Disclosure: Get Regular publishes this guide and makes a gut-health tracking app. Product descriptions are attributed to public sources; this article is not an independent hands-on test or clinical validation.
Quick answer: Most gut health apps are not covered by HIPAA, the US health-privacy law, because HHS says a consumer app that you fill with your own data generally isn't a covered entity or business associate. Their promises are enforced by the FTC, state laws and Apple's rules instead. So check seven things yourself: account, storage, stool photos, AI use, tracking, export and deletion, and breach handling.
Poop data feels personal in a way step counts don't. Stool photos, symptoms, medications and period dates can reveal a lot, and "is it private?" is a fair question to ask before you start. The answer is rarely "yes" or "no". It's "private from whom, and under what rules?" This guide explains the rules in plain language, then gives you seven checks and a checklist you can use on any app.
Key takeaways
- HIPAA generally covers health plans, clearinghouses, most health care providers and their business associates. A consumer app downloaded by individuals to track their own data generally isn't one of them [1].
- The FTC's Health Breach Notification Rule covers health apps that aren't covered by HIPAA, and treats unauthorized disclosures as breaches, not just hacks [2][3].
- Apple's App Privacy labels are self-reported by developers, who are responsible for keeping them accurate [5]. Read the label and the policy together.
- Manual entry is the privacy-friendliest way to log stool: you can skip the photo and still get the diary.
Does HIPAA protect your gut health app data?
Usually not. HIPAA applies to "covered entities" (health plans, health care clearinghouses and most health care providers) and to their "business associates". HHS's Office for Civil Rights says that when consumers download a health app and enter their own data, the developer generally isn't a business associate, because it isn't acting for a covered entity [1].
That changes if a health system, insurer or clinic offers or pays for the app and directs how its data is used. Then the developer may be a business associate and HIPAA can apply to that arrangement [1]. OCR also notes that when you direct a covered entity to send your records to an app that isn't covered, HIPAA no longer protects the data once it arrives there [1].
So when a consumer app's listing says "HIPAA compliant", it's fair to ask what that covers. For example, mySymptoms' App Store listing describes meeting HIPAA and GDPR standards in the context of sharing a diary with clinicians through its clinic web app [10]. That's a claim about one feature, and the developer is the one to ask which parts of the service it covers.
What rules protect health app data if not HIPAA?
Three layers apply in the US, and none of them works like HIPAA: the FTC, state health-data laws and Apple's own App Store rules.
| Layer | What it does | What it doesn't do |
|---|---|---|
| FTC Health Breach Notification Rule | Requires vendors of personal health records and related entities not covered by HIPAA to notify individuals, the FTC and sometimes the media after a breach of unsecured identifiable health information. A 2024 update clarified it applies to health apps and that a "breach" includes unauthorized disclosures, not only hacks [2]. Consult the current rule and professional guidance for applicable notification duties [2]. | It doesn't set general rules for how an app may use your data day to day |
| State laws | Washington's My Health My Data Act protects personal health data that falls outside HIPAA, requires consent for collecting and sharing it, and is enforced through the state's consumer protection law [4]. Other states have their own rules | Coverage varies by where you live |
| Apple's App Store rules | Developers must fill in a privacy "nutrition label" and are responsible for keeping it accurate and up to date [5]. Data processed only on your device doesn't count as "collected" and needn't be listed [5] | Labels are self-reported; Apple isn't promising an audit of every one |
The practical upshot: a good app tells you plainly what it collects, who else gets it, and how to delete it. A weak app hides that in legal text. You can't rely on HIPAA to fix a vague policy.
The 7 things to check before you log
Seven questions cover most of the risk in a gut health app. Each takes a minute to answer from the App Store page and the privacy policy.
1. Do you need an account, and what does sign-up collect?
An app that works without an account holds less about you. Some diaries say they need no registration; others start with an anonymous username; others require an email or social login. Bowelle's FAQ says it doesn't require registration or collect personal data before use [8]. mySymptoms says accounts start with an anonymous username and name and email are only needed to share with a clinician [10]. Ask yourself whether the account is needed for the feature you want.
