Privacy Policy
Effective Date: June 14, 2026 | Last Updated: June 14, 2026
🔒 Privacy at a Glance
- Your health data is protected. Apple HealthKit data and your supplement logs are never used for advertising, never sold, and never shared with ad networks or data brokers. We enforce this with technical controls (see our Consumer Health Data Notice).
- We do advertise. Like most apps, we use standard analytics and advertising tools (such as pixels and SDKs) to measure performance and promote Flexwell. Under some laws this is considered a "sale" or "share" of certain data — and you can opt out anytime.
- You're in control. Use our "Do Not Sell or Share My Personal Information" tools, and we honor Global Privacy Control (GPC) browser signals.
- Flex conversations. Your AI chats are processed by our AI providers (currently OpenAI and Anthropic) solely to generate responses. They are not used to train those providers' models.
- We never see your payment info. All payments are handled by Apple and RevenueCat.
- You can delete everything. Request full account and data deletion anytime at hello@flexwell.com or in the app.
Notice at Collection (California & other states): We collect identifiers, internet/app activity, commercial information, and — with your opt-in — health information, to provide and improve Flexwell, for analytics, and for advertising. We may "sell" or "share" certain non-health information for cross-context behavioral advertising. We do not sell or share health data. See your opt-out options in Sections 10 and 12.
1. Who We Are
Flexwell is owned and operated by Micawber Media LLC, a Texas limited liability company.
Address: 1885 FM 2673, Suite H31, Canyon Lake, TX 78132
Email: hello@flexwell.com
Website: flexwell.com
This Privacy Policy applies to the Flexwell mobile application, the Flexwell website (flexwell.com), and all related services (collectively, the "Service").
2. Information We Collect
Information You Provide
| Data Type | What We Collect | Why |
|---|
| Account Data | Email address, name (optional), password (stored as bcrypt hash) | Account creation and authentication |
| Supplement Stack | Supplements you track, dosages, timing preferences, custom entries | Core tracking functionality |
| Daily Logs | Which supplements you take or skip each day, timestamps | Consistency tracking and streaks |
| Flex Conversations | Messages you send to Flex, AI responses | Personalized AI supplement guidance |
| Barcode Scans | Barcodes and FNSKUs you scan | Supplement identification and lookup |
Information from Connected Services (Your Choice)
| Data Type | What We Collect | Why |
|---|
| Apple HealthKit Data | Heart rate, sleep duration, steps, HRV, blood oxygen (opt-in only) | Health-contextualized Flex advice and insights |
Information Collected Automatically
| Data Type | What We Collect | Why |
|---|
| Device Info | Device type, operating system, app version | Bug fixes and compatibility |
| Usage Data | App opens, feature usage, screen views, in-app events | Analytics and improving the app experience |
| Identifiers & Activity (for ads/analytics) | Device/advertising identifiers, cookies (web), IP address, app/web activity, general (non-precise) location | Analytics, attribution, and advertising for Flexwell (see Section 7) |
Information We Never Collect
- Credit card or payment details (handled entirely by Apple and RevenueCat)
- Precise GPS location
- Contact lists or phone contacts
- Biometric identifiers (no face geometry, fingerprints, or voiceprints — see Section 19)
- Photos or microphone content (camera is used only for barcode scanning and images are never stored)
3. How We Use Your Information
We use your information for the following purposes:
- Provide the Service: Supplement tracking, daily logs, streak calculations, barcode scanning
- Power Flex AI: Your supplement stack, health data, and conversation history are sent to our AI providers to generate personalized guidance
- Health Insights: Analyze connected health data to provide trends and supplement optimization suggestions
- Interaction Warnings: Check your supplement stack for potential interactions
- Account Management: Authentication, password resets, account settings
- Communication: Respond to support requests, send service updates
- Analytics & Improvement: Understand usage patterns (in aggregated or pseudonymized form where possible) to improve features and fix bugs
- Advertising & Marketing: To promote Flexwell, we may use information such as the fact that you visited our website or downloaded our app to show you advertisements for Flexwell on other platforms (e.g., Meta, Google, TikTok, Apple Search Ads) and to measure campaign effectiveness. We do not use your health data for this purpose.
Health-data line we will not cross: We never use your Apple HealthKit data or supplement health information for advertising, and we never sell it. Our advertising and analytics partners do not receive it.
4. AI and Machine Learning (Flex)
Flex is Flexwell's AI-powered supplement advisor. Here is exactly how your data is used:
- What Flex sees: When you chat with Flex, we send your current supplement stack, recent health data (if connected), consistency history, and your conversation history to generate a personalized response.
