sign in on shows the same ones. It is a display setting, kept while your account is open, and it changes nothing you have logged.

Coaching setup. At setup we ask why you are here, how you want to be coached, what has got in the way before, and what previous attempts taught you. You can skip any of it.

Community content. Posts, comments, direct messages, reports you file, and anything else you publish in the Loopa community.

Identity verification, only if you choose it. mobieusVerified is optional. Nothing in Loopa requires it, and declining costs you nothing but the badge and the community features it opens early. If you do start it, you give us your legal name as it appears on your identity document, the type of document, an image of it, and a short selfie video for the liveness check. A person at Mobieus reviews them.

The document image and the liveness video are deleted 90 days after the decision. What remains afterwards is the outcome (verified or not, your legal name, the document type, and the date) because that is the record of a check we are accountable for having made. Your legal name is shown to nobody but you: it appears on your own verification screen and nowhere else in the app.

Organization membership, only if you join one. If you enter an organization's invite code, we record which organization it is, when you joined, when you left, and your role in it (member, administrator or owner) including any change to that role and who made it. You may belong to several, and each membership is its own record. That record is what opens the organization's private room and its challenges to you, and, where the organization runs Loopa itself at its own address, what puts its name and color in your app. §5 says what an organization can and cannot see, which never includes anything about you individually.

An organization's picture, if one is uploaded. An owner or an administrator can give their organization a picture. It belongs to the organization and is chosen by the people who run it: it is not a photograph of any member, and it holds nothing about anybody's health. What we store is a square JPEG our own server writes from what was uploaded (the file as it arrived is not kept) and it is shown to that organization's members. Deleting the organization deletes the picture: the file itself, not only our record of it. Replacing an organization's picture deletes the one it replaced, in the same way.

A record of what is done to an organization. Separately from your membership, every administrative act on an organization is recorded: created, renamed, suspended, handed to a new owner, its invite code retired, a member joining, leaving, removed, promoted, demoted or muted, a challenge created, changed, closed or deleted, the room moderated, and the organization deleted. Each entry holds the organization, who acted, the role they acted in, what they acted on and when: and, where somebody entered a challenge, the sentence they were shown saying what entering shares. It holds no health data. It outlives the organization itself, because it is the only remaining record that the organization existed and that somebody deleted it, and we keep it for 90 days and then delete it. Only our own administrators can read it; no owner or administrator of an organization can.

A session you show your coach. If you have a coach and you show them one workout or one activity session (§5), we record which session it was and its name, the note you wrote if you wrote one, when you shared it, and when you took it back. The first time you share with a coach we also record that you agreed to it: the version of the wording you were shown, the date, whether you were on iPhone, Android or the web, the app version (the wording lives in the app, so the version is what says which words you read) and a one-way hash of the address you connected from, never the address itself.

Support correspondence. What you write to us, and what we write back.

3.2 What connected services give us, with your permission

Nothing below is connected unless you connect it, and you can disconnect any of it at any time.

Source	What it sends us
Apple Health (HealthKit)	Weight, body fat, waist, blood pressure, heart rate, resting heart rate, blood glucose, steps, exercise minutes, water, sleep and workouts. Loopa also writes back what you log: weight, body composition, workouts, and your daily fluid total, which is your whole fluid intake when you have turned on "Count all liquids", and your water alone when you have not
Android Health Connect	The equivalent categories on Android
Withings	Weight and body composition, blood pressure, sleep and activity from your Withings devices
Oura	Sleep, readiness, heart rate and activity
iHealth	Weight, blood pressure, blood glucose, blood oxygen, heart rate, temperature, sleep and activity
Wear OS watch	Quick logs you record on the watch

3.3 What a friendship creates

Very little, and none of it is health data. When you use Friends we store:

the connection itself, who asked, who answered, when, and its current state
your discoverability choices: who may send you a request, whether a username search returns you, whether friends see your streak badge, whether your health achievements appear on your profile
any invite links you create, as a one-way hash. The link itself is shown to you once and is never stored, so a copy of our database contains no working link
anyone you have blocked, which only you can see
any report you file about another member, with the reason you chose, whatever you wrote, and a snapshot of that member's profile as it read at the time

We do not store your contacts, because we never read them.

3.4 What we collect automatically

Your IP address, device type and operating system version, app version, the pages or screens you open, and the times you do it. On the web, cookies and similar technologies. See §7.

Usage analytics in the apps. If you are in the EU, the EEA, the UK or Switzerland, nothing is sent unless you turn this on. Everywhere else it is on unless you switch it off. When it is on, the iPhone and Android apps send our analytics provider, HeyCatch, a short record of how the app is used: which of a fixed list of general screens you open (Today, Diary, Progress, Community, You, Membership, the Premium offer, Settings, setup, sign in and sign up), a fixed list of account events (signing up, finishing setup, seeing the Premium offer, starting a purchase and completing one, with the plan you chose), and whether you are on Loopa Basic or Loopa Premium. It is recorded under your Loopa account number, or before you sign in under a random identifier the app creates, and never under your name or email address. It contains no health data: nothing you log, no food, weight, medication, protocol or symptom, and no screen whose name would say anything about your health. §7 has the detail and says how to switch it off.

Where you got to in the app tour. If you take the guided tour, we store which step you reached and whether you finished it, skipped it or are partway through: nothing else about it. It is kept with your account rather than on the handset so the tour picks up where you left off on another device, and it goes when your account does.

If you turn on notifications we store a push token: issued by Apple on iPhone and iPad, by Google's Firebase Cloud Messaging on Android, or by your browser's own push service on the web. A token identifies the installation, not you, and deleting the app or turning notifications off invalidates it.

3.5 What we work out from all of it

Body mass index, calorie and macronutrient targets, weight-trend forecasts, streaks, energy balance and the insights and suggestions the app shows you. These are derived from the above, not collected separately.

Estimated body fat. If you have not recorded a body fat percentage, Loopa can estimate one from your height, weight, age, sex and body measurements, using the U.S. Navy, Relative Fat Mass or BMI-based formula. If you choose a method (a Loopa Premium setting), we store which one you chose and when, and that you have seen the note that your estimate changed; if you have not chosen, Loopa picks automatically as it always has. The estimate, and the fat and lean mass worked out from it, are recalculated from your measurements whenever you look and are not stored. A body fat percentage you record yourself or that comes from a connected device is never replaced by an estimate. An estimate is a formula's result, not a measurement.

What we work out from ketone readings. If you use Metabolic Insights, Loopa computes the glucose ketone index from a ketone reading and a glucose reading taken close to it, your own 30-day medians, and the relationship explorer's statistics: how strongly your ketone readings and other things you log (food, fasting, exercise, sleep and weight) have tended to move together, and from how many readings. These are recalculated whenever you look and are not stored. They describe your own data, they are not compared with anybody else's, and they are not medical advice or a diagnosis.

Interaction alerts. If you add medications or supplements, Loopa checks them against FDA-approved product labeling and against the food and drink you have logged, and records any interaction those labels state. Each alert holds the pair, where the label states it, the label's own sentence, and whether you have marked it reviewed. The check runs entirely on our servers against a copy of the FDA's public labeling data. nothing about you is sent to the FDA or to anyone else to perform it.

Daily summaries. We compute one summary row per day from what you logged, so your trends and reports can be drawn without re-reading your whole history. It contains nothing you did not log; it is arithmetic on your own entries, and it is encrypted like they are.

What we work out from a Low FODMAP protocol. If you run one, five things are computed from your own entries and from published research, and none of them is medical advice and none of them diagnoses anything. Whether a meal crosses a published threshold compares the FODMAP content of what you entered, at the serving you entered, against cut-off values published in the peer-reviewed literature; where we hold no measurement for a food we say so rather than guess, and a food we have only partly measured is never reported as fine. Whether servings add up does the same arithmetic across everything in one meal and anything you logged in the previous three hours, because several modest servings can total more than any one of them. Whether your symptom score moved compares the score you gave at the end of restriction against the one you gave at the end of baseline, against the size of change the research treats as meaningful; if it did not move by that much, Loopa's guidance is to stop the protocol, never to restrict further. What a challenge suggests compares the days of a three-day challenge against your own baseline days. A single heavier day is deliberately not treated as a finding, because the blinded research measured a similar rate of reaction to a placebo. What your own log shows side by side takes the days you ate more of one FODMAP group than you usually do and puts your average symptom scores on those days next to your average on the rest, together with your stress and sleep on each side and the number of days behind every figure. Nothing at all is shown until you have fourteen days carrying both a checked meal and a symptom entry, and until then you are told how many days are left rather than shown a partial answer. A day you logged no meal on is not treated as a day you ate none of something: it is left out and counted separately. It is a description of your own diary and it does not say that one thing caused another. All of it describes what you recorded, and every question about what it means belongs with a clinician.

