Privacy Policy

Last updated: 26 July 2026

Traqr (“we”, “us”, “our”) is a personal health-tracking app and website that helps you manage your GLP-1 medication journey. This policy explains what personal information — including health information — we collect, how we use and protect it, and the rights you have over it. We handle your information in accordance with the New Zealand Privacy Act 2020 and the Health Information Privacy Code 2020.

Information we collect

Information you give us

• Medication and injection data — dose amounts, injection dates, injection sites and medication type.
• Weight and body measurements — weigh-ins and body-composition records.
• Nutrition data — meal descriptions, calorie and macronutrient information, and meal timestamps.
• Meal photos — images you capture or select for AI-powered food analysis.
• Hydration data — daily water-intake records.
• Side effects — symptom type, severity and dates.
• Improvements — positive changes you record (type of change, how much difference it made, dates, and any notes you add).
• Profile information — your name, start date, goal weight and preferences.
• Newsletter email — if you choose to sign up for updates on this website, the email address you provide.

Information collected automatically

• Account identifiers — an anonymised user ID used to manage your account (via Firebase Authentication when you sign in with Apple, Google or email).
• Subscription status — entitlement information managed by RevenueCat.
• Usage and analytics data — in-app events and basic device information collected through Firebase Analytics to understand how the app is used and to improve it.
• Crash diagnostics — crash and error reports collected through Firebase Crashlytics so we can fix problems.
• Notification tokens — a device push token (via Firebase Cloud Messaging) so we can send the injection and hydration reminders you enable.

Health information

Much of what you record in Traqr — your medications, weight, side effects and related notes — is health information, which receives additional protection under the Health Information Privacy Code 2020. We collect it directly from you, only to provide the tracking and forecasting features you use, and we do not use your health information for advertising or sell it to anyone.

How we use your information

Your information is used to provide and improve the app’s core functionality, including to:

• display your tracking history and progress;
• generate weight forecasts, pharmacokinetic estimates and insights;
• analyse meal photos using AI;
• sync your data across your devices;
• send the reminders you turn on;
• manage your subscription; and
• diagnose problems and improve reliability.

We do not sell, rent or trade your personal information, and we do not share your health data with advertisers, data brokers or pharmacy partners.

Sharing and third-party services

We use a small number of trusted service providers to run Traqr. They process your information only to provide their service to us, under their own privacy and security obligations:

We may also disclose information where we are required to by law, or to protect the rights, safety or property of our users or others.

Sharing your data with a Care Team

Traqr lets you share the health information you track with someone you choose — for example a coach, a healthcare provider, or another person you trust (“a recipient”). This sharing is entirely your decision. It never happens automatically, it is limited to the categories you approve, and you can stop it at any time. This section explains what can be shared, how you stay in control, what the recipient agrees to, and your rights.

Care Team sharing is a convenience feature that lets you extend your own data to someone helping you. It is not a clinical service, and it does not make Traqr or the recipient your healthcare provider.

What data you can share

When you set up sharing, you choose from up to eight separate categories of the information you have tracked in Traqr. You approve each category individually:

• Weight — your recorded weight entries and trend.
• Medication and doses — the GLP-1 medication you track and your logged doses.
• Side effects — side effects you have recorded.
• Nutrition — daily aggregates only (for example, daily totals). Individual meal contents, meal descriptions and meal photos are not shared.
• Appetite — your appetite / hunger / fullness / food-noise entries.
• Body composition — body-composition measurements you have recorded.
• Weight forecast — the modelled projection Traqr generates from your data.
• Improvements — positive changes you have chosen to note (the type of change and how much difference it made). Your free-text notes on an improvement are never shared.

What is never shared, regardless of what you approve: free-text notes, meal photos and meal contents. These are removed on our servers before any data reaches a recipient. Nutrition is only ever provided as daily aggregate figures.

Some of the information you track may originate from Apple Health (HealthKit) — for example weight or body-composition data you have chosen to sync. If you share a category that contains HealthKit-sourced data, that data is included in what the recipient receives.

You choose the recipient, and you stay in control

• You choose who receives your data. You initiate sharing from within the app and direct it to a specific recipient.
• Per-category consent. Your consent is explicit and given per category. A recipient only ever sees the categories you have approved.
• Expiry.Every share has an expiry. When it lapses, the recipient’s access ends automatically unless you renew it.
• Revocation at any time. You can revoke a share, or an individual category, at any time from the app. Revocation stops future access straight away.
• Honest limit on revocation. Revoking access stops the recipient reading anything further, but it cannot recall information the recipient has already viewed, exported or saved. If you have shared data and later revoke it, please assume the recipient may still hold copies of what they accessed before you revoked. If that is a concern, ask the recipient directly to delete what they hold.

