Privacy Policy

Last updated: August 5, 2026

1. Introduction

Buettner Labs LLC (“Buettner Labs,” “we,” “us,” or “our”), a Wyoming limited liability company, operates the Biohack mobile application and the website at buettnerlabs.com (collectively, the “Service”). This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our Service.

By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service.

2. Information We Collect

2.1 Information You Provide

  • Account information: when you create an account via email or Apple Sign-In, we collect your email address and, if provided, your name. If you sign in with Apple and choose to hide your email, we receive only the relay address Apple provides.
  • Profile and health data: optional information you provide such as age, biological sex, height, weight, activity level, dietary preferences, health goals, and any health conditions you choose to enter. In the EEA and the UK this is special category data concerning health; see Section 9.6.
  • Meal and nutrition data: photos, text descriptions, voice descriptions, barcode scans, and food intake data you voluntarily submit through the app, together with the ingredients and nutrient estimates derived from them.
  • Supplement data: supplements you log, including name, dosage, and schedule.
  • Fasting data: fasting start/stop times and related metrics you record in the app.
  • Coach conversations: the messages you exchange with the in-app AI coach, and the facts the coach records about you so it can refer back to them (for example a stated intolerance or a training routine). You can view and delete these facts at any time in the app under Coach memory.
  • Communications: when you contact us via email or support channels.

2.2 Information Collected Automatically

  • Device information: device type, operating system version, unique device identifiers.
  • Usage data: features used, actions taken, time spent, and interaction patterns within the app. We collect this using our own first-party analytics stored in our database and, subject to the consent rules below, Google Firebase Analytics (see Section 5).
  • Analytics consent: Firebase Analytics is switched off by default in the app. Outside the United States we ask you first, and nothing is sent to Firebase unless you agree. In the United States it is on from the start and you can switch it off at any time in the app. Which rule applies is decided by your App Store account's country, not by your phone's language: a US-language phone used in Germany is treated as German. You can change your choice at any time in the app.
  • Aggregate counters: regardless of the above, the app increments anonymous counters in our own database, for example how many meals were logged across all users on a given day. These carry no user ID, no device ID, and nothing else that could identify you; they are volume figures, not tracking.
  • Advertising identifier (IDFA): if, and only if, you grant permission when iOS asks, we use Apple's advertising identifier to understand which channel a new user came from. If you decline, no advertising identifier is used. You can change this at any time in iOS Settings → Privacy & Security → Tracking.
  • IP address: used for approximate location, security, and abuse prevention.
  • Crash and performance data: diagnostic information to help us identify and fix technical issues.
  • Subscription status: whether you hold an active subscription or trial. Purchases are processed by Apple; we never receive your payment card details.

2.3 Device Permissions

The app asks for the following permissions. Each is optional, each is requested only when the related feature is used, and each can be withdrawn in iOS Settings at any time.

  • Camera: to photograph meals for nutritional analysis and to scan product barcodes.
  • Photo library: so you can select an existing photo for meal analysis.
  • Microphone and speech recognition: so you can describe a meal by speaking instead of typing. Speech is transcribed on your device; the audio is not sent to us or to any third party. Only the resulting text is submitted, and only if you confirm it.
  • Location (while in use): used to estimate sunlight exposure at your latitude so the app can adjust your vitamin D target. Your coordinates are used on the device for this calculation and are not stored as a location history.
  • Apple Health: see Section 2.4.
  • Notifications: reminders you enable, such as fasting windows and logging nudges.

2.4 Apple Health (HealthKit)

With your explicit permission, the app can read data from and write data to Apple Health. We use this only to show your information back to you inside the app and to keep your records consistent between Biohack and Apple Health.

In line with Apple's requirements, we commit that:

  • We never use Apple Health data for advertising, marketing, or any similar service.
  • We never sell Apple Health data, and never disclose it to data brokers, advertising networks, or information resellers.
  • We never use Apple Health data for any purpose other than providing you with health and fitness features you have asked for.
  • Apple Health data is not shared with our AI providers.

You can withdraw Health access at any time in the Apple Health app under Sharing → Apps. Revoking access stops any further reading or writing immediately.

