Your information, and your choices.

Who this policy covers

This policy covers the Myo Rhythms website and application, including the conversational assistant Myo. Myo Rhythms is operated by Dive In Ventures LLC, a Texas limited liability company. It does not cover a connected provider’s own account or services. Our separate Consumer Health Data Privacy Policy describes consumer health information and related rights.

Information we collect

• Account and household information: email, identifiers, profile details, age information, time zone, goals, preferences, invitations, household roles, and the household details an authorized adult supplies.
• Health and wellness information: meals and food preferences; allergies and dietary restrictions; weight and body measurements; nutrition targets; exercise and performance; sleep, recovery, energy, symptoms, injuries or limitations you describe; optional menstrual or reproductive-cycle records; and supplement products, schedules, doses you enter, and recorded intake. Plans, readiness summaries, and adaptations can infer wellness information from these records.
• Conversations and other content: messages, onboarding answers, feedback, and support information you submit. Messages may contain health information even when entered as ordinary text. Submit only information needed for the feature.
• Connected services: when you authorize WHOOP or Oura, the permitted profile, sleep, recovery, activity, and body signals supported by that connection, together with connection credentials, permission scopes, and sync status. We also keep normalized records and source information used to explain your plan.
• Membership and payments: household access, code redemption, subscription status, billing identifiers, and transaction-related records. Stripe collects payment details directly. Myo Rhythms does not store your full payment card number.
• Early-access applications: first name, email, household size, selected wearables, areas where you want help, an optional short note, and your communication choices. Applying does not create an account or membership.
• Technical information: session and device information, request and error details, app version, security records, push subscriptions if enabled, and service performance. With your separate public-site analytics choice, Google Analytics receives page and section views, scroll milestones, general device and traffic-source information, and signup-flow events. We do not send it your name, email, application answers, free text, or health values.

Sources are you, authorized household adults for shared information, providers you connect, payment and authentication providers, and information generated when the service runs. We do not purchase consumer health information from data brokers.

How we use information

We use information to authenticate you; create, explain, and adapt plans; track the records you choose to keep; coordinate shared meals and groceries; synchronize authorized devices; manage membership; deliver requested reminders and essential notices; respond to support and privacy requests; and protect and maintain the service. Optional conversation capture and optional product measurement have separate choices. We do not sell personal information or use your health information for targeted advertising.

Conversations and AI

Myo uses AI services, currently Anthropic, to interpret your messages and generate explanations. Your message, relevant conversation context, and selected profile or wellness information needed for the request may be sent to that provider. This processing is part of providing an AI response even if you decline optional conversation capture.

Ordinary chat context is held in temporary server memory. Its expiry clock is 24 hours from the conversation’s most recent activity; expired context is removed when the cache is next cleaned or the process restarts. This is not a promise that each message disappears exactly 24 hours after you send it. Onboarding drafts and structured records extracted for your profile or tracking are separate records.

With your separate permission, we can retain encrypted copies of your messages, Myo’s replies, and associated interaction details in a separate capture store for evaluation and improvement of Myo. That capture is scheduled to expire 365 days after the original capture time. Authorized reviewers may access captured content for that purpose. Declining capture does not prevent you from using Myo or saving confirmed tracking records. Consent applies to your own conversations, not another adult’s account.

You can withdraw conversation-capture consent in Data and privacy or request help through Support. Withdrawal stops new optional capture once applied and queues deletion of previously captured copies. Account deletion also queues capture deletion. These background operations are not instantaneous. Withdrawing capture consent does not undo necessary processing already performed to answer a message or delete your confirmed profile and tracking history. AI providers’ service, security, and legal retention may differ from Myo’s capture window; we do not represent that provider processing has zero retention.

Households and private information

Household meal plans, recipes, groceries, and cooking coordination are shared. Your personal weight, targets, tracking, cycle details, and other private wellness records are scoped to you. Paying for a membership does not give a billing manager access to another adult’s private health data. Shared planning may reveal a preference or restriction through the meals chosen, and anything you put directly into shared content can be visible to household members. Do not include another adult’s private information without their permission.

Who receives information

Providers process information needed for their role: Supabase for authentication and databases; Railway for application delivery; Anthropic for AI processing; Stripe for payments; configured email or push delivery services for messages; and, only after you allow public-site analytics, Google Analytics for bounded website and signup-flow events. WHOOP and Oura process authorization and connection requests when you connect them. We do not send your application answers, meal, cycle, supplement, or conversation content to Google Analytics or Stripe.

Authorized operators may access information when needed for early-access review, support, security, privacy requests, or consented evaluation. We may disclose information when legally required, to address fraud or threats, or in a business transfer subject to applicable privacy restrictions. These circumstances are not permission to sell health data or disregard your consent. Provider services may process information in the United States or other countries where they operate. Their own services are also governed by their policies.