What your own settings change, and the one thing they cannot. If you tell us how a food group suits you, or mark an individual food, that decides how Loopa rates the foods it applies to and what it suggests to you - in search, in the meal planner, in the app's food suggestions and in the check you run before you eat. Two rules bound it. A setting that widens what you can eat applies only in the final phase, the one whose whole purpose is finding the widest diet that suits you; during the short restriction trial and the testing that follows it, everything you eat is measured the same way, because otherwise the comparison at the end is not measuring what it says it is. A setting that leaves a group out applies straight away, because nothing in the protocol depends on you eating anything. And marking a food as one you get on with never turns a food we have no measurements for into one we say is fine: where Loopa has not measured a food it says so, and your mark is shown beside that answer rather than in place of it.

What we work out from a bariatric or medical weight-management track. If you run one, three things are computed from your own entries and from published guidance, and none of them is medical advice. Where the reference calendar would put you compares the date you entered for your procedure against the day ranges in the published reference stages. It is shown beside where you actually are, never in place of it, and it never moves you: if your care team has sent in a protocol, or you have told us they advance you at your visits, then nothing but their instruction changes your stage. Supplement timing conflicts compare the reminder times you set against the published rule that iron and calcium are taken at least two hours apart, and offer you a time that clears it; the app never changes a time you set. How far your weight has moved from its lowest point since your procedure is a percentage worked out from weights you logged, and it is compared against a threshold: 10 per cent by default: only to decide whether to offer you a set of reading and a summary to take to an appointment. It decides nothing about your health, and no one is notified.

What we work out from a medication protocol. If you run one, four more things are computed from your own entries and nothing else. Your pattern buckets each day by how many days it fell after a logged dose and averages what you recorded on those days: check-ins, symptoms, sessions completed: and, once three full cycles are logged, names the days your logs put among your strongest and roughest. A weekly lean-mass protection score is a number from 0 to 100 built from the days you met your protein goal, the resistance sessions you completed and the direction of your lean-mass estimate; it is cached week by week, encrypted like the rest. Symptom and food patterns count how often a symptom was logged within three hours of a food you had logged, and are shown only once a symptom has five entries and the food appears before at least half of them. Your week places training days around those patterns and marks dose days as calendar markers. Every one of these describes what you recorded; none of them interprets it, none of them is advice about the medication, and each says "still learning" rather than guessing before it has enough of your logs.

Referrals. You have an invite code. If somebody uses it we record that their account came from yours, when, and whether they finished setting up. That is the whole of it. We never tell you who used your code, only how many people have, and we never tell them anything about you: what they know is what you wrote in the invite yourself.

We check for the obvious abuse: a code used on the account that owns it, an account already attributed to somebody, a burst of sign-ups against one code in a short window, and whether two accounts arrived from the same connection, and we keep the outcome of that check so the same decision is not made twice. Nothing about it produces a payment, a discount or a price, so there is nothing here that decides what anybody is charged.

Sending an invite never touches your contacts. The app hands the message to whichever mail or chat app you choose and you pick the recipient there. Loopa does not ask for permission to read your contacts, does not hold one, and never learns who you sent it to.

3.6 What we deliberately do not collect

We do not collect precise geolocation. We do not collect your contacts, your calendar, your photo library beyond the individual images you attach, your call or message logs, or your browsing outside Loopa. We do not fingerprint your device for advertising, and Loopa contains no advertising SDK of any kind.

We never receive your card number, bank details or full payment credentials. Those go to Apple, Google or Stripe, who tell us only whether a subscription is active.

We never receive your voice. When you log something by asking Siri or Gemini, the assistant does the listening on your device and sends Loopa only the finished instruction: an amount, a food name, a duration. No audio recording reaches us, and none is stored by us in any form. What your assistant itself keeps is governed by Apple's and Google's own policies, not this one.

4. Why we use it, and our legal basis for doing so

For readers in the EU, EEA, UK or Switzerland, the third column is our Article 6 basis, and Article 9 where health data is involved.

What we do	Why	Legal basis
Create and run your account, sign you in, keep you signed in	To provide what you asked for	Performance of a contract
Store, display and chart what you log	The core of the product	Performance of a contract, and your explicit consent for health data (Art. 9(2)(a))
Calculate targets, trends and forecasts	The core of the product	Performance of a contract; explicit consent for health data
Generate AI meal plans, coaching replies and food estimates	A feature you switch on and use	Performance of a contract; explicit consent for health data
Sync with a device or health platform you connected	You asked us to	Your consent, withdrawable by disconnecting
Send you reminders and notifications you configured	You asked us to	Performance of a contract; consent where required
Take payment and manage your subscription	To sell you the thing you bought	Performance of a contract; legal obligation for tax records
Keep the service secure, prevent abuse, investigate fraud	To keep Loopa working and safe	Legitimate interests
Screen a new member's forum posts against the Community Guidelines before publishing	To keep the community safe, and because the app stores require it of an app carrying user content	Legitimate interests
Understand which features are used, in aggregate, including usage analytics through HeyCatch (§7)	To improve the product and understand how people find and use it	In the apps: in the EU, the EEA, the UK or Switzerland, your consent, given by turning the switch on and withdrawn by turning it off; everywhere else, legitimate interests, and you can switch it off at any time in the app's settings. On loopahealth.app, HeyCatch runs for every visitor on the basis of our legitimate interests and the Terms of Service you agree to by using the site. Google Analytics on our websites, your consent through the cookie choice
Respond to your support requests	To help you	Performance of a contract; legitimate interests
Comply with law, respond to lawful requests, defend claims	We must	Legal obligation; legitimate interests

Where consent is the basis, you can withdraw it at any time. Stop using the feature, disconnect the service, or delete the data, and withdrawing does not affect anything done before you withdrew.

We do not use your information for automated decision-making that produces legal or similarly significant effects. The AI coach makes suggestions. It does not decide anything about you, it cannot change your subscription or your access, and you are free to ignore it.

5. Who we send it to

A clinician you choose. If you create a report (§11.1) and send someone the link, they can read what is in it. That is the entire point of the feature and it happens only when you do it. We do not send it for you, and we do not know who you sent it to.

We share personal information only with the companies below, only for the purpose named, and only under a written contract that forbids them from using it for their own purposes.

Who	What they receive	Why
Anthropic PBC	The health context described in §6, and what you type into the coach. Separately, the text of a forum thread or reply you post while you are a new member, for the moderation check in §6.1	Runs the AI features and the community content filter
Stripe, Inc.	Email, name and payment details you enter on the web	Processes web payments. Stripe is the controller of its own payment data.
Apple Inc.	Purchase receipts; a push token if you enable notifications	In-app purchases and push notifications on iPhone and iPad
Google LLC	Purchase receipts; a Firebase Cloud Messaging token if you enable notifications	In-app purchases and push notifications on Android
Withings, Oura Health, iHealth Labs	An authorization token you granted	Reads the data you asked us to sync
FatSecret, Open Food Facts	The food name or barcode you searched for	Food and nutrition lookup. They do not receive your identity or your log.
Giphy (Snap Inc.)	Your search term, if you insert a GIF in the community	GIF search
Google Analytics	Web usage of loopa.mobieus.io, only if you accept analytics cookies	Aggregate usage measurement. Not used in the mobile apps.
HeyCatch, Inc.	From the apps, only while the switch is on (off by default in the EU, the EEA, the UK and Switzerland, on by default elsewhere): your Loopa account number (or, before you sign in, a random identifier), the IP address your device connects from, app and system version, device model, general screen names, account events and your plan (§7). From loopahealth.app, for every visitor: the pages you visit and what you click there, with no name or Loopa account attached. Never your name, email address or health data	Aggregate usage analytics, as our service provider. HeyCatch runs its service with providers of its own, which it names publicly at heycatch.ai/subprocessors, and those can include AI model providers it uses to analyse usage. None of them receives your health data, because HeyCatch never does
Our own mail server	Your email address and the message	Sends account email. Operated by us, not a third party.

