Privacy Policy | Gutwise

1. About this Privacy Policy and Gutwise

This privacy policy applies to the Gutwise app, owned and operated by Gutwise AS (Org. No. 927 516 098, Erling Skakkes gate 54, 7012 Trondheim). Gutwise AS is a Norwegian limited company behind the Gutwise app. Gutwise is a brand, a community, and an app that guides people towards an anti-inflammatory and gut-friendly lifestyle through advice on holistic health, nutrition, activity, stress management, exercise, and sleep.

Gutwise is the data controller for the personal data we collect or receive through your use of the Gutwise app (the Service). We are committed to protecting your privacy and to being transparent about when, why, and how we process your personal data.

As a Norwegian company, we process personal data in accordance with the Norwegian Personal Data Act of 2018 and the EU General Data Protection Regulation 2016/679 (GDPR), regardless of where you use the Service. If you live outside the EEA, you may have additional rights under local privacy laws. We will inform you of these rights as far as possible and facilitate their exercise.

Please read this policy carefully and review it periodically. We may update it due to legal changes, changes in our practices, or other reasons. We will notify you of material changes.

2. Information We Process, the Purpose, and Legal Basis

Registration and use of the Service

Purpose: To register you as a user and provide the Service.

Information: Name, address, telephone number, and email address.

Legal basis: Processing is necessary to perform our agreement with you.

Device data

Purpose: Certain actions in the app collect information about your device so that the Service can function properly.

Information: Device type and model, and the software version you use.

Legal basis: Our legitimate interest in operating and improving the Service, which is not overridden by your rights and freedoms.

Health information in the Service

Purpose: To analyse and calculate health and activity parameters, provide insights, and give advice based on those insights.

Information: Date of birth, gender, height, and weight for personalised activity calculations; resting and maximum heart rate from connected devices or manual entry to estimate fitness development, health risks, and activity needs.

Legal basis: Your explicit consent. You may withdraw your consent at any time; this does not affect processing completed before withdrawal. Without consent, we cannot provide all Service features.

Data from connected devices

Purpose: The same purposes as the health information you provide in the Service.

Information: Activity, heart rate, sleep, and HRV (Heart Rate Variability) data from connected services such as Whoop, Oura Ring, Fitbit, Polar, Garmin, Apple Health, or equivalent services.

Legal basis: Your consent to transfer the data directly from the service provider to the Gutwise app.

Communications

Purpose: To respond when you contact us by email, telephone, or through the app.

Information: Name, email address, telephone number, subscription information, and other information you choose to share.

Legal basis: Our legitimate interest in responding to your enquiry.

Newsletters, marketing, and other information

Purpose: To send important subscription information, error messages, updates, newsletters, marketing, and Service tips.

Information: Name, email address, telephone number, and relevant subscription information.

Legal basis: Your explicit consent or our legitimate interest. Electronic marketing is sent in accordance with the Norwegian Marketing Act.

3. Storage and Sharing of Personal Data

Disclosure to others

We do not share or sell your personal data unless you consent or there is another lawful basis for doing so, such as fulfilling an agreement with you, complying with a legal obligation, or our legitimate interest in sharing the information.

In specific cases, we may share personal data with advisers, auditors, lawyers, IT consultants, and others. Such sharing is governed by an agreement and limited to what is necessary for the third party to provide its services to Gutwise.

Data processors and transfers

We may use external suppliers, including storage and communication providers, that process personal data on our behalf. We enter into data processing agreements to ensure appropriate security throughout the processing.

Our data processors may be located outside the EU/EEA. We transfer personal data outside the EU/EEA only where a legal basis exists under GDPR Chapter V, and choose EU/EEA storage where possible. You can contact us for information about the basis for a transfer.

Retention and security

We do not retain your personal data longer than necessary for the processing purpose and our legal obligations. Data processed under consent is deleted if consent is withdrawn. Data processed to perform an agreement is deleted when the agreement and related obligations, including accounting and complaint-handling obligations, have been fulfilled. Data required by law is deleted when retention is no longer required.

Personal data is stored electronically in local IT systems with appropriate security measures. We use regular risk assessments, technical monitoring systems, physical procedures, and routines for access and correction requests to prevent unauthorised access and ensure compliance with applicable law.

4. Your Rights and Information About Enquiries

You have the following rights in connection with the personal data we process about you:

Access: You may receive information about, and access to, the personal data we store about you.
Correction and deletion: You may ask us to correct inaccurate information or delete information. We will accommodate deletion requests where possible, unless we still need the information or law requires continued processing.
Restriction: You may ask us to stop processing your personal data, for example while a concern about unlawful processing is resolved.
Data portability: For data you have provided that is processed automatically and necessary to perform an agreement, you may request delivery or transfer in a structured, commonly used, machine-readable format.
Objection: You may object to processing when justified by your particular situation.
Complaint: You may complain to a supervisory authority. In Norway, this is the Norwegian Data Protection Authority (Datatilsynet). Please contact us first so we can address any misunderstanding.
Withdrawal of consent: Where processing is based on consent, you may withdraw it at any time using the method stated when you gave consent or by contacting us.

5. Contacting Us

If you have questions or concerns about our processing of your personal data, or wish to exercise one or more privacy rights, please contact Gutwise AS at Erling Skakkes gate 54, 7012 Trondheim.

We may ask you to verify your identity before responding. We facilitate the exercise of your rights free of charge and within 30 days. If we need more time, we will let you know.