Privacy Policy

Sthira is run by Kogos LLC, a Texas limited liability company (“we”). It helps you track food, weight, how you feel and, if you use them, GLP-1 medicines, and keep your medicine covered. That is personal health information, so we keep this simple: we collect what the app needs to work, we never sell it, we never use it for ads, and you can take it with you or delete it at any time. If you live in Washington State or want the short version for health data, read our Consumer Health Data Privacy Policy.

What we collect

• Account: your name, email, and a securely hashed password or your Google sign-in.
• Health information you log: medicines, doses and injection sites, meals and nutrition estimates, water, symptoms and side effects, weight, waist, blood sugar and A1C, energy and appetite, notes and appointments.
• Coverage answers, if you save a coverage plan: your type of insurance, your medicine, health conditions that affect coverage, your starting BMI, what you pay now, and whether you have an HSA, plus the steps and calls you check off.
• Profile: goal, height, birth year, sex if you choose to share it, diet, cuisine, language, country and time zone.
• Coach conversations, so the coach can follow up on earlier questions. You can clear them at any time.
• Payments: your plan, renewal date and purchases. Card details stay with Stripe; we never see your full card number.
• Messages you send us through the Contact page or the feedback box, and waitlist and partner applications.
• Website counts: page views and button taps with a random ID kept in your browser. If you arrive through a partner's or friend's link, a small first-party cookie remembers who referred you for 60 days. We don't store IP addresses or use advertising pixels.

Why we use it

• To run the features you ask for: logging, targets, insights, reminders, the coach, coverage plans, reports and calendar feeds.
• To send the emails you asked for, such as receipts and coverage deadline reminders. Every reminder has a link to turn reminders off.
• To answer your messages, keep your account secure and stop abuse, for example rate limits on sign-ups.
• To bill Pro and the Coverage Pack, and credit the partner who referred you, if any.
• To improve Sthira using totals across all members, never individual health records.

We collect and use health information only with your consent, which you give when you set up the app or save a coverage plan. You can withdraw consent by deleting your account; we then stop processing and delete your data as described below.

AI features

Meal photos, typed meals and coach questions are sent to our AI provider, Anthropic, to produce an estimate or an answer. Photos are deleted after the estimate; we store only what you save. Under Anthropic's commercial terms, this data isn't used to train their models. The coach is an AI, not a dietitian or doctor, and it never recommends a medication dose. Coverage plans and letters are built from fixed rules, not AI.

Who processes your data

• Anthropic: meal estimates and the coach.
• Our hosting and database providers (Vercel and Supabase): to store and serve your account.
• Stripe: to take payments in the US. Members in India pay through Razorpay or Dodo Payments.
• ZeptoMail by Zoho: to send account emails, receipts and reminders.
• Open Food Facts: receives only the barcode number you scan.

These providers act on our instructions under contracts that protect your data. They are mostly in the United States, so if you live elsewhere your data may be processed outside your country, with the safeguards the law requires.

We don't sell personal data, show ads, or share health data with advertisers, insurers, employers or drug makers.

Sharing you choose

• Report links: a read-only report you share with a doctor. Links expire after 14 days and you can revoke them.
• Coach sharing: if you add a coach in Settings, that coach sees your weight trend, protein, doses, symptoms and report. Nothing is shared until you add them, and you can stop at any time.
• Calendar feeds: a private link with your dose schedule or coverage deadlines that you add to your calendar app.

How long we keep it

• Your logs, coverage plan and account: until you delete your account. Deletion removes them from our database at once and from backups within 30 days.
• Messages to us: up to 2 years, so we can follow up, unless you ask us to delete them sooner.
• Waitlist entries: until we launch, or until you ask us to remove you.
• Payment records: as long as tax law requires, usually 7 years in the US. These contain no health information.
• Security logs: at least one year.

Your rights

• See and download everything as a file from Settings.
• Correct anything you logged, at any time, in the app.
• Delete your account from Settings. This permanently removes your logs.
• Withdraw consent, stop coach sharing, turn off reminder emails, and turn off calendar feeds and report links at any time.
• Depending on where you live, laws such as Washington's My Health My Data Act, the Texas Data Privacy and Security Act and the California Consumer Privacy Act give you further rights. Email privacy@example.com or use our Contact page to use them. We reply within 30 days (sooner where the law requires), and you can appeal any decision by replying to our answer.

Security and breaches

Data is encrypted in transit and at rest by our providers. Access to production data is limited to the small Sthira team. Private links use long random tokens you can revoke. If a breach affects your data, we will tell you without undue delay, and the authorities within the time the law sets (60 days under the FTC's Health Breach Notification Rule).

Children

Sthira is for adults aged 18 and over. We don't knowingly collect data from anyone younger.

Changes

If we make a material change, we'll email you and show a notice in the app before it takes effect.

Contact

Questions or requests: privacy@example.com, or our Contact page. Kogos LLC, Texas, United States.

If you live in India or the EU

We process your health information with your explicit consent under India's Digital Personal Data Protection Act and the GDPR. We keep security logs for at least one year and payment records for up to 8 years, as Indian law requires, and report breaches within 72 hours. Grievance officer: Sthira privacy team, Kogos LLC, at privacy@example.com. We acknowledge grievances within 48 hours and resolve them within 90 days. If you're not satisfied, you may complain to the Data Protection Board of India.