Effective date: October 10, 2026 · Applies to: Ren (ren.1088labs.com) and any other 1088labs app that offers health features. 1088labs is a Wyoming limited liability company ("we", "us"). This policy supplements our main Privacy Policy and governs consumer health data specifically. Where this policy and the main policy differ on health data, this policy controls.
1. Why a separate policy
Some of what you can track with Ren, weight, medications, sleep, mood, is health information. Several U.S. states (including Washington, Nevada, and Connecticut) require a dedicated consumer health data privacy policy, and roughly twenty states treat health data as "sensitive data" with extra protections. Rather than give different users different protections, we apply the strongest of these standards to every user, in all 50 states and every U.S. territory.
2. Health data we collect
We collect health data only when you enter it or connect an account that provides it. The categories:
- Body measurements: weight and related figures you log.
- Medications: medication names, schedules, and when you record taking them.
- Nutrition and hydration: meals and water intake you log.
- Sleep: sleep times and quality you log.
- Mood and mental well-being: mood scores and journal entries you record.
- Fitness and physiological data from Whoop (only if you connect a Whoop account, via Whoop's official authorization flow, limited to the scopes you approve): recovery percentage, heart-rate variability (HRV), resting heart rate, sleep score, and strain.
- Glucose readings from the Juggluco app (only if you turn that on in the Ren app on your phone): the value, trend and time of each reading Juggluco broadcasts, plus a hashed form of the sensor serial (the serial itself never leaves your phone). This is wellness data; Ren shows you your own numbers and never offers a diagnosis or treatment advice.
- Glucose readings from Health Connect (only if you turn that on in the Ren app on your phone): the value and time of each blood glucose record in Health Connect and the name of the app that wrote it, for example Lingo. Ren reads blood glucose only, nothing else in Health Connect. This is wellness data; Ren shows you your own numbers and never offers a diagnosis or treatment advice.
- Meal photos and nutrition estimates (only if the nutrition feature is turned on for your account): when your message has food or meal words in it (for example "lunch" or "ate"), asks Ren to log, save, add or track a photo ("log this"), asks about its calories ("how many calories is this"), or the photo comes right after you tell Ren you are about to eat, the photo you send goes to the AI model (see section 6) to estimate the foods, calories and macros. Unless you only asked a question, Ren stores the result as a meal record: the foods, the numbers, the time and your own words on that message. The numbers are estimates unless Ren read them straight off a nutrition label in the photo, and the reply says which. They are wellness data, never medical or dietary advice. A photo you send with none of those is not read as a meal. If a photo sent that way turns out not to show food, nothing is stored. A question about a photo ("how many calories is this") is answered without saving a meal.
- Health-related conversations: things you tell the assistant about your health so it can log or act on them for you.
We do not collect: genetic data, reproductive or sexual health data as a category of service, precise geolocation tied to health services, or biometric identifiers (fingerprints, face scans, voiceprints). Heart-rate data from Whoop is used as fitness data only, never to identify you.
3. Where it comes from (sources)
- You: what you type or say to the assistant, and logs you create in the app.
- Whoop: if and only if you connect it. Disconnecting stops all further access immediately.
- Juggluco: an app on your phone that you choose to connect. Ren receives only what Juggluco sends it on the phone and never contacts Abbott, Juggluco or any other server for it. Turning the switch off in the Ren app stops it immediately.
- Meal photos: a photo you take or choose and send to Ren in chat. It is read as a meal only in the cases described above: your message has food or meal words, asks Ren to log, save, add or track it, or asks about its calories, or the photo follows you saying you are about to eat. The photo itself stays with your chat attachments like any other photo.
- Health Connect: Android's own health data store on your phone, read only if you turn the Health Connect switch on in the Ren app and grant Ren the Blood glucose permission there. Ren never contacts the app that wrote the reading or any server for it. Revoke the permission in Health Connect or turn the switch off in Ren at any time; either stops it immediately.
We do not buy health data, do not collect it from data brokers, and do not infer health conditions about you for any purpose beyond the features you use.
4. How we use it (purposes)
- To provide the features you use: logging, reminders (like medication reminders), summaries ("how did I sleep?"), trends, and briefings you enable.
- To personalize the assistant's help with your own data, for you only.
- To operate, secure, and debug the service.
We never use your health data for advertising, never sell it, and never share it with data brokers or advertisers. We do not use health data to train AI models. Our AI provider handles the data it receives under its own terms (see section 6).
5. Consent
All health data in Ren is collected on an opt-in basis: nothing is collected unless you deliberately enter it, connect Whoop, or turn on glucose from Juggluco or from Health Connect in the Ren app. Connecting Whoop uses Whoop's own consent screen where you approve exact scopes. If we ever want to collect or use health data for a purpose not in this policy, we will ask for your affirmative consent first, and you can say no with no change to your service. Logging a meal from a photo is opt-in in the same way: the feature is off unless it is turned on for your account, and a photo is read only in the cases described in section 2. You can withdraw consent at any time by deleting the data, disconnecting Whoop, or deleting your account (section 8).
6. Who we share it with
The complete list of third parties that can process your health data:
- Anthropic (Claude), the third-party large-language-model provider behind the assistant's intelligence. Your messages and relevant stored data (including health logs, when your request needs them) are sent to it to generate the assistant's responses, and it handles that data under its own terms. A meal photo goes to it only in the cases described in section 2 (and only if the nutrition feature is on). 1088labs itself does not use your data to train AI models.
- Infrastructure/hosting providers, which store and transmit data for us under contract, only as needed to run the service.
