GLTrax
Privacy Policy
Effective Date: August 6, 2026
Sections below open with a plain-language Summary. Summaries are for readability only; the full text of the section controls.
1. Introduction and Scope
Summary: This policy covers what GLTrax, LLC does with your information. It does not cover what the clinicians and labs do with theirs — they have their own notice.
This Privacy Policy is issued by GLTrax, LLC ("Company," "we," "us," or "our"), which operates the GLTrax mobile and web application (the "Platform") — a wellness companion for adults using GLP-1 medications. GLTrax, LLC is the party responsible for the personal information described here. It applies to the Platform, our websites, and our customer support.
What this policy does not cover. When you order laboratory testing, FPK Services LLC d/b/a Analyte Health ("Analyte Health"), through its affiliated clinicians at Wilcrest Medical Group, forms the clinician-patient relationship and is the HIPAA Covered Entity for the resulting protected health information. Their handling of your information in that relationship is governed by their Notice of Privacy Practices, not by this policy. This policy covers what happens to lab results and related information after they are disclosed to us under the authorization you signed. It also does not cover third-party services you reach through links from the Platform.
We are not a HIPAA Covered Entity or Business Associate. HIPAA does not regulate us, and we are not subject to HIPAA enforcement. We nonetheless apply HIPAA-aligned safeguards to health information as a matter of practice, and we are contractually bound to protect lab results we receive.
2. Information We Collect
2.1 Information You Provide
- Identifiers and contact details: name, email address, phone number, and postal address where you give one
- Demographics: date of birth (used to verify you are 18 or older and required on lab orders), sex, and general location
- Account credentials
- Payment and billing information — card details are collected and stored by Stripe, Inc.; we retain only the last four digits, card brand, and transaction records
- Health and wellness information you enter (see Section 3)
- Content of your communications with our support team
- Free-text notes, uploaded files, and progress photos where you choose to add them
2.2 Information Collected Automatically
- Log data: IP address, timestamps, pages and screens viewed, and referring URLs
- Device and browser information, including operating system, device type, and unique device or installation identifiers
- Usage and interaction data: features used, session duration, and error and crash reports
- Approximate location inferred from IP address — we do not collect precise GPS location
- Cookie and similar local-storage data (see Section 11)
2.3 Inferences and Generated Data
We generate new information from what we collect: trends and averages over time, adherence rates, derived measures such as BMI from your height and weight, and AI-generated wellness insights drawn from your logged data and, where you have authorized it, your laboratory results. These inferences are themselves health information and are treated as such throughout this policy.
3. Health and Sensitive Information
Summary: The health data you put in — and the lab results we receive for you — is the most sensitive thing we hold. We treat it as sensitive personal information and never sell it.
We collect the following categories of health and other sensitive personal information:
- Weight, body measurements, and body composition
- Medication information: GLP-1 medication name and brand, dose, dose schedule, injection or dose timing, and adherence
- Symptoms and side effects, including nausea, bloating, cramps, constipation, and diarrhoea, and free-text notes about them
- Nutrition entries, including protein, fiber, and food descriptions
- Activity entries, including type and duration
- Biometrics you record: weight, glucose, A1c, cholesterol, and similar values
- Laboratory results and related health information received from Analyte Health, Wilcrest Medical Group, and the performing laboratory under the Records Release Authorization you signed
- Data imported from Apple Health (iOS) or a connected device or wearable, where you connect one
- Your check-in conversations with the AI, which may contain any of the above
- Progress photos, where you add them
- Date of birth, which is sensitive in combination with the above
- Account credentials, which are treated as sensitive personal information under California law
We collect this information because you choose to give it to us, or because you have authorized a laboratory to disclose it to us, and we use it only for the purposes in Section 5 and in the authorizations you have signed. Where a state law requires separate consent to collect or to share consumer health data, we obtain that consent — see the Consumer Health Data Privacy Notice.
