Privacy Policy

This Privacy Policy explains how Peppy Panda Health Inc., an Iowa corporation ("PeppyPanda," "we," "us"), collects, uses, shares, and protects information when you use the PeppyPanda mobile app and website (together, the "Service"). PeppyPanda pairs you with "Peppy," an AI wellness companion for people going through GLP-1/GIP medication treatment or bariatric surgery weight-loss journeys.

1. Information you provide

• Account information — your email address and password (managed by our authentication provider), and, if you choose social sign-in, the basic profile information that provider returns (name, email).
• Health and wellness profile — information such as your weight-loss approach (e.g. GLP-1/GIP medication or bariatric surgery type), height, current and goal weight, calorie and protein targets, and related preferences.
• Logs you create — food and drink, water, supplements and vitamins, exercise and activity, weight, mood, and symptoms. You create most of these by chatting with Peppy in natural language; our AI extracts the structured details and saves them.
• Chat messages — the messages you exchange with Peppy. When your chat history is saved, we automatically remove common direct identifiers such as email addresses, phone numbers, and web links.
• Photos — any images you choose to upload (for example, progress photos or meal photos).
• Community content — if you use community features, the posts, comments, reactions, follows, and group memberships you create.
• Support communications — information you send us by email.

2. Information collected automatically

• Usage and device data — app version, device type and operating system, general diagnostic and crash information, and timestamps of your activity.
• Authentication tokens — a secure login token is stored on your device so you stay signed in.
• Push notification token — if you turn on notifications, your device generates a push token that we store so we can send the reminders you enabled. It identifies your device, not you, and is not used for tracking or advertising. Turning notifications off in your device settings revokes it.
• AI usage metrics — counts of AI requests and tokens processed, used to operate and rate-limit the Service.

PeppyPanda does not use third-party advertising trackers.

3. Information from connected services

If you choose to connect a fitness service such as Google Fit, we receive the data you authorize — for example step counts and activity — to display alongside your other logs. You can disconnect it at any time, which stops future syncing.

4. How we use your information

• Provide the core Service — logging your entries, generating your dashboard, tracking progress toward your goals, and letting Peppy respond with relevant context.
• Process your natural-language messages through AI models to extract structured logs and generate replies.
• Train, evaluate, and improve our own AI models so Peppy gets more accurate and helpful over time.
• Send you notifications you have enabled (such as check-in reminders).
• Operate, secure, debug, and improve the Service, including enforcing usage limits and preventing abuse.
• Respond to your support requests.
• Comply with legal obligations.

AI model training. We use conversations with Peppy and the information extracted from them to train, test, and improve PeppyPanda's own AI models. Common direct identifiers (email addresses, phone numbers, web links, and similar) are stripped when your chat history is stored and again before any data is used for training, and training data is not linked to your name or account. Our team also reviews and curates the examples used. We do not permit third-party AI providers to use your content to train their models, and we never sell your personal information. If you'd prefer your conversations not be used to improve our models, email us at support@peppypandahealth.com.

5. How we share your information

We do not sell your personal information. We share it only in these situations:

• Service providers who host and operate the Service for us, under agreements that require them to safeguard your information and use it only to provide services to us. By category:
  • Cloud hosting and database providers — run our application and store your data, including authentication and uploaded files.
  • AI providers — process the messages you send to Peppy so the Service can interpret them and generate replies. Depending on configuration this may be one or more third-party AI companies or a model operated by PeppyPanda, and the specific provider can change as we improve the Service. Third-party AI providers are engaged to process this data on our behalf and are contractually prohibited from using your content to train their own models.
  • Push notification delivery — delivering the notifications you enable relies on your device platform's messaging service (Apple on iOS, Google on Android). It receives your device's push token and the notification text, and processes them only to deliver the message.
• Other users — content you post in community features is visible to other participants according to the audience you choose.
• Legal and safety — when we believe disclosure is required by law or necessary to protect the rights, safety, or property of users or the public.
• Business transfer — in connection with a merger, acquisition, or sale of assets, with notice to you.

6. Data retention

We keep your information for as long as your account is active. When you delete your account, we permanently delete your profile, logs, chat history, photos, connected-service tokens, and community content, and we remove your login credentials. Backups and system logs are purged on a rolling basis. Content that was already incorporated into a trained AI model before your deletion request can't be individually pulled back out of that model, but we delete the underlying records and don't use them for future training. We may retain limited records where required for legal or security purposes.

7. Your choices and rights

• Access and correction — you can view and edit your profile and logs in the app, or ask us for a copy of your data.
• Deletion — you can delete your account and associated data at any time. See peppypandahealth.com/delete-account for instructions.
• Notifications — you can turn push notifications on or off in the app or your device settings.
• Connected services — you can disconnect Google Fit or similar integrations at any time.

Depending on where you live, you may have additional rights (for example, under the California Consumer Privacy Act or the GDPR) to access, correct, delete, or port your information, and to object to or restrict certain processing. To exercise any of these, email us at support@peppypandahealth.com. We will not discriminate against you for exercising your rights.

8. Security

We protect your information with encryption in transit (HTTPS), encryption at rest through our infrastructure providers, scoped access tokens, and access controls limiting who can reach production data. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

9. Children's privacy

The Service is intended for adults and is not directed to children under 18. We do not knowingly collect personal information from children under 13. If you believe a child has provided us information, contact us and we will delete it.

10. International users

PeppyPanda is operated from the United States and your information is processed and stored primarily there. Some service providers may process data in other countries; where they do, we rely on appropriate safeguards. If you access the Service from outside the United States, you consent to that transfer and processing.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you in the app.