- Processing: Flex conversations are processed using third-party large language model providers, currently OpenAI and Anthropic. Your data is sent to these providers via their APIs solely to generate responses.
- Training: Per these providers' API data usage policies, data submitted via their APIs is not used to train their models. We configure available settings to disable training and minimize retention.
- Storage: Your Flex conversation history is stored in our database to provide context for future conversations and improve response quality.
- No significant automated decisions: We do not use AI to make automated decisions that produce legal or similarly significant effects on you.
Important: Flex provides informational guidance only. It is not a substitute for professional medical advice, diagnosis, or treatment. Always consult a qualified healthcare provider before making changes to your supplement regimen.
5. Health Data, HealthKit & Health Data Firewall
If you choose to connect Apple HealthKit, we access health metrics you explicitly authorize, such as heart rate, sleep, steps, HRV, and blood oxygen. We also treat the supplements, dosages, and wellness notes you enter as sensitive health information.
Apple HealthKit Commitments (Required by Apple):
- Health data obtained from HealthKit will not be sold to advertising platforms, data brokers, or information resellers.
- Health data will not be used for advertising or marketing purposes.
- Health data will not be shared with third parties without your explicit consent, except as required to provide the Service (e.g., sending to our AI providers for health-contextualized advice).
- Health data will be used solely for providing health-related features directly to you within the Flexwell app.
- You can disconnect HealthKit at any time in your device settings or within the Flexwell app.
Health Data Firewall
We apply technical controls so that health data is structurally separated from advertising and analytics. We do not include, log, or infer health data in any advertising, attribution, analytics, or crash-logging tool. We maintain a "no-send" blocklist of health-related fields, labels, and parameters so that such data does not reach those tools.
We store health data in our secure database with source attribution (e.g., "apple_health") to provide trends and power Flex's health-aware insights. This data is encrypted in transit and at rest.
Flexwell is not a HIPAA-covered entity. However, we treat all health data with the highest level of care and apply security standards consistent with sensitive health information. See our dedicated Consumer Health Data Privacy Notice for state-specific rights and consents.
6. How We Share Information
We share data in these circumstances:
- AI providers (OpenAI, Anthropic): Supplement stack, health data, and conversation history are sent to power Flex responses. These providers do not use API data to train their models.
- Apple / RevenueCat: Purchase receipts are processed by Apple and RevenueCat for subscription management. We never receive your credit card information.
- Hosting Provider: Our database and API are hosted on Railway. They process data on our behalf under standard data processing terms.
- Email Provider (Customer.io): If you opt in to marketing emails, your email address is shared with Customer.io for email delivery.
- Advertising & Analytics Partners: For non-health data, we share certain identifiers and activity with advertising and analytics partners for cross-context behavioral advertising and measurement (see Section 7). Under California law this may be a "sale" or "share"; you can opt out (see Section 12).
- Legal Requirements: We may disclose information if required by law, court order, subpoena, or government request.
- Business Transfer: If Micawber Media LLC is acquired or merges with another company, your data may be transferred as part of that transaction. We will notify you before your data becomes subject to a different privacy policy.
7. Advertising, Analytics & Tracking Technologies
Like most online services, we use cookies, pixels, SDKs, and similar technologies ("Trackers") to operate, measure, and promote the Service.
- Essential: Some Trackers are necessary for the Service to function (security, authentication).
- Analytics: We use analytics tools to understand how the Service is used so we can improve it.
- Attribution: We use attribution tools to understand which campaigns drive installs and subscriptions.
- Advertising: We and our partners use Trackers to show and measure advertisements for Flexwell, and to build audiences for our own campaigns.
Website consent: On flexwell.com, non-essential Trackers (analytics and advertising) load only after you consent via our cookie banner. You can change your choices at any time using the "Cookie Settings" link in the website footer. EU/UK visitors are shown a consent manager consistent with local law.
No health data: Per our Health Data Firewall (Section 5), no health data is shared with any advertising or analytics partner.
