Consumer Health Data Privacy Policy

What we collect, and why

• Injury and pain notes. These are anything you tell your guide about injuries, pain, surgery, or limits on how you move. You add them in Profile › Health Profile, by voice or by typing. Your guide uses them to leave out the moves you ask about. It can make mistakes and cannot assess an injury or ensure a move is safe for you. If a note asks Butter to treat or rehab an injury, your guide says it can't, offers to leave moves out instead, and does not save the request as an instruction. If a note mentions something like recent surgery, a new injury, sharp or worsening pain, or numbness, your guide suggests checking with a doctor and leaves that area out. Notes can also reveal things like pregnancy or a recent procedure if you mention them. We treat everything in your notes as health data.
• Areas to work or avoid. These are the muscles and poses you ask your guide to focus on or skip. Your guide uses them to choose the poses in each session.
• Setup health check. During setup we ask one question: whether you have an injury or something that hurts, had surgery in the last year, are pregnant or were in the last year, or have a condition that affects how you move. We keep your answer (yes, no, or that you would rather not say) with its date. If you answer yes or would rather not say, we ask you to check with your doctor, and ask whether your doctor has cleared you. We keep that answer too. You can also tell us what your doctor said to avoid. We save that as a note, so your guide leaves those moves out. We use it to point you to your doctor, and to ask again every 12 months, and whenever a note mentions surgery or pregnancy. Your guide does not read these answers, except what you tell us to avoid. If you said Not now when we asked to allow your guide, we still ask the health check for your safety, but keep only a record that we showed you the doctor screen, not your answers.
• Health details. These are the gender, age range, height, and weight you choose in your profile. Butter keeps a copy with your account so they follow you to a new phone. Your weight helps estimate calories. Older profiles may contain values you confirmed from Apple Health; new profiles do not read them from Health.
• Session activity. This is the sessions you start and finish, and the poses you hold and for how long. It includes the length, intensity, and difficulty you choose, your streaks, and what you tell us about how a session felt. Your guide plans your next session from what you did in your last ones. If you turn on usage analytics, we also count sessions and their length, without your notes, health details, or poses, to see how Butter is used and where it fails. It starts off; the switch is under Profile › Data & Privacy.
• What you say to your guide. When you speak a note, the app sends the recording to xAI, which turns it into text. xAI deletes the recording once it returns the text, under zero-retention terms. We keep only the text. That text is health data when it describes your body.
• Apple Health workouts. With your permission, Butter saves finished sessions as yoga workouts with estimated energy. It can read back only the workouts and energy records it added, to check, update, or remove them. It does not read other Health data or use Health readings to choose your session settings. In this policy, "health readings" means data stored in Apple Health. Stop new saves under Profile › Apple Health. Change Apple's permissions in the Health app.
• Your guide's conclusions. Your guide draws conclusions from your notes and history when it plans or speaks. For example, it can decide to keep your low back easy this week. Those conclusions, including ones in saved plans or guide messages, are health data too. We do not keep a separate, lasting summary of you.
• Support and legal messages. Your messages, photos, and attachments can describe your health. This includes what you send in Chat with Concierge, messages sent to our support, privacy, or legal email addresses, and our replies. A person on our team reads and answers every message.
• Membership and email records. These can show that you use Butter or subscribe to health-related content. We use your current email topic settings to choose optional emails. See how email subscriptions start and stop. We keep delivery and opt-out records to manage those messages and your choices. We do not use your notes, health readings, or session history to choose marketing emails.
• Technical fault records. Error codes, timing, and app steps can show use of health features. They use random identifiers and help us find faults. These reports exclude notes, message text, and health readings. The same is true of the 7-day diagnostics log you can send when our team asks; we keep it for 30 days.

Butter collects no genetic data and no precise location. We do not create voiceprints or use your voice to identify you. Voice-note recordings go to xAI only to be turned into text, and xAI does not keep them. Our security logs keep the IP address you connect from, and its country, for up to 30 days to stop abuse, as the Privacy Policy explains. Our delivery logs keep IP addresses for up to 90 days. We never use IP addresses to learn anything about your health, or to tell whether you are near a clinic or any other health facility.