That's it. No affiliates receive your health data, and we will not sell consumer health data, so we will never ask you for the "sale authorization" some state laws define. If you direct the assistant to share something (for example, email your doctor a summary), that happens only on your explicit instruction, to the recipient you chose.
We may disclose health data if legally compelled (for example, a valid court order), and we will resist overbroad requests. We do not voluntarily share health data with law enforcement.
No geofencing: we do not use geofences around health-care facilities (or anywhere else) to track you, collect health data, or send you messages, a practice several state laws ban and we simply don't do.
7. Retention, deletion, and security
Health data is kept while your account is active so the assistant can keep helping you. You can delete individual entries at any time by asking the assistant, and deleting your account deletes your personal data within 30 days (per the main policy, section 8). Data from a disconnected Whoop account stops being collected immediately. Glucose readings (from Juggluco or from Health Connect) stop the moment you turn the switch off in the Ren app or revoke the permission in Health Connect; the readings already received are kept for 30 days and the daily summaries for 120 days, and all of it is deleted with your account. Meal records are kept in your account for up to 120 days. In chat you can edit or delete the most recent meal for a few hours after it is logged (for example "delete that" right after it is logged, or "that was 2 eggs not 3"); to change or remove an older meal sooner, contact us (section 8) or delete your account. The photo itself is not copied into the meal record; it stays with your chat attachments, which you can delete in Settings. Health data gets the same protections as the rest of your data (TLS in transit, restricted production access) and we treat it as the most sensitive category we hold.
8. Your rights, honored in all 50 states
Regardless of which state you live in, you can:
- Know and access the health data we have about you, most of it is directly visible in the app; you can also ask us for a copy, including a list of the third parties (section 6) it has been shared with.
- Correct it, edit or fix any log in the app.
- Delete it, specific entries, whole categories, or everything.
- Export a portable copy.
- Withdraw consent, stop logging, disconnect Whoop, or turn off any health feature.
- Not be discriminated against for exercising any of these rights.
How to exercise them: ask the assistant in the app, or email info@1088labs.com. We will verify the request is really from you and respond within 45 days (extendable once by 45 days for complex requests, with notice).
Right to appeal
If we decline a request, you may appeal by replying or emailing info@1088labs.com with the subject "Appeal". A different reviewer will decide the appeal within 45 days and explain the decision in writing. If your appeal is denied, you may contact your state's Attorney General; for Washington residents, the Washington State Attorney General at atg.wa.gov.
9. State-specific disclosures
Washington (My Health My Data Act)
This policy serves as our Consumer Health Data Privacy Policy under the WA MHMD Act. Sections 2–4 list the categories collected, sources, and purposes; section 6 lists the categories shared and all third parties; section 8 describes how to exercise your rights and appeal. We collect and use consumer health data only with consent or as necessary to provide a service you requested, and we do not sell consumer health data.
Nevada (SB 370)
Nevada residents have the rights in section 8, including the appeal process. Sections 2–6 provide the disclosures Nevada's consumer health data law requires (categories, sources, uses, and third parties). We do not sell consumer health data.
Connecticut (CTDPA)
Consumer health data is "sensitive data" under Connecticut law and we process it only with your consent (section 5). Connecticut residents have the access, correction, deletion, portability, and appeal rights in section 8. We do not use geofencing near health facilities.
California (CMIA and CCPA/CPRA)
Health data you enter and Whoop data are "sensitive personal information" under the CCPA. We use sensitive personal information only to provide the services you request, never for advertising or profiling, so no "Limit the Use of My Sensitive Personal Information" action is needed; the limit is already our only mode. We do not sell or share personal information as the CCPA defines those terms. To the extent Ren's health features are covered by California's Confidentiality of Medical Information Act (which reaches some consumer health apps), we maintain the confidentiality of that information as CMIA requires and do not disclose it without your authorization except as the law permits.
Illinois, Texas, and Washington biometric laws (BIPA, CUBI, RCW 19.375)
We do not collect biometric identifiers, no fingerprints, faceprints, voiceprints, or scans of hand or face geometry. Whoop physiological data (HRV, heart rate) is used solely as fitness information and is never used to identify you. If we ever introduce a feature involving biometric identifiers, we will provide notice and obtain written consent first, as these laws require.
States with comprehensive privacy laws
In Colorado, Virginia, Utah, Texas, Oregon, Montana, Florida, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island, and other states with comprehensive privacy laws, health data qualifies as sensitive data requiring opt-in consent, which is how we treat it for everyone (section 5). Residents of these states have the rights in section 8, including appeal where state law provides it.
All other states and territories
If your state has no dedicated health-privacy statute, you get the same protections anyway: opt-in collection, no sale, no advertising use, full access/correction/deletion/export rights, and the appeal process. New state laws take effect regularly; we track them and apply this strongest-standard approach as they arrive.
10. HIPAA note
1088labs is not a health-care provider, health plan, or health-care clearinghouse, so the data you give Ren is generally not covered by HIPAA, which is exactly why the state laws above (and this policy) exist. We voluntarily apply HIPAA-adjacent practices: minimum necessary use, access controls, and breach notification as required by applicable law. Ren is not a medical device and does not provide medical advice, diagnosis, or treatment, talk to a real clinician for that.
11. Children
Ren is for adults 18 and up. We do not knowingly collect health data from anyone under 18, and we delete it if we learn we have.
12. Changes
If we change how we handle health data in a meaningful way, we will notify you in the app and obtain fresh consent where the change requires it. The effective date above always shows the current version.
13. Contact
Questions, requests, or appeals: info@1088labs.com, or message the assistant in the app.