Privacy Policy

Effective date: June 1, 2026
Last updated: September 27, 2026

This Privacy Policy explains how HealthTales, LLC, a Minnesota limited liability company doing business as GLP101 ("HealthTales," "GLP101," "we," "us," or "our"), collects, uses, shares, and protects personal information when you use the GLP101 website at glp-101.com, the GLP101 app, our lessons, tools, community, live experiences, emails, and content made available through third-party AI assistants (collectively, the "Services").

‍
If you live in Washington, Nevada, or Connecticut, or if you want details about health-related data specifically, please also read our Consumer Health Data Privacy Policy, which is part of this Privacy Policy.

‍

Our Privacy Commitments
  • We do not sell your personal information.
  • We do not share your weight, journey stage, or other health-related information with advertising platforms, employers, insurers, or pharmaceutical companies.
  • Advertising pixels are used only on our public marketing pages, only with your consent where required, and never inside the logged-in GLP101 app, in health tools, or at checkout.
  • You can delete your account and data at any time.
1. Who We Are and How to Contact Us

HealthTales, LLC
PO Box 7256
Minneapolis, MN 55407
USA
Email: support@healthtales.co
‍

2. Scope and Audience

GLP101 is an education platform. We are not a healthcare provider, and our content is not medical advice.


The Services are intended for adults 18 years of age or older located in the United States. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected personal information from someone under 18, we will delete it. If you believe a minor has provided us information, contact support@healthtales.co.

‍

3. HIPAA Status

HealthTales is not a "covered entity" or "business associate" under the Health Insurance Portability and Accountability Act ("HIPAA"), and information you provide directly to us is generally not protected health information under HIPAA. Instead, your information is protected by this Privacy Policy, our Consumer Health Data Privacy Policy, and applicable federal and state consumer privacy laws, including the FTC Act and the FTC Health Breach Notification Rule. We do run our technology on a HIPAA stack and follow HIPPA-specific practices. We apply security safeguards to health-related information as described in Section 10.

‍

4. Information We Collect
‍

4.1 Information you provide

  • Account information: first name, last name, email address, and password (or sign-in through Google).
  • Learning preferences: topics you want to learn about.
  • Journey stage: your self-reported stage with GLP-1 medications, such as Considering, On a GLP-1, or Considering stopping or switching.‍
  • Weight logs: weight entries and related dates you choose to record in our tools.‍
  • Community content: your profile display name, posts, messages, comments, and reactions in community spaces.‍
  • Live experiences: registrations, attendance, and any questions or chat messages you submit during live sessions.‍
  • Communications: messages you send to our support team, survey responses, and feedback.

We do not ask for your medical records, diagnoses, prescriptions, insurance information, Social Security number, race or ethnicity, sexual orientation, or biometric data. Please do not include sensitive details you do not want us to have in free-text fields or community posts.


4.2 Payment and subscription information
Payments are processed by Stripe. We do not receive or store your full card number. We receive and keep limited billing information from Stripe, such as your name, billing ZIP code, card brand, the last four digits of your card, and its expiration date. We also keep your plan type, subscription status, renewal dates, transaction history, and records of your consent to automatic renewal terms.


4.3 Information collected automatically

  • Usage data: lessons and videos you start and complete, progress through learning paths, time spent on content, and features you use.
  • Device and technical data: browser type, device type, operating system, IP address, approximate location derived from IP address (city or state level), referring pages, and dates and times of access.
  • Email engagement: whether you open our emails and click links in them.


4.4 Information from Third Parties

  • Sign-in providers: if you sign in with Google, we receive your name, email address, and profile image as permitted by your Google settings.
  • Advertising and marketing partners: if you click one of our ads, we may receive information about the ad campaign that brought you to our site.
  • AI assistants and connectors: if you use GLP101 content through a supported third-party AI assistant, we receive the request the assistant sends to our connector, which may include the text of your question, and technical information needed to return our content. If you link your GLP101 account to the connector, we also receive your account identifier.

