Privacy Policy for Changing Shape Application
Last Updated: January 11, 2026
1. Introduction
Changing Shape ("we," "us," or "our") is committed to protecting your privacy and the sensitivity of your personal, particularly health-related, information. This Privacy Policy explains in detail how we collect, use, disclose, and safeguard your personal information when you use our Changing Shape mobile application (the "App"). By using the App, and especially by providing us with your sensitive health data, you are providing your explicit consent to the data practices described in this policy. If you do not agree with the terms of this Privacy Policy, please do not use the App.
Important Legal and Regulatory Context
HIPAA Status Clarification: Changing Shape is NOT a covered entity or business associate under the Health Insurance Portability and Accountability Act (HIPAA). The health and fitness data you provide through our App is NOT protected by HIPAA. While we implement robust security measures to protect your information, you should understand that:
- Your health data in this App does not have the same legal protections as medical records held by your doctor or hospital
- We are not bound by HIPAA's Privacy Rule, Security Rule, or Breach Notification requirements
- If you need HIPAA-protected health information storage, you should consult with your healthcare provider about their patient portal systems
While we are committed to complying with applicable privacy, consumer protection, and data security laws, no method of data handling or security can guarantee complete compliance with all legal requirements or protection against evolving regulatory interpretations, technologies, or security threats.
Washington My Health My Data Act: As a company based in Washington State, we are subject to the Washington My Health My Data Act (MHMDA), which provides heightened protections for consumer health data. This Privacy Policy is designed to comply with MHMDA requirements, and we are committed to protecting your consumer health data in accordance with this law.
FTC Health Breach Notification Rule: We ARE subject to the FTC Health Breach Notification Rule, which requires us to notify you and the FTC in the event of a breach of your health information. We take the security of your health data seriously and employ industry-standard security measures as described in Section 5 of this Privacy Policy.
Important Disclaimer Regarding Health and Wellness Information
The Changing Shape App provides tools and information to assist you in your diet and fitness journey. However, the App and its content are for informational purposes only and do not constitute medical advice, dietary advice, or healthcare recommendations. Results may vary, and the App is not a substitute for consultation with qualified healthcare professionals, including doctors, registered dietitians, or certified fitness trainers. Always seek the advice of your physician or other qualified healthcare provider for any questions you may have regarding a medical condition or before starting any diet, exercise, or wellness program. Changing Shape disclaims any liability for health outcomes or decisions you make based on information provided through the App.
2. Information We Collect
We collect several types of information from and about users of our App, adhering to the principle of data minimization - we will only collect and use personal information that is necessary for the purposes outlined in this Privacy Policy.
2.1 Personal Information You Provide Directly
Account Information: When you create an account, we collect information such as your name, email address, password, age, gender, and location (if you choose to share it).
Profile Information: You may choose to provide additional information for your profile, such as your profile picture, fitness goals, dietary preferences, weight, height, activity level, and other sensitive health-related information.
Diet and Fitness Data (Consumer Health Data): When you use the App to track your diet and fitness activities, we collect information you input, such as food logs, calorie intake, exercise routines, workout data, steps, and other related sensitive health data. By providing this information, you explicitly consent to our processing of this consumer health data for the purposes outlined in this Privacy Policy. Under Washington's My Health My Data Act, this is considered "consumer health data" and receives heightened protections.
Camera and Photo Data: If you choose to use camera features within the App, we may access your device's camera to allow you to:
- Capture photos of meals for food logging and nutritional tracking purposes
- Take progress photos to document and monitor your fitness journey over time
- Update your profile picture
- Share images in community features with other users (if you choose to do so)
Camera Access and Control:
- We only access your device camera when you actively initiate camera-related features within the App
- We do not access your camera in the background or without your explicit action
- Photos taken through the App are processed and stored only with your permission
- You maintain full control and can revoke camera permissions at any time through your device settings
What We Don't Do With Your Camera:
- We do not use photos for facial recognition or biometric identification
- We do not access your camera without your knowledge or consent
- We do not scan or access your existing photo library without separate permission
- We do not use your photos for any purpose beyond those you explicitly authorize within the App
- We do not share your photos with third parties for advertising or marketing purposes
Storage and Processing of Photos:
- Photos you capture may be stored locally on your device and/or uploaded to our secure cloud servers based on your choices within the App
- Photos uploaded to our servers are encrypted during transmission using TLS encryption and at rest using AES-256 encryption
- You can delete photos from the App at any time through the App interface
Communications: If you contact us directly, we may collect your name, email address, phone number, and the content of your communications.