4. Where Information Comes From
| Source | What we receive |
|---|---|
| You | Everything you enter, upload, or tell support. |
| Analyte Health, Wilcrest Medical Group, and the performing laboratory | Laboratory results and related health information, order status, and requisition details — disclosed to us only as permitted by the Records Release Authorization you signed. |
| Stripe, Inc. | Payment status, the last four digits and brand of your card, and refund and dispute records. Stripe does not give us your full card number. |
| Apple Health (iOS) / connected devices | Only the categories you approve, such as weight, steps, or activity. Read-only — we never write back. |
| Your device and browser | Log, device, and usage data described in Section 2.2. |
| Sign-in providers (e.g. Google) | Your email address and basic profile, where you use third-party sign-in. |
| Cloud, hosting, email, and analytics providers | Operational and delivery data about our own services. |
5. How We Use Information
Summary: To run the Platform for you, bill you, keep it secure, meet legal obligations, and — only if you opt in — send you marketing.
The table below maps each purpose to the categories of information used, which is also our notice at collection for California purposes.
| Purpose | Categories used |
|---|---|
| Provide the Platform: accounts, check-ins, tracking, charts, and insights | Identifiers, demographics, credentials, health and sensitive information, inferences, device and usage data |
| Place and manage laboratory orders | Identifiers, demographics (including date of birth), contact details, order selections, signed authorizations, and — after disclosure — laboratory results |
| Generate wellness insights and summaries | Health and sensitive information, inferences |
| Process payments, subscriptions, and refunds | Identifiers, contact details, payment and transaction data |
| Customer support | Identifiers, contact details, communications, and whatever you share with support |
| Transactional communications: receipts, security alerts, order and result notifications | Identifiers, contact details, order and account data |
| Marketing, where you have opted in | Identifiers, contact details, and general usage data — never health or laboratory data |
| Product improvement, analytics, and debugging | Device and usage data, error reports, and aggregated or de-identified information |
| Security, fraud prevention, and abuse detection | Identifiers, credentials, device and usage data, IP address |
| Legal compliance, internal audit, and defending legal claims | Any category, as strictly necessary |
We use your health and sensitive personal information only for the purposes above that are necessary to provide the Platform you asked for, to comply with law, or that you have separately authorized. We do not use it to advertise to you, and we do not disclose it for anyone else's advertising.
6. AI, Inferences, and Model Training
The Platform uses artificial intelligence, including large language models, to generate check-in responses, wellness summaries, and insights. To do that, the relevant portions of your data are sent to our AI provider to produce a response for you. Our AI provider is contractually prohibited from using that data to train its models, and does not do so.
AI-generated content may be inaccurate, incomplete, or unsuitable for your circumstances, and it is not a substitute for professional medical advice. See Section 5 of our Terms for the full disclosure.
If this ever changes. We will not begin using your health information to train models without telling you in advance and obtaining your separate, affirmative opt-in consent. We will not do it by quietly amending this policy.
Automated decisions. We do not use automated processing to make decisions that produce legal or similarly significant effects about you. AI insights are informational and do not determine your access to the Platform, your pricing, or any clinical outcome.
De-identified data. Where we use aggregated or de-identified information for analytics or product improvement, we maintain it in de-identified form, do not attempt to re-identify it except as required or permitted by law, and require the same of anyone we give it to.
7. How We Share Information
Summary: Labs, payment processing, hosting, AI, and email — plus law enforcement when legally required. Nothing goes to advertisers.