We also disclose information when the law requires it, when we must to establish or defend legal claims, or to protect the rights and safety of our members, and to a buyer or successor if Mobieus is acquired or merges: in which case this policy continues to apply until you are told otherwise, and you will be told before your information becomes subject to a different one.

If you are mobieusVerified

Verification belongs to you, not to one account, so it is recognized across every Mobieus community you belong to. Loopa, and any gym, club or employer running on Mobieus.

What crosses is one fact: that you are verified. Not your identity document, not the liveness video, not your date of birth, and nothing you have logged. A community you join learns that the person behind your account passed an identity check, which is what lets it open features a brand-new account waits for. It learns nothing else about the check and nothing at all about your health record, which stays governed by everything else in this policy.

It is asked for only about you. A community can ask whether one of its own members is verified. It cannot ask about anybody else's.

If you have friends in Loopa

A friendship in Loopa is a social connection, not a data-sharing arrangement. Somebody who is your friend can see:

your display name
your profile photo
your streak badge. How many days in a row you have logged something, but only if you leave "Show my streak to friends" switched on. It is on by default and it is one number. It does not say what you logged, or what any of it was.
how many friends the two of you have in common

That is the entire list. A friend cannot see your weight, your food diary, your fasting, your cycle, your measurements, your vital signs, your photos, your targets or your allergen list. Sharing any of that is a separate, per-category decision you make when you invite somebody as an accountability partner, described above, and ending a friendship, or blocking somebody, ends that sharing too, in both directions and immediately.

How people find you. Three ways, and no others:

an invite link you create and hand to somebody, which expires after seven days and which you can revoke at any time
a username search, and only if you have chosen to appear in one. The default is that somebody has to type your exact username; you can widen that or switch it off entirely
friends of friends, only if you switch that on

We never read your contacts. Neither app asks for the address book, and no part of Loopa matches an email address or a phone number to a member. If you type somebody's email address into the search, it finds nothing, because the search only ever looks at usernames.

Blocking is private. If you block somebody, they are not told, and nothing in the product will let them work it out. You each disappear from the other's view of Loopa.

Your health achievements are yours. Badges like "Ten Pounds Gone" are computed from your health record, so they are off your public profile unless you turn them on. You always see your own.

Everyone you are connected to, and everything each of them can see, is listed on your Your Data screen, with a button that ends each one.

If you are in a Family Group

A Family Group shares one Premium subscription between up to six adults. On its own it shares no health data at all: nobody in the group, including the person who pays, can see another member's food diary, weight, water, vital signs, measurements, photographs, medications or targets. Two things cross, and each is a separate decision you make for yourself.

The shared pantry, if you switch it on. What you add to it: the item, the quantity and your name beside them: is visible to the other members, and any of them can edit or remove it.

A meal you choose to share. You can send a meal to the rest of your Family Group, so that one person can build it and everybody else can log it in a tap. You can send a whole meal or a single food out of your own food diary, offer a food at the moment you log it, or send one of your saved meals without logging it at all.

What goes with it is a frozen copy of that meal: the foods, their portions, the calories and macronutrients for each one, which meal of the day it was, and its date: the day you ate it, or the day you sent it when it came from a saved meal you had not logged. Your name goes with it, because the people receiving it are being told who cooked.
Nothing else travels. Not the rest of your diary, not the day it sat in, not your weight, your targets, your allergen list or anything you have not sent. A photograph of the plate is never sent. It stays in your own encrypted storage and no other member can open it.
It is a copy, not a window. Changing or deleting the meal in your own diary afterwards does not change what they already hold, and does not reach into what any of them logged.
They decide what to do with it. Log it as it came, adjust the portion first, change it and pass their own version on, or ignore it. Anything they log becomes their own diary entry, encrypted with their own key, and it records that it came from you.
You see how it landed. How many people logged it, and which of them. That is the same visibility a Family Group already gives its members of each other's names, and nothing more.
A shared meal expires after seven days if nobody acts on it. Anything already logged is untouched.

It is one switch, and it is yours. "Family meal sharing" lives under Preferences in the app and in your health settings on the web, and it is on to begin with. Turning it off stops meals reaching you and stops you sending them: both directions, across every group you belong to. Nobody is told you turned it off; a member who has is simply not on the list, and anything already waiting for you is hidden rather than deleted, and comes back if you turn it on again in time.

Because a shared meal has to be readable by everybody you sent it to, and nobody else holds your key, the frozen copy is stored without your personal encryption on it. It is reachable only through a live membership of the group it was sent to, it goes when the seven days are up or when either of you deletes their account, and the copy anybody logs from it is encrypted with their own key like every other entry in their diary.

If you belong to an organization

An organization is a group inside Loopa: a gym, a club, a team at work, a set of friends who wanted a room of their own. This section applies only if you have joined one. If you have not, none of it happens to you.

You join by entering an invite code or opening an invite link, and you decide to do it. Organizations are private (there is no directory, no browse and no search) and nobody at one can attach your account without you. You may belong to as many as you like, and each is separate from the others: its own members, its own room, its own challenges, and your own role in each.

What joining gives you is a private room and the organization's challenges. The room is a forum space for its members. The challenges are its own contests, which you enter or ignore as you please. That is the entire list, and it is the entire list in both directions.

What an organization can never see is your health record, in any part, by any route. Not your food log, not your weight, not your photographs, not your measurements, not your workouts, not your cycle, not your vital signs. This is not a setting that happens to be switched off. There is no permission for it in the system, so there is nothing for anyone at your organization to be granted, ask for, or be given by mistake, including the person who owns it. No role there can recommend anything to you, and nothing you show your coach can be addressed to anybody at your organization.

A challenge shares one number, and only if you enter it. A challenge counts one measure over one stretch of dates: workouts logged, active minutes, steps, distance, water logged, days with a completed fast, or a daily check-in. Entering is a separate decision for each challenge, and the screen tells you which measure and which dates before you make it. What is shared is your total for that measure over that window, with the other members of that organization. Never a day of it, never where the number came from, never anything else about you. A leaderboard is named or anonymous, whichever the organization chose; on an anonymous one, the only row anybody can put a name to is their own. Coming out of a challenge takes you off the board.

What an owner and an administrator can do. Every organization has exactly one owner, and the owner may make other members administrators. Between them they change the organization's name, description, picture and accent color; share the invite code and retire one in favor of a new one; remove a member; mute a member in the room; create, close and delete the organization's challenges; and moderate that room. A mute applies to that room and to nothing else in Loopa. None of it touches anything you have logged, and moderation of the wider Loopa community stays with us.

Suspension and deletion. We can suspend an organization, which makes it read-only: nobody posts, nobody new joins, and its members go on reading their own history and can leave at any point. Its owner can delete it, which is permanent: the room and every post in it, every challenge and every result go, and there is no undo. Deleting your own Loopa account does the same to any organization you own, and ends every other membership you hold.

What we record about it. Which organizations you belong to, when you joined each, when you left, and your role in each. Separately, every administrative act on an organization is recorded; §3 says what is in that record and §9 says that it is kept for 90 days.

Leaving. One tap, and it deletes nothing. The room closes for you, you come out of any of its challenges that are still running, and your account, your subscription, your history, your data and every other organization you belong to are untouched. Results you already recorded stay on the boards they are on, because other people took part in those contests. The same is true if the organization is suspended or its owner deletes it.

A gym that runs Loopa for its own members is a different arrangement, and not one of the organizations described above. It is a partner of ours, with its own agreement and its own Loopa at its own address, and its name and color appear in your app. Once a month it sees counts about its members as a group: how many were active, how many hold Premium, how many are both, how many plans its coaches shared and how many were accepted, how many joined, how many left, and how many stayed 90 and 180 days. Those figures describe a set of people. They never name one. Its agreement with us forbids using anything it learns through Loopa in any employment, promotion, discipline, pay, insurance, benefits or membership-pricing decision about an individual, with no exception, and forbids requiring you to join or to share anything with a coach. If a coach there coaches you inside Loopa, what they see is what you switched on, per category, on your own consent screen, and you can switch any of it off at any moment; that organization cannot create the permission, cannot inherit it, and cannot see through it; and every time your coach opens your data it is logged and you can read the log.