‍

5. Cookies, Pixels, and Similar Technologies
‍

5.1 Essential technologies

We use essential cookies and similar technologies to keep you signed in, secure your account, process payments, remember your preferences, and operate the Services. These cannot be turned off, because the Services will not work without them. Our authentication provider may use third-party cookies to support secure sign-in across our domains.

‍

5.2 Analytics
We use product analytics to understand how the Services are used and to improve our content and experience. Inside the logged-in app, analytics use pseudonymous identifiers and an approved list of events. We do not send weight values, journey stage, or community content to analytics tools.

‍

5.3 Advertising Pixels
We advertise GLP101 on social media and other platforms. On our public marketing pages only, and only with your consent where required, we use advertising pixels and cookies from partners such as Meta, Google, and TikTok. These tools may collect information such as the pages you visit, your IP address, and device identifiers, to measure our ads and show GLP101 ads to you on other sites and apps.

We do not place advertising pixels inside the logged-in GLP101 app, in our weight tools or journey-stage questions, in community spaces, or on checkout and account pages. We do not send your weight, journey stage, or other health-related information to advertising partners, and we do not use it to build advertising audiences.
‍

5.4 Your Cookie Choices
You can accept or decline non-essential cookies in our cookie banner, and change your choice anytime by selecting Consent Preferences in the footer of our website. We honor Global Privacy Control (GPC) browser signals as a request to opt out of advertising cookies and targeted advertising. You can also block cookies in your browser settings.

‍

6. How We Use Your Information

We use personal information to:

  • Provide the Services: create and manage your account, deliver lessons and tools, save your progress and weight logs, and operate community and live features.
  • Process subscriptions: charge your payment method, send receipts, confirmations, renewal reminders, and price-change notices, and handle cancellations and refunds.
  • Personalize your learning: recommend content based on your topics, journey stage, and progress. This happens within GLP101 only.
  • Communicate with you: send transactional and account emails and, if you opt in, marketing emails and newsletters.
  • Improve and develop the Services: analyze usage trends, usually in aggregated or de-identified form.
  • Market GLP101: measure and improve our advertising, as described in Section 5.3.
  • Keep the Services safe: moderate community content, prevent fraud and abuse, and protect security.
  • Meet legal obligations: comply with laws, respond to legal requests, keep tax and accounting records, and enforce our Terms.

We do not use your personal information to train artificial intelligence models, and we do not allow our vendors to do so.

‍

7. How We Share Your Information
‍

We do not sell your personal information. We do not share identifiable information with employers, insurers, sponsors, or pharmaceutical companies for their own purposes.


We share information only as follows:

‍

Service providers (processors)

We share information with third-party vendors that perform services on our behalf, such as:

  • Service providers: vendors that process information on our behalf under contracts requiring them to protect it and use it only to provide services to us. These include cloud hosting (Amazon Web Services), authentication and sign-in, payment processing (Stripe), email delivery and email marketing, product analytics, customer support, video hosting, and community and live-event tools.
  • Advertising partners: as described in Section 5.3, limited to activity on our public marketing pages, with your consent where required. This does not include health-related information.
  • Other members: your display name, profile, and community posts are visible to other members in community spaces.
  • AI assistants you use: when you request GLP101 content through a third-party AI assistant, we return our content to that assistant. The assistant provider handles your conversation under its own privacy policy.
  • Care and business partners: if you access GLP101 through a partner, such as a healthcare provider or employer program, we will share identifiable information with that partner only as described to you at enrollment and with your consent.
  • Legal and safety: when we believe in good faith that disclosure is required by law, legal process, or government request, or is necessary to protect the rights, property, or safety of our users, HealthTales, or others.
  • Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to this Privacy Policy. We will notify you before your information becomes subject to a different privacy policy.
  • With your consent: in other cases where you direct us to share information.

We may share aggregated or de-identified information that cannot reasonably identify you, such as total lesson completions. We commit not to try to re-identify de-identified data.

‍

8. Community and Live Features

Anything you post in community spaces can be seen by other members, and members may copy or share it. Please do not post health or personal details you want to keep private. We moderate community spaces and may remove content that violates our Terms.

