Draft, pending legal review. This page describes what Lotl commits to; the binding text is being reviewed before launch.

Privacy policy

Last updated 14 October 2026

Lotl helps you plan and log what you take and do for your health. That means we handle health data, so we keep this short and specific: what we collect, why, where it lives, and what you can do about it.

Who we are

Lotl is run by Prehoy Industries LLC, 30 N Gould St, Sheridan, WY, United States. For anything privacy-related, write to support@uselotl.com. Because we're based outside the EU, our representative in the EU is [EU representative under GDPR Art. 27, name and address]. [Data protection officer, if appointed].

What we collect

• Account: your email address and a sign-in session. No password.
• Your plan: the items you add (names, doses, times of day, how often), your usual wake, meal and bed times, and what you mark as taken or skipped.
• Optional extras, only if you use them: progress photos, body measurements, blood-work results, messages to the assistant, your pond and friends.
• Technical basics: your device type when you sign in on a new device, so we can warn you. We don't store your location.

Why, and on what basis

We use your data only to run Lotl for you: timing your plan, reminders, history, and the features you switch on. Health data is processed with your explicit consent, which you give when you set up your day and can withdraw at any time by deleting your account [GDPR Art. 9(2)(a); US state consumer health data consents].

We never sell your data, never use it for advertising, and never use it to train AI models.

Where your data lives

Lotl runs in two separate regions. EU accounts are stored and processed in the EU, US accounts in the US, and the two don't share a user database. Photos and lab reports are stored encrypted in your region.

Who helps us

• Hosting and storage in your region: [provider, location].
• Email delivery for sign-in codes and account notices: Brevo (EU) [US provider]. Emails never contain health details.
• The AI assistant and look-ups (only when you use them): Anthropic. We send the minimum needed, without your name or email [processing region and retention terms].

Each processes data only on our instructions, under a data processing agreement.

Sharing you choose

Shared stacks contain only item names, doses, moments and frequency, never your history, stock or email, and prescriptions only if you tick them. Friends see your axolotl and its decorations, never your plan. You can stop sharing or remove a friend at any time.

How long we keep it

As long as you have an account. When you delete it, everything is removed straight away, and encrypted backups are cleared within [30] days.

Your rights

• Export everything as a file, from Settings.
• Delete your account and all its data, from Settings.
• Correct anything by editing it in the app.
• Ask us what we hold, or object to any processing, at support@uselotl.com.
• Complain to your data protection authority [EU: lead supervisory authority; US: state rights under e.g. Washington's My Health My Data Act, CCPA].

Age

Lotl is for adults. [Minimum age: 16 or 18]. Cosmetic procedure features are 18+.

Changes

If this policy changes in a way that matters, we'll email you at least 30 days before it takes effect.