If you joined Loopa through a partner

Some gyms, clubs and creators are Loopa partners. If you created your account through a partner's link, entered a partner's code, or claimed a partner program, we record which partner it was and when. That record is what lets us pay the partner a commission if you later choose a paid plan, and it is decided once: a later link or code from somebody else does not replace it.

A partner's link counts only if you create your account within that partner's attribution window after following it, which their terms set and which is 60 days unless they say otherwise. To know when you followed it, the link leaves a referral cookie in your browser (see §7). If you install the Android app from the link, Google Play passes the app the partner's code and the time you followed the link, and the app sends those two things to us once, when you first sign in; nothing else from Google Play is read or kept. A partner's code has no window: it counts when you enter it.

A partner is never told who you are. What a partner sees is counts about everyone who joined through them, as a group: how many followed their link, how many created an account, how many claimed their program, how many are in an included period or hold Lifetime Beta Access through it now, how many moved to Loopa Basic when an included period ended, how many chose Loopa Premium or Premium Family, and what they have earned. Never a name, an email address, or anything you log.

If you claim a partner program, we also record the claim: the date, the program, when your included period ends, the organization you joined with it, and which plan you already held when you claimed, so that a plan you were already paying for is never counted as one the partner brought. We record your acceptance of the Loopa Terms of Service and of the program's addendum separately, each with the version and effective date of the document, the time you accepted, and the internet address and browser you accepted from. That is how we can show which terms applied to you. An included period ends on its date and never becomes a paid subscription on its own.

Some partner programs give Lifetime Beta Access instead of an included period. Then the claim has no end date, and the record of your Lifetime Beta Access (the same record every holder of Lifetime Beta Access has) also notes which program you claimed it through and which partner that program belongs to. Places in those programs are limited, and we count how many have been used, as a number.

Claiming a program is written to our administrative audit log, with whether the partner was credited with bringing you. If we revoke a claim, which a program's addendum allows only when a claim broke that addendum or our Terms, the revocation is written there too, with the reason, and we email you to say what was withdrawn and why. The audit log records actions, not anything you log, and it is kept as §9 describes.

A partner that also runs an organization in Loopa sees that organization exactly as any organization owner does, as described above, and nothing more for being a partner. Being a partner gives no access to your health record, in any part, by any route.

If you have a Loopa Coach

This section applies only to members who have a coach. If you do not, nothing here happens to you, no coach can see anything of yours, and the coach screens do not appear in your app at all.

There are two ways to have one. You can sign up through a coach's referral link, which is how it worked before. Or, as of August 20, 2026, you can already be a member and tap a coach's link to join them. The link is the only way in either case, because a coach gives it to a specific person. There is no directory and no code to type. We record which of the two happened, because they are different decisions: one is choosing a coach while choosing Loopa, the other is deciding, with a history already behind you, to hand some of it to a named person.

A Loopa Coach is an independent person, not our employee, and they are paid a commission on subscriptions that start through their link, including yours. Because of that we treat what they can see as a disclosure to a third party rather than something internal, even though the data never leaves our systems.

Nothing reaches your coach until you turn it on. The consent screen starts with every category off. You choose them one at a time: weight, activity, workouts, body measurements, progress photos, nutrition, fasting, cycle, supplements, streaks, and, if you run one, GLP-1 support, testosterone therapy support, hormone therapy support and bariatric support. And you can turn any of them back off whenever you like. There is no button that turns them all on at once, and your coach is not allowed to make sharing a condition of coaching you.

The three protocol categories show a pattern, and nothing else. Each of them shows your coach exactly five things: which symptoms you logged and how they cluster around dose days, as counts; which days of the week your doses fall on; your 14-day averages for energy, mood, sleep quality and motivation; which calendar days are dose days, as markers on your coach's programming calendar; and which of your days your logs put among your strongest and roughest, as those two words only. They never show the compound name, any amount, any lab value, a note on any entry, the check-in scores behind a label, a question you wrote for your prescriber, your food-noise entries, or your supply and calculator figures, and testosterone therapy support never shows libido, even where you record it. Each of the three is its own switch, so turning one on says nothing about the others.

Bariatric support shows a shape, not a record. If you run a bariatric or medical weight-management track, this category shows your coach four things: which stage of the eating plan you are in and how long you have been in it; how many days you logged in the last two weeks, with your average protein and fluid against that stage's own target; how many of your supplement reminders are switched on, as a number; and which symptoms you flagged and how often over the last 30 days. It also shows that your care team has sent us a protocol, if they have. It never shows a supplement name or amount, a lab result or lab date, your weight, the notes you write on a symptom, the food beside one, your food-tolerance list, a question you wrote for your care team, or anything your care team wrote in their protocol. A coach supports the training and the habits; they cannot change your stage, your supplements or your lab schedule.

Low FODMAP support shows the plan, not the symptoms. If you run the Low FODMAP protocol, this category shows your coach seven things: which phase you are in and how long you have been in it; when your restriction phase is scheduled to end; how many of the last two weeks you logged on, as a number; which food groups you have tested and what each test found; which groups you have brought back; whether a challenge is running now, and which group it is for; and whether you started the protocol when Loopa did not suggest it. That last one is a yes or no about the app's advice rather than about you, and it is there so a coach can tell a protocol Loopa suggested from one you chose on your own judgment. It never shows a symptom score of any kind, anything about your stools, the notes you write on a symptom entry, your overall symptom score or how it compares with your baseline, which foods you ate, what any meal was checked as, the answers you gave when you enrolled, your answers to the digestive health questions, or what Loopa said about the protocol and why. A coach plans food around your phase and your tested groups; what your symptoms did on a given day stays between you and a clinician.

A consent you gave before September 2, 2026 is not widened for you. The calendar items are new. A protocol category you switched on before they existed keeps showing exactly what it showed then, and your coach receives no calendar markers from it, until you read the updated list and confirm it again in the app. We record which version of the list you confirmed.

Peptide protocols are never shared with a coach. There is no toggle for them, by design. There is no category to switch on, nothing for a coach to ask for, and no screen on their side where one could appear.

Workouts, body measurements and progress photos are three separate choices. Sharing your training log does not share your measurements, and neither one shares your photos. A coach who can see that you trained still cannot see your waist measurement or open a photo unless you switched that category on by itself.

Body measurements show your numbers. With this category on, your coach sees the measurements you recorded over the last 90 days (never further back than you can see yourself): each site's value and the date you recorded it, how each one has changed since the first reading in that time, and your body fat percentage if you record it. They are shown in your coach's own units, inches or centimeters, each with its unit beside it. Where the measurements came from, such as a connected device, is not shown.

Progress photos show your photos. With this category on, your coach can see your progress photos, full size and as small previews, with the day and the pose (front, side or back) of each. A photo is fetched from our servers every time your coach opens it, and checked against your switch at that moment. Its address works only for your coach and only while the switch is on, and we instruct their browser or app not to keep a copy. Every photo your coach opens, including each small preview, is recorded in the list of who looked. Switch the category off and your photos leave your coach's view the next time their screen asks for them. Your coach cannot change, delete or move a photo.

You have one coach at a time. Joining a coach ends any previous coaching relationship in the same act: that coach's private forum closes for you immediately, every category you had switched on for them is switched off, and anything you had shown them is withdrawn from their view. What they sent you stays in your own history, where you can still read it. Your subscription, your price and everything you have logged are untouched.

Showing your coach one session. Separately from the categories above, you can show your coach a single workout or activity session, with a note if you want to add one. It is one item, chosen by you, and it opens nothing else: showing a session does not open your training log, and nothing is ever shared on a schedule or by itself. There is no route in Loopa that puts anything of yours in front of a coach without you choosing that item.