| Who | What and why |
|---|---|
| Analyte Health, Wilcrest Medical Group, and the performing laboratory | Your name, date of birth, sex, contact details, and the tests you selected — the information needed to place and fulfil your order, shared only after you sign the Lab Order Authorization. |
| Stripe, Inc. | The information needed to take payment and handle refunds and disputes. We do not send Stripe your health data beyond a generic order description. |
| Cloud hosting, database, and infrastructure providers | Data at rest and in transit, so the Platform can run. Bound by contract to process it only on our instructions. |
| AI model providers | The content needed to generate a response for you, under contracts prohibiting training on it. |
| Email and notification providers | Your email address and message content, to deliver account and (if opted in) marketing email. |
| Analytics and error-monitoring providers | Device, usage, and crash data. We do not send them your health or laboratory data. |
| Professional advisers | Information as needed for legal, accounting, audit, and insurance purposes, under duties of confidentiality. |
| Law enforcement and other authorities | Information where we are legally required to disclose it, or where we believe in good faith it is necessary to protect the rights, property, or safety of any person. |
| A successor entity | In a merger, acquisition, financing, reorganisation, bankruptcy, or sale of assets. We will notify you before your information becomes subject to a different privacy policy. |
We stand guard over your data. When we receive a government or third-party demand for your information, we require valid legal process, disclose no more than the process compels, and — unless legally prohibited — notify you so you have the opportunity to object.
Health repository data. Data received from Apple Health or a similar source is never used for marketing or advertising and is never transferred to a third party for those purposes. The integration is read-only — we request read access only and never write to Apple Health — and we do not store data received from it in iCloud. You can disconnect at any time from your device settings; disconnecting stops further import but does not retract data already received, which remains in your account until you delete it. There is no equivalent Android integration today.
8. We Do Not Sell Your Data
We have not sold or shared personal information for these purposes in the preceding 12 months, and we do not use advertising cookies, advertising SDKs, or tracking pixels that would transmit your health, weight, medication, or laboratory data to an advertising network. We have no plans to do so; if that ever changed, we would obtain your separate opt-in consent first, as state consumer health data laws require.
9. Your Privacy Rights
Summary: Access, correct, delete, take a copy, or object — plus appeal if we say no. Email admin@gltrax.com and we will verify it is you.
Subject to your location and to verification, you may:
- Know and access the personal information we hold about you, including the categories, sources, purposes, and recipients
- Receive a portable copy in a machine-readable format — download your logged data as a CSV any time from Settings → Your data, or request a copy at the address in Section 18
- Correct inaccurate or incomplete information
- Delete your personal information
- Opt out of the sale or sharing of personal information and of targeted advertising (we do none of these, so there is nothing to opt out of)
- Limit our use and disclosure of sensitive personal information to what is necessary to provide the Platform
- Withdraw consent where our processing is based on consent, including by revoking a lab authorization (Section 10)
- Object to or restrict certain processing, where applicable law provides that right
- Not be discriminated against for exercising any of these rights
How to make a request. Email admin@gltrax.com with the subject line "Privacy Request" from the email address on your account, and tell us which right you are exercising. We will verify your identity — for a sensitive request we may ask you to confirm information already in your account — and respond within the time your state or country's law requires, generally 45 days, with an extension where permitted.
Authorized agents. You may use an authorized agent. We will ask the agent for written proof of authority and may ask you to confirm the request directly.
Appeals. If we decline a request, we will tell you why. You may appeal by replying with the subject line "APPEAL" within 30 days. We will respond in writing with our decision and reasoning. If we deny your appeal, you may contact your state attorney general.
Limits. We may need to retain some information despite a deletion request — for example, to comply with a legal or contractual retention obligation (including retention of signed laboratory authorizations), to complete a transaction you asked for, to detect security incidents, or to defend a legal claim. We will tell you when this applies, and we will delete the rest.
10. Revoking a Lab Authorization
Revocation takes effect when we receive it and stops any further disclosure of your results to us from that point forward. It does not undo a disclosure already made in reliance on the authorization while it was in force, and it does not affect results we already hold — you can delete those separately using your rights in Section 9. Revoking may mean we can no longer show you results for an order already placed, and it does not by itself cancel or refund a pending order; see the Lab Services Terms.
Each authorization also expires on its own, 10 years after you sign it, whether or not you revoke it.
11. Communications and Cookie Choices
Marketing email. Optional and off unless you opt in. Unsubscribe from any marketing email or in your settings. Transactional messages continue regardless — receipts, security alerts, order and result notifications, and changes to these policies — because they are part of the service.
