GLTrax
Consumer Health Data Privacy Notice
Effective Date: August 8, 2026
Sections open with a plain-language Summary. Summaries are for readability; the full text controls.
1. Who This Notice Is For
Summary: Everyone — but it carries specific legal force for residents of Washington, Nevada, and Connecticut.
GLTrax, LLC ("we," "us") publishes this notice as the entity that determines the purpose and means of collecting consumer health data through GLTrax. It applies with legal force to consumers who are residents of Washington, Nevada, and Connecticut, and to Washington residents whose consumer health data is collected in Washington. We extend the same practices and rights to all of our users regardless of where they live.
What is not covered. This notice does not cover protected health information held by Analyte Health or Wilcrest Medical Group in their clinician-patient relationship with you — that is governed by HIPAA and their own Notice of Privacy Practices. It covers consumer health data that we collect, including lab results after they are disclosed to us.
2. What Consumer Health Data We Collect
"Consumer health data" means personal information linked or reasonably linkable to you that identifies your past, present, or future physical or mental health status. For GLTrax that includes:
- Weight, body measurements, and body composition
- GLP-1 and other medication information: name, brand, dose, schedule, dose or injection timing, and adherence
- Symptoms and side effects, and free-text notes about them
- Nutrition and food intake entries
- Physical activity entries
- Biometric values you record: weight, glucose, A1c, cholesterol, and similar
- Laboratory test selections, orders, and results
- Data from Apple Health (iOS) or a connected device, where you connect one
- Your check-in conversations with the AI, which may contain any of the above
- Progress photos
- Inferences we generate from the above, including trends, adherence rates, derived measures such as BMI, and AI-generated wellness insights
- The fact that you sought or obtained laboratory testing or health services through us
- Precise location data — we do NOT collect this, and note it here only to be explicit
3. Where It Comes From
- Directly from you, when you enter it, upload it, or tell our support team
- From Analyte Health, Wilcrest Medical Group, and the performing laboratory, when results are disclosed to us under the Records Release Authorization you signed
- From Apple Health (iOS) or a device you connect, limited to the categories you approve. The integration is read-only and you can disconnect at any time; disconnecting stops further import but does not retract data already received
- Generated by us, as inferences drawn from the above
4. Why We Collect It
| Purpose | Consumer health data used |
|---|---|
| Provide the tracking, check-in, and charting features you asked for | All categories in Section 2 |
| Generate wellness insights and weekly summaries for you | All categories in Section 2 |
| Place and manage the laboratory orders you request | Test selections, orders, results, and the demographics needed on a requisition |
| Deliver your results to you and store them in your account | Laboratory orders and results |
| Provide customer support you request | Whatever you choose to share with support |
| Comply with legal obligations and defend legal claims | Any category, only as strictly necessary |
| Keep the Platform secure and detect abuse | Account and access data — not the health values themselves |
We do not collect, use, or share consumer health data for advertising, marketing to you based on your health status, profiling, list-building, resale, or any purpose not listed above.
5. Consent: Collecting and Sharing Are Separate
Summary: We ask twice, on purpose. Agreeing that we may hold your health data is not the same as agreeing that we may send it anywhere.
We obtain your consent separately for each:
- Consent to collect. When you create your account and accept our Terms and Privacy Policy, you consent to our collection of the consumer health data you choose to enter, for the purposes in Section 4. You can withhold it simply by not entering data, and you can withdraw it by deleting data or your account.
- Consent to share. Sharing your consumer health data with anyone outside GLTrax, LLC requires a second, distinct consent that we ask for at the point it matters. For laboratory testing, that consent is the separately signed Lab Order Authorization (to send your information out to the clinician and laboratory) and Records Release Authorization (to receive your results back). We do not share consumer health data with anyone else except the service providers in Section 6, who process it only on our instructions.
Each consent is specific, informed, freely given, and revocable. We do not condition access to the Platform on consent to share, we do not bundle these consents into acceptance of the Terms, and we do not use a pre-ticked box or infer consent from your silence or continued use.
Withdrawing consent. Withdraw a sharing consent at any time in Settings → Lab authorizations, or by emailing admin@gltrax.com with the subject line "Revoke Authorization." Withdrawal takes effect when we receive it and applies going forward; it does not undo a disclosure already made while the consent was in force.
6. Who We Share It With
We share consumer health data only with:
| Category | Who and why |
|---|---|
| Laboratory partners | Analyte Health, its affiliated clinicians at Wilcrest Medical Group, and the performing laboratory and collection site — to place and fulfil an order you requested, under your signed authorizations. |
| Processors | Cloud hosting, database, and infrastructure providers that store the data, and AI model providers that generate responses for you. Each is contractually bound to process it only on our instructions, to protect it, and not to use it for its own purposes or to train models on it. |
| Legal and safety | Authorities, where we are legally compelled or where disclosure is necessary to protect someone from serious harm. We require valid legal process and disclose no more than compelled. |
| A successor entity | In a merger, acquisition, or sale of assets. We will notify you before your data becomes subject to a different notice, and any successor is bound by the consents you gave. |
We do not share consumer health data with advertisers, data brokers, analytics networks, or social platforms, and we do not embed any tracking pixel or advertising SDK in the parts of the Platform where consumer health data exists — that is, anywhere you sign in, enter information, or view your own health records.
