Consumer Health Data Privacy Policy

Last updated: October 24, 2026

Effective date: [EFFECTIVE DATE].

This policy explains how Debut, made by Punch LLC ("Debut", "we", "us"), collects, uses and shares consumer health data, as Washington's My Health My Data Act, Nevada's consumer health data law (SB 370) and Connecticut's consumer health data law require. It covers the Debut app and this website, and we apply it to everyone, wherever you live. It adds to our Privacy Policy.

The consumer health data we collect

In the Debut app, only after you give the consent to collect:

your weight and weigh-ins, height, goal and focus, and whether your weight trend is on pace, kept on your iPhone;
the meals you log, with their calories, protein, carbs, fat and fiber, kept on your iPhone, and meal photos, which are sent for the estimate (with your consent to share) and not kept;
the workouts you log, with their minutes and active calories, and the plans you keep, kept on your iPhone;
from Apple Health, if you connect it: your weight, height, birthday and sex, and your workouts with their active calories;
your age and sex, which together with the above can describe your health;
your messages with future you and the photos you send in them, kept on your iPhone, and anything about your health that you choose to tell future you;
biometric data: the photos of your face you choose and the face measurements made from them, and your voice recording and the voice measurements made from it. The photos and the recording are kept on your iPhone; the measurements exist only in memory and are destroyed right after each use, as our Privacy Policy's Biometric information section explains;
what Debut works out from these: your trend, the plans you kept, your weekly letter's flags (whether your weight trend is behind pace or changing fast, and whether your logged calories are under your floor), and checks of what you say to future you for signs of a crisis or of struggling with food, your body or your mood.

Debut's usage counts never include consumer health data.

On this website, none: the beta sign-up asks only for your email and that you're an adult in the US. The letter form isn't meant to collect any: it asks no health questions, asks you not to include health details, has Debut's server turn back answers with common health words before they go to Anthropic, and doesn't store your answers.

Why we collect and use it

To build your plan, show your trends and count your workouts toward your plan.
To make future you's images, clips and voice, with your consent to share and your face and voice releases.
To write future you's replies, nudges, check-ins and weekly letters, and to estimate meals, with your consent to share.
To notice when you might be in danger or struggling, so future you can point you to help.

We never use consumer health data for advertising, and we never sell it.

Where it comes from

From you; from Apple Health, if you connect it; from your iPhone, which works out things like your trend and the plans you kept and checks your messages for signs of a crisis; from Debut's server and Anthropic's model, which check the messages that are sent; and on this website, from your beta application.

We don't sell consumer health data. These processors handle it only on our behalf, under contracts that limit them to providing the features you use:

Debut's studio, on a GPU server rented from Vast.ai: your photo crops, age, sex, height, weight, goal and track, how far ahead future you is, scenes picked from your reasons, the images it made earlier (for clips) and, with the voice release, your voice recording and the lines future you says. Deleted within an hour.
Anthropic: what you say or send to future you, including photos, and the conversation so far; your first name, reasons and if-then plans; your track, coaching style and local time; the plans you kept and missed, your protein and calories, today's meals and workouts, the week's workouts, breathing and meditation minutes and personal bests, and which way your weight trend is going (never the number); the notes future you keeps about you, if Let future you remember is on, with health details only if you turn on Remember health details; and the meals you type, say or photograph. Under Anthropic's published terms, it keeps these for up to 30 days, or up to 2 years if its safety systems flag them, and doesn't train AI on them.
Debut's own server, only with its own separate yes, which only test builds ask for at the moment: that you logged your first meal and your first workout, and each plan you keep, each with the day and a random ID. Never what you ate, your weight, a workout's details or Apple Health data. Deleted after 90 days, or as soon as you turn it off.
Vercel: runs Debut's server, which passes requests on without storing their content, and this website.

Third parties and affiliates. Debut has no affiliates. The only third party that receives consumer health data from Debut is Apple, and only on an iPhone that can't turn speech into text on the device: there, what you say to Debut, like a meal or a message to future you, goes to Apple to be turned into text, under Apple's privacy policy. You can type instead.

What you do yourself isn't sharing by Debut: for example, saving to Apple Health, adding your workouts to your calendar, inviting a workout buddy or sharing your recap video.

To collect: asked during setup, before Debut saves anything about your body, meals or workouts.
To share: asked separately, the first time anything would go to Debut's studio or Anthropic. Without it, nothing is sent, and Debut uses your iPhone's own model or its built-in lines.
Face release: asked before Debut measures your face.
Voice release: asked only if you choose to record your voice, before anything is recorded.

Each consent screen shows what goes where, why and how long it's kept, and your answer is saved with the time and the exact words you saw. You can withdraw any of them anytime in Profile › Privacy & data or, for the beta, by emailing privacy@heydebut.com. Withdrawing stops collecting or sharing from then on.

Your rights

You can:

confirm whether we collect, share or sell your consumer health data, and see it and get a copy of it (in the app, with Export my data);
correct it, in the app where you entered it or by emailing us;
get a list of every third party and affiliate we've shared it with, and how to contact them (today, Apple, for speech recognition on some iPhones, at apple.com/privacy/contact);
withdraw your consent;
have it deleted: in the app, with Delete everything, which also tells Debut's studio to delete any job still there (it deletes everything within an hour anyway); for website data, by email. What Anthropic received isn't tied to an account or ID, so we can't single out yours to delete early; Anthropic deletes it within 30 days, or within 2 years if its safety systems flagged it.

Email privacy@heydebut.com, from the address you used if it's about the beta. We'll answer within 45 days, and can extend that once by 45 days when we need to, telling you why. If we decline, you can appeal by replying to our answer. We'll answer your appeal within 45 days, and if we deny it, we'll tell you how to contact your state's Attorney General. Using these rights costs nothing and never changes how we treat you.

How long we keep it

On your iPhone: until you delete it. The photos you chose for future you and your recording also go once Debut has gone unused for 3 years.
Debut's studio: deleted within an hour of each job.
Anthropic: for up to 30 days, or up to 2 years if its safety systems flag it, under its published terms, which don't allow it to train its models on what Debut sends.

Third-party tracking

No other company collects consumer health data about your activity on Debut over time or across other sites or apps. Debut has no advertising, analytics or tracking software from other companies, and its own usage counts never include consumer health data.

Location

Debut doesn't collect your location, and doesn't use geofences around health care facilities or anywhere else.

Changes to this policy

When this policy changes, we'll post the new version here and update the dates at the top. If a change affects what we collect, share or keep, or your rights, we'll tell you in the app or by email before it applies. Debut won't collect or share consumer health data in a new way without asking for your consent first.

Contact

Punch LLC, [ADDRESS]. Email privacy@heydebut.com.