Consumer Health Data Privacy Policy

What we collect, and why

• Injury and pain notes. These are anything you tell your guide about injuries, pain, surgery, or limits on how you move. You add them in Profile › Health Profile, by voice or by typing. Your guide uses them to adapt your session and choose moves. It can make mistakes and cannot assess an injury or ensure a move is safe for you.
• Areas to work or avoid. These are the muscles and poses you ask your guide to focus on or skip. Your guide uses them to choose the poses in each session.
• Health details. These are the gender, age range, height, and weight you choose in your profile. Butter keeps a copy with your account so they follow you to a new phone. Your weight helps estimate calories. Older profiles may contain values you confirmed from Apple Health; new profiles do not read them from Health.
• Session activity. This is the sessions you start and finish, and the poses you hold and for how long. It includes the length, intensity, and difficulty you choose, your streaks, and what you tell us about how a session felt. Your guide plans your next session from what you did in your last ones. We also count sessions, durations, and poses, without your notes or health details, to see how Butter is used and where it fails. You can turn that off under Profile › Data & Privacy.
• What you say to your guide. When you speak a note, your phone turns the audio into text, and only the text reaches our servers. The audio never leaves your phone. That text is health data when it describes your body.
• Apple Health workouts. With your permission, Butter saves finished sessions as yoga workouts with estimated energy. It can read back only the workouts and energy records it added, to check, update, or remove them. It does not read other Health data or use Health readings to choose your session settings. Stop new saves under Profile › Apple Health. Change Apple's permissions in the Health app.
• Your guide's conclusions. Your guide draws conclusions from your notes and history when it plans or speaks. For example, it can decide to keep your low back easy this week. Those conclusions, including ones in saved plans or guide messages, are health data too. We do not keep a separate, lasting summary of you.
• Support and legal messages. Your messages, photos, and attachments can describe your health. This includes what you send in Chat with Concierge, messages sent to our support, privacy, or legal email addresses, and our replies. A person on our team reads and answers every message.
• Membership and email records. These can show that you use Butter or subscribe to health-related content. We use your current email topic settings to choose optional emails. See how email subscriptions start and stop. We keep delivery and opt-out records to manage those messages and your choices. We do not use your notes, health readings, or session history to choose marketing emails.
• Technical fault records. Error codes, timing, and app steps can show use of health features. They use random identifiers and help us find faults. These reports exclude notes, message text, and health readings. The same is true of the 7-day diagnostics log you can send when our team asks; we keep it for 30 days.

Heart rate and heart rate variability readings are health data, not biometric identifiers. Butter collects no biometric identifiers, no genetic data, and no precise location. We collect coarse location (country, region, city) for app diagnostics, as the Privacy Policy explains. We never use it to learn anything about your health, or to tell whether you are near a clinic or any other health facility.

Where it comes from

Your health data comes from these sources:

• you, when you type, speak, set something in the app, or contact us;
• your use of Butter, which creates your session history;
• the workouts and energy records Butter itself added to Apple Health, as described above;
• our own systems, which draw your guide's conclusions from the first three;
• a person you authorize to act for you, who may give us details needed to handle your request.

We do not buy health data.

How we use it

We use your health data only to:

• plan your sessions and your guide's words around your body;
• speak to you about your practice;
• keep your history and streaks, so your guide can plan from them;
• answer your questions and support requests;
• detect and fix faults that stop Butter from working;
• find bugs and improve the performance and accuracy of the existing planner, using relevant notes, health details, plans, and session results;
• see how Butter is used, from session counts and durations only, never from your notes or health details;
• send optional emails according to your current topic settings, and manage delivery and opt-outs.

We read your notes and health details to give you the sessions you asked for. That is what Butter is, so we do not ask separately and there is nothing to switch off; deleting your account is how it stops. The uses that are not part of giving you a session are your choice, and you can say no to each without losing Butter: seeing how Butter is used, keeping de-identified examples to improve the planner, and keeping extra copies of what your guide was asked and answered. We ask for separate permission before using your health data to develop a different product you are not using. We do not use your notes, health readings, health details, or session history for advertising or marketing. We do not sell health data or share it for cross-context behavioral advertising.

We also handle health data as needed to process your privacy requests and meet our legal duties. The limited records kept for those purposes are described below.

Who receives it

The companies below process health data for us. We do not permit our AI providers to train their models on the content we send. Their storage periods are listed below. We use random request identifiers, but notes and questions can contain details that identify you. xAI also receives your first name to speak it. Our providers must protect the data under their contracts.

When our team drafts a reply with the assistant, Anthropic also receives any health details you wrote in that support thread. No affiliate receives your health data, and no company other than those listed here receives it, except under the legal and safety disclosures below. We never send your health notes or readings to Stripe or Apple: a payment request carries your plan and your account code, nothing about your body. Our crash reports are built to exclude them too.

Other disclosures are limited to what law permits: to comply with law or valid legal process, or to address a threat to someone's safety. If Gregarious merges with or is bought by another company, this policy still applies to your health data. We will tell you about any change.

How we protect it

Our active databases and file stores are encrypted. Some fields have a second layer of encryption. These include profile details, saved notes, and support messages. We manage those keys apart from the data. Other practice records have the first layer only. Your answers about how a session felt are one of them. Each service uses its own identifier. Our identity system can link them, and the content can still identify you. We restrict access to people and service providers who need it to operate Butter, handle support and security, or review how well the guide plans. No system is perfectly secure.