6.1 Collection Across Other Websites and Services
No third party collects consumer health data across other websites or online services through GLTrax. Nevada SB 370 requires this notice to summarise the extent to which that happens, and the summary is that it does not.
In the GLTrax application — every page you reach after signing in, and the sign-in and registration pages themselves — we run no advertising SDKs, no advertising or targeting cookies, and no tracking pixels or web beacons. This covers your dashboard, check-ins, charts, lab ordering and results, your care-team report, and your settings, and it covers the GLTrax mobile apps in full. These are the only places consumer health data exists, and no third-party tag runs on any of them.
On our public marketing pages — our home page and our blog — we use Google Analytics to count visits and see which articles people read. Those pages are open to anyone, require no account, and contain no health information: there is nothing on them for an analytics tool to observe about you beyond the fact that a browser loaded a public web page. Google Analytics can recognise a returning browser across sites that use it, which is why we disclose it here, but it is deliberately kept off every page where health information is entered or shown. That separation is enforced technically, not only by policy — our security headers permit Google's servers to be contacted from those two public pages and nowhere else.
The third parties we use for the application itself are the ones listed in the table above. Each receives only what it needs to perform its function for us, uses it only on our instructions, and none of them are permitted to combine it with data from other sites or use it to build a profile of you. If we ever introduced anything capable of cross-site collection inside the application, we would say so here and obtain your separate consent first.
7. We Do Not Sell Consumer Health Data
Washington law requires a signed, statute-specific valid authorization before any sale of consumer health data. We have not sought and do not hold any such authorization, because we do not sell this data. If we ever intended to, we would have to obtain a separate written authorization meeting the statutory requirements from you first — your acceptance of our Terms, this notice, or any lab authorization would not permit it.
8. Your Rights
With respect to consumer health data, you have the right to:
- Confirm whether we are collecting, sharing, or selling your consumer health data
- Access the data, including a list of all third parties and affiliates with whom we have shared it, and contact information for each
- Withdraw consent to our collection and to our sharing of it, separately
- Have it deleted
- Not be discriminated against for exercising any of these rights
Deletion goes downstream. When you ask us to delete consumer health data, we delete it from our live systems and from our backup and archive systems on our next scheduled backup cycle, and we notify every processor and affiliate to whom we disclosed it, instructing them to delete it too. We will tell you when this is complete. We may retain the minimum necessary where a law requires it — most notably a signed laboratory authorization, which we must keep as evidence of what was authorized; we will tell you if that applies.
What deletion cannot reach. Results and records held by Analyte Health, Wilcrest Medical Group, or the performing laboratory as part of your clinician-patient relationship are their medical records, subject to their own legally mandated retention periods. We cannot delete those, and a request to us does not reach them. Contact them directly.
9. How to Exercise Your Rights
- In the app: revoke authorizations in Settings → Lab authorizations; download your data as a CSV from Settings → Your data; delete data or your account in Settings.
- By email: admin@gltrax.com, with the subject line "Consumer Health Data Request." Tell us which right you are exercising and which state you reside in.
- By telephone: 302-600-2130.
- By post: GLTrax, LLC, Attn: Privacy Officer, 2810 N Church St STE 89196, Wilmington, DE 19802. Include the email address on your account so we can locate it.
We will verify your identity, generally by confirming control of the email address on your account and information already held in it, and we will not ask for more information than needed to verify you. We respond within 45 days, and may extend once by a further 45 days where reasonably necessary, telling you why before the first period ends. There is no charge for the first two requests in a 12-month period.
Authorized agents. You may designate an agent. We will require written proof of authority and may ask you to confirm the request directly.
10. Appeals
If we decline your request, we will tell you why and how to appeal. To appeal, reply with the subject line "APPEAL" within 30 days. We will respond in writing within 45 days with our decision and reasoning.
If we deny your appeal, you may complain to:
- Washington: the Office of the Attorney General, at atg.wa.gov/file-complaint. The My Health My Data Act also gives Washington consumers a private right of action under the Consumer Protection Act.
- Nevada: the Office of the Attorney General, at ag.nv.gov.
- Connecticut: the Office of the Attorney General, at portal.ct.gov/ag.
11. Security and Retention
We apply administrative, technical, and physical safeguards appropriate to the sensitivity of consumer health data, including encryption in transit and at rest, row-level access controls so an account can only reach its own records, least-privilege staff access, and audit logging. Access to consumer health data inside our organisation is limited to the personnel who need it to provide the service or to comply with law.
We retain consumer health data for as long as your account is active and you have not deleted it, and then delete or de-identify it, except where a legal or contractual obligation requires retention. Retention periods are set out in Section 13 of our Privacy Policy.
12. Changes
We will not use consumer health data for a materially different purpose than the ones in Section 4 without obtaining your separate affirmative consent first. If we change this notice we will post the updated version with a new effective date and, for material changes, give at least 10 days' advance notice by email or a prominent in-app notice.
13. Contact
GLTrax, LLC (operator of GLTrax) — Attn: Privacy Officer
2810 N Church St STE 89196
Wilmington, DE 19802
Telephone: 302-600-2130
admin@gltrax.com
This notice was last reviewed and updated on August 8, 2026.