Text messages. We do not send SMS or leave voicemails unless you explicitly opt in. If you do opt in: message frequency varies, message and data rates may apply, consent is not a condition of any purchase, and you can stop at any time by replying STOP, END, CANCEL, UNSUBSCRIBE, or QUIT. Reply HELP for help. Opting out of one message programme does not opt you out of others. We are not liable for messages that are delayed or undelivered by your carrier.
Cookies. We use cookies and similar technologies that are strictly necessary to run the Platform (sign-in, session, security) and a limited set for preferences and product analytics. We do not use advertising cookies and do not sell cookie data. You can control cookies in your browser; disabling the necessary ones will break sign-in.
Global Privacy Control. We honour the Global Privacy Control (GPC) and similar browser opt-out signals as a valid opt-out request from the browser sending them, in the states where it is recognised.
12. Security
We maintain administrative, technical, and physical safeguards appropriate to the sensitivity of the data we hold, including encryption of data in transit and at rest, row-level access controls so each account can only reach its own records, least-privilege access for staff, audit logging of administrative actions, and periodic review of our configuration and dependencies.
Despite our efforts, no security measure can guarantee absolute security, and we cannot guarantee that your data will never be accessed without authorization. You can help: use a strong, unique password you do not reuse elsewhere, do not share your credentials, and tell us at admin@gltrax.com if you think someone has accessed your account.
If there is a breach. We will notify you and the relevant regulators as required by applicable law, including state breach notification laws and the FTC Health Breach Notification Rule, which applies to us as a non-HIPAA health application. Where the incident involves information we received from Analyte Health, we will also notify Analyte Health promptly and cooperate in the response, as we are contractually required to do.
13. How Long We Keep Information
We keep information for as long as needed for the purpose it was collected for, and then delete or de-identify it. In deciding how long, we consider the type and sensitivity of the data, the risk of harm from unauthorized disclosure, whether we can achieve the purpose another way, and our legal and contractual obligations.
| Data | Retention |
|---|---|
| Account and health tracking data | While your account is active. Deleted on account deletion, subject to the limits below. |
| Laboratory results held by us | While your account is active, or until you delete them. Note the ordering clinician and laboratory keep their own copy under their own legally mandated retention periods, which we do not control. |
| Signed authorizations and consents | At least six years from the date signed or the date it last was in effect, whichever is later, and in any event for the period required by Analyte Health, who may ask us for a copy at any time. These are retained even after account deletion, because their whole purpose is to evidence what was authorized. |
| Billing and transaction records | Seven years, for tax and accounting purposes. |
| Security and audit logs | Up to 24 months. |
| Backups | Expire on their own rolling schedule, generally within 90 days of deletion from the live system. |
| Marketing preferences and suppression lists | Indefinitely, so we can honour an unsubscribe. |
13.1 Biometric Identifiers
We hold no biometric identifiers, so there is nothing to retain and nothing to destroy. We do not collect or store fingerprints, faceprints, voiceprints, retina or iris scans, or scans of hand or face geometry, and we do not use any data to identify you biometrically.
Two features come near this and neither crosses it. Voice input streams your audio from your own browser to our speech-to-text provider and returns words; only the text is saved to your check-in, no recording is kept, and no speaker identification, speaker labelling, or voice matching is performed or permitted — the credentials involved cannot invoke those services at all. Face ID or fingerprint unlock in the mobile app is handled entirely by your device: the operating system tells the app whether the check passed, and never releases the underlying biometric to us.
If we ever did collect a biometric identifier, we would publish a written retention and destruction schedule, and obtain written consent, before beginning — not after. This paragraph is here so our position is stated rather than inferred from silence.
