Legal

Privacy Policy

Effective [date of publication] · Last updated November 8, 2026

GURU Vitals is a screen-free band or ring, a body-composition scale and an app with an AI coach. They only work by handling your personal and health data, so we've tried to explain plainly what we collect, why, who sees it and what control you have. This policy covers the GURU Vitals app, devices, website and related services (the "Services").

1. The short version

• We collect health and fitness data from your device, scale and app so the Services can work. We use it to run GURU Vitals for you, and for nothing that you haven't agreed to.
• We don't sell your personal data. We don't use your health data for advertising, and we don't let advertisers track you in our app.
• Your trainer, your employer or anyone else sees your data only if you invite them, and only the data you choose. You can stop sharing at any time.
• The AI coach runs on a third-party AI provider. We ask your permission before the first conversation. The provider can't use your data to train its models, and neither can we unless you separately opt in.
• You can see, download, correct and delete your data, and delete your whole account, from inside the app.
• GURU Vitals is for adults aged 18 and over.

2. Who we are

The Services are provided by [legal entity name, e.g. GURU Vitals, Inc.] ("GURU Vitals", "we", "us"), a [state] [corporation / limited liability company] at [street address, city, state ZIP]. We decide how and why your personal data is processed. Contact details are in section 19.

We are not a health care provider, and in most cases the federal health privacy law HIPAA does not apply to us. This policy, the Consumer Health Data Privacy Policy and state privacy laws do. If you share data with someone who is covered by HIPAA, that law governs what they do with it once they have it.

3. What we collect

We don't collect your precise location. If we ever add a feature that needs it, such as GPS routes for runs, it will be off until you turn it on.

Cookies on our website

Our website uses one strictly necessary cookie, which remembers your cookie choice for 6 months. Two optional kinds stay off unless you accept them in the cookie banner:

• Analytics: Google Analytics shows us which pages people visit.
• Advertising: Google cookies measure whether our ads lead to visits, and may be used to show our ads to people who have visited the site.

Optional cookies only ever see website browsing. They never see your health data, your account or your contact details. You can change your choice at any time from "Cookie settings" at the bottom of every page. If your browser sends a Global Privacy Control signal, advertising cookies stay off. The website also loads fonts from Google Fonts, which receives your IP address when a page loads.

4. How we use it

• To provide the Services: sync your device, calculate your scores, run the coach, log your meals and workouts, build your plans and show your trends.
• To share what you ask us to share: with your trainer, employer program, other people you invite, challenge groups, partner gyms and connected apps.
• To keep the Services working and safe: fix bugs, prevent fraud and abuse, secure accounts and provide support.
• To improve the Services: check the accuracy of our scores and features and develop new ones. Where we can, we use de-identified or aggregated data for this.
• To talk to you: service and account messages. We send marketing emails only if you agree, and every one has an unsubscribe link. Marketing never uses your health data.
• To follow the law: tax and accounting records, responses to valid legal requests, and protecting our rights.

We won't use your data for a new purpose that isn't compatible with these without telling you first and, for health data, asking your permission.

5. Your consent and choices

The app asks for your permission at the moment it matters, not in a block of fine print:

• Collecting health data: when you set up the app, we explain what your device collects and why, and ask you to agree.
• Sharing health data: we ask separately before anything goes to the AI provider behind the coach, a trainer, an employer program, anyone else you invite or a challenge group.
• Phone permissions (camera, Bluetooth, notifications, Apple Health, Health Connect) are asked for by your phone's own system prompt, when you first use the feature that needs them.

You can withdraw any consent in the app under Settings › Privacy, or by emailing us. Withdrawing doesn't undo what was lawfully done before. If you withdraw your consent to collect health data, the core features stop working, because they need that data.

6. The AI coach and food scanning

The coach is AI

The GURU coach is an artificial intelligence, not a person, and not a doctor, dietitian or licensed trainer. To answer you, we send the relevant parts of your data (your message, goals, recent scores, logs and the coach's memories) to a third-party AI model provider, currently [provider name], which processes it for us as our service provider.

• We ask your explicit permission in the app before your first conversation. If you say no, the coach stays off and everything else still works.
• Our contract with the provider forbids it from using your data to train its models, and allows it to keep your data for no longer than [0 / 30] days, and only to detect abuse.
• We don't use your conversations, photos or health data to train or fine-tune AI models, ours or anyone else's, unless you separately opt in. Our Terms of Use say the same.

What the coach remembers, and how to make it forget

The coach remembers your goals, injuries, preferences and past conversations so you don't have to repeat yourself. In the app you can view, edit and delete individual memories, delete conversations, or reset the coach completely.

When the coach changes things

The coach can rebuild a workout, swap a meal or reshape your plan. It only changes your plan inside the app, it tells you when it does, and you can undo it.

Food scanning

The app uses your camera only while the food scanner is open, after your phone asks your permission. A meal photo is sent to [our servers / our AI provider] to recognize the food. We keep it [in your food log until you delete it / only long enough to analyze it, then delete it]. Barcode and label scans look up nutrition facts in third-party food databases using the product code or food name only, never your identity. Food photos are never used for advertising.

7. Who sees your data

People you choose

Every connection starts with an invitation that you send or accept. Each one shows exactly what the other person will see, and you can end it at any time in Settings › Sharing.

Once someone you've invited has your data, they are responsible for how they use it under their own policies and the law. Copies they've already downloaded or received can't be pulled back when you stop sharing.

Partner gyms

If you link your device's NFC key to a membership at a partner gym, such as an [EGYM]-equipped gym, we share the key's identifier with that gym so it can open the door or log you in. The gym records your visits under its own privacy policy. We never share your health data with gyms.

