Privacy Policy

Last updated: July 29, 2026

This Privacy Policy explains how Leyva Analytics LLC, doing business as Chiron ("Chiron," "we," "us," or "our"), collects, uses, stores, and protects information when you use Chiron, our AI wellness and fitness coach available on WhatsApp and at heychiron.com (the "Service").

1. Information We Collect

1.1 Information you provide

• Phone number, used as your account identifier and to communicate with you via WhatsApp.
• Wellness and fitness information you choose to share, including meals, workouts, supplements, and biometrics (e.g. weight, sleep).
• Photos and files you send (e.g. meal or workout photos) for Chiron to analyze.
• Messages exchanged with Chiron, retained to provide continuity in coaching conversations.
• Payment and billing information when you subscribe to a paid plan, collected and processed directly by Creem, our payment processor and merchant of record - this happens entirely on Creem's own secure checkout page, never over WhatsApp, and we do not store your full card details ourselves.

1.2 Information collected automatically

• Basic usage and API metadata (e.g. message timestamps, request volume) used for billing accuracy, spend controls, and abuse prevention.

2. How We Use Your Information

• To provide personalized wellness, nutrition, and fitness coaching.
• To maintain conversational memory/context so Chiron can reference things you've previously told it.
• To operate free-trial and subscription budget controls.
• To detect and prevent abuse, and to enforce our Terms of Service.
• To send you service-related messages (e.g. welcome messages, account status, trial/subscription updates).
• To analyze, maintain, and improve the Service and its underlying AI models, using only de-identified and aggregated data - never your raw, identifiable conversations or wellness data.

3. How We Share Your Information

We do not sell your phone number or personal data, and we do not share your mobile information with third parties for their own marketing or promotional purposes. We share information only with the following service providers, solely to operate the Service:

• Meta / WhatsApp - to transport messages between you and Chiron.
• The provider used to register and provision our WhatsApp Business phone number, which does not see or transport message content.
• Our AI service provider - to process your messages and generate Chiron's responses. We use this provider's paid API tier, under which its terms state that our prompts and responses are not used to train or improve its models.
• Our web portal authentication provider - to authenticate you via phone verification.
• Creem - our payment processor and merchant of record, to process subscription payments. Creem, not Leyva Analytics LLC, is the seller of record for your purchase.
• Our hosting provider, for secure infrastructure hosting.
• A cloud storage provider, for encrypted, access-controlled nightly backups.
• A security/content-delivery network in front of heychiron.com for web traffic (not WhatsApp messages, which go directly to Meta).

We may also disclose information if required by law, or to protect the safety of a user or the public (for example, in a genuine medical or safety emergency disclosed in conversation).

4. Data Retention and Deletion

We retain your information for as long as your account remains active, so Chiron can maintain continuity in your coaching. You may request deletion of your account and data at any time by texting Chiron directly, or via heychiron.com. Once requested, your account enters a 30-day grace period (during which you can restore it by texting "restore"), after which your data is permanently deleted from our live systems.

Your data also exists in encrypted nightly backups, kept for disaster-recovery purposes only and never used for day-to-day operations. Backups are automatically and permanently deleted on a rolling 60-day cycle, so any backup containing your data is fully erased no later than 60 days after your account is purged from our live systems.

5. Data Security

We use industry-standard safeguards, including encrypted transport (HTTPS/TLS), access-controlled infrastructure, and nightly encrypted backups, to protect your information. No system is 100% secure, and we cannot guarantee absolute security.

Chiron is a consumer wellness product, not a HIPAA-covered entity or business associate, and does not operate under a HIPAA Business Associate Agreement. We protect your information as described in this Policy, but you should not assume HIPAA's specific legal protections apply to your use of the Service.

6. Cookies and Similar Technologies

heychiron.com uses only essential cookies and similar technologies necessary to operate the site - for example, keeping you signed in to your account, and security/bot-mitigation cookies set by our content-delivery network (Cloudflare) to protect the site from abuse. We do not currently use cookies for advertising, cross-site tracking, or analytics profiling. If this changes in the future, we will update this section and, where required by law, obtain your consent first. Most browsers let you block or delete cookies through their settings; doing so may affect your ability to stay signed in.

7. Message Frequency and Rates

Message frequency varies based on your conversations with Chiron and any account/trial notifications. Message and data rates may apply, as charged by your mobile carrier. Reply HELP for help or STOP, UNSUBSCRIBE, or CANCEL to opt out of messages at any time.

8. Children's Privacy

The Service is not directed to individuals under 18. We do not knowingly collect personal data from anyone under 18, and specifically do not collect data from children under the age of 13 in compliance with the Children's Online Privacy Protection Act (COPPA). If you believe a minor has provided us information, contact us immediately at privacy@heychiron.com and we will delete it.

9. Medical Disclaimer

Chiron is an AI coaching tool, not a telemedicine service, and does not provide medical advice, diagnosis, or treatment. Always consult a qualified healthcare provider regarding any medical condition or before making changes to your diet, exercise, or wellness regimen.

10. Your Rights

Depending on your location, you may have rights to access, correct, or delete your personal information, and to opt out of certain uses. To exercise these rights, contact us using the information below.

California residents: under the CCPA/CPRA, you have the right to know what personal information (including sensitive personal information, which includes health information) we collect, to request its deletion or correction, and to opt out of its sale or sharing. We do not sell your personal information and do not share it for cross-context behavioral advertising.

Nevada residents: under Nevada law, you may direct us not to sell your covered information. We do not sell your personal information.

11. Washington Consumer Health Data

Some of the information Chiron collects (meals, workouts, biometrics) may qualify as "consumer health data" under the Washington My Health My Data Act. We do not sell your consumer health data, and we do not share it with third parties for advertising or other marketing purposes. We share it only with the service providers listed in Section 3, solely to operate the Service. Washington residents may exercise the rights described in Section 10 by contacting us using the information below. By using the Service and providing biometric or health-related data, you affirmatively consent to the collection and use of this consumer health data as described in this Policy.

12. International Users (GDPR)

Chiron is available globally via WhatsApp, and this Policy applies to you regardless of your location. If you are located in the European Economic Area, the United Kingdom, or Switzerland, the following additional information applies:

Data Controller: Leyva Analytics LLC, the entity operating Chiron, is the data controller responsible for your personal data (see Section 14 for contact details).

Legal Basis for Processing: We process your information based on (a) performance of a contract, to provide the Service you've requested, (b) our legitimate interests in operating, securing, and improving the Service, and (c) your consent, where required, such as for certain health-related data.

Cross-Border Transfers: Leyva Analytics LLC and our service providers are based in the United States, so your information is transferred to and processed in the U.S. and other countries outside the EEA/UK/Switzerland. Where required, we rely on Standard Contractual Clauses or other approved transfer mechanisms with our service providers to safeguard your data in connection with these transfers.

In addition to the rights described in Section 10, EEA/UK/Swiss residents have the right to lodge a complaint with their local data protection supervisory authority.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above.

14. Contact Us

To exercise your privacy rights, or for any questions about this Privacy Policy, please email us at privacy@heychiron.com.