GFY21

GFY21 Consumer Health Data Privacy Policy

Version 1.0 · Effective November 10, 2026 · FTS21, LLC, doing business as GFY21

This is an earlier version. The current policy is at gfy21.com/consumer-health-data.

This policy describes how FTS21, LLC, doing business as GFY21 ("GFY21"), handles consumer health data, as that term is used in the Washington My Health My Data Act and the Nevada consumer health data law. It supplements the GFY21 Privacy Policy at gfy21.com/privacy. GFY21 applies this policy to every person who uses the GFY21 Program, wherever they live.

1. Our approach

GFY21 Wellness and GFY21 Nutrition are designed to keep your wellness and nutrition information on your device. GFY21 collects only the limited information needed to activate your Program Card, run the Program and answer your support requests. GFY21 treats all of that information as consumer health data and protects it accordingly.

2. Consumer health data we collect and why

  • Program activation records: your Program Card code, email address, activation date, access end date, and the documents you accepted with their versions and times. We use these to activate your card, give you access for your Program Term and keep a record of your acceptances.
  • Support Records: your email address, the messages you send and our replies, the request category, and technical details about the app and your device: app name and version, operating system, browser and the app screen you asked for help from. For support emails, we record the number and file types of attachments; we do not open, download or store attachment contents. We use Support Records to answer your requests and operate support.
  • Security records: one-way coded values derived from your network address and card code, used only to limit repeated attempts, and server logs with the last part of your network address removed, kept 30 days. We use these to protect the Program.

We collect this information because it is necessary to provide the Program you requested. Information you choose to include in a support message, such as a description of a symptom, becomes part of your Support Record; please leave health details out of your messages.

3. Sources

We collect consumer health data directly from you, through the apps and through email you send to support@gfy21.com, and automatically from the apps when you activate a card or submit a support request.

4. Sharing

GFY21 does not sell consumer health data. We share it only with service providers that process it on our behalf, under contracts that limit their use to providing services to GFY21:

  • cloud hosting and database providers;
  • our business email provider, which hosts support@gfy21.com; and
  • encrypted backup storage.

GFY21 has no affiliates that receive consumer health data. We may also disclose information when the law requires it.

5. Retention

We keep support message content and your email address for 90 days after a support request closes, and content-free support records for 24 months. Program activation records are kept for as long as your card's records are needed to administer the Program and meet legal obligations. Encrypted backups expire on their own schedule, and deletions are reapplied before any restored data is used.

6. Your rights

You may:

  • confirm whether GFY21 collects, shares or sells your consumer health data, and access it, including a list of the third parties with which it has been shared;
  • withdraw consent to its collection or sharing; and
  • request that we delete it.

To make a request, email legal@gfy21.com from the email address you use with GFY21. We verify your request, respond within 45 days, and may extend that once by 45 days when reasonably necessary, with notice to you. If we decline a request, you may appeal by replying to our decision; we respond to appeals within 45 days. If your appeal is denied, you may contact the Attorney General of your state. We do not charge for requests and do not treat you differently for making one.

7. Storage and security

Consumer health data is stored in the United States. GFY21 limits access to authorized personnel, encrypts data in transit and in backups, and keeps an audit record of access to Support Records.

8. Changes

We post updates to this policy on this page with a new effective date.

9. Contact

FTS21, LLC, doing business as GFY21 · legal@gfy21.com