The first time you share with a coach, we show you what they will see and record that you agreed. §3 lists what that record holds. It holds nothing you logged, and it is asked for per coach. A new coach is a new decision, not the renewal of an old one.
You can take a share back whenever you like, and it leaves your coach's view in that moment. Your own record of what you showed and when stays with you, including after you withdraw it.
Leaving a coach, or joining a different one, withdraws everything you had open with them at the same time as it switches every category off.

Everything in this section is in the app as well as on the web. You will find it under More, then Preferences, then Your coach. That matters: a control you can only reach from a browser is not really a control, so the switches, the record of who looked, stopping sharing and leaving are all two taps from the app's menu. Sharing a new session is done in the app, where the screen setting out what your coach will see lives; in a browser you can read what your coach has sent you, accept or decline it, and withdraw any share you have open.

Turning a category off cuts your coach's access to it immediately, including the history. It is not "from now on": permission is checked every single time your coach opens anything, so a category you switch off is closed even for data they could see yesterday.
Every time your coach opens one of your categories, it is recorded. Who, which category, when, and whether they were looking at a list of their clients or had opened you specifically. Those are different things and we used to record them identically, which made the record overstate. You can read it yourself, under "Who looked, and when".
What your coach is told about who you are is the name on your profile. If you have not given a name, they see your username with any email domain removed: never your email address, and never your account identifier.
Blocking your coach cuts all of it at once, along with their ability to send you anything. It does not change your subscription, your price, or your access to their forum.
Leaving your coach ends the relationship and revokes everything. Your subscription, your price and your history are untouched. If you later tap their link again you rejoin with every category off, exactly like a new client. Nothing you switched off comes back on by itself.
Your coach never sees a category you have not enabled. Not blurred, not hidden behind a count, not as an empty placeholder, and never as a prompt asking them to ask you for it. It simply is not there.
Your coach cannot change anything in your account. They can send you a short note, offer you a meal plan, and recommend a routine or point at a session of yours they would like you to repeat. Every one of those is an offer: you accept it or you decline it, and if you accept, your own account is what writes it. A routine you accept is copied into your own library and stays yours, including after the relationship ends.
What your coach can send you is limited. A small number of short notes a day, and a small number of posts to their group. That limit exists because someone paid on your subscription should not be able to use your app as a mailing list.
A coach gives general wellness guidance, not medical advice. Anything clinical belongs with your own clinician.

You can also share with a buddy or an accountability partner. That works the same way and on the same terms: you choose, per category, and you can stop at any time.

Beyond that, and beyond what you choose to share yourself, we do not share your information with anyone. Specifically:

We have never sold personal information and we will not.
We do not share personal information for cross-context behavioral advertising. Loopa carries no advertising.
Your health data is never disclosed for any advertising or marketing purpose, by us or by anyone we send it to.
Your health data is never used to train an AI model. Anthropic's commercial terms bar it from training on data submitted through its API, and our contract with them reflects that.
We do not disclose health data to data brokers, insurers, employers or credit reference agencies.

6. Artificial intelligence in Loopa

Loopa's meal planner, coach, food estimation and other AI features are powered by Anthropic's Claude models, accessed through Anthropic's API. The coach uses Claude Sonnet 5 and Claude Haiku 4.5, choosing between them for each message, and the screen that asks your permission names both. Anthropic processes the request and returns a result. It never uses what we send to train its models: its commercial terms bar it. It deletes what we send within 30 days, or keeps it for up to 2 years if the request is flagged for breaking its usage rules. We do not have a zero-retention agreement with Anthropic, so we do not tell you it keeps nothing.

What is sent, and when. Only when you use an AI feature, and only what that feature needs. The coach may include:

Your weight, goal, progress and BMI
Today's calories, macronutrients and water against your targets
Your calorie and macro targets, and your logging streak
What you told us at coaching setup
The message you just wrote, and up to your last 8 messages in that conversation with the coach's replies
A fast you are currently in
Your age, sex, and what brought you to Loopa
Medical conditions, prescription medications, and whether you are pregnant or nursing
Your diet style and the foods you never eat
The supplements you take, with doses
Today's steps and workouts, and the habits you are tracking
Which kinds of medication protocol you have switched on, and the protein, calorie, fiber and training settings they set
Your Low FODMAP protocol, if you run one: which phase you are in, how long is left, and which food groups you have tested (never a symptom score)
If you use Metabolic Insights, how many ketone readings you logged in the last 30 days, their trend, and the patterns found in your own data (never a reading's value)
Notable readings from your vitals and measurements
Your body fat percentage, whether you recorded it or Loopa estimated it, which method produced an estimate, and the fat and lean mass worked out from it and your weight

The last three of those exist for your safety: the app cannot avoid recommending a food you are allergic to, or a fasting protocol that is wrong while you are pregnant, unless it knows.

The coaching AI is told which kinds of protocol are switched on and the goal settings they create: the type only, never a medication name, a dose or a lab value. What reaches it is "a GLP-1 protocol is active" and the protein, calorie, fiber and training figures that follow from it, so that its advice about food and training matches what you are doing.

If you have a Low FODMAP protocol running, meal suggestions, recipes and the meal planner are told about it too. What they receive is the phase you are in and how many days into it you are, how many days your restriction phase has left, the food group and test food of a challenge you are in and which day of it you have reached, how the food groups you have tested suited you, the food-group settings and food marks you have made yourself, and, if you started the protocol with a constipation-predominant pattern, a note to favor fiber and fluids. That is so what they suggest fits the phase you are in. Your symptom scores, stool entries and notes are never sent. With no protocol running, nothing about Low FODMAP is sent.

A progress photograph you upload from the web is checked for its orientation, and only with your prior consent to that feature. If you have given it, the picture is sent to the AI provider for the single question of which way up it is, and for nothing else. A photograph taken in the app is never sent to any AI provider. The app records which way up it is at the moment you take it, so there is nothing to ask.

The app tells you this at the point of use. The coach screen shows the list assembled from your own data, so if you have entered no medications, it does not tell you medications are sent. Your name, email address, username and account identifier are not included.

AI output is not medical advice. It is generated by a language model, it can be wrong, and it is not a substitute for a clinician. Do not use it to diagnose, treat, or change a medication.

The coach checks what you write, and what it writes back, before you see a reply. Most of the checks run on our servers. If your message says you are thinking of harming yourself, describes a medical emergency, or asks for help eating far too little, purging or exercising to cancel out food, you get a fixed reply with crisis and emergency contacts and your message is not sent to the AI at all. If you ask the coach to play a therapist, a doctor or another person, or to ignore its rules, it declines without sending your message to the AI. If the AI's reply would diagnose you, give a medicine or supplement dose, tell you to start, stop or change a medicine, or claim something cures a condition, you see a fixed reply instead. These replies are free whatever plan you are on.

One check uses the AI provider. When your message is about to be sent to the coach or the habit builder, which happens only after you have agreed to send it (the screen that asks your permission says so), the same message, and the end of the one you sent before it, is also read by Claude Haiku 4.5 at Anthropic for one purpose: to look for signs that you may be in crisis or in danger that the checks above missed. If it finds them you get the same fixed reply with crisis and emergency contacts, and the coach does not answer that message. Anthropic handles this exactly as it handles the coach request (above): no training, deleted within 30 days, or up to 2 years if flagged. If the check does not answer within a few seconds, the coach carries on as it would have without it.

When a check acts we record which check it was in the usage row described below, and nothing of what you or the AI wrote. For the AI check we also keep a row with its outcome (no concern found, a concern found and of which kind, or that it could not run) and how many tokens it used, again with nothing of what you wrote.

If you would rather no health information reach an AI provider at all, do not use the AI features. Everything else in Loopa works without them.

We count how often you use an AI feature, and that record is about you. For each AI feature we keep a row saying which feature ran, that it was your account, whether you were on the free tier or Premium at the time, when, how many tokens it used and whether it succeeded, was refused, was stopped by a safety check (and which one), or was answered from cache. It holds no health content. Not the food, not the question, not the answer, and it exists for three reasons: two of Loopa's AI features have a daily limit on the free tier and the count is how the limit is known; we cap what the whole service can spend in a month; and we need to see when something is failing. You can ask us to delete it under §9, and it goes when your account does.