How recipients access your data (and what we don’t do)

Recipients do not get access to Traqr’s app or to your raw account data. Instead:

• Recipients sign in to a separate web portal (clinic.traqr.health).
• All access is served through our secured server functions (Cloud Functions), which enforce the exact categories and expiry you approved. Recipients cannot reach any data outside the scope you set.
• Data that must never leave (free text, meal photos, meal contents) is stripped on our servers before delivery; nutrition is delivered as daily aggregates only.
• We do not verify a recipient’s identity, qualifications, or professional standing. A recipient must confirm their email address before receiving data — but email confirmation is only proof that we can reach that address. It is not a check of who they are or whether they are qualified. You are responsible for making sure you are sharing with the right person.
• Recipients must set up multi-factor authentication (a TOTP authenticator app) to sign in.

What the recipient agrees to

Before receiving any data, a recipient must accept binding terms. Under those terms, the recipient agrees to:

• Use the data only to support you — the person who shared it.
• Not use it for marketing, advertising, resale, data-mining, building or training models/AI, or any other purpose of their own.
• Not re-share or pass your data on to anyone else.
• Notuse the portal as a clinic’s, health plan’s, or other organisation’s own patient-management or record-keeping system. Professional use is welcome where you have chosen to share with them, but organisations may not direct, require, or contract for its use, and these terms create no business-associate relationship with Traqr.

If a recipient breaks these terms, they are in breach of their agreement with us, and we can suspend or delete their access (see Reporting misuse below).

Where your data is processed

Traqr runs on Google Cloud. Care Team data is processed and stored in Google’s us-central1 region (United States) using Firestore and Cloud Functions.

If you are in the European Economic Area, the United Kingdom, or another region with data-transfer rules, this means your information is transferred to and processed in the United States. We rely on Google’s Standard Contractual Clauses and associated safeguards for that transfer. Because health information is special-category data under the UK/EU GDPR, we process it on the basis of your explicit consent, which you give when you set up a share and which you can withdraw at any time.

Separately, the recipient you choose may be located in any country. By directing a share to them, you authorise us to deliver your information to them wherever they are, and the privacy protections that apply to them may not be comparable to those in your own country. This delivery happens only under the consent you give, and it stops when you revoke the share or it expires.

Audit logging

Every time a recipient accesses your shared data, we record it (who accessed, what category, and when). These audit logs let us enforce the scope you set, support you if you report misuse, and detect unauthorised access.

How long we keep it

• Your shared datastays in your Traqr account for as long as you keep your account, under Traqr’s general retention policy. Sharing does not create a second permanent copy inside Traqr — recipients read your live, scoped data through the portal.
• A recipient’s own copies(anything they exported or saved) are outside our control and are subject to the recipient’s obligation to use them only to support you.
• Records of your sharing choices — each grant, scope change, renewal and revocation — are kept even after you revoke a share, so we can evidence exactly what you authorised and when.
• Audit logsare retained for the period stated in Traqr’s general retention policy.

Reporting misuse

If you believe a recipient has misused your data — used it for anything other than supporting you, re-shared it, or otherwise breached their terms — you can report the recipient from within the app, or contact us at support@traqr.health. We can suspend or deletea recipient’s account and revoke their access.

Your rights over Care Team sharing

You can, at any time:

• See and manage your active shares in the app.
• Withdraw consent for any category or any recipient (see the revocation limits above).
• Access the personal information Traqr holds about you, and request a copy.
• Request deletion of your data, subject to any legal retention obligations.
• Contact us with any privacy question or complaint at support@traqr.health.

Depending on where you live, you may have additional rights under the NZ Privacy Act 2020 and the Health Information Privacy Code, the EU/UK GDPR, the US FTC Health Breach Notification Rule, the Washington My Health My Data Act, and other local laws. Nothing in this section limits those rights.