Butter is not a HIPAA covered entity or business associate. HIPAA does not apply to the information you give Butter. Your rights come from the FTC Act, the FTC Health Breach Notification Rule, and state health data laws like Washington's My Health My Data Act.

How long we keep it

We keep completed sessions for the life of your account, unless you delete them. Cancelling a paid membership does not delete your history. Other health data follows the periods below.

We can retain examples to test the existing planner and improve its prompts, including after account deletion, only after verifying they are de-identified. We do not use your data or these examples to train or fine-tune AI models. The examples must not reasonably identify you or a device linked to you. We keep them in that form and do not try to identify people from them. Any recipient must agree to the same limits.

The 90-day limit below applies to extra copies we keep to debug AI results. Your saved notes and sessions have their own periods. We keep an older debugging example only in the de-identified form described above. Copying the data does not restart the 90 days.

Our database backups have a 30-day retention setting. Deleted records can stay in old backups until they expire. Our host may take more time to remove them. We restrict backup access to recovery.

Your rights

You have these rights over your health data. We do not charge for using them or discriminate against you for doing so. If you delete data, features that need it can no longer use it. For example, your guide can no longer plan from a note you deleted.

Know, and get a copy. You can ask whether we collect, share, or process health data about you. You can get a copy of it, and the list of every company that received it and how to reach them. In Profile, under Data & Privacy, you can download your data yourself. That file names those companies. Apple Health readings are not in it. Export them from the Health app.

Say no to the optional uses. Go to Profile, then Data & Privacy. You can turn off usage analytics there. Saying no to any optional use never costs you Butter. Your guide reading your notes and health details to plan your sessions is not one of these: it is the service itself, so there is no switch for it, and deleting your account is how it stops. If you turned that reading off while it was a switch, it stays off until you say otherwise. You can also ask us by email.

Delete. Open a note in Profile › Health Profile and choose Delete note. After deletion succeeds, your guide stops using it for new plans and messages. We scrub the note's text; a dated marker that a note existed stays. You can also delete your account under Profile › Account, or ask by email. Account deletion removes your notes, health details, and personal guide content, subject to the limited records and backup periods described here. If you subscribed on butter.yoga, it also cancels your membership and deletes your Stripe customer record. Provider copies follow the deletion process and exceptions described above.

How to ask. Ask in the app, or email privacy@butter.yoga. If your account has an email, use it to help us verify the request. You do not need to create an account to ask. We use reasonable checks to protect your data and ask only for details needed for those checks. We act without undue delay and respond within 45 days of receiving your request. Verification does not restart that clock. If we reasonably need more time, we tell you why within those 45 days and take at most 45 more. This does not extend an earlier deadline for deletion or stopping a use of your data. Someone you authorize can ask for you, and we check their authority.

For Nevada health-data deletion requests, we delete our active copies and notify recipients within 30 days of verifying the request. Backup copies follow the limits described above. We follow any shorter deadline that applies. You do not have to wait for our reply to use the app's deletion or withdrawal controls.

How to review or change your health data

You can see and change your health details any time in Profile. You can read, edit, and delete your notes in Profile › Health Profile. To review or change anything else, or to fix a mistake, email privacy@butter.yoga. You can read this policy any time in the app, under Profile, and at butter.yoga/health-privacy.

Appeals

If we turn down a request, we tell you why and how to appeal. Reply to our answer, or email privacy@butter.yoga with "Appeal" in the subject line. We review your appeal and give you a written decision, with reasons, within 45 days. If we still say no, we explain how to contact your state Attorney General: Washington at atg.wa.gov/file-complaint, Nevada at ag.nv.gov, Connecticut at portal.ct.gov/ag. Residents of other states can contact their own Attorney General.

One thing deletion does not erase

When you agree in the app, we record the choice, time, document version, screen, and a fingerprint of the exact text. If we have your email, the record can hold a code that matches an address you later provide. These records include your health-data consent choices. They do not contain your notes or health readings, but they can still identify you. We keep necessary evidence after account deletion to honor your choices and resolve legal claims. A claim can arrive after an account is gone.

How we tell you about changes

We never add a new kind of health data, a new use, or a new third-party recipient without asking you first. We tell you in the app, and you agree with a fresh tick before it starts. That agreement is its own act, never bundled with anything else. If we replace a company under Who receives it with another company doing the same job, we tell you in the app. We update that list. We do not ask for a new tick for that swap.

Whenever the words of this policy change, we ask you to read and agree to the new version in the app. We ask even for a small change. You can keep practicing while the request is pending. Closing it records no agreement. That is separate from your permission to use your health data. Agreeing to new words never turns that permission back on. If you turned it off, it stays off. We also tell you by email, if we have your address. The date at the top of this policy shows when it last changed. Every earlier version stays available at butter.yoga/legal/health-data/ followed by its version number, for example butter.yoga/legal/health-data/1.0.0.

Contact

Questions about this policy or your health data: privacy@butter.yoga Support: support@butter.yoga Legal: legal@butter.yoga

Effective date: October 2, 2026 Last updated: October 2, 2026

Gregarious, Inc. 2261 Market Street STE 85362 San Francisco, CA 94114

Portions adapted from Common Paper standard agreements (CC BY 4.0) and the Basecamp open-source policies archive (CC BY 4.0).