Estimates are shared between members, and that sharing contains nothing of yours. When the nutrient estimator works out what is in a set of foods, we keep the answer so nobody has to pay for the same question twice. What is stored is a one-way fingerprint of the foods and their amounts, the model that answered, and the nutrients: a fact about food, true for anyone who eats it. No account, no date and no log is stored with it, so it is not a record of you, it is not linked back to you, and deleting your account does not need to touch it. Your own logged day, and the estimate as it appears on your screen, stay in your account and are covered by everything else in this policy.

6.1 The community content filter

There is one place AI runs whether or not you asked for it, and it is fair that you know.

When a member who is new to Loopa posts a thread or a reply in the forums, the text of that post is sent to Anthropic and classified against the Community Guidelines before it publishes. If the classifier is confident the post breaks a rule, the post is held for a moderator instead of going live. Once a member is established, their posts are not checked at all.

Only forum threads and replies. Not your direct messages, not your health log, not anything you have not chosen to publish.
One exception, and it only happens after a report. If somebody reports a specific message or post (or you report one) the reported item's text is sent to Anthropic once, to help a human moderator triage it. That is a response to a report, not screening: nothing is read this way unless a person has flagged that particular item, and a moderator makes the decision either way.
Only the post. The title and body, HTML stripped and length-capped. Your name, email address, account identifier and health data are not sent.
No training, and limited retention. Anthropic returns a verdict and never trains its models on the content. It deletes it within 30 days, or keeps it up to 2 years if it is flagged for breaking its usage rules.
It fails open. If the call errors or times out, the post publishes.

We do this because a community where anyone can publish anything to everyone needs a first line that is faster than a person, and because the app stores require one of an app that carries user-generated content. Everything the filter holds still goes to a human.

7. Cookies and tracking

In the mobile apps: one analytics component, which you can switch off, and no advertising or cross-app tracking. The Loopa iPhone and Android apps contain no advertising SDK and no tracking pixel. We do not use Apple's advertising identifier, we do not use Google's advertising ID, and there is nothing to ask you to permit under App Tracking Transparency because we do not track you across other companies' apps or websites: nothing the apps record is combined with information from other companies' apps or websites, used for advertising, or given to a data broker.

The apps carry one analytics component, from our analytics provider HeyCatch (heycatch.ai), and this is the whole of what it sends:

Who: your Loopa account number, which is a number and nothing else. Before you sign in, a random identifier the app creates for itself. Never your name, your email address or your username. What it records is pseudonymous: tied to that number rather than to your name, but still about your account.
Your device: the app version, the operating system and its version, and the device model and type. HeyCatch also receives the IP address your device connects from, as any internet service does, and can use it to estimate a general location such as your country or city. Loopa never gives it your precise location, and has none to give.
Screens: which of these general screens you open: Today, Diary, Progress, Community, You, Membership, the Premium offer, Settings, setup, sign in and sign up. No other screen is recorded, and none whose name would say anything about your health.
Events: that you signed up, that you finished setup, that you saw the Premium offer (not which feature it was for), and that you started or completed a purchase, with the plan you chose.
Your plan: whether you are on Loopa Basic or Loopa Premium.

It never receives your health data: no food, weight, measurement, medication, protocol, symptom or anything else you log, nothing you write, and nothing from Apple Health or Health Connect. There is no screen recording and no record of what you tap.

Whether it is on to begin with depends on where you are. If you are in the EU, the EEA, the UK or Switzerland, it is off by default: nothing is sent until you turn on Share usage analytics in the app's settings, and turning it on is your consent, which you can withdraw at any time by turning it off again. Everywhere else it is on by default, on the basis of our legitimate interest in understanding how Loopa is used. To switch it off, turn off Share usage analytics in the app's settings; the app stops sending anything from that device straight away, and it stays off until you turn it back on. Switching it off changes nothing else about how Loopa works for you.

On loopahealth.app: your cookie choice itself, kept in your browser so we do not ask again, and the security cookies our host sets. Google Tag Manager loads, and nothing inside it runs until you choose: analytics cookies (beginning _ga) only if you turn Analytics on, and Google advertising cookies only if you turn Advertising on. Both are off by default, turning one off clears what it set, and Global Privacy Control switches advertising off. The cookie notice on that site lists the same.

HeyCatch on loopahealth.app runs for every visitor, on every page, wherever you are. It is not controlled by your cookie choice, and a Global Privacy Control signal does not switch it off. It records the pages you visit on loopahealth.app and what you click there, with your IP address and your browser and device type, and it keeps a random identifier in your browser so that visits from the same browser are counted together. Because loopahealth.app has pages about health topics, such as GLP-1 medications, weight-loss surgery and hormone therapy, the pages you visit can show an interest in a health topic. It does not know who you are: you do not sign in on loopahealth.app, and nothing it records there is joined to a Loopa account. The way to avoid it is not to use loopahealth.app, or to block scripts or clear site data for loopahealth.app in your browser. If you apply for the beta there, it records that an application was submitted, and nothing you put in the application.

On loopa.mobieus.io: cookies that are strictly necessary to sign you in and keep your session secure, and. only if you accept them. Google Analytics and Google Tag Manager for aggregate usage measurement. The banner appears before any analytics tag loads, "Decline" means no analytics cookie is set, and you can change your mind at any time. We use Google Consent Mode so the choice is passed on rather than merely remembered locally.

The referral cookie. If you follow a Loopa partner's link, loopa.mobieus.io sets a cookie named loopa_ref holding that partner's code, a random identifier for this browser, the time you followed the link and, if the link carried one, the partner's campaign label. It holds nothing about your health and nothing that names you. It lasts 90 days, and it is read once, when you create an account, to record which partner you came from (§5). Deleting it in your browser's settings means a partner's link is not credited.

Global Privacy Control. We honor the GPC signal. If your browser sends it, we treat it as a valid opt-out of any sale or sharing of personal information and of targeted advertising, without you having to do anything else. Because we do not sell, share or advertise, the practical effect on our websites is that Google Analytics and Google advertising stay off. GPC does not switch off HeyCatch on loopahealth.app, which runs for every visitor (§7) as our service provider and is neither a sale nor sharing (§15). GPC is a browser signal and the apps do not receive it; in the apps, use the switch described above.

8. How we protect it

Health data is encrypted with a key of your own. Every member has their own random 256-bit data encryption key. Health values are encrypted with it using AES-256-GCM before they are written to the database, and your key itself is stored only in wrapped form. A database dump, on its own, is useless. This covers your food logs, vitals, measurements, profile, supplements and progress photographs: and, if you run a medication protocol, the compound names, amounts and notes you typed, the note on any dose, every symptom and severity you recorded, your wellbeing check-ins and the lab values you entered.

We hold the key that unwraps yours, and you should know what that means. Your key is wrapped by a platform key that lives on the server, not by anything you know or carry. There is no passphrase of yours anywhere in it. So this is encryption that defeats a stolen database, a stolen backup or a stolen disk. It is not encryption that puts your record beyond our own reach: a small number of our staff, working on the server itself, can decrypt it. We would rather say that than let the word "encrypted" do work it has not earned.

Not everything is encrypted, and here is what is not. Your fasting times, the meal plans and weekly insights we generate for you, your habit check-ins, the record of health notices you accepted, the fluid Focus targets you chose to watch (the fact that you follow green tea, not how much of it you drank) the record of administrative acts on an organization, which names an act and who performed it and carries no health content at all, anything you post in the community, and the subscription identifiers your app store gives us are stored as ordinary text. So are three parts of a medication protocol: the cadence of the schedule you set, the route, and the site on the body map you chose. A reminder has to fire on the right day at the right hour, and the rotation map has to be drawn, and neither of those can be done from a value nobody can read. None of the three names a substance or an amount. So is the version of the coach-sharing disclosure you confirmed for each protocol category. A number that says which list you read, and nothing about your health. So are two facts about a Low FODMAP protocol you started: that you started it when Loopa did not suggest it, and which phase you told us you were already in. The first is a yes or no that names no condition and is reachable from more than one set of answers; the second is a phase name. The reason Loopa gave for not suggesting it is encrypted, because one of its three possible answers could only ever apply to somebody who told us about a specific condition, and so are the digestive health answers all of it was worked out from. So are the settings you make on that protocol: how you told us each food group suits you, and the name of a food you marked as one you get on with or one that bothers you. Every meal you check is rated against them, and a rating cannot be worked out from values nobody can read. A setting names a carbohydrate group and a mark names a food; neither names a condition, and any note you write on a mark is encrypted like everything else you write. None of it is trivial, and we are not going to pretend the list is shorter than it is.