14. Children and Teens
The Platform is for adults aged 18 and over. We do not knowingly collect personal information from anyone under 18, we apply technical measures at signup to prevent under-18 accounts, and we verify date of birth on laboratory orders. We do not sell or share the personal information of children or teens, because we do not sell or share personal information at all. If we learn that an account belongs to someone under 18, we will close it and delete the associated data. If you believe a minor has given us information, contact admin@gltrax.com and we will delete it promptly.
15. State-Specific Disclosures
15.1 California
Summary: You can see what we hold, correct it, delete it, and take a copy. We don't sell your data, so there is nothing to opt out of.
This section is our notice at collection and privacy policy disclosure under the California Consumer Privacy Act as amended by the California Privacy Rights Act (Cal. Civ. Code § 1798.100 et seq.). It applies to California residents.
Categories of personal information. Using the categories set out in Cal. Civ. Code § 1798.140(v), in the preceding 12 months we have collected the following. For each, the sources are in Section 4, the business and commercial purposes in Section 5, the categories of recipients in Section 7, and our retention criteria in Section 13.
| Statutory category | Collected? | What it is for us |
|---|---|---|
| A. Identifiers | Yes | Name, email address, phone number, postal address, account identifier, device identifier, IP address. |
| B. Cal. Civ. Code § 1798.80(e) records | Yes | Name, contact details, payment information (card brand and last four digits; full card details go to Stripe, not us), and medical information you log or that a laboratory discloses to us. |
| C. Protected classification characteristics | Yes | Age and date of birth; sex where you provide it. Used to verify you are 18+ and to complete laboratory requisitions — never to make decisions about you. |
| D. Commercial information | Yes | Subscription and laboratory orders, transaction and refund history. |
| E. Biometric information | No | We do not collect biometric identifiers such as fingerprints, faceprints, or voiceprints, and we do not use any data to identify you biometrically. Body measurements are health information, category B, not biometric identifiers. |
| F. Internet or other network activity | Yes | Pages and screens viewed, feature usage, session duration, crash and error reports. |
| G. Geolocation data | Approximate only | City- or region-level location inferred from IP address. We do not collect precise geolocation. |
| H. Sensory information | Transiently | If you use voice entry, audio streams directly from your device to our speech-to-text provider and only the resulting text is stored. We do not retain recordings. |
| I. Professional or employment information | No | — |
| J. Non-public education information | No | — |
| K. Inferences | Yes | Trends, averages, adherence rates, derived measures such as BMI, and AI-generated wellness insights drawn from your data. |
Sensitive personal information. Under Cal. Civ. Code § 1798.140(ae) we collect two categories: account log-in credentials, and personal information collected and analyzed concerning your health (everything in Section 3). We use and disclose these only for the purposes permitted by § 1798.121(a) and CCPA Regulations § 7027(m) — performing the service you asked for, security and fraud prevention, and other permitted operational purposes. We do not use or disclose sensitive personal information to infer characteristics about you, and we do not use it for advertising. Because our use stays within those purposes, the right to limit does not apply and we are not required to offer a "Limit the Use of My Sensitive Personal Information" link. We do not collect the other sensitive categories: Social Security, driver's licence, passport, or state ID number; financial account credentials; precise geolocation; racial or ethnic origin; religious or philosophical beliefs; union membership; the contents of your mail, email, or texts other than with us; genetic data; biometric identifiers; or information about your sex life or sexual orientation.
Sale and sharing. In the preceding 12 months we have not sold personal information and have not shared it for cross-context behavioural advertising, as those terms are defined in § 1798.140(ad) and (ah). We have no actual knowledge of selling or sharing the personal information of consumers under 16 years of age — the Platform is 18+ and we do not knowingly permit minors to hold accounts. Because we do not sell or share, we do not provide a "Do Not Sell or Share My Personal Information" link; there is nothing for it to opt you out of. We did disclose personal information for the business purposes in Section 5 to the categories of recipients in Section 7.
Your rights. As a California resident you have the right to know what we collect and how we use it, to access the specific pieces we hold, to correct inaccuracies, to delete, to a portable copy, to opt out of sale and sharing, to limit the use of sensitive personal information, and not to be discriminated or retaliated against for exercising any of them. We do not offer financial incentives for personal information.
