Uppa Consumer Health Data Privacy Policy
Effective: 1 November 2026
This policy is required by Washington's My Health My Data Act and by similar laws in Nevada and Connecticut. It covers only consumer health data: information that is linked, or could reasonably be linked, to you and that identifies your past, present or future physical or mental health. It applies to everyone who uses Uppa, wherever they live.
Zero Morphism LLC ("Uppa"), 647 Escuela Pl, Milpitas, CA 95035. Contact: privacy@flyuppa.com.
Our general Privacy Policy covers everything else.
1. The consumer health data we collect
- Medicine: that you take or plan to take a GLP-1 medicine; which medicine, the dose, the schedule, the start date, and the doses you log.
- Symptoms: what you log in How I feel (for example nausea or constipation), how strong, and when; "Better now"; "Nothing bothering me"; answers to check backs.
- Body measurements: weight, height, goal range, sex and age range.
- From Apple Health, only if you allow it: your weight, and your sleep times (used for your wake and bed times).
- Eating and drinking: meals (photos, descriptions, items), the nutrition we estimate, food tags, drinks, and foods you avoid.
- Health facts you tell us: for example a fluid limit or a salt restriction.
- Inferences we make from the above: your daily plan, the changes made to it and why, which changes worked or didn't for you, and safety prompts such as "Worth a call".
- Waitlist and newsletter: your email address together with the fact that you joined the waitlist or asked for the newsletter for an app for people on GLP-1 medicines. The sign-up asks no health questions.
- Feedback: health information you choose to include in beta feedback or support messages.
We don't collect precise location, and we don't set geofences around health care facilities.
2. Where it comes from
- From you, when you join the waitlist or sign up for the newsletter, set up the app, log, answer or write to us.
- From Apple, if you test Uppa through TestFlight: your feedback and screenshots, if you send them.
- From Apple Health, only if you allow it: your weight and sleep times. Uppa only reads them and never writes to Apple Health.
- From the app, which works things out from what you log (section 1, inferences).
We don't buy health data, and we don't get it from anyone else apart from Apple Health when you allow it.
3. Why we collect and use it
- To build and adapt your daily plan, and show tips and safety prompts.
- To estimate nutrition from meals.
- To tell you when Uppa launches (the waitlist) and send the newsletter, if you signed up for it.
- To run the beta test, and to answer feedback and support.
- Only if you switch on "Improve Uppa": to check and improve how the app works, using de-identified data.
- To keep Uppa secure and meet legal duties.
We collect and share consumer health data only with your consent, or where it is necessary to provide the service you asked for. You give consent:
- on the waitlist or newsletter sign-up form (your email, only for those emails);
- on the health-data screens in onboarding;
- with the Apple Health permission on your iPhone;
- with the separate meal-photo switch;
- with the separate "Improve Uppa" switch.
4. Who we share it with
We share consumer health data only with processors who run parts of Uppa for us under contract. They may use it only to do that work for us, and never for their own purposes or to train AI.
| Processor | What it does | Health data it handles |
|---|---|---|
| Amazon Web Services | Hosting and storage for the app (US) | All of section 1 |
| Cloudflare | Hosts the website, delivers its pages, and stores waitlist and newsletter sign-ups (North America) | Your IP address and the pages you view, which could show an interest in GLP-1 medicines. Kept in server logs for 30 days. Also your email address, and the fact that you signed up for a waitlist or newsletter about an app for people on GLP-1 medicines |
| Amazon Web Services (Amazon Bedrock) | Runs the AI (Anthropic's Claude model) that estimates nutrition from a meal photo | The photo and its description. Not kept after the estimate, not sent to Anthropic, not used for training |
| Amazon SES (part of Amazon Web Services) | Sends the emails you asked for | Your email address, and the fact that you signed up for a GLP-1 app |
| Google Workspace | Our email, including support@ and privacy@ | Health information you choose to include in a message to us |
| Apple | Distributes the app and handles purchases | That you use Uppa, an app for people on GLP-1 medicines |
We share with affiliates: none today.
We never sell consumer health data, and we never share it with advertisers, data brokers, insurers or employers. We share it with no third parties other than the processors above, and with authorities only where the law compels us.
5. Your rights
You have the right to:
- Confirm whether we collect, share or sell your consumer health data, and see it, including a list of every third party and affiliate we've shared it with and how to reach them.
- Withdraw consent to our collecting and sharing it.
- Delete it. Deletion also reaches our processors and backups, as section 4 of the Privacy Policy describes.
- Appeal a refusal. Reply to our answer with "appeal". We'll respond within 45 days and tell you how to contact the Washington Attorney General if you disagree with the outcome.
How to use them:
- In the app: Profile → Privacy (export, the consent switches, delete account). Your plan is made from your health data, so withdrawing consent to collect it means deleting your data.
- Or email privacy@flyuppa.com from your account email.
- For the waitlist or the newsletter: use the unsubscribe link, or email us from the address you signed up with.
Timing: we respond within 45 days, and may extend once by 45 days if needed, telling you why. It's free.
We won't treat you differently for using these rights. The one exception: without consent to health data, the app can't build a plan, so we'd close the account or keep it with no health logging, whichever you choose.
6. Changes
We'll post any change here. If we want to use consumer health data for a new purpose, or share it with someone new, we'll ask for your consent first.