2. Where is the data stored: your phone or the cloud?
On-device storage means the developer's servers don't hold your log. Bowelle says data is stored on your device and never on its servers, though device backups include it [8]. Plop says data is stored locally by default and that Premium adds optional cloud backup and sync [9]. Cloud storage isn't bad (it's how you recover a lost phone), but it means the company holds your data, so the policy matters more.
3. Do stool photos leave your phone?
Photos are the most sensitive input, so ask three things: is the photo uploaded, is it kept after analysis, and is it saved to your camera roll? Get Regular's policy says photos are compressed and sent to its AI provider, are "not permanently stored" on its servers (only analysis results are saved), and that you can log manually instead [6]. Another stool-scan app, Flush, says on its listing that it "doesn't save your images" [15]; that's the developer's claim, and you'd need its policy to see what that covers. If you don't want a photo to go anywhere, choose manual entry. More on the AI side in can an app analyze a photo of your poop?.
4. Is your data used for AI, research or marketing?
Look for three phrases: "train", "research" and "marketing". Check whether the AI provider is named, whether your data is used to train models, and whether research use is opt-in. Get Regular's policy names OpenAI's API as the provider and says OpenAI doesn't use API inputs to train its models; it also says only anonymized content is sent [6]. Those are company statements, and "anonymized" is a strong word for photos and free-text notes that readers can't verify. For the broader picture, see AI gut health apps: what AI can and can't tell you.
5. Who else gets the data, and is it used to track you?
In the App Store label, "Data Used to Track You" means data that is linked with third-party data for advertising or advertising measurement, or shared with a data broker [5]. Check that box first. Then check "Data Linked to You", which lists what's tied to your identity. A label with health data under "Data Linked to You" isn't a red flag by itself (a cloud account needs that), but a label with health data under "Used to Track You" deserves a hard look. Policies also list service providers: analytics, crash reporting, email and ad-measurement companies.
6. Can you export and delete your data, and how fast?
You should be able to take your data out and delete it. Look for in-app account deletion and a stated time. Get Regular's policy says in-app account deletion removes data from its systems within 30 days [6]. Bearable and CareClinic say you can export or delete your data in-app [11][12]. A diary you can't export is also a data-loss risk, so check both.
7. What happens if there's a breach, and who regulates it?
Policies should say how you'd be told. Under the FTC rule, health apps outside HIPAA that suffer a breach, including an unauthorized disclosure, must notify you within 60 days of discovery [2]. Get Regular's policy states a 60-day breach notice [6]. Also check whether your state has a health-data law that gives you extra rights, such as Washington's [4].
How do popular gut apps describe their data handling?
Privacy labels vary widely, and a longer label can reflect more features rather than worse behavior. The table reports what each developer declares; it isn't a verdict. Checked 19 Oct 2026.
A worked example: reading Get Regular's privacy policy
For ongoing records, explore the Get Regular food and symptom tracker. Check the current workflow, privacy information and access before entering sensitive information. A recorded association is a question to investigate, not a confirmed trigger.
Reader checklist (copy this)
Use this table on any gut health app before you log your first stool.
| # | Question | Where to look | Green flag | Red flag |
|---|---|---|---|---|
| 1 | Do I need an account? | Listing, first screen | Works without one, or anonymous | Forced login before any use |
| 2 | Where is the data stored? | Policy "data storage" | On device, or encrypted cloud with clear terms | No mention |
| 3 | Do photos leave my phone? | Policy, in-app settings | Manual option; photos not kept | Photo uploads with no opt-out |
| 4 | AI, research or marketing use? | Policy | Provider named; no training on your data; research is opt-in | Vague "improve our services" |
| 5 | Who else gets it? | App Privacy label and policy | Nothing under "Used to Track You" | Health data under tracking or ads |
| 6 | Can I export and delete? | Settings, policy | In-app export and deletion with a stated time | "Email us" only, no timeline |
| 7 | What happens in a breach? | Policy | Stated notice period, contact address | Silent |
| 8 | Does "HIPAA compliant" appear? | Listing | Explains what it covers | Used as a blanket reassurance |
If you can't answer five or more of these from the listing and policy, treat the app as high-risk for sensitive logs and keep to manual entry, or use a paper diary.
What should you do if you're not sure?
If you're unsure, log less. You can track stool form, timing and symptoms without photos, names or free-text notes, and a plain diary (paper or on-device) still gives your doctor the pattern. Don't let privacy worries stop you from seeing a doctor about symptoms: take a hand-written log to the visit (how to share a log).
