gutWise Privacy Policy
Last updated: 12 November 2026
1. Who we are and what this policy covers
This privacy policy applies to the gutWise app and to gutwise.com.
gutWise is owned and operated by Gutwise AS (organisation number 927 516 098), c/o Berit Nordstrand, Erling Skakkes gate 54, 7012 Trondheim, Norway. In this policy "we", "us" and "gutWise" mean Gutwise AS. We are the data controller for the personal data described here.
gutWise was previously offered under the GØT brand, and some app-store records may still show that name.
We are a Norwegian company, so we process your personal data in accordance with the Norwegian Personal Data Act 2018 and the EU General Data Protection Regulation 2016/679 (GDPR), wherever in the world you use the Service. If you live outside the EEA you may have additional rights under your local law, and we will help you exercise them where we can.
The terms of use for the gutWise app are at https://gutwise.com/terms. How we use cookies on gutwise.com is covered in our Cookie Policy at https://gutwise.com/cookies.
gutWise is not a medical service. It is a food and lifestyle programme. It does not diagnose, treat or prevent any condition, and it does not replace advice from your doctor.
Age. gutWise is intended for adults. You must be at least 18 years old to create an account. We do not knowingly collect personal data from anyone under 18; if you believe a minor has given us data, contact us at post@gutwise.no and we will delete it.
2. What we collect, why, and on what legal basis
2.1 Account and contact information
What: your name and email address, your login details, and any other details you choose to add to your profile.
Why: to create and maintain your account, give you access to the Service, and provide customer support.
Legal basis: performance of our contract with you (GDPR Art. 6(1)(b)).
2.2 Health information
- Date of birth, gender, height and weight, used to personalise calculations and recommended activity levels
- Resting and maximum heart rate, entered by you or received from a connected device, used to estimate fitness development and suggested activity level
- Information you record in the app about your habits, meals, digestion and wellbeing across the 12 steps
Why: to calculate the insights and scores the Service is built on, and to give you guidance based on them.
Legal basis: your explicit consent (GDPR Art. 6(1)(a) and Art. 9(2)(a)). Health data is a special category of personal data and receives additional protection.
You can withdraw this consent at any time, and withdrawal does not affect processing carried out before you withdrew it. Without this consent we cannot provide most of the Service.
2.3 Data from connected devices and health platforms
What: activity data, heart rate, sleep data and heart rate variability.
From: services you choose to connect, such as Apple Health, Google Health Connect or a supported wearable device.
Why: the same purposes as section 2.2.
Legal basis: your explicit consent, both in the gutWise app and in the connecting service. You control the connection and can disconnect it at any time in the app, and revoke access in the other service.
We use data received through Apple Health only to provide features inside the app. We do not use it for advertising, and we do not sell it or share it with data brokers.
2.4 Subscription and payment information
Subscriptions are purchased and managed through the Apple App Store or Google Play. We never see or store your card details. Apple and Google process your payment and share limited subscription status with us so we can give you access.
What: subscription status, plan, renewal and cancellation status, and a store transaction identifier.
Legal basis: performance of our contract with you.
2.5 Device and technical data
What: device type and model, operating system version, app version, language setting, and crash and diagnostic data.
Why: to keep the app working, diagnose faults and improve stability.
Legal basis: our legitimate interest in operating and improving a functioning service (GDPR Art. 6(1)(f)).
2.6 Communications with us
What: your name, email address, the topic and preferred reply language you select, your message, subscription details if you share them, and anything else you choose to tell us when you contact support by email or through the contact form on gutwise.com.
Why: to answer you and keep a record of the enquiry.
Legal basis: our legitimate interest in responding to enquiries, and performance of our contract with you.
Messages sent through the contact form on gutwise.com are delivered to us by Formspree, operated by Formspree, Inc. in the United States, which processes them on our behalf as a data processor. Transfers to Formspree rely on the safeguards described in section 3.
2.7 News and marketing
If you have agreed to receive news from us, we use your email address to send it. You can unsubscribe at any time using the link in each email or by contacting us.
Legal basis: your consent. Marketing by email or SMS is sent in line with the Norwegian Marketing Control Act section 15, meaning we only send it where you have consented or where we have an existing customer relationship with you.