User Content: If the App includes community features, we collect User Content you post, such as forum posts, comments, recipes, and progress updates.
Payment Information: For subscription services, we use third-party payment processors (e.g., Stripe, PayPal) and do not directly collect or store your full payment card details. We may receive limited payment information, such as transaction IDs and billing information, from these processors to manage subscriptions. Please refer to the privacy policies of our payment processors for details on their data handling practices:
2.2 Information Collected Automatically
Usage Data: We collect information about your use of the App, such as features you use, content you view, time spent in the App, and frequency of use.
Device Information: We collect information about your mobile device, including the device type, operating system version, device identifiers (such as IDFA or Android Advertising ID), mobile network information, and hardware settings.
Log Data: Our servers automatically record information ("Log Data") created by your use of the App, which may include your IP address, browser type, referring/exit pages and URLs, number of clicks, domain names, landing pages, pages viewed, and other such information.
Camera and Media Permissions: When you grant the App permission to access your camera, we only access it when you actively use camera-related features. We do not access your camera in the background or without your knowledge. Camera access is used solely for the in-app functionality you initiate.
Cookies and Similar Technologies: We use cookies, pixel tags, and similar technologies to collect information about your activity on the App, analyze app usage, and personalize your experience. Cookies are small data files stored on your device. We use both session cookies (which expire once you close your web browser) and persistent cookies (which stay on your computer until you delete them). You can manage your cookie preferences through your browser settings.
Third-Party SDKs and Analytics Tools: We use the following third-party services that may collect information about you:
Each third-party service operates according to its own privacy policy. We encourage you to review their policies to understand how they handle your data.
2.3 Information from Third-Party Sources
Social Media Integration: If you choose to connect your social media accounts to the App, we may collect information from those accounts, such as your profile information and friends list, as permitted by your settings on those services.
Health and Fitness Integrations: If you connect the App to other health and fitness apps or devices (e.g., Apple Health, Google Fit, Fitbit), we may collect data from those services, such as activity data, heart rate, sleep data, and other health metrics, based on your permissions and choices within those services.
2.4 Sensitive Personal Information and Consumer Health Data
Under certain privacy laws, including Washington's My Health My Data Act and California's Consumer Privacy Rights Act (CPRA), the following types of information we collect are considered "sensitive personal information" or "consumer health data":
- Health and fitness data (diet logs, exercise data, weight, body measurements, photos of meals, progress photos)
- Precise geolocation (if collected)
- Account credentials (username and password)
Purpose of Collection: We collect sensitive personal information and consumer health data solely to provide you with the Services you request, including personalized diet and fitness recommendations, progress tracking, and community support features.
No Sale of Sensitive Data: We do not sell or share sensitive personal information or consumer health data for cross-context behavioral advertising or any other commercial purposes.
3. How We Use Your Information
We use the information we collect for various purposes, including to:
Provide and Maintain the App: To operate, maintain, and improve the App and its features, and to provide you with the Services you request.
Personalize Your Experience: To personalize your experience within the App, such as providing customized diet and fitness recommendations, content, and features tailored to your profile and preferences.
Process Photos and Images: To display, store, and process photos you capture or upload through the App for meal tracking, nutritional analysis (if applicable), progress monitoring, and profile customization purposes.
Account Management: To manage your account, process subscriptions and payments, and provide customer support.
Communicate with You: To communicate with you about your account, updates, new features, promotions, and other news and information we think will be of interest to you. We may communicate via email, in-app notifications, or other means.
Improve the App: To analyze App usage trends and user behavior, conduct research and development, and improve the App's functionality and user experience.