2.5 Information We Do Not Collect

We do not collect protected health information (PHI) as defined by HIPAA, and we are not a covered entity or business associate under HIPAA. We do not knowingly collect personal information from anyone under the age of 18. If you believe someone under 18 has provided us with personal information, please contact us at info@buettnerlabs.com and we will delete it promptly.

3. How We Use Your Information

We use the information we collect to:

  • Provide, maintain, and improve the Service.
  • Generate your personalized nutrition scores, nutrient tracking, coaching insights, and supplement recommendations within the app.
  • Answer your questions in the AI coach, which reads your own logged data to do so (see Section 4).
  • Analyze usage patterns to improve the user experience.
  • Measure which channels new users discover us through, where you have permitted this.
  • Send you product updates and service-related communications.
  • Respond to your inquiries and provide customer support.
  • Detect, prevent, and address technical issues, fraud, and abuse.
  • Comply with legal obligations and enforce our terms.

4. Artificial Intelligence and Your Data

Two features of the Service send your data to AI providers. We describe both here in full, because the scope differs and it matters which one you are using.

4.1 Meal scoring

When you submit a meal, the description, photo, or barcode result you provided is sent to Anthropic's Claude API to identify ingredients and estimate nutrients. Separately, short food descriptions may be sent to OpenAI's API to generate a numerical representation (an “embedding”) used to match your entry against our ingredient database. Neither provider receives your name or email address.

4.2 The AI coach

The coach is different in kind, and we want to be explicit about it. When you ask the coach a question, it looks up your own records in order to answer, and whatever it looks up is sent to Anthropic's Claude API as part of that conversation. Depending on the question, this can include:

  • your profile, including age, biological sex, height, weight, activity level, dietary protocol, goals, and any health conditions you entered;
  • your logged meals and their ingredients, nutrient totals and trends, and your score history;
  • your fasting sessions and your supplement schedule and adherence;
  • your food preferences;
  • earlier messages from your conversations with the coach, and the facts it has recorded about you.

If you do not want this data sent to an AI provider, do not use the coach. The rest of the app continues to work without it. Apple Health data is never sent to the coach.

4.3 Common terms

Neither Anthropic nor OpenAI uses your data to train their models. Both act as processors on our instructions, under contract, and retain data only as long as needed to return a result and to meet their own abuse-monitoring obligations. AI output can be wrong; see our Health Disclaimer and Section 10 of our Terms.

5. How We Share Your Information

We do not sell your personal information. We may share your information with:

  • Service providers: third-party vendors who help us operate the Service. These currently include:
    • Supabase: database hosting, authentication, and backend infrastructure.
    • Anthropic: AI meal analysis and the AI coach, as described in Section 4.
    • OpenAI: text embeddings used to match food descriptions against our ingredient database, as described in Section 4.1.
    • Google (Firebase Analytics): product analytics telling us which features are used and where people get stuck. Off by default and, outside the United States, sent only if you consent (see Section 2.2). Where you have additionally granted the iOS tracking permission, Apple's advertising identifier is used for install attribution.
    • Apple: Apple Sign-In authentication if you choose it, and processing of all subscription purchases.
    • Open Food Facts: open-source product database. When you scan a barcode, a query may be sent to Open Food Facts to retrieve product and nutrient information. Open Food Facts is a non-profit project; data is processed according to their privacy policy.
    • U.S. Department of Agriculture (FoodData Central): queried from our servers for reference nutrient data on packaged foods. These queries contain food identifiers only and carry nothing that identifies you.
    • Google Search Console: used to monitor how our website appears in Google Search results. It provides aggregated, anonymous data and does not place cookies on your device.
    • Google Ads: conversion tracking for advertising campaigns on our website. This tracking only activates after you accept cookies.
    These providers are contractually obligated to protect your data and use it only to provide services to us.
  • Legal compliance: if required by law, regulation, legal process, or governmental request.
  • Business transfers: in connection with a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. If you delete your account, we will delete your personal data within 30 days, except where we are required to retain it by law or for legitimate business purposes (such as resolving disputes or enforcing our agreements). You may request account deletion at any time through the app's Profile settings or by contacting info@buettnerlabs.com.