Your password is never stored. See §3.1.

Every tenant has its own database. Loopa's data is not commingled with any other community on the Mobieus platform, and no query can reach across that boundary.

Beyond that: TLS on every connection, no plaintext secrets in the codebase, per-user API keys rather than shared ones, append-only audit logging for privileged actions, rate limiting, and access to production limited to the people who need it.

No system is perfect, and we will not pretend otherwise. If a breach affects your personal information we will notify you and the relevant regulators within the deadlines the law sets: 72 hours to the supervisory authority under the GDPR, and without unreasonable delay under US state and Canadian law.

9. How long we keep it

What	How long
Account and health data	While your account is open, and until you delete it
Meal photographs	Processed and discarded. The photograph is used to identify the food and is deleted once it has been, along with its thumbnail. There is no photo-history setting; if we ever add one we will say so here first
What a meal photograph was read as	24 hours, or until you log the meal, whichever comes first. It is what the review screen shows you and what lets you come back and finish. Encrypted with your key
What you corrected a photo estimate to	While your account is open, and it goes when your health data goes. It is the pair (what we read, and what you said it was) and it is what tells us whether the estimate is any good. Encrypted with your key
Progress photographs	While your account is open. Deleting your account unlinks them from disk
A meal you shared with your Family Group	While your account is open, and it goes when your health data goes. It stops being actionable after 7 days, and what any member logged from it is their own diary entry from then on
A medication protocol record	While your account is open, and it goes when your health data goes. The schedule and its cadence go with it
Your digestive health answers	While your account is open, and they go when your health data goes. They live in the same record as the conditions and medications you give us, so erasing your health data erases them in the same act. You can also change or clear any single answer yourself, at any time, without erasing anything else
Community posts and comments	While your account is open; you may delete them sooner
Direct messages	Until deleted by a participant
Support tickets	2 years after resolution, 3 years if closed
Record of which members viewed data you shared with them	365 days
Record of sharing consents you gave or withdrew	365 days
Record of a session you showed your coach	While your account is open, including after you take it back, so you can always see what you showed and when
Record that you were shown the coach-sharing screen and agreed	While your account is open. It holds no health data
Your conversations with the AI coach	365 days from each message, then deleted automatically. You can delete one conversation, or all of them, at any time in the app, and they go when your health data goes. Encrypted with your key
Record of health notices you accepted	While your account is open, and it goes when your health data goes. Withdrawing one MARKS it rather than erasing it, because a withdrawn acknowledgment is still the record that one was given: deleting the account deletes both
Sign-in attempts	30 days
Read notifications	90 days
Administrative audit log	Kept indefinitely. It is hash-chained and append-only precisely so that nobody, including us, can quietly edit the record of what an administrator did. It contains actions, not health data.
Which partner you joined through	While your account is open. Our commission records keep the account number a commission was earned on, and nothing else about you, for as long as billing and tax records are kept
A partner program you claimed, and the terms you accepted for it	While your account is open. Deleting your account deletes both, and the included period or Lifetime Beta Access it gave ends with it. The audit-log entry that you claimed it, or that it was revoked, is kept with the administrative audit log
Record of administrative acts on an organization	90 days, then deleted. It outlives the organization it describes, because deleting an organization removes its room, its challenges and its results and this is the only record left that any of it happened. It contains acts, not health data
Billing and tax records	7 years, because tax law requires it
Analytics (web, if you accepted it)	Per Google Analytics retention, currently 14 months
Usage analytics held by HeyCatch (§7)	For as long as we use HeyCatch to provide aggregate usage reporting, and deleted within two months after we stop. Ask us and we will have HeyCatch delete what it holds under your account number sooner (§10)

The point of a history app is history, so we do not silently expire your logs. They are yours until you say otherwise.

We keep a record of who reads your health data, and most of it you can now read yourself.

Open More → Preferences → Your Data in the app, or Settings → Your Data on the web. Under "Who has looked at your information" you will find every time a Loopa Coach opened something of yours (their name, the date, and which category) and every time Loopa support or an administrator opened your record, with their role, the date, what they looked at, and the reason they gave. Nobody at Loopa can open a member's record without picking a reason first, and that reason is what you see. If nobody has, it says so.

If you share data with a buddy or in a challenge, every time one of them views a category of it is recorded (who, what category, and when) and kept for a year. That particular record does not have its own screen yet; ask us and we will tell you what it says.

Separately, and in a log that cannot be edited or deleted after the fact, we also record any bulk export of a health record, with its date range and row count, and any occasion on which somebody signs into your account under our support-impersonation process. We keep that indefinitely, because a record that can be trimmed is not an answer to "who has seen my data".

The boundary still matters, so here it is. What you see covers a coach reading your data, a member of our staff opening your record in our own tools, and an operator signing in as you. It does not cover an engineer reading the database directly, because no application-level log can see that. The honest control there is who we allow near a database, not a log entry, and it does not cover our software reading your data to run the app, which is constant and has no person on the other end.

Ask at privacy@mobieus.io and we will tell you what either log says for you.

10. Deleting your account, and what that actually does

You can delete your account yourself, without asking us:

In the app: More → Delete Account
On the web: Account settings → Delete account
Or write to privacy@mobieus.io and we will do it

Deletion removes your account and cascades through every health table, and. This is the part that matters. it destroys your encryption key in the same transaction. Everything you ever stored becomes permanently undecryptable, by us and by anyone who ever obtains a copy of the database. Progress photographs are unlinked from disk. There is no undo and no recovery, so export first if you want a copy.

It takes any partner program you claimed and the record of the terms you accepted for it, and the included period or Lifetime Beta Access it gave ends with the account. The entry in our administrative audit log that says you claimed it stays, as every administrative audit entry does (§9); it records the action, not anything you logged.

It takes every meal you shared with your Family Group, and your record of the ones they shared with you. A meal one of them already logged stays in their diary, as an ordinary entry of theirs, with your name no longer attached to it.

It also takes your social side with it: every friendship in both directions, every request you had sent or received, every invite link you had created, every block you had placed, and every organization membership you held, including any organization you owned, which is deleted with everything in it. Blocks other people placed on you stop mattering the moment the account is gone.

Three things survive, and all are required: records we must keep for tax and accounting; moderation records where content was removed for violating the rules, kept so a banned account cannot simply return; and our administrative audit log, which is append-only and records actions taken on accounts, such as a partner program claimed or revoked (§9). A report you filed about somebody else is part of that moderation record and is kept, with your identity removed from it. None of them includes your health data.

Usage analytics (§7) is held by HeyCatch under your account number, not in your Loopa record, so deleting your account does not reach it by itself. Write to privacy@mobieus.io and we will have HeyCatch delete it. It never contains your health data.

Deleting your account does not cancel a subscription bought through Apple or Google. Cancel that in the App Store or Google Play, or you will keep being charged.

11. Taking your data with you

Every member can export, at any time, without asking:

CSV and Excel. Your complete health history, from Health → Export
PNG. Charts, for the ones you want as a picture
Account export. Your profile and community content
Family meals. Every meal you shared with your Family Group and every one they shared with you, with what you did about each, included in the account export

This satisfies the right to data portability. If you want something we do not already offer, ask.

11.1 Sharing a report with a clinician

Loopa can build a summary for a doctor, dietitian or pharmacist: your intake, weight trend, nutrient adequacy, medications and any interaction alerts, over a window you choose. It is made only when you ask for it, and it is shared only by you.

The file is stored encrypted with your own key, outside anything the web serves.
It is reachable only through a link containing 256 bits of randomness. There is no list of reports to browse and no way to guess one.
The link expires on a date you set (seven days by default, ninety at most) and you can revoke it at any moment. Revoking does not merely switch the link off: it deletes the file.
You may put a passcode on it, which we store only as a hash.
Every attempt to open it is recorded, successful or not, so you can see whether it was used. We keep the opener's network address only as a one-way hash: enough to tell you the same reader came back twice, not enough for us to identify them.
We never email the report and never send it anywhere ourselves. It goes where you send it and nowhere else.
Deleting your account deletes the reports and their files, and any outstanding link stops working.