Use of Artificial Intelligence: We use artificial intelligence (AI) and machine learning to enhance your experience, including:
- Generating personalized meal plans and recipes
- Providing fitness routine recommendations
- Analyzing food photos for nutritional estimates (if applicable)
How AI Uses Your Data:
- Your personal data (diet logs, fitness data, preferences, photos) is used to personalize AI recommendations for you
- We do NOT use your individual data to train our general AI models unless you provide explicit opt-in consent
- Aggregated, anonymized data may be used to improve AI algorithms
- AI-generated content is not a substitute for professional medical or nutritional advice
AI Limitations and Accuracy: AI-generated recommendations are estimates based on general data and may not be accurate for your specific situation. Always consult qualified professionals for medical, dietary, or fitness advice.
Marketing and Promotions: With your consent where required by applicable law, we may use your information for marketing and promotional purposes, such as sending you newsletters, special offers, and information about new products or services. You can opt-out of receiving marketing communications (see Section 7 below).
Legal Compliance and Safety: To comply with applicable laws, regulations, legal processes, or governmental requests, and to protect the safety, rights, property, or security of Changing Shape, our users, or others.
Aggregated and Anonymized Data: We may aggregate and anonymize your information with other users' information for statistical analysis, research, and other purposes. This aggregated and anonymized data does not identify you personally.
“Aggregated and anonymized data” means data that has been processed to remove personal identifiers and is not reasonably capable of being re-identified, directly or indirectly, using commercially reasonable means.
Automated Decision-Making and Profiling: We use automated systems (AI/algorithms) to:
- Generate personalized meal plans based on your dietary preferences and goals
- Recommend fitness routines based on your activity level and objectives
- Suggest content you may find interesting
Your Rights Regarding Automated Decisions:
- You have the right to not be subject to decisions based solely on automated processing that produce legal or similarly significant effects
- Our AI recommendations do not produce legal or similarly significant effects and are advisory only
- You can always request human review of automated decisions by contacting https://www.changingshape.com/contact
- EU/UK residents have the right to object to profiling as outlined in Section 7
4. Sharing of Your Information
We may share your information in the following circumstances:
With Service Providers: We may share your information with categories of third-party service providers who perform services on our behalf, such as:
- Payment processors (e.g., Stripe, PayPal)
- Analytics providers (e.g., Google Analytics, Firebase Analytics)
- Cloud hosting providers (e.g., Google Cloud Platform)
- Email delivery services
- Customer support platforms
- Marketing and advertising platforms
These service providers are contractually obligated to protect your information and use it only for the purposes for which we disclose it to them, and in accordance with applicable data protection laws. Where our service providers use sub-processors (other companies assisting them in providing services), we require our service providers to ensure that these sub-processors are also bound by contractual obligations to protect your data. Where service providers or sub-processors are located outside of your jurisdiction, we ensure appropriate data transfer mechanisms are in place, such as Standard Contractual Clauses approved by the European Commission, or other legally recognized safeguards.
4.1 Sharing of Photos and Images
We handle your photos with care and respect for your privacy:
- No Unauthorized Sharing Photos you take or upload are only shared with third parties (such as our cloud storage service providers) as necessary to provide App functionality and only with your consent
- Community Features: If you choose to post photos to community features (such as forums or progress sharing), those images will be visible to other users of the App. You control what you share publicly
- No Sale or Marketing Use: We do not sell your photos to third parties or use them for advertising or marketing purposes
- Service Providers: Photos may be processed by our authorized service providers (such as cloud storage providers like Google Cloud Platform) solely as necessary to provide App functionality. These providers are contractually bound to protect your data
- AI Analysis (if applicable): If we use AI to analyze meal photos for nutritional information, this processing is done solely to provide you with requested features and your photos are not used to train AI models for other purposes without your explicit consent
With Business Partners: We may share aggregated and anonymized data with business partners for research, marketing, or other purposes. This data will not identify you personally.
For Legal Reasons: We may disclose your information if we believe it is necessary to comply with a legal obligation, respond to a legal request, protect our rights or property, protect the safety of our users or the public, or detect, prevent, or address fraud or security issues.
In Connection with a Business Transfer: We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company. The acquiring company will be required to honor the commitments made in this Privacy Policy.