7. Data Security

We implement commercially reasonable technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. Data is encrypted in transit using TLS and at rest in our database, and access to your records is enforced at the database level so that one account cannot read another's. However, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

8. Cookies and Tracking Technologies

Our website may use cookies and similar tracking technologies to enhance your experience. These may include:

  • Essential cookies: required for the website to function properly (e.g., theme preference).
  • Analytics cookies: may be used in the future to help us understand how visitors interact with our website. We will update this section accordingly.
  • Marketing cookies: used to measure the effectiveness of our advertising campaigns. These include Google Ads cookies (such as _gcl_au). These cookies are only set after you accept cookies via our consent banner.

You can control cookies through your browser settings. Disabling certain cookies may affect the functionality of the website. The Biohack mobile app does not use cookies; the equivalent controls there are the iOS tracking prompt described in Section 2.2 and the analytics setting in the app.

9. Your Privacy Rights

9.1 All Users

Regardless of your location, you may:

  • Request access to the personal information we hold about you.
  • Request correction of inaccurate information.
  • Request deletion of your personal information and account.
  • Request a copy of your data by emailing info@buettnerlabs.com. We will provide your data in a portable format within 30 days. You can also export your data yourself from within the app.
  • Opt out of non-essential communications at any time.

9.2 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

  • Right to Know: you may request that we disclose the categories and specific pieces of personal information we have collected about you.
  • Right to Delete: you may request that we delete your personal information, subject to certain exceptions.
  • Right to Correct: you may request correction of inaccurate personal information.
  • Right to Limit Use of Sensitive Personal Information: health information is sensitive personal information under the CPRA. We use it only to provide the Service you asked for, which is a use the CPRA permits without a separate opt-out, and never to infer characteristics about you for advertising.
  • Right to Opt-Out: you have the right to opt out of the sale or sharing of your personal information. We do not sell your personal information. We do not share your health, meal, or coach data for cross-context behavioral advertising. If you grant iOS tracking permission, your advertising identifier is used for install attribution; you can withdraw that at any time in iOS Settings → Privacy & Security → Tracking, and declining has no effect on the Service.
  • Right to Non-Discrimination: we will not discriminate against you for exercising your privacy rights.

To exercise any of these rights, contact us at info@buettnerlabs.com. We will respond to verifiable requests within 45 days.

9.3 Residents of Other U.S. States

If you reside in Virginia, Colorado, Connecticut, Texas, Oregon, Montana, Utah, or other states with comprehensive privacy laws, you may have similar rights to access, correct, delete, and opt out of certain data processing. Several of these laws treat health data as sensitive and require your consent before it is processed; where that applies, we ask for it in the app. Contact us at info@buettnerlabs.com to exercise these rights.

9.4 Canadian Residents (PIPEDA)

If you are a Canadian resident, the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation provide you with rights regarding your personal information, including:

  • Right to Access: you may request access to the personal information we hold about you.
  • Right to Correction: you may request correction of inaccurate or incomplete personal information.
  • Right to Withdraw Consent: you may withdraw your consent to our collection, use, or disclosure of your personal information at any time, subject to legal or contractual restrictions.
  • Right to Complain: you may file a complaint with the Office of the Privacy Commissioner of Canada if you believe your privacy rights have been violated.

Health information is sensitive under PIPEDA and we rely on your express consent to process it. Your data is stored and processed outside Canada, including in the United States, where it may be accessible to courts and law enforcement under the laws of those countries. If you are in Quebec, you may also request that we cease disseminating your information and may exercise your right to data portability under Law 25. To exercise any of these rights, contact us at info@buettnerlabs.com.

9.5 Australian and New Zealand Residents

If you reside in Australia, the Privacy Act 1988 and the Australian Privacy Principles (APPs) provide you with rights regarding your personal information. If you reside in New Zealand, the Privacy Act 2020 provides similar protections. These include:

  • Right to Access: you may request access to the personal information we hold about you.
  • Right to Correction: you may request correction of inaccurate, out-of-date, or incomplete personal information.
  • Right to Complain: Australian residents may file a complaint with the Office of the Australian Information Commissioner (OAIC). New Zealand residents may file a complaint with the Office of the Privacy Commissioner.

