Privacy Policy

This is what the Percy app and the Normal Range Club website do with your information. Plain English, written so you can check every line against the app.

This policy replaces version PP-v4.4 of 24 October 2026 and everything before it.

What changed on 27 October 2026: Percy is an AI app, and it needs its AI helper to work. Percy asks for your yes once, on one screen at setup, with two buttons: "I agree" and "Sign out". One tap on "I agree" lets Percy save the health answers you give it and sends what the AI needs to the outside AI service we pay for (we may use more than one). There is no "Not now", and there is no switch in the app to turn the AI helper off. If you do not agree, you cannot use Percy: tap "Sign out" and nothing is saved or sent. If you agree and later change your mind, the way to stop the AI is to delete your account. Before, the AI helper and a separate health profile were choices you could say no to and still use Percy; that is no longer the case. Your goals, weight and height now go with a question, unless you have told Percy you have, or had, struggles with food, or that you would rather not say, or you tell Percy in the chat and say yes to hiding your numbers (see "Percy and AI"). "Help improve Percy" is no longer asked during setup: it is a switch in Me, then Privacy & data, and it starts off. You can now clear your chat from your phone with "Delete my chat" in Me. If you agreed to an earlier wording, or tapped "Not now" before, Percy asks you once more, and until you agree you cannot use Percy. We also took out the sections for features that are no longer in the app (the clinic finder, the readiness check itself and payment on the website), updated where each switch lives in the app (Me, then Privacy & data), added how we send information outside Malaysia, and updated how deleting your information works when you pay through Apple.

In the same update we made the page match the iPhone app in other places. Percy can add a walk you timed to Apple Health as a workout, and it saves nothing else there. The microphone turns your speech into text on your iPhone and keeps no recording. Percy can show your recent photos next to the camera. The iPhone app keeps your sign-in in the iPhone's Keychain and sets no cookie. The iPhone app never asks for your location. The yearly plan can start with a 3-day free trial for eligible new members, and there is no free plan.

What changed on 24 October 2026: we added the Percy waitlist (see “The website”).

What changed on 9 October 2026: Normal Range Club is now the Percy app. The coaching programme has ended, so this page no longer describes a coach reading your log. If you were a coaching member, the section "If you were a coaching member" covers your old records.

The short version

• Most of what you put into Percy stays on your phone. Your blood sugar, blood pressure, cholesterol and weight readings, your mood, meals, workouts (including any you tell Percy about in the chat), medication reminders, Journey diary, chat history (the last 1000 messages), and the health answers you give Percy are held by the app on your own device. We do not store them on our server or in our backups, so we have no copy to look at. The one exception is your choice: if you switch on "Help improve Percy" (Me, then Privacy & data; it starts off), the questions you ask Percy and its answers are also kept on our server for up to 180 days, without your name.
• Some of it travels, and you must tap "I agree" on the setup screen to use Percy at all. Percy needs the AI helper to work, so there is no way to use Percy without it. When you ask Percy something, the question goes through our server to the outside AI service we pay for (we may use more than one) to be answered. With it go a limited slice of what Percy knows about you: your goals (such as lower blood sugar, blood pressure or cholesterol, or losing weight), your weight and height, your allergies and food rules, what you have eaten today, and your country. Photos you send for reading go too, and so does anything you type. We do not keep it (see "Percy and AI"); our AI service providers keep requests for a limited period.
• Some things never go: your age, medicines, kidney, heart or pregnancy answers, your name or account, your saved blood pressure, blood sugar and cholesterol readings, and the weights you log over time. If you have told Percy you have, or had, struggles with food, or that you would rather not say, or you tell Percy in the chat and say yes to hiding your numbers, your weight, height and "lose weight" goal never go either. Your Apple Health data never goes.
• We do not store your meal and menu photos. A photo is read once, in memory, by an AI service we pay for and released by us. That service may keep the request for a limited period.
• The iPhone app never asks for your location. The microphone turns your speech into text on your iPhone, and the recording is not kept or sent.
• What we hold is small: your name and email from sign-in, your subscription record, a few records of the choices you make in the app, and, only if you switch them on, Percy's memory of what you have told it and the questions you let us keep to make Percy better.
• Percy needs its AI helper, so your yes on the setup screen is required. The screen has two buttons: "I agree" and "Sign out". If you do not agree, you cannot use Percy, and nothing is saved or sent. There is no "Not now" and no switch in the app to turn the AI helper off later. To stop the AI after you have agreed, delete your account: in Me, then Privacy & data, "Stop Percy's AI" explains this and takes you to "Delete my account". You are asked before you pay.
• Helping Percy get better is a separate choice, and it starts off. It is a switch in Me, then Privacy & data, called "Help improve Percy", not part of setup. Leave it off and we do not keep your questions or Percy's answers. Switch it on and you can switch it off any time; we delete what we kept for you at once. You can use Percy fully with it off.
• We do not sell what you tell Percy and we do not hand it to advertisers. There are no ads in Percy.
• You can download everything we hold, or delete it, inside the app (Me, then Privacy & data).

The rest of this page is the detail.

Who we are

Normal Range Club is a trading name of NRC VANTAGE ENTERPRISE, a sole proprietorship registered in Malaysia, registration number 202603193260 (PG0590927-D), owned by Choo Lai Hock, known as Jason Choo. We are the data controller. Business address: 12A-10 Plaza Permata, 6 Jalan Kampar, Sentul Selatan, 50400 Kuala Lumpur, Malaysia.

For anything about your information: [email protected]. Jason is the privacy contact.

Data-protection contact. To use a right in this policy, to ask how your information is handled, or to report a suspected breach, write to Jason Choo, NRC VANTAGE ENTERPRISE, at the address above or at [email protected].