With Your Consent: We may share your information with third parties when we have your consent to do so.
Publicly Visible Information: If you participate in community features of the App, any information you voluntarily disclose and post to public areas of the App (e.g., forums, profiles) will be publicly visible and accessible to other users.
Important Note on "Sharing" Under Privacy Laws: Under certain privacy laws, including Washington's My Health My Data Act and California's CPRA, disclosing information to third parties for certain purposes (such as analytics or targeted advertising) may constitute "sharing" even if no money is exchanged. We share data with Google Analytics and Firebase Analytics for analytics purposes. You have the right to opt-out of this sharing as described in Section 7.
5. Data Security
We take reasonable and appropriate technical and organizational measures to protect your personal information from unauthorized access, use, or disclosure. These measures are regularly reviewed and updated to address evolving security threats and include:
Encryption: We use Transport Layer Security (TLS) encryption to protect data in transit and Advanced Encryption Standard (AES-256) encryption for data at rest.
Firewalls: We utilize firewalls to protect our systems from unauthorized access.
Secure Server Facilities: We store your personal information in secure server facilities with strict access controls.
Access Controls: Access to personal information is restricted to authorized personnel on a need-to-know basis.
While we strive to use commercially acceptable means to protect your personal information and implement robust security measures aligned with industry best practices, please remember that no method of transmission over the internet or method of electronic storage is completely secure. Therefore, while we are committed to protecting your personal information, we cannot guarantee its absolute security.
5.1 Data Breach Notification
In the event of a data breach affecting your personal health information, we will:
- Notify affected users via email within 60 days of discovery of the breach
- Notify the Federal Trade Commission as required by the FTC Health Breach Notification Rule
- Notify the Washington Attorney General as required by the Washington My Health My Data Act
- Notify prominent media outlets if the breach affects 500 or more users in a specific geographic area
-
Provide information about:
- What happened and when we discovered it
- What information was involved
- Steps we're taking to address the breach
- What you can do to protect yourself
- How to contact us for more information
You can help us reach you in the event of a breach by keeping your email address current in your account settings.
6. Data Retention
We will retain your personal information for as long as your account is active or as needed to provide you services, and as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements. The retention period may vary depending on the type of data.
Account Information: Retained while your account is active and for 90 days after account deletion for account recovery purposes, then permanently deleted.
Diet and Fitness Data (Consumer Health Data): Retained while your account is active. Upon account deletion, raw data is deleted within 30 days. We may retain anonymized, aggregated data indefinitely for statistical analysis and research purposes.
Photos and Images: Retained while your account is active. Upon account deletion, photos are deleted from our servers within 30 days. Photos stored locally on your device will remain until you manually delete them.
Log Data and Usage Analytics: Retained for 12 months, then automatically deleted or anonymized.
Payment and Transaction Records: Retained for 7 years to comply with tax and accounting laws.
Customer Support Communications: Retained for 2 years after the last interaction, then deleted.
Marketing Communications: Retained until you unsubscribe, then deleted within 30 days.
Legal Hold: If data is subject to litigation, investigation, or regulatory requirement, we will retain it until the matter is resolved, even if it exceeds the normal retention period.
When we no longer need to retain your personal information, we will securely dispose of it in accordance with our data retention policies and applicable law.
7. Your Rights and Choices
You have certain rights regarding your personal information, subject to applicable law. To exercise any of these rights, please contact us using the contact information provided in Section 11 below, outlining your request and providing sufficient information to allow us to verify your identity. We will process your request within 30-45 days as required by applicable law. We may need to request additional information to verify your identity before processing your request to protect your information and privacy.
General Privacy Rights (All Users)
Access and Correction: You have the right to access and review the personal information we hold about you and to request corrections of any inaccuracies. You can access and update some of your account information directly within the App's settings.
Deletion: You have the right to request the deletion of your personal information, subject to certain legal exceptions. We may need to retain certain information for legal obligations, to resolve disputes, or enforce our agreements.
Opt-Out of Marketing Communications: You have the right to opt-out of receiving marketing communications from us at any time. You can do this by following the unsubscribe instructions in our marketing emails or by adjusting your notification settings within the App.