Health information is sensitive information under APP 3 and the New Zealand Privacy Act, and we collect it only with your consent and only where it is reasonably necessary for the Service. Under APP 8 and Information Privacy Principle 12, we disclose personal information to overseas recipients: our hosting, analytics, and AI providers, who are located primarily in the United States. We take reasonable steps to ensure those recipients handle it consistently with the APPs and the New Zealand Privacy Act, but you should be aware that the information will be held outside Australia and New Zealand. To exercise any of these rights, contact us at info@buettnerlabs.com.

9.6 European Economic Area (EEA) Residents (GDPR)

Buettner Labs LLC is a United States-based company. However, if you reside in the European Economic Area (EEA), we are committed to respecting your rights under the General Data Protection Regulation (GDPR).

Legal Basis for Processing (Art. 6 GDPR)

We process your personal data on the following legal bases:

  • Consent: where you have given clear consent for a specific purpose, for example submitting meal photos for analysis, enabling analytics, or using the AI coach.
  • Contract Performance: where processing is necessary for the performance of a contract with you, for example providing the Service after you create an account or administering your subscription.
  • Legitimate Interest: where processing is necessary for our legitimate interests, such as ensuring security and preventing fraud and abuse, provided these interests are not overridden by your rights.

Health Data (Art. 9 GDPR)

Information about your health (the conditions you enter, and anything you tell the coach about your health) is a special category of personal data. We process it solely on the basis of your explicit consent under Art. 9(2)(a) GDPR, which you give when you choose to enter it and when you choose to use the AI coach. You are never required to provide it: every health field in the app is optional, and the Service works without it. You may withdraw your consent at any time by deleting the information in the app or by contacting us, without affecting the lawfulness of processing before withdrawal.

International Transfers

Your data is transferred to and processed in the United States. We rely on the European Commission's Standard Contractual Clauses, together with the supplementary measures described in Section 7, as the safeguard for these transfers under Chapter V GDPR.

Your Rights Under the GDPR

In addition to the rights listed in Section 9.1, EEA residents have the following rights:

  • Right to Erasure (Art. 17): you may request that we delete your personal data without undue delay where the data is no longer necessary for the purpose it was collected, you withdraw consent, or there is no other legal basis for processing.
  • Right to Restrict Processing (Art. 18): you may request that we restrict the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data or object to processing.
  • Right to Data Portability (Art. 20): you may request to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller.
  • Right to Object (Art. 21): you may object to processing of your personal data based on legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
  • Right to Withdraw Consent (Art. 7(3)): where we rely on your consent, you may withdraw it at any time.
  • Right to Lodge a Complaint: you have the right to lodge a complaint with a supervisory authority in the EU/EEA member state of your habitual residence, place of work, or place of the alleged infringement if you believe our processing of your personal data violates the GDPR.

We do not use your data for automated decision-making producing legal or similarly significant effects. Your longevity score is information for you, not a decision about you: it does not gate access to anything and no consequence follows from it.

To exercise any of these rights, contact us at info@buettnerlabs.com. We will respond to your request within 30 days.

9.7 United Kingdom Residents (UK GDPR)

If you are a UK resident, you have the same rights as described in Section 9.6 above under the UK General Data Protection Regulation (UK GDPR), including the treatment of health data as special category data processed on the basis of your explicit consent. In addition:

  • Supervisory Authority: you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe your data protection rights have been violated.
  • International Transfers: your data may be transferred to the United States where our servers and service providers are located. We rely on appropriate safeguards, including the UK International Data Transfer Addendum to the Standard Contractual Clauses, to protect your data during such transfers.

10. Third-Party Links

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies before providing them with any personal information.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a new “Last updated” date and, where appropriate, notifying you through the app. Your continued use of the Service after any changes constitutes acceptance of the updated policy.

12. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your privacy rights, contact us at:

Buettner Labs LLC
30 North Gould Street, Ste R
Sheridan, WY 82801
United States
info@buettnerlabs.com

Representative in the European Union (Art. 27 GDPR)
Friedrich Buettner
Thomas-Mann-Str. 2A
28213 Bremen, Germany
info@buettnerlabs.com

Individuals in the EEA may contact our representative on all matters relating to the processing of their personal data and the exercise of their rights under the GDPR.