8. Third-Party Services
Flexwell integrates with the following third-party services. This list may change; we update it as vendors change.
| Service | Purpose | Data Shared |
|---|
| OpenAI, Anthropic | Power Flex AI advisor | Supplement stack, health data, conversation messages |
| Apple HealthKit | Health data sync | Read-only access to authorized metrics |
| RevenueCat / Apple App Store | Subscription & payment | Purchase receipts, subscription status (payment handled by Apple) |
| Railway | Cloud hosting | All app data (encrypted) |
| Customer.io | Email marketing (opt-in) | Email address only |
| Meta, Google, TikTok, Apple Search Ads | Advertising & measurement | Non-health identifiers & activity (with consent on web) |
| Analytics / attribution provider | Analytics & install attribution | Non-health usage events, device identifiers |
Each service operates under its own privacy policy. We encourage you to review them.
9. Data Retention
- Active accounts: We retain your data for as long as your account is active.
- Consumer health data: Retained for the life of your account and deleted within 30 days of account deletion.
- Analytics/advertising data: Retained up to 24 months unless you opt out earlier.
- Deleted accounts: When you request account deletion, we permanently delete your personal data within 30 days, including your supplement stack, daily logs, Flex conversation history, and health data.
- Anonymized data: We may retain anonymized, aggregated data (that cannot identify you) for analytics purposes.
- Legal obligations: We may retain certain data as required by law (e.g., transaction records for tax purposes).
- Backups: Deleted data may persist in encrypted backups for up to 90 days before being purged.
10. Data Security
We implement industry-standard security measures to protect your data:
- Encryption in transit: All data transmitted between the app and our servers uses TLS (HTTPS) encryption.
- Encryption at rest: Database is encrypted at rest via our hosting provider.
- Password security: Passwords are hashed using bcrypt with salt. We never store plaintext passwords.
- Authentication: JWT-based authentication with 30-day expiry.
- Access control: API endpoints require authenticated access; users can only access their own data. Administrative access to consumer health data uses role-based access controls.
No system is 100% secure. While we take extensive precautions, we cannot guarantee absolute security. If you believe your account has been compromised, contact us immediately at hello@flexwell.com.
11. Your California Privacy Rights (CCPA/CPRA)
If you are a California resident, you have the following rights under the CCPA, as amended by the CPRA:
- Right to Know / Access the personal information we collect, use, disclose, sell, and share.
- Right to Delete your personal information.
- Right to Correct inaccurate personal information.
- Right to Opt-Out of Sale/Sharing: We sell or share certain non-health personal information for cross-context behavioral advertising. You may opt out (see Section 12).
- Right to Limit Use of Sensitive Personal Information: We only use sensitive personal information (including health data) to provide the features you request. You may request we further limit such use.
- Right to Non-Discrimination for exercising your privacy rights.
Categories of Personal Information (Last 12 Months)
| Category | Collected | Sold/Shared for Advertising |
|---|
| Identifiers (email, name, device IDs) | Yes | Yes (device IDs/activity for ads) |
| Internet/Network Activity (app & web events) | Yes | Yes |
| Health information (incl. HealthKit) | Yes (opt-in) | No |
| Commercial info (subscriptions) | Yes | No |
| Inferences (AI-generated insights) | Yes | No |
Submitting a Verifiable Consumer Request
To exercise your rights, email hello@flexwell.com with the subject line "CCPA Request." We will verify your identity using the email associated with your account and respond within 45 days (extendable by 45 days with notice). You may designate an authorized agent; we may require proof of authorization.
12. Do Not Sell or Share My Personal Information & GPC
We sell or share certain non-health personal information (such as device identifiers and app/web activity) with advertising partners for cross-context behavioral advertising. We do not sell or share your health data.
You can opt out of the sale/sharing of your personal information at any time:
- Website: Use the "Do Not Sell or Share My Personal Information" and "Cookie Settings" links in the flexwell.com footer.
- In-app: Use the Privacy controls in the app's Settings to opt out of advertising/sharing and to limit use of sensitive data.
- Global Privacy Control (GPC): We treat a valid GPC signal from your browser as a request to opt out of sale/sharing for that browser or device.
- Email: hello@flexwell.com with the subject "Opt Out."
13. Other U.S. State Privacy Rights (CO/CT/VA/UT & more)
If you reside in a state with a comprehensive privacy law (including Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and others), you have rights to access, correct, delete, and obtain a portable copy of your personal data, and to opt out of targeted advertising and the "sale" of personal data.
- Targeted Advertising / Profiling: We process personal data for targeted advertising. You may opt out via our Privacy controls, the website footer links, or a recognized universal opt-out signal (e.g., GPC where applicable).
- Sensitive Data: We obtain opt-in consent before processing sensitive data such as health information (see our Consumer Health Data Notice).
- Requests & Appeals: Submit requests to hello@flexwell.com. If we deny your request, you may appeal by replying "Appeal" to our decision within 30 days, and we will inform you in writing of our decision on appeal.