If a live session will be recorded, we will tell you before or at the start of the session. Recordings may include your name, voice, image, and chat messages if you participate, and may be made available to other members.

‍

9. Data Retention

We keep personal information only as long as needed for the purposes in this policy:

  • Account information, weight logs, journey stage, learning history: While your account is active. Deleted within 30 days after you delete your account.
  • Community posts. While your account is active, unless you delete them sooner. Removed within 30 days after account deletion.
  • Support communications: Up to 3 years after the conversation ends.
  • Billing, transaction, and automatic renewal consent records: 7 years, to meet tax, accounting, and consumer protection record-keeping requirements.
  • Backups: Deleted automatically on a rolling schedule of up to 90 days.
  • Aggregated or de-identified data: May be kept indefinitely because it does not identify you.
10. Security

We use administrative, technical, and physical safeguards designed to protect your information, including:

  • Hosting on HIPAA-eligible Amazon Web Services infrastructure independently certified under frameworks such as SOC 2 Type II and ISO 27001 (as provided by AWS).
  • Encryption in transit (TLS 1.2 or higher) and at rest (AES-256 with AWS Key Management Service).
  • OAuth 2.1 authentication with scope-based, role-based access controls.
  • Isolated databases, network security groups, and a web application firewall.
  • Audit logging, secrets management, and limited employee access to personal information.
  • Pseudonymous analytics identifiers and an approved list of analytics events.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

‍

11. Breach Notification

If we discover a breach of security affecting your personal information, we will investigate promptly, take steps to limit harm, and notify affected users, regulators, and others as required by applicable law, including the FTC Health Breach Notification Rule and state breach laws. Where laws differ, we aim to follow the most protective requirement, and we will notify you without unreasonable delay and no later than 30 days after discovery unless law enforcement asks us to delay.

‍

12. Your Rights and Choices

We offer the following rights to all users in the United States, regardless of where you live:

  • Access and portability: request a copy of the personal information we hold about you.
  • Correction: update your account details in Account Settings, or ask us to correct inaccurate information.
  • Deletion: delete your account in Account Settings, or ask us to delete your personal information, subject to the retention exceptions in Section 9.
  • Withdraw consent: withdraw consent for processing of health-related information, as described in our Consumer Health Data Privacy Policy.
  • Opt out of targeted advertising: use Consent Preferences in our website footer or enable Global Privacy Control.
  • Opt out of marketing emails: use the unsubscribe link in any marketing email. We will still send transactional messages about your account and subscription.
  • Appeal: if we decline your request, you can appeal by replying to our decision with the subject "Privacy Appeal." We will respond within 45 days. If you are not satisfied, you may contact your state attorney general.

How to make a request. Email support@healthtales.co with the subject "Privacy Request," or write to our mailing address. We will verify your identity, usually by confirming control of your account email, before completing a request. You may use an authorized agent, and we may ask the agent for proof of authorization. We respond within 45 days and may extend by another 45 days where permitted, letting you know if we do. We will not discriminate against you for exercising your rights.

‍

State-specific rights. Residents of California, Minnesota, and other states with consumer privacy laws may have additional rights, such as the right to know how their information is processed, to question the result of certain automated decisions, or to obtain a list of third parties we have disclosed information to. Please contact us to exercise any right provided by your state's law.

‍

California "Shine the Light." We do not share personal information with third parties for their own direct marketing purposes.

‍

13. Third-Party Links and Services

The Services may link to or integrate with third-party websites and services, including Google sign-in, Stripe, and AI assistants. This Privacy Policy does not apply to them, and we are not responsible for their privacy practices. Please review their policies.

‍

14. Changes to This Privacy Policy

We may update this Privacy Policy as our Services, practices, or legal requirements change. We will update the "Last updated" date and, for material changes, notify you by email or through a prominent notice in the Services before the changes take effect. If a change would allow us to use health-related information in a materially different way, we will ask for your consent first.

‍

15. Contact Us

If you have questions, concerns, or requests related to this Privacy Policy or our handling of your information, you can contact us at:

‍

HealthTales, LLC
PO Box 7256
Minneapolis, MN 55407
USA

Email: support@healthtales.co

‍