Metabolic Insights is in a report only if you switch it on. If you use Metabolic Insights, the report can include a section with your ketone readings, the glucose each one was paired with, the glucose ketone index and the patterns the relationship explorer found. It is off unless you turn it on for that report, and it is left out if your Premium membership has ended.

A protocol summary is made when you ask and is not stored. If you run a medication protocol you can generate a summary of it for your prescriber, as a PDF or a spreadsheet, over a window you choose. It is built at the moment you ask for it and handed straight to you as a download. No copy of it is kept on our side, and there is no link to expire or revoke. Making one is written into your own access record, under "Who has looked at your information", so you can see afterwards that you made it and when.

12. Apple Health and Apple CareKit

If you connect Apple Health, Loopa reads only the categories you tick and writes back only what you ask it to write. Beyond that:

HealthKit data is never used for advertising or any similar service, and never will be.
HealthKit data is never sold, rented, or disclosed to data brokers, insurers, employers or marketers.
HealthKit data is never stored in iCloud. It is stored on your device and on our own servers, encrypted as described in §8.
HealthKit data is used only to provide the health features you are using, and to nothing else.
Lab results in Apple Health's clinical records can be read into your lab log, on iPhone, if you grant it. Only the markers you approve are read, only when you ask for them, and nothing is ever written back into your clinical records. What comes across is the marker, its value and its unit, kept exactly as it arrived and encrypted with your key like the rest of your record.
You can revoke access at any time in Settings → Health → Data Access & Devices → Loopa, or by disconnecting inside Loopa. Revoking stops future syncing; data already synced stays until you delete it.

Loopa's Care Plan is built on Apple's CareKit framework. It runs on your device, and the checklist data it produces is treated exactly like the rest of your health data.

13. Android Health Connect

If you connect Health Connect, Loopa reads only the data types you grant and writes back only what you ask it to.

Our use of Health Connect complies with the Google Play Health Apps policy and the Health Connect Permissions policy:

Health Connect data is used only to provide the features you are using, showing your data, calculating targets, and generating the insights you asked for.
Health Connect data is never used for advertising, marketing, or any similar purpose.
Health Connect data is never sold or transferred to a data broker, insurer, employer, or information-resale service.
Health Connect data is not used to determine credit or lending eligibility, and is not shared for those purposes.
We transfer Health Connect data to Anthropic only where you use an AI feature that needs it, as a service provider under contract, and for no other purpose.
We do not read data types we do not need, and we ask for a permission only when the feature that uses it exists.
Lab results are an iPhone matter. Reading lab results out of Apple Health's clinical records is an iPhone feature, described in §12; nothing equivalent is read from Health Connect, and no lab result is ever written to it.
Revoke access at any time in Settings → Apps → Health Connect → App permissions → Loopa. Deleting the Loopa app removes its Health Connect permissions.

14. Your rights

Everyone, wherever you live, has these rights on Loopa. We do not make them conditional on your jurisdiction:

Know what we hold about you and why
Access a copy
Correct anything wrong
Delete your account and everything in it
Export your data in a portable format
Withdraw consent to anything you consented to
Object to processing based on legitimate interests
Restrict processing while a dispute is resolved
Be free from retaliation for exercising any of the above

How. Most of it you can do yourself in the app. For anything else, write to privacy@mobieus.io from your account email. We reply within 30 days, and we will tell you if we need longer. We do not charge for this. We may ask you to confirm your identity: only to be sure we are not handing your health data to somebody else.

Authorized agents. In the US you may use an authorized agent; we will ask for proof of the authorization and may ask you to confirm it directly.

Appeals. If we refuse a request, we will tell you why, and you may appeal by replying with the word "Appeal". A different person reviews it and answers within 45 days. If we deny the appeal we will tell you how to complain to your state Attorney General.

Complaints.

EU / EEA: your national data protection authority. The list is at edpb.europa.eu
UK: the Information Commissioner's Office, ico.org.uk
Switzerland: the Federal Data Protection and Information Commissioner
Canada: the Office of the Privacy Commissioner of Canada, or the Commission d'accès à l'information du Québec
United States: your state Attorney General

We would rather you came to us first, but you are not required to.

15. If you are in the United States

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We have not done either in the preceding 12 months, including for consumers we know to be under 16.

HeyCatch receives usage analytics (§7) as our service provider. Its contract with us bars it from selling or sharing that information and from using it outside the service it provides to us, so sending it to HeyCatch is neither a sale nor sharing.

Categories collected in the last 12 months (California terminology): identifiers; customer records; commercial information (purchases); internet activity; sensitive personal information. Specifically health data, and account credentials in the OPAQUE form described in §3.1. Sensitive personal information is used only to provide the service you asked for and to keep it secure, which are the purposes California permits without a separate right to limit; we do not use it to infer characteristics about you.

We do not collect biometric identifiers, precise geolocation, government identifiers, or information about racial or ethnic origin, religion, philosophical beliefs, union membership, sexual orientation or immigration status.

Consumer health data. If you live in Washington (My Health My Data Act), Nevada (SB 370), or Connecticut, your health data on Loopa is consumer health data, and it has its own policy: Loopa Consumer Health Data Privacy Policy. Washington requires that document to stand on its own, so it is a separate page rather than a section of this one, and it is the one to read for those rights. That expressly includes the medications and supplements you record, the times you log taking them, and the interaction alerts we derive from them, and it includes any report you generate for a clinician. The whole of this policy applies to it, and specifically: §3 lists what we collect, §4 why, §5 exactly who receives it, §8 how it is protected, §9 how long it is kept, §10 how to have it destroyed, and §14 how to exercise your rights. We do not sell consumer health data and we have never collected a signed authorization to do so, because there is nothing to authorize. We do not use a geofence around any health care facility, and Loopa contains no geofencing capability of any kind. Washington residents may email privacy@mobieus.io and we will confirm deletion, including by notifying anyone we sent it to.

State rights. Residents of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia and any other state with a comprehensive privacy law have the rights in §14. Where a state gives a right to opt out of profiling with legal or similarly significant effects, note that we do not do that at all.

Loopa is not a HIPAA covered entity. We are not a health plan, a clearinghouse, or a health care provider that bills electronically, so the health data you record here is not protected health information under HIPAA and HIPAA's rules do not govern it. That is precisely why this policy, and the encryption behind it, are written the way they are.

16. If you are in Canada

We handle personal information in accordance with PIPEDA and, for Quebec residents, Law 25.

We rely on your consent, which is express for health information given the sensitivity, and which you may withdraw at any time subject to legal and contractual limits we will explain if they apply. We collect only what the purpose requires.

Your personal information is stored and processed in the United States, and is subject to lawful access there. Our service providers named in §5 operate in the United States and elsewhere.

Quebec residents also have the right to data portability (§11) and to be informed of automated decision-making: we make none, as §4 states. Our Privacy Officer is reachable at privacy@mobieus.io, and you may complain to the Commission d'accès à l'information du Québec.

17. International transfers

We operate from the United States and your information is stored there. If you are in the EEA, UK or Switzerland, that is a transfer outside your region.

We rely on the European Commission's Standard Contractual Clauses, and the UK Addendum where applicable, in our contracts with the service providers in §5, together with the technical measures in §8: in particular per-user encryption, which limits what any transfer actually exposes.

Ask at privacy@mobieus.io if you want details of the safeguards for a specific transfer.

18. Links to other services

Loopa links to Apple, Google, and the services you connect. Once you follow a link or authorize a connection, that company's own privacy policy governs what it does. We have no control over them and cannot answer for them. Read theirs.

19. Changes to this policy

We will update this page when what we do changes. The version number and date at the top always tell you which version you are reading.

For a change that materially affects your rights or expands how we use your information, we will tell you in the app and by email before it takes effect, and where the law requires consent we will ask for it rather than assume it. Continuing to use Loopa after a change takes effect means you accept the updated policy.

20. Contact


Privacy	privacy@mobieus.io
Support	support@mobieus.io
Post	Mobieus Partners LLC, Sheridan, WY, United States

A person reads that mailbox. Write in plain language; you do not need to cite a statute to get a straight answer.