Note on HIPAA (US): Care Team sharing is you sharing your own information with a person you choose. In the typical case — sharing with a coach, family member or other trusted person — the recipient is not acting as your healthcare provider and Traqr is not acting as a HIPAA “business associate”. Whether HIPAA applies in a particular situation is fact-specific: it depends on who the recipient is and how they use the data (for example, a clinic that adopts the portal as part of its own patient-management systems may bring its own HIPAA obligations — which is why our recipient terms welcome individual professional use but bar organisations from adopting the portal as their own patient-management infrastructure).

For recipients — your obligations in short

If someone shares their Traqr data with you, you are receiving another person’s health information on trust. Before you can see any data you must confirm your email, set up multi-factor authentication, and accept our recipient terms. By accepting, you agree to:

• Use the data only to support the person who shared it with you.
• Never use it for marketing, advertising, resale, data-mining, or to build or train models/AI.
• Never re-share it or pass it to anyone else.
• Understand that access is scoped and time-limited by the person sharing, that every access is logged, and that they can revoke your access at any time.
• Understand that Traqr can suspend or delete your account if you misuse the data or breach these terms.

Confirming your email verifies a delivery address only — it is not a badge of verification, and it does not represent that Traqr has checked your identity or qualifications.

What we hold about you as a recipient: your account email, the profile details you provide (name, role description, country), your acceptance of the recipient terms, and logs of your access to data shared with you. We use this to operate the portal, enforce the recipient terms, and support the people who share with you. You have the rights described in this policy in respect of that information, subject to our need to retain terms-acceptance and access records.

Storage, security and overseas disclosure

• Your data is stored in Firebase (Google Cloud Platform), encrypted in transit (TLS) and at rest.
• Meal photos are stored in Firebase Storage under your authenticated user path.
• Firestore security rules ensure that only you can access your own data.
• We do not store your data on our own servers outside of Firebase.

Overseas storage:Traqr’s database and processing run on Google Cloud infrastructure located in the United States, and our service providers (Google, RevenueCat) may store and process information in other countries. This means your information — including health information — is held overseas. We only use providers that are required to protect it with safeguards comparable to those under the New Zealand Privacy Act 2020.

Cookies, local storage and website analytics

The traqr.health website uses a small number of functional cookies and browser local storage — for example, to remember your light/dark theme preference and whether you are viewing in app or web mode.

We also use Google Analyticson the public website (the marketing pages, guides, and this page) to understand how the site is used — pages visited, approximate region, and device type. Google Analytics sets its own cookies and receives technical information such as your IP address; we do not send it your name, email address, or any health information, and it does not run inside the Traqr app or the clinic portal. We do not use advertising cookies. You can block analytics cookies in your browser settings or with Google’s opt-out browser add-on.

How long we keep your information

We keep your information for as long as your account exists. You can delete your account and all associated data at any time (see below). Newsletter subscribers can unsubscribe at any time, after which we remove your email from the mailing list.

Your rights

Under the Privacy Act 2020 and the Health Information Privacy Code 2020, you have the right to:

• Access the personal information we hold about you;
• Correct information you believe is inaccurate;
• Export your data — available at any time from the in-app Settings screen;
• Delete your account and data (see below); and
• Withdraw consent for optional features, such as HealthKit / Health Connect sync.

To access or correct your information, email us at support@traqr.health. We will respond as soon as reasonably practicable, and within 20 working days as required by the Privacy Act.

Deleting your account

You can permanently delete your account and all associated data directly from the app:

• open the app and go to Settings;
• tap Delete Account; and
• confirm the deletion.

This permanently removes your Firestore records (injections, weights, meals, measurements, side effects, hydration), your stored meal photos and your authentication account. This action is irreversible. If you cannot access the app, you can also request deletion by emailing support@traqr.health.

Making a complaint

If you have a concern about how we have handled your information, please contact us first at support@traqr.health so we can try to put it right. If you are not satisfied with our response, you can complain to the New Zealand Office of the Privacy Commissioner at privacy.org.nz or on 0800 803 909.

Data breaches

We take reasonable steps to protect your information. If a privacy breach occurs that is likely to cause you serious harm, we will notify you and the Office of the Privacy Commissioner as required by the Privacy Act 2020’s notifiable-breach scheme.

Children’s privacy

Traqr is not intended for anyone under the age of 16, and we do not knowingly collect information from children. If you believe a child has provided us with personal information, please contact us so we can remove it.

Changes to this policy

We may update this policy from time to time. Any changes will be reflected by the “Last updated” date above. Significant changes will be communicated through the app or website.

Contact us

If you have any questions about this policy or your information, contact us at support@traqr.health.