How long information stays

• Profile, confirmed history, and plans: generally kept while needed to provide your account and history, until you delete applicable records or your account. Canceling membership does not itself erase these records. Some corrections preserve earlier versions until account erasure.
• Optional captured conversations: scheduled for deletion after 365 days from capture, or earlier after consent withdrawal or account deletion. Cleanup workers perform the deletion.
• Exports: prepared files expire after 24 hours. A download authorization expires after five minutes and is single-use.
• Operations: optional product events, safe error events, and certain technical traces have 30-day cleanup windows. Support message text is scheduled to be cleared 90 days after a request is resolved; limited request metadata can remain. Aggregate operational summaries can remain longer.
• Early-access applications: scheduled for deletion after 18 months unless you join, withdraw sooner, or we need a shorter period under applicable law. Contact Privacy or Support to withdraw an application or request deletion.
• Deletion and billing records: limited, redacted records can remain for security, evidence of request completion, dispute resolution, or financial obligations. The current account-erasure flow retains specified redacted billing facts for up to 13 months from their original creation; payment providers may have their own legally required retention.

Expiry and a completed deletion are different. Queued work, retries, and provider coordination can affect when physical cleanup finishes. Backups and provider-held copies are not represented as instantly erased by the in-app request. We handle those copies and valid legal retention obligations as part of fulfilling the applicable privacy request; contact us for the status or scope of a specific request.

Your controls, exports, and deletion

Use Data and privacy for your export, account deletion, and optional product measurement settings. Your export covers your own supported profile and confirmed tracking history, normalized wearable evidence, plans and adaptations, and limited shared context. It excludes another adult’s private records, secret credentials, and certain internal queues or computation traces. Capture availability is reported separately; a missing capture component does not mean no captured content exists.

Deletion requires a fresh identity check and removes your private account records through a background workflow. Preserve the completion key provided in the app so you can check the result after sign-in access ends. A queued or blocked request is not complete. Shared household records remain for other members after your private attribution is removed. Household billing may require transfer to another adult or cancellation before all steps finish.

Disconnect a wearable in Device connections to stop future imports. Disconnecting is not the same as deleting previously imported history, and deleting Myo data does not delete your WHOOP or Oura account. Use their controls for provider-held data. You can disable optional reminders and product measurement separately; essential security, privacy, and billing notices remain necessary.

Privacy rights and requests

Depending on your location and the law’s scope, you may have rights to know or access information, receive a portable copy, correct or delete information, withdraw health-data consent, limit certain uses of sensitive information, opt out of sale, targeted advertising or certain profiling, and appeal a denied request. Myo does not sell personal information or use it for targeted advertising. We do not make decisions about employment, credit, insurance, or similar legal eligibility.

Use the in-app tools or Support to request help, including if you cannot sign in. State the right you want to exercise; you do not need to include health details in the first message or create a new account. We may verify your identity and an authorized agent’s authority before releasing or changing information. We will explain any applicable exception or extension and will not unlawfully discriminate against you for exercising your rights. To appeal a denial, contact the same support channel with “Privacy appeal” and the request reference. You can also contact your state attorney general or privacy regulator.

Cookies, local storage, and security

Authentication uses cookies. The app also stores device preferences and public app assets needed for installation and operation. The chat interface does not intentionally save conversation text to browser local storage. Public-site Google Analytics is off until you allow it; your choice is stored in your browser and can be reset by clearing site data. In-app product measurement remains a separate setting. Neither is used for targeted advertising.

We use access controls, household and individual data boundaries, and encryption for sensitive credentials and the optional conversation capture store. No internet service, device, or storage system is completely secure. Keep your device and sign-in codes private and tell us promptly about suspected misuse. We assess incidents and provide notices when required by applicable law. Myo is a consumer wellness service, not your clinical medical record, and we do not claim HIPAA certification or compliance.

Adults, children, and dependents

Accounts and coaching are intended for adults 18 and older. The service is not directed to children under 13. An authorized parent or guardian may supply limited dependent information needed for household meal planning, such as food restrictions, age band, and portions. This does not create a child’s independent coaching account or a child weight-loss program. Do not let a child use your account or submit unnecessary child health details. Contact us if a child has submitted information directly or you need to review or remove dependent information.

Changes and contact

We update the date above when this policy changes and provide additional notice for material changes as appropriate. New purposes that require consent will require that consent; an updated policy alone does not supply it.

Use Support for help with a privacy request. Creating a support reference by itself does not send a message. Business mail can be sent to Dive In Ventures LLC, 5900 Balcones Drive, STE 100, Austin, TX 78731.