2.8 Website analytics and cookies
How we use browser storage on gutwise.com is set out in our Cookie Policy at https://gutwise.com/cookies. Website clicks are recorded only after you accept analytics, and never if your browser sends Global Privacy Control. Page visits, time on page, page speed and errors are recorded for every visitor, without cookies and without identifying anyone.
Lovable provides the website visitor analytics. It records the pages visited, where visitors came from, their country, browser, operating system and device type, how long they stay, how fast pages load, errors and, after analytics consent, clicks. We do not currently send additional app events to Lovable's website analytics.
Lovable's analytics uses no cookies, stores nothing on the visitor's device, does not keep IP addresses and does not identify visitors. Lovable collects this data for us. Lovable's privacy policy at https://lovable.dev/privacy explains how it handles it.
Detailed website analytics data is kept for 90 days and daily summaries for a year. Your analytics choice is saved in your browser and an acceptance is honoured for up to 12 months. You can change your choice using Cookie settings in the footer. Fonts are loaded from Google Fonts. Google receives your IP address to deliver them; this does not set cookies.
4. How long we keep your data
We keep personal data only as long as we need it for the purpose it was collected for, or as long as the law requires.
| Data | Retention |
|---|---|
| Account and profile data | For as long as your account is active |
| Health data recorded in the app | For as long as your account is active, or until you withdraw your consent |
| Data from connected devices | For as long as the connection is active and your account exists, or until you withdraw your consent |
| Support correspondence | For as long as needed to handle your enquiry and any follow-up |
| Newsletter subscription | Until you unsubscribe |
| Accounting and transaction records | Five years after the end of the financial year, as required by the Norwegian Bookkeeping Act |
| Crash and diagnostic data | For as long as needed to diagnose and fix faults |
If you withdraw consent for health data processing, we delete that data unless we are legally required to keep it. If you delete your account, we delete or anonymise your personal data without undue delay, and at the latest within one month, except where retention is legally required.
5. How we protect your data
Personal data is stored electronically in systems with security measures appropriate to the sensitivity of the data. Because we process health data, we apply additional safeguards.
Our measures include access control and authentication, encryption in transit and at rest, regular risk assessment, technical monitoring, logging, and internal routines for handling access, correction and deletion requests. You can ask us for further detail about our security arrangements.
If a personal data breach occurs that is likely to result in a high risk to your rights and freedoms, we will notify you and the Norwegian Data Protection Authority as required by GDPR Articles 33 and 34.
6. Your rights
- Access
- You can ask what personal data we hold about you and receive a copy.
- Rectification
- If something is wrong or out of date, tell us and we will correct it.
- Erasure
- You can ask us to delete your personal data. We will do so unless we still need it for a purpose you have been told about, or the law requires us to keep it.
- Restriction
- You can ask us to stop processing your data while a dispute or correction is resolved.
- Portability
- For data you gave us that we process automatically to fulfil our contract, you can ask for it in a structured, commonly used, machine-readable format, or ask us to transfer it to another provider.
- Objection
- You can object to processing based on our legitimate interests, on grounds relating to your particular situation.
- Withdraw consent
- Where we rely on consent, you can withdraw it at any time, without affecting processing already carried out.
- Complain
- You can complain to a supervisory authority. In Norway this is Datatilsynet (datatilsynet.no). If you are in another EEA country or the UK, you may complain to your local authority instead. We would appreciate the chance to resolve the matter first.
We respond to requests free of charge and within 30 days. If we need longer, we will tell you why. We may ask you to verify your identity first.
7. If you are in the United Kingdom
If you are in the United Kingdom, we process your personal data in line with the UK GDPR and the Data Protection Act 2018. You have the rights described in section 6, and you can complain to the Information Commissioner's Office (ico.org.uk).
8. If you are in California or another US state with privacy legislation
If you live in a US state with consumer privacy legislation, you may have additional rights, for example to know, correct or delete personal information we hold about you. We do not sell personal information and do not share it for cross-context behavioural advertising. To exercise your rights, contact us at post@gutwise.no. We will not treat you differently for doing so.
9. Changes to this policy
We may update this policy to reflect changes in the law, in our practices or in the Service. We will tell you about material changes through the app or by email before they take effect. The date at the top of this page shows when it was last updated.
10. Contact us
For any question about this policy, or to exercise any of the rights above:
- Email: post@gutwise.no
- Post: Gutwise AS, c/o Berit Nordstrand, Erling Skakkes gate 54, 7012 Trondheim, Norway
- Organisation number: 927 516 098