Data Portability: You may have the right to request to receive a copy of your personal information in a structured, commonly used, and machine-readable format (JSON or CSV) and to transmit that data to another controller. To request your data export, contact
https://www.changingshape.com/contact with "Data Export Request" in the message. We will provide your data within 30 days of verification.
Withdraw Consent: If we are processing your personal information based on your consent, you have the right to withdraw your consent at any time. Withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal.
Camera and Photo Permissions: You can revoke the App's access to your camera at any time through your device settings (typically found in Settings > Apps > Changing Shape > Permissions). Revoking camera access will prevent you from using photo-capture features but will not affect other App functionality. You can delete photos you've uploaded to the App at any time through the App interface. Previously captured photos will remain in the App unless you choose to delete them individually or delete your entire account.
For Washington Residents (My Health My Data Act)
As a Washington-based company, we provide all users with the enhanced rights required by Washington's My Health My Data Act:
Right to Confirm and Access: You have the right to confirm whether we are collecting or sharing your consumer health data and to access that data.
Right to Withdraw Consent: You have the right to withdraw your consent to our collection and sharing of your consumer health data at any time.
Right to Delete: You have the right to have your consumer health data deleted from our systems, including from archived or backup systems. Upon receiving a deletion request, we will also notify all third parties and affiliates with whom we have shared your data to delete it as well.
Right to a List of Third Parties: You have the right to obtain a list of all third parties and affiliates with whom we share your consumer health data, including their contact information.
For California Residents (CCPA/CPRA)
Right to Know: You have the right to request disclosure of the categories and specific pieces of personal information we have collected about you in the past 12 months, including:
- Categories of personal information collected
- Categories of sources from which personal information was collected
- Business or commercial purposes for collecting or selling personal information
- Categories of third parties with whom we share personal information
- Specific pieces of personal information we have collected about you
Right to Delete: You have the right to request deletion of your personal information, subject to certain exceptions.
Right to Correct: You have the right to request correction of inaccurate personal information.
Right to Opt-Out of Sale/Sharing: You have the right to opt-out of the "sale" or "sharing" of your personal information. We do not sell personal information in the traditional sense, but sharing data with analytics providers (Google Analytics, Firebase) may qualify as "sharing" under CCPA.
Do Not Sell or Share My Personal Information: To opt-out, contact
https://www.changingshape.com/contact with "CCPA Opt-Out" in the message, or adjust your preferences in Settings > Privacy > Do Not Sell or Share My Information.
Right to Limit Use of Sensitive Personal Information: You have the right to limit our use of your sensitive personal information (including health data) to purposes reasonably necessary to provide the services you request. To exercise this right, contact
https://www.changingshape.com/contact with "Limit Sensitive PI Use" in the message.
Right to Non-Discrimination: You have the right not to receive discriminatory treatment for exercising your CCPA rights.
Authorized Agents: You may designate an authorized agent to make requests on your behalf. We will require written proof of authorization.
For Virginia, Colorado, Connecticut, Utah, and Other State Residents
Residents of states with comprehensive privacy laws have similar rights including access, deletion, correction, and opt-out rights. Contact us using the information in Section 11 to exercise these rights.
For European Economic Area (EEA), UK, and Swiss Residents (GDPR)
Right to Access: You have the right to obtain confirmation of whether we process your personal data and to access such data.
Right to Rectification: You have the right to request correction of inaccurate personal data.
Right to Erasure: You have the right to request deletion of your personal data under certain circumstances.
Right to Restriction of Processing: You have the right to request restriction of processing your personal data under certain circumstances.
Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, machine-readable format.
Right to Object: You have the right to object to processing of your personal data based on legitimate interests or for direct marketing purposes.
Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority in your jurisdiction if you believe our processing of your personal information violates applicable data protection laws.