Apple Health and Google Health Connect

If you connect them, we read and write only the data types you approve in your phone's settings. Data from these platforms is never used for advertising or marketing, never sold, and shared with third parties only to provide the Services or when you ask us to.

Our service providers

We use companies that help us run the Services, such as cloud hosting, the AI model provider, email delivery, customer support, crash reporting and payment processing. They may use your data only to provide services to us, under contracts that require them to protect it at least as well as this policy does.

Legal reasons and safety

We disclose data when the law requires it (see section 17), or when we believe it's necessary to protect someone from serious harm.

If the company changes hands

If we're involved in a merger, acquisition or sale of assets, your data may transfer as part of it, still protected by this policy. We'll tell you before your health data moves to a new owner, and the new owner must ask your consent before using it in any new way.

De-identified data

We may share data that has been de-identified or aggregated so that it can't reasonably identify you. We won't try to re-identify it, and we require anyone we share it with to promise the same.

8. No selling, and no ads in the app

• We don't sell personal data and we haven't in the past 12 months.
• The app contains no advertising, and no advertising or data-broker code that tracks you across other companies' apps or websites. Nothing from the app is "shared" for cross-context behavioral advertising.
• On our website, Google advertising cookies run only if you accept them in the cookie banner. Some state laws call this "sharing" or "targeted advertising". It never involves your health data, your account or your contact details, and you can turn it off at any time in "Cookie settings".
• We don't use profiling to make decisions about you that have legal or similarly significant effects.
• We honor Global Privacy Control (GPC) and similar browser opt-out signals as a request not to sell or share your data. When your browser sends one, advertising cookies stay off on our website.

9. How long we keep it

10. Deleting your account

You can delete your account in the app under Settings › Account › Delete account. That deletes your whole account and the personal data in it, including your challenge entries, not just a deactivation. Deleting the account doesn't cancel an App Store or Google Play subscription, so cancel that in your store settings too. We tell our service providers to delete their copies. Deleted data leaves our live systems within 30 days and our backups within 6 months.

11. Security and breaches

We encrypt your data in transit and at rest. Only staff and contractors who need access to do their jobs have it, and they are bound by confidentiality. We review access regularly. No system is perfectly secure, so please use a strong, unique password.

If a breach exposes your data, we'll notify you, and any regulators, as the law requires. That includes the US Federal Trade Commission's Health Breach Notification Rule, which requires notice within 60 days of discovery.

12. Your US privacy rights

Wherever you live in the US, you can:

• Access the personal data we hold about you, and get a copy in a portable, machine-readable format;
• Correct data that is wrong;
• Delete your data;
• Withdraw consent you've given;
• Opt out of the sale of your data, targeted advertising and significant automated profiling (we don't sell your data or profile you; website advertising cookies run only if you accept them, and you can turn them off in "Cookie settings");
• Appeal if we refuse a request.

How to ask: use Settings › Privacy in the app, or email privacy@guruvitals.com. We verify requests by having you sign in or confirm from your account email. You can use an authorized agent if you give them signed permission, and we may still confirm your identity with you directly.

Timing: we reply within 45 days. If we need longer, we'll tell you why, and take no more than another 45 days.

Appeals: reply to our decision with "Appeal" within 60 days. We'll answer within 45 days and explain our reasons. If you're still not satisfied, you can contact your state Attorney General.

We won't charge you, deny you service or give you a worse service for using these rights.

13. California disclosures

In the past 12 months we collected these categories of personal information, as the California Consumer Privacy Act (CCPA) names them. We disclosed each for business purposes, to the recipients listed. We haven't sold any of it. If you accept advertising cookies on our website, Google receives identifiers and website activity for advertising, which the CCPA calls "sharing". Nothing else is shared, and health data never is.

Sources, purposes and how long we keep each category are in sections 3, 4 and 9. We use sensitive personal information only for the purposes the CCPA allows without a right to limit, such as providing the Services you ask for, security and quality, so we don't offer a "Limit the Use of My Sensitive Personal Information" link. We don't disclose personal information to third parties for their own direct marketing. We don't offer financial incentives in exchange for your data.

14. Washington, Nevada and Connecticut

These states have specific laws for consumer health data. Our Consumer Health Data Privacy Policy explains how we handle that data and how to use your rights under them.

15. Age limit

The Services are for people aged 18 and over. We ask for your date of birth at sign-up, and we don't knowingly collect data from anyone younger. If we learn that someone under 18 has an account, we delete it. If you think a child has signed up, email privacy@guruvitals.com.

16. Users outside the US

We are based in the US and store data in [the US / region]. If you live in the European Economic Area or the UK, we rely on your explicit consent to process health data, and on our contract with you for the rest. You also have the right to object, to restrict processing, and to complain to your local data protection authority. Transfers to the US are protected by [Standard Contractual Clauses / the EU-US Data Privacy Framework]. Our EU representative is [name, address] and our UK representative is [name, address]. Where local law gives you more rights than this policy, you have them.

17. Government requests

We don't hand over your data voluntarily. We disclose it only in response to a valid, legally binding request, such as a subpoena, court order or warrant. We push back on requests that are too broad, and disclose no more than the request requires. We tell you before disclosing, unless the law forbids it or there's an emergency.

18. Changes to this policy

We review this policy at least once a year. If we make a material change, we'll tell you in the app or by email at least 30 days before it takes effect. If a change means using your health data in a new way, we'll ask your consent first. The date at the top shows the latest version.

19. Contact us

[Legal entity name]
[Street address, city, state ZIP]
Privacy: privacy@guruvitals.com
Support: support@guruvitals.com
Phone: [phone number]