Where it comes from

Your health data comes from these sources:

• you, when you type, speak, set something in the app, or contact us;
• your use of Butter, which creates your session history;
• the workouts and energy records Butter itself added to Apple Health, as described above;
• our own systems, which draw your guide's conclusions from the first three;
• a person you authorize to act for you, who may give us details needed to handle your request.

We do not buy health data.

How we use it

We use your health data only to:

• plan your sessions and your guide's words around your body;
• speak to you about your practice;
• keep your history and streaks, so your guide can plan from them;
• answer your questions and support requests;
• detect and fix faults that stop Butter from working;
• with Improve Butter on, improve how your guide plans sessions, and design and test new Butter features, using your requests and plans, profile details, answers and notes, effort ratings and session feedback;
• see how Butter is used, from session counts and lengths only, if you turn usage analytics on;
• send optional emails according to your current topic settings, and manage delivery and opt-outs.

We ask you to allow your guide once, on its own step and apart from our Terms, before anything goes to Anthropic, OpenAI, or xAI. You can turn it off at any time under Profile › Data & Privacy (Use my personal data to plan my sessions). When it is off, your guide gives you general sessions, and your notes and health details are not sent to Anthropic for planning. Your saved notes and health details stay in your profile, unused, until you turn it back on or delete them. You can also say no at that step and use general sessions. The uses that are not part of giving you a session are your choice. During setup, we ask you to answer each one: Turn on or Not now. Neither is pre-selected. Improve Butter lets our team use your requests and plans, profile details, answers and notes, effort ratings and session feedback to improve how your guide plans and to design and test new Butter features. Usage analytics holds nothing about your body or your practice. You can say no to each without losing Butter. We ask for separate permission before using your health data to develop a different product you are not using. We do not use your notes, health readings, health details, or session history for advertising or marketing. We do not sell health data or share it for cross-context behavioral advertising.

We also handle health data as needed to process your privacy requests and meet our legal duties. The limited records kept for those purposes are described below.

Who receives it

The companies below process health data for us. We do not permit our AI providers to train their models on the content we send. Their storage periods are listed below. We use random request identifiers, but notes and questions can contain details that identify you. xAI also receives your first name to speak it. Our providers must protect the data under their contracts.

When our team drafts a reply with the assistant, Anthropic also receives any health details you wrote in that support thread. No affiliate receives your health data, and no company other than those listed here receives it, except under the legal and safety disclosures below. We never send your health notes or readings to Stripe or Apple: a payment request carries your plan and your account code, nothing about your body. Our crash reports are built to exclude them too.

Other disclosures are limited to what law permits: to comply with law or valid legal process, or to address a threat to someone's safety. If Gregarious merges with or is bought by another company, this policy still applies to your health data. We will tell you before any change.

How we protect it

Our active databases and file stores are encrypted. Some fields have a second layer of encryption. These include profile details, saved notes, and support messages. We manage those keys apart from the data. Other practice records have the first layer only. Your answers about how a session felt are one of them. Each service uses its own identifier. Our identity system can link them, and the content can still identify you. We restrict access to people and service providers who need it to operate Butter, handle support and security, or review how well the guide plans. No system is perfectly secure.

Butter is not a HIPAA covered entity or business associate. HIPAA does not apply to the information you give Butter. Your rights come from the FTC Act, the FTC Health Breach Notification Rule, and state health data laws like Washington's My Health My Data Act.

How long we keep it

We keep completed sessions for the life of your account, unless you delete them. Cancelling a paid membership does not delete your history. Other health data follows the periods below.

With Improve Butter on, we can retain examples to test the existing planner and improve its prompts, including after account deletion, only after verifying they are de-identified. We do not use your data or these examples to train or fine-tune AI models. The examples must not reasonably identify you or a device linked to you. We keep them in that form and do not try to identify people from them. Any recipient must agree to the same limits.

The 90-day limit below applies to extra copies we keep to debug AI results. Your saved notes and sessions have their own periods. We keep an older debugging example only in the de-identified form described above. Copying the data does not restart the 90 days.

Our database backups have a 30-day retention setting. Deleted records can stay in old backups until they expire. Our host may take more time to remove them. We restrict backup access to recovery.

