On this page
If you live in the European Union or the United Kingdom and you're considering a GLP-1 tracking app, GDPR is your friend before it's your problem. The Regulation gives you rights an app must respect, defines what the app can collect about you and on what basis, and obliges the operator to be honest about all of it in their privacy policy. This guide explains what GDPR actually requires of a weight loss app — including Muscle Guard — and how to read an app's privacy posture before you install it.
What counts as your data on a GLP-1 app
More than you think. Most weight-loss apps process at least three categories of personal data: identifying information (email, name), behavioural information (weight, food, exercise, photos), and inferred information (your patterns, risk flags, recommendations). The middle category, behavioural, includes health data — and health data is "special category" personal data under Article 9 GDPR, which requires explicit consent or another specific legal basis before processing.
That's a higher bar than ordinary personal data. The app must tell you clearly what health data it collects, why, and have a legitimate legal basis for each use. "It improves the app" is not, by itself, a sufficient basis for processing your medication log, weight or photos.
Your rights, in plain language
| Right | What it means in practice |
|---|---|
| Access | Get a copy of every piece of data the app holds about you, in a readable format, within one month |
| Rectification | Correct anything inaccurate or incomplete |
| Erasure ("right to be forgotten") | Delete your data, the account, the lot — usually with a documented retention window for legitimate purposes (typically <30 days) |
| Portability | Export your data in a machine-readable format (JSON, CSV) so you can take it elsewhere |
| Restriction | Limit how the app processes your data without deleting it |
| Object | Refuse certain types of processing (especially marketing or profiling) |
Every reputable app, including Muscle Guard, makes these rights available either directly in the app or by emailing support. The friction of exercising the right is itself a signal of how the operator thinks about your data.
How to read an app's privacy policy in under 10 minutes
Privacy policies look long and legalistic but they're usually the same shape. Search for these terms and read the surrounding paragraph:
- "Third party" or "Third parties" — every third party that touches your data must be listed. If a privacy policy doesn't name them, it's not GDPR-compliant.
- "Advertising" — is your data used for advertising? If yes, is it first-party only or third-party? Third-party ad networks are typically a red flag for a health app.
- "International transfer" or "Data hosting" — where does your data physically live? EU region is the lowest-friction answer. US hosting requires additional safeguards (Standard Contractual Clauses, Data Privacy Framework participation).
- "Retention" — how long is your data kept after you stop using the app or delete your account?
- "Legal basis" — under what article of GDPR does the processing happen? Most should cite Article 6(1)(b) (performance of a contract) for the service itself and Article 9(2)(a) (explicit consent) for health data.
Cookies, banners, and a quieter approach
If you've spent any time online in Europe you have clicked thousands of cookie banners. They exist because the e-Privacy Directive requires explicit consent for non-essential cookies. The polite implication: any site or app that doesn't set non-essential cookies doesn't need a banner. Muscle Guard's website, by design, does not use third-party trackers or non-essential cookies — and therefore does not have a cookie banner. This is the privacy-first posture made architectural rather than performative.
How Muscle Guard handles GDPR
The architectural commitments:
- EU-region data hosting. Account and health data live in Firebase Cloud Firestore, EU-West region. AI plate-scan images are processed transiently and not retained.
- Explicit consent for health data processing. You consent at sign-up. You can withdraw consent at any time.
- No third-party advertising. No ad networks, no behavioural ad targeting, no data sale.
- Deletion in one tap. Profile → Delete Account → two-tap confirmation → all personal data removed within 7 days.
- Portability available on request. Email support and we'll generate a JSON export of everything we hold.
- Doctor PDF generated on-device. The PDF is created on your phone, not on our servers, and shared at your discretion only.
The full Privacy Policy lives at /privacy.html and the deletion mechanics at /delete-account.html. The EU regional page at /regions/eu.html sets out the broader posture.
Red flags when evaluating any weight-loss app
- A vague privacy policy. "We may share data with selected partners" is not specific enough to consent to.
- A cookie banner with no genuine reject-all option. Often a dark-pattern signal.
- Required social-network login. Means your weight-loss app activity may be linked to your social graph.
- No deletion route in-app. If you have to email to delete, the friction is the point.
- No named data controller. Article 13 requires the controller's identity. If you can't find a registered company name in the privacy policy, walk away.
Frequently asked questions
Is health data treated differently under GDPR?
Yes. Article 9 designates health data as a special category requiring explicit consent or another specific legal basis. Apps cannot rely on 'legitimate interest' to process health data the way they can for ordinary personal data.
Where does Muscle Guard host my data?
Account and health data are stored in Firebase Cloud Firestore, EU-West region. The Doctor PDF is generated on your phone, not on our servers.
Does Muscle Guard sell my data?
No. Not to advertisers, not to data brokers, not to insurers, not to anyone. We don't sell data.
Can I export my data?
Yes. Email support@muscleguardglp.com and we'll generate a JSON export of everything we hold about you within one month, as required by the GDPR portability right.
What happens if I delete my account?
All personal data removed within 7 days. Anonymised, aggregated metrics may be retained for app improvement — never linked back to you.
Does Muscle Guard use cookies?
The website uses no third-party trackers and no non-essential cookies. We don't display a cookie banner because we don't need to set the kind of cookies that require consent.
Where is your Data Controller registered?
Brand Expert (Pty) Ltd, Johannesburg, South Africa. EU users have the right to lodge complaints with their local Data Protection Authority — typically the BfDI in Germany, CNIL in France, AEPD in Spain.
Start your free 7-day Pro trial →
Track this with Muscle Guard
Score your muscle preservation across protein, training, weight trend and body composition.
Subscribe to the research library
Get new research articles when they ship. One email per week. No marketing, no third parties. Unsubscribe in one tap.