How to exercise them. Download your logged data yourself at any time from Settings → Your data, or email admin@gltrax.com with the subject line "Privacy Request." We operate exclusively online and deal with you by email, so under § 1798.130(a)(1)(A) email is our designated request method and we do not maintain a toll-free number. We verify a request by confirming control of the email address on your account and, for requests for specific pieces of information or for deletion, by matching information already in your account; we ask for no more than is needed to verify you. We respond within 45 days and may extend once by a further 45 days where reasonably necessary, telling you why first. An authorized agent may submit on your behalf with written permission signed by you, and we may ask you to verify your identity directly with us. If we decline, we will explain why and how to appeal (Section 9).
Shine the Light. Under Cal. Civ. Code § 1798.83, we do not disclose personal information to third parties for those third parties' own direct marketing purposes.
This section was last updated on August 6, 2026.
15.2 Washington, Nevada, and Connecticut
Consumer health data is covered by our separate Consumer Health Data Privacy Notice, which addresses the Washington My Health My Data Act, Nevada SB 370, and the health provisions of the Connecticut Data Privacy Act. That notice describes the separate consents we obtain for collecting and for sharing consumer health data, the right to delete it, and how to exercise these rights.
15.3 Nevada
Nevada residents may direct us not to sell certain covered information. We do not sell it. To submit a request anyway, email admin@gltrax.com with the subject line "Nevada Opt-Out."
15.4 Other States
Residents of states with comprehensive privacy laws — including Colorado, Virginia, Utah, Texas, Oregon, Montana, and others as they take effect — have rights of access, correction, deletion, portability, and opt-out of targeted advertising, sale, and profiling with legal or similarly significant effects, together with a right to appeal a denial. Exercise them as described in Section 9. Where a state requires opt-in consent to process sensitive data, we obtain it.
16. United States Only
Summary: GLTrax is offered in the United States, to people in the United States. We are not set up to serve users elsewhere and we do not try to.
The Platform is offered solely to residents of the United States. It is not directed to, and we do not offer it to, individuals in the European Economic Area, the United Kingdom, Switzerland, or elsewhere. Our prices are in US dollars only, the Platform is available in English only, we do not market it in any other country, and our laboratory services are available only in US states — every order is checked against the state you are ordering from and refused if we are not permitted to serve it. We also do not load analytics or any other third-party tag for visitors outside the United States.
Your information is stored and processed in the United States, under United States law. If you access the Platform from outside the United States, you do so on your own initiative, your information will be transferred to and processed in the United States, and privacy laws here may differ from those where you live.
Because we do not offer the Platform outside the United States, we do not maintain the compliance apparatus that serving other jurisdictions would require — we have not appointed a representative in the European Union or the United Kingdom, and we do not hold transfer mechanisms such as Standard Contractual Clauses. We would rather say so plainly than describe protections we are not in a position to provide.
That said, our commitment to you does not depend on where you are. Whoever you are and wherever you are, you may contact admin@gltrax.com to ask what personal information we hold about you, to have it corrected, or to have it deleted, and we will honour that request. If you believe you hold rights under a law outside the United States, write to us and we will respond rather than refuse on jurisdictional grounds.
17. Changes to This Policy
We may update this policy. For material changes we will give you at least 10 days' advance notice by email or a prominent in-Platform notice before the change takes effect, and we will update the effective date at the top of this page. Where a change would materially expand how we use health or sensitive information beyond what you have already agreed to, we will obtain your separate affirmative consent rather than relying on notice.
18. Contact Us
For privacy questions, requests, or complaints, contact our Privacy Officer:
GLTrax, LLC (operator of GLTrax) — Attn: Privacy Officer
2810 N Church St STE 89196
Wilmington, DE 19802
Telephone: 302-600-2130
admin@gltrax.com
This policy was last reviewed and updated on August 6, 2026.