Your rights

You have these rights over your health data. We do not charge for using them or discriminate against you for doing so. If you delete data, features that need it can no longer use it. For example, your guide can no longer plan from a note you deleted.

Know, and get a copy. You can ask whether we collect, share, or process health data about you. You can get a copy of it, and the list of every company that received it and how to reach them. In Profile, under Data & Privacy, you can download your data yourself. That file names those companies. Apple Health readings are not in it. Export them from the Health app.

Say no to the optional uses. Go to Profile, then Data & Privacy. Usage analytics and Improve Butter each have a switch there, set to the answer you gave during setup. Neither is pre-selected when we ask. Saying no does not change what you get from Butter. Your guide reading your notes and health details has its own switch there too, Use my personal data to plan my sessions. It is on once you allow it, and you can turn it off at any time; your guide then gives you general sessions. You can also ask us by email.

Delete. Open a note in Profile › Health Profile and choose Delete note. After deletion succeeds, your guide stops using it for new plans and messages. We scrub the note's text; a dated marker that a note existed stays. You can also delete your account under Profile › Account, or ask by email. Account deletion removes your notes, health details, and personal guide content, subject to the limited records and backup periods described here. If you subscribed on butter.yoga, it also cancels your membership and deletes your Stripe customer record. Provider copies follow the deletion process and exceptions described above.

How to ask. Ask in the app, or email privacy@butter.yoga. If your account has an email, use it to help us verify the request. You do not need to create an account to ask. We use reasonable checks to protect your data and ask only for details needed for those checks. We act without undue delay and respond within 45 days of receiving your request. Verification does not restart that clock. If we reasonably need more time, we tell you why within those 45 days and take at most 45 more. This does not extend an earlier deadline for deletion or stopping a use of your data. Someone you authorize can ask for you, and we check their authority.

For Nevada health-data deletion requests, we delete our active copies and notify recipients within 30 days of verifying the request. Backup copies follow the limits described above. We follow any shorter deadline that applies. You do not have to wait for our reply to use the app's deletion or withdrawal controls.

How to review or change your health data

You can see and change your health details any time in Profile. You can read, edit, and delete your notes in Profile › Health Profile. To review or change anything else, or to fix a mistake, email privacy@butter.yoga. You can read this policy any time in the app, under Profile, and at butter.yoga/health-privacy.

Appeals

If we turn down a request, we tell you why and how to appeal. Reply to our answer, or email privacy@butter.yoga with "Appeal" in the subject line. We review your appeal and give you a written decision, with reasons, within 45 days. If we still say no, we explain how to contact your state Attorney General: Washington at atg.wa.gov/file-complaint, Nevada at ag.nv.gov, Connecticut at portal.ct.gov/ag. Residents of other states can contact their own Attorney General.

One thing deletion does not erase

When you agree in the app, we record the choice, time, document version, screen, and a fingerprint of the exact text. If we have your email, the record can hold a code that matches an address you later provide. These records include your health-data consent choices. They do not contain your notes or health readings, but they can still identify you. We keep necessary evidence after account deletion to honor your choices and resolve legal claims. A claim can arrive after an account is gone.

How we tell you about changes

We never add a new kind of health data, a new use, or a new third-party recipient without asking you first. We tell you in the app, and you agree with a fresh tick before it starts. That agreement is its own act, never bundled with anything else. If we replace a company under Who receives it with another company doing the same job, we tell you in the app. We update that list. We do not ask for a new tick for that swap.

Whenever the words of this policy change, we ask you to review the new version in the app. We ask even for a small change. You can keep practicing while the request is pending. That is separate from your choices about optional uses. Reading new words never turns an optional use back on. We also tell you by email, if we have your address. The date at the top of this policy shows when it last changed. Every earlier version stays available at butter.yoga/legal/health-data/ followed by its version number, for example butter.yoga/legal/health-data/1.0.0.

Contact

Questions about this policy or your health data: privacy@butter.yoga Support: support@butter.yoga Legal: legal@butter.yoga

Effective date: October 15, 2026 Last updated: October 15, 2026

Gregarious, Inc. 2261 Market Street STE 85362 San Francisco, CA 94114

Portions adapted from Common Paper standard agreements (CC BY 4.0) and the Basecamp open-source policies archive (CC BY 4.0).