Privacy Policy

1. Who we are

Health by CRBN (formerly Baseline) is a product of CRBN HQ LLC, a Pennsylvania limited liability company (“we”, “us”). This policy explains how we handle personal information when you use Health by CRBN’s website, app and assistant connector. It works together with our Terms of Service. Contact: adrian@crbnhq.com.

2. What we collect and why

• Account: your email address, to sign you in with one-time codes and to contact you about your account or changes to these terms. Sign-in records (time, IP address and device) are kept by our authentication provider for security.
• Profile: display name, calorie and macro targets, timezone, weight unit, display choices and Home layout, so Health by CRBN shows your day the way you set it up.
• Food log: foods and meals you log, amounts, calories, macros and optional micronutrients, barcodes you scan, saved foods and meals, and the text you or your assistant sent when logging (for example “two eggs and toast”), so we can show your day and fix entries later.
• Meal photos: photos you add to meals. They are stored privately, shown only through short-lived links, and location and other EXIF data are stripped when the photo is processed.
• Body data: weight, body-fat percentage and muscle mass you log.
• Training: programs, workouts, sets, reps, weights, training maxes, notes, and cardio sessions (type, duration, distance, average heart rate).
• Strava (only if you connect it): activity summaries such as name, description, type, date, duration, distance and average heart rate. We store no GPS routes or map data. Strava sign-in tokens are kept on our servers only.
• Assistant connections (only if you connect one): the assistant app’s name, sign-in tokens, the previews and receipts of changes it made, and a usage log of which tools were called, when and how many items (no food text or other content).
• Edit history: a record of changes to your data, with before and after copies, including entries you delete. We keep it for security and so changes can be undone or restored, while your account is active or as stated in this policy.
• Technical data: request logs kept briefly by our hosting provider (IP address, browser, pages requested), and rate-limit counters stored as hashed keys that expire within 2 days, to keep the Service secure and working.

We collect this from you, from the assistant you connect when you ask it to read or log something, and from Strava if you connect it.

3. Consumer health data

Much of what Health by CRBN stores is “consumer health data” under laws such as Washington’s My Health My Data Act, Nevada’s consumer health data law and the Connecticut Data Privacy Act. This section is our consumer health data privacy policy.

• Categories: food and nutrition intake (including meal photos and barcodes), body weight and body composition, exercise and training history, heart rate from cardio and Strava activities, nutrition and training targets, and anything you write in free-text fields. Free-text fields can hold sensitive details if you put them there (for example injuries, conditions or medications): workout and set notes, the text sent when logging food, Strava activity names and descriptions, and other notes you add.
• Purposes: to store and show your logs, totals, targets and trends; to let assistants and apps you connect read or log for you; to keep the Service secure, prevent abuse and fix problems; and to meet legal obligations. We don’t use it for advertising, and we don’t use it to make decisions with legal or similarly significant effects about you.
• Sources: you, the assistant you connect, and Strava if you connect it.
• Sharing: only with the processors listed in section 5, which act on our instructions, with services you choose to connect, with members of a household you were invited to (see section 6), and where required by law. We don’t sell consumer health data.
• Consent: we ask for your separate, explicit consent before we collect or store health data, and again when this policy changes materially. Until you consent to the current version, Health by CRBN adds no new health data for your account from any source (the app, a connected assistant or Strava); what is already stored stays as it is, and you can still view, download or delete it. You can withdraw consent at any time by deleting your account and data in Settings → Account or by emailing adrian@crbnhq.com; without it we can’t run Health by CRBN for you.
• Your rights: you can confirm whether we hold your health data, see and download it, ask who we shared it with, correct it, and delete it, as described in section 10. We will not discriminate against you for exercising these rights. If we deny a request, you can appeal by replying to our answer, and we will respond within 45 days. If your appeal is denied, you may contact your state attorney general.

4. No selling, no ads, no tracking

We don’t sell or rent personal information, share it for cross-context behavioral advertising, show ads, or use advertising pixels or tracking cookies. Health by CRBN uses only the cookies needed to keep you signed in, and stores a few display preferences on your device.

Analytics: our host, Vercel, measures how fast pages load (Speed Insights) on every page, and counts visits to our public pages (the home page, sign-in, Terms and this policy) with Vercel Web Analytics. Both work without cookies. They receive the page address without its query string, and timing or visit counts. They never receive what you log, your account, or anything you see inside the app.