14. Consumer Health Data Laws (Washington, Nevada & more)
Certain states — including Washington (My Health My Data Act) and Nevada (SB 370) — provide specific protections for "consumer health data," which can include the supplement and wellness information you enter and the HealthKit metrics you connect.
- We collect and use consumer health data only with your opt-in consent and solely to provide the features you request.
- We obtain separate consent before sharing consumer health data with the processors who help us deliver those features (such as our AI and hosting providers).
- We do not sell consumer health data, and we do not share it with advertising partners.
- We do not use geofencing around healthcare facilities to collect or infer health data.
- You may withdraw consent, or request access or deletion of your consumer health data, at any time by disconnecting HealthKit, deleting your account, or contacting hello@flexwell.com.
Full details, including categories, sources, and purposes, are in our dedicated Consumer Health Data Privacy Notice.
15. International Privacy Rights (GDPR-Aligned)
While Flexwell is currently US-based, we extend the following rights to all users:
- Right of Access to a copy of your personal data.
- Right to Rectification of inaccurate data.
- Right to Erasure ("right to be forgotten").
- Right to Data Portability in a machine-readable format.
- Right to Restrict Processing.
- Right to Object to processing based on legitimate interests, including direct marketing.
- Right to Withdraw Consent at any time where processing is based on consent.
Our lawful bases include: (a) your consent (e.g., health data, marketing cookies), (b) performance of a contract (providing the Service), and (c) our legitimate interests (improving the Service, ensuring security). To exercise these rights, email hello@flexwell.com.
16. Children's & Teens' Privacy (COPPA)
Flexwell is not intended for children under 13. We do not knowingly collect personal information from children under 13. Health tracking features require users to be at least 16 years old.
We do not knowingly sell or share the personal information of users under 16. If we learn a user is under 16, we will not sell or share their personal information. If you believe a child under 13 has provided us with personal information, contact hello@flexwell.com and we will delete it.
17. Email Marketing (CAN-SPAM)
We comply with the CAN-SPAM Act. If you opt in to our email list:
- We clearly identify ourselves in all emails.
- Every marketing email includes an unsubscribe link.
- We honor unsubscribe requests promptly (within 10 business days).
- We never use deceptive subject lines or false header information.
- We include our physical address in every marketing email.
Transactional emails (password resets, account notifications) are not marketing and may be sent without opt-in.
18. Push Notifications
Flexwell may send push notifications (e.g., supplement reminders, feature updates, and occasional offers). Push notifications require your opt-in via device settings, and you can disable them at any time in your device settings or within the app. We do not send SMS or text-message marketing.
19. Biometric Information
Flexwell does not collect, create, or store biometric identifiers or biometric information (such as face geometry, fingerprints, voiceprints, or iris scans). Camera access is used solely for on-device barcode scanning; we do not store raw camera imagery.
20. International Data Transfers
Flexwell's servers are located in the United States. If you access the Service from outside the US, your data will be transferred to and processed in the United States. By using Flexwell, you consent to this transfer. We apply the same privacy protections to all users regardless of location.
21. Data Breach Notification
- We will notify affected users by email within 72 hours of becoming aware of a breach affecting their personal information.
- We will describe the nature of the breach, what data was affected, and what steps we are taking.
- We will notify relevant authorities as required by applicable law (including the California Attorney General if 500+ California residents are affected).
- We will provide guidance on steps you can take to protect yourself.
22. Your Right to Delete
You may request complete deletion of your account and all associated data at any time:
- Use the in-app account deletion option, or email hello@flexwell.com with the subject "Delete My Account."
- We will verify your identity using your account email.
- Within 30 days, we will permanently delete: your account, supplement stack, daily logs, Flex conversation history, and health data.
- Anonymized aggregated data (that cannot identify you) may be retained.
- Data in encrypted backups will be purged within 90 days.
Account deletion is irreversible. Cancelled subscriptions must be managed through the Apple App Store.
23. Changes to This Policy
- We will update the "Last Updated" date at the top of this page.
- For significant changes, we will notify you by email or through an in-app notification.
- Continued use of Flexwell after changes are posted constitutes acceptance of the updated policy.
For questions, concerns, or requests related to this Privacy Policy or your personal data:
Micawber Media LLC
1885 FM 2673, Suite H31
Canyon Lake, TX 78132
Email: hello@flexwell.com
Website: flexwell.com
We aim to respond to all privacy inquiries within 30 days.