How to track gut health with privacy in mind
- Pick the least data you need. Manual Bristol entry beats a photo if you don't need AI.
- Use an alias email if the app requires an account, and no real name.
- Strip identifying detail from notes. Write "doctor appointment", not names or addresses.
- Review app permissions (camera, photos, location, Health) in iOS settings, and turn off what the feature doesn't need.
- Test deletion and export in the first week, before you've logged months of data.
FAQ
Are gut health apps HIPAA compliant? Usually the question doesn't apply. HIPAA covers health plans, clearinghouses, most health care providers and their business associates, and HHS says a developer of a consumer app that people download to track their own data is generally not a business associate [1]. If an app says it's HIPAA compliant, ask which part of the service that covers.
Can my poop data be traced back to me? It can be, if the app links entries to an account, email or device identifier. The App Store label's "Data Linked to You" section shows what each developer says is tied to your identity [5]. Manual entry and account-free use do not by themselves establish that a record is unlinked or anonymous. Check identifiers, permissions and actual data practices.
Is it safe to upload stool photos to an app? It depends on the app. Check whether the photo is uploaded, kept after analysis, shared with an AI provider or saved to your camera roll, then decide. Manual entry avoids the question.
What happens if a health app is hacked or leaks my data? Under the FTC's Health Breach Notification Rule, health apps that aren't covered by HIPAA must notify affected people, the FTC and sometimes the media, and a "breach" includes unauthorized disclosure to third parties, not only hacking [2][3]. Individuals must be notified within 60 days of discovery [2].
How do I delete my data from a gut health app? Look for in-app account deletion first, then the privacy policy for a stated time. Export your data before you delete it. Deleting the app from your phone doesn't necessarily delete your account.
Sources
- HHS Office for Civil Rights. Health App Use Scenarios & HIPAA (February 2016). https://www.hhs.gov/sites/default/files/ocr-health-app-developer-scenarios-2-2016.pdf
- FTC. FTC Finalizes Changes to the Health Breach Notification Rule (26 Apr 2024). https://www.ftc.gov/news-events/news/press-releases/2024/04/ftc-finalizes-changes-health-breach-notification-rule
- FTC. Health Breach Notification Rule: The Basics for Business. https://www.ftc.gov/business-guidance/resources/health-breach-notification-rule-basics-business (penalty figure as stated on the page when read, 19 Oct 2026)
- Washington State Attorney General. Protecting Washingtonians' Personal Health Data and Privacy. https://www.atg.wa.gov/protecting-washingtonians-personal-health-data-and-privacy
- Apple Developer. App privacy details on the App Store. https://developer.apple.com/app-store/app-privacy-details/
- Get Regular. Privacy Policy (last updated 8 June 2026). https://www.getregular.com/legal/privacy-policy
- App Store (US). Get Regular: AI Gut Health. https://apps.apple.com/us/app/id6749188690 (checked 19 Oct 2026)
- Bowelle. FAQ. https://bowelle.com/faq/ (checked 19 Oct 2026)
- App Store (US). plop - poop tracker & analyzer. https://apps.apple.com/us/app/id1505427265 (checked 19 Oct 2026)
- App Store (US). mySymptoms Food Diary. https://apps.apple.com/us/app/id405231632 (checked 19 Oct 2026)
- App Store (US). Symptom Tracker - CareClinic. https://apps.apple.com/us/app/id1455648231 (checked 19 Oct 2026)
- App Store (US). Bearable - Symptom Tracker. https://apps.apple.com/us/app/id1482581097 (checked 19 Oct 2026)
- App Store (US). Happy Poop: Toilet Journal Log. https://apps.apple.com/us/app/id1586000388 (checked 19 Oct 2026)
- App Store (US). Poop Tracker - Balloon. https://apps.apple.com/us/app/id6471620319 (checked 19 Oct 2026)
- App Store (US). Flush: Poop & Gut Health Scan. https://apps.apple.com/us/app/id6748068252 (checked 19 Oct 2026)
This article is for general education and isn't legal or medical advice. Get Regular is a tracking app — it doesn't diagnose or treat any condition. If you have red-flag symptoms or ongoing changes in your digestion, talk to a doctor.