5. Service providers and connected services

These providers process data for us so Health by CRBN can run:

• Supabase: database, sign-in and photo storage (United States).
• Vercel: hosting, request logs, and cookieless page-speed and public-page visit analytics (section 4).
• Resend: sends sign-in code emails (your email address and the code).
• Open Food Facts: when you scan a barcode, we send only the barcode number to look it up. No account information is sent.

Data goes to these services only if you connect them:

• AI assistants such as Claude, ChatGPT or Grok. When you connect one, it can read the Health by CRBN data its tools return (and log for you if you allow it). What it receives goes to that provider under your own account with them and is governed by their terms and privacy policy. You can remove an assistant in Settings → Assistants at any time.
• Strava. We read your activity summaries using the access you grant. Strava’s own privacy policy applies to your Strava account. You can disconnect in Settings → Fitness apps.

6. Your data is private to your account

Your logs, photos, targets, saved foods, meals and programs belong to your account. Other Health by CRBN users can’t see them. The one exception is a household: if you were invited to share a household, its members can see each other’s logs and share saved foods, meals and programs. Health by CRBN has no way to invite anyone today, so every account is its own household.

7. Who at CRBN HQ LLC can see your data

Access by CRBN HQ LLC is limited to providing support you ask for, keeping the Service secure, investigating problems or abuse, and responding to legal requests. The operator has an internal usage dashboard and administrative database access for those purposes only.

8. Retention and deletion

• We keep your data while your account is active or as stated in this policy.
• When you delete your account in Settings → Account, sign-in is locked at once, and your logs, photos and photo files, Strava link and activities, assistant connections, usage log, edit history and profile are deleted right away, along with your saved foods, meals and programs (unless you share a household with someone who still uses them). If a photo file or your sign-in record can’t be removed at once, Health by CRBN tells you and retries every day until it is. We keep a record that the account was deleted (its ID and when, with no health data) so the deletion can be finished and confirmed.
• Backups are kept by our database provider for a limited period and are not restored except for disaster recovery.
• When you remove a single meal photo, it disappears at once and its files are deleted from storage within 30 days (normally within a day). Unused photo uploads from assistants are deleted the same way.
• Request logs kept by our hosting provider and sign-in records kept by our authentication provider expire on those providers’ schedules.
• We may keep limited information longer when the law requires it or to resolve a dispute, and only for that purpose.

9. Security

We use encryption in transit (HTTPS) and at rest through our providers, row-level security so each account can reach only its own (and its household’s) data, private photo storage with short-lived links, server-only storage of connection tokens, signed and expiring assistant access, an append-only edit history, and rate limits on sign-in and other endpoints. No system is perfectly secure.

If a breach affects your health information, we will notify you and the authorities as required by law, including the FTC Health Breach Notification Rule, without unreasonable delay and within the time the law sets.

10. Your rights and choices

• Access and export: download all your data as a JSON file in Settings → Account. Meal photos are included as download links that work for one hour. If any part can’t be read, the file says it is incomplete; download it again.
• Correct: edit or delete any entry in Health by CRBN, or update your profile in Settings.
• Delete: delete your account and data in Settings → Account.
• Withdraw consent: delete your account, or email adrian@crbnhq.com. Disconnect an assistant or Strava in Settings at any time.
• Other requests (for example a list of who we shared your data with, or an appeal): email adrian@crbnhq.com. We will verify the request comes from your account email and respond within 45 days.

11. Children

Health by CRBN is not for anyone under 18. We don’t knowingly collect data from children. If you believe a child is using Health by CRBN, email adrian@crbnhq.com and we will delete the account.

12. International users

Health by CRBN is run from the United States and your data is stored there. If you use it from elsewhere, your data is transferred to the United States. We honor requests to access, correct, delete, export or restrict use of your data from anywhere, including rights under the GDPR and UK GDPR; the legal basis for health data is your explicit consent.

13. Changes to this policy

The “Last updated” date shows the current version. For material changes, we will tell you in Health by CRBN or by email before they take effect and ask for your consent again where the law requires it.

14. Contact

CRBN HQ LLC · adrian@crbnhq.com