Account Deletion
You may delete your account at any time by:
Upon account deletion:
- Your account will be deactivated immediately
- Personal information will be deleted within 30 days, including from archived and backup systems
- We will notify all third parties with whom we have shared your consumer health data to delete it as well
- Some information may be retained as required by law or for legitimate business purposes (e.g., transaction records for accounting, fraud prevention)
- Anonymized/aggregated data may be retained indefinitely for research and analytics
Verification Process
To protect your privacy and security, we will verify your identity before processing requests. We may request:
- Account email verification
- Additional identifying information (name, account details)
- Government-issued ID in certain circumstances
We will respond to verified requests within 30-45 days depending on applicable law.
8. Children's Privacy
AGE RESTRICTION: The Changing Shape App is intended for users 18 years of age and older. We do not knowingly collect personal information from anyone under the age of 18.
COPPA COMPLIANCE: We comply with the Children's Online Privacy Protection Act (COPPA). We do not knowingly collect personal information from children under 13 years of age. If we become aware that we have collected personal information from a child under 13 without verified parental consent, we will delete that information immediately.
PARENTAL NOTIFICATION: If you are a parent or guardian and believe your child under 18 has provided us with personal information, please contact us immediately at
https://www.changingshape.com/contact. We will take steps to verify the claim and delete the information.
AGE VERIFICATION: We may implement age verification mechanisms and reserve the right to request proof of age at any time. Accounts found to belong to users under 18 will be terminated immediately.
9. International Data Transfers
Your information may be transferred to and maintained on computers located outside of your state, province, country, or other governmental jurisdiction where the data protection laws may differ from those in your jurisdiction, including to the United States where we are headquartered. If you are located outside the United States and choose to provide information to us, please note that we transfer the data, including Personal Information, to the United States and process it there.
Transfer Mechanisms: We ensure lawful data transfers using:
- EU-US Data Privacy Framework (for transfers from EEA to US) - we are in the process of self-certifying under this framework
- UK Extension to EU-US Data Privacy Framework (for transfers from UK to US)
- Standard Contractual Clauses approved by the European Commission (where applicable)
- Adequacy decisions recognized by the European Commission or UK
- Your explicit consent for transfers to countries without adequacy decisions
Data Processing Agreement: Our service providers processing data on our behalf are bound by data processing agreements requiring them to protect your data according to applicable data protection standards.
Your Rights: If you are located in the EEA or UK, you have the right to obtain information about the safeguards we use for international transfers. Contact us at
https://www.changingshape.com/contact
Photos and Images: Photos you capture or upload through the App may be transferred to and stored on servers located in the United States and other jurisdictions where our service providers operate. We ensure that all such transfers are conducted in accordance with applicable data protection laws and that appropriate safeguards are in place to protect your data, including encryption during transmission and storage.
By using the App and agreeing to this Privacy Policy, you freely and specifically consent to the transfer of your personal information to the United States. We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy and applicable data protection laws.
10. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our data practices, legal requirements, or for other reasons. We will post notice of any material changes within the App or on our website and update the "Last Updated" date at the top of this Privacy Policy. For significant changes, we may also provide more prominent notice or seek your consent, as required by applicable law. We encourage you to review this Privacy Policy periodically for any updates. Your continued use of the App after the posting of changes constitutes your acceptance of such changes.
11. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our Privacy Team at:
Disputes arising from or relating to this Privacy Policy are governed by the dispute resolution and arbitration provisions set forth in our Terms of Use, which are incorporated herein by reference, except where prohibited by applicable law.
12. Consent
BY USING THE CHANGING SHAPE APP, YOU ACKNOWLEDGE THAT YOU HAVE READ THIS PRIVACY POLICY, UNDERSTAND IT, AND PROVIDE YOUR EXPLICIT CONSENT TO THE COLLECTION, USE, PROCESSING, AND DISCLOSURE OF YOUR PERSONAL INFORMATION, INCLUDING SENSITIVE HEALTH DATA AND CONSUMER HEALTH DATA, AS SPECIFICALLY DESCRIBED IN THIS PRIVACY POLICY AND THROUGH IN-APP CONSENT MECHANISMS, WHICH MAY VARY BY FEATURE AND DATA TYPE. YOU UNDERSTAND THAT YOU HAVE THE RIGHT TO WITHDRAW YOUR CONSENT AT ANY TIME BY CONTACTING US OR DELETING YOUR ACCOUNT.