We are not a healthcare provider, and HIPAA does not apply to what you tell Percy. HIPAA is the United States law for doctors, hospitals, health plans and their suppliers. We are none of those. We handle what you tell Percy under this policy and the laws named in it.

The map, in one place

What stays on your phone

The app keeps these in your phone's own storage, and we store no copy of them:

• Your readings (blood sugar, blood pressure, cholesterol, weight) and the time you filed each one
• Your mood, your Journey diary, your meals and what you logged about them
• Your workouts, including a workout you tell Percy about in the chat (Percy files it on your phone), and your medication reminders (the name you typed and the time you chose)
• Your profile photo, your badges and your week plan. The profile photo is cut down and kept on the phone only; nothing is uploaded.
• Your Percy conversations. The app keeps the last 1000 messages on your phone; older ones drop off. "Delete my chat" in Me clears the conversation from your phone. If you switched on "Help improve Percy", a copy of each question and Percy's answer also goes to us (see "Helping Percy get better"); "Delete my chat" does not remove that copy, but switching "Help improve Percy" off does.
• Your health answers. Percy asks first, on the setup screen, for your yes to save a few sensitive answers (what you are working on and your diabetes type, your doctor's food rules, your age, sex, height, weight and target weight, how active you are, and health things you tell Percy in the chat if Percy saves them) and to send what the AI needs to the outside AI services we pay for (we may use more than one). That yes is required to use Percy (see "Percy and AI"). The answers stay on this phone: they are not uploaded and not shown to anyone else. Some of them go to the AI with a question, and the setup screen and "Percy and AI" below say exactly which: your goals, weight and height, allergies and food rules. Your age, medicines, kidney or heart answers, pregnancy answers and past struggles with food never go. You can see and change your answers in Me, then Privacy & data. To remove them, use "Clear this phone" or delete your account.
• Your daily food-energy guide and the goal you set for it
• What you choose to import from Apple Health (weight, blood pressure, blood sugar, steps, sleep, workouts and calories burned), only if you tap Connect (see "Apple Health" below)

None of that is stored on our server, and we keep no copy of it. Two things are worth saying plainly. First, the slice of it that goes with a question you ask Percy passes through our server on its way to the AI service, and we do not keep it (see "Percy and AI", below). Second, the one thing we do store is the questions and answers you choose to let us keep under "Helping Percy get better", below.

Two consequences, said plainly.

• If you delete the app, clear its data or lose the phone, that information is gone and we cannot restore it. If it matters to you, download it first (Me, then Privacy & data, then Download everything).
• It does not follow you to a new phone. The one exception is Percy's memory, below, if you switch it on, and even that does not include your readings.

Your phone's own backup. If you back up your phone (to iCloud on an iPhone, or to a computer), that backup is Apple's or your computer's, under your own account, and it can include what the app keeps on the phone, including lab reports you added. Restoring that backup to a new phone may bring them back. We do not receive or see your phone's backup.

What does travel, and it is worth knowing: when you ask Percy a question with the AI helper on, the question and a slice of what Percy knows about you go to the outside AI service we pay for (we may use more than one) to be answered. That is set out in full under "Percy and AI". If you type a number into a question ("my sugar was 11 this morning"), it is part of the question and goes with it. Your saved readings do not.

Storing this on your device is what makes the app work, which is why there is no consent banner for it. We do not use what we store on your device to track you.

Apple Health

In the iPhone app, Percy can read some of what Apple Health already holds, and it can add one kind of thing to it. It asks to read only after you tap Connect. If you connected on an earlier version, Percy asks you once more, for calories burned only. It asks to save a workout only the first time you save a timed walk. If you do not tap Connect, Percy asks Apple Health for nothing to read.

What Percy reads: your weight, blood pressure, blood sugar, steps, sleep, workouts, and calories burned (today's total).

What Percy saves: when you time a walk with Percy, Percy can add it to Apple Health as a workout: the kind of walk, when it started and ended, and how long it was. It does not save calories or anything else. This works only while Apple Health is connected in Percy, and it stops when you tap Stop importing. A workout saved to Apple Health stays there until you delete it in the Health app.

It stays on your phone. What Percy reads from Apple Health is held by the app on your own device, like your other readings. It is not sent to our server. It is not sent to our AI service providers. It is not part of Percy's memory if you switch that on, and it is not part of "Help improve Percy". We never see it and we keep no copy. We do not use it for advertising or marketing, and we do not sell it or share it with anyone.

You stay in charge.

• You can stop at any time in the app: Manage, then Stop importing. Nothing more comes in and walks stop being saved. What already came in stays until you delete it like any reading, or use "Clear this phone".
• You can take Percy's access away completely in your iPhone's Settings: Health, then Data Access & Devices, then Percy.
• What came in from Apple Health is counted in the file you download from the app (Me, then Privacy & data, then Download everything).
• "Clear this phone" removes it from the app. Deleting your account does not clear your phone.

Camera, photos, microphone and location

• Camera. Percy uses the camera to photograph a meal or a menu and to scan barcodes. What happens to a photo is set out under "Meal photos, menus and barcodes" below.
• Your photo library. If you allow it, Percy shows your recent photos next to the camera, so you can pick a meal or menu photo you already took. Browsing them happens on your phone. A photo leaves your phone only if you choose it to be read, and then it follows the path under "Meal photos, menus and barcodes". Percy does not save pictures into your photo library, and we do not keep a copy.
• The microphone. If you tap the mic, your iPhone turns what you say into text on the phone. The recording is not kept and not sent; only the text appears in the message box. What you then send is handled like anything you type.
• Location. The iPhone app never asks for your location and has no location permission. (If you save a home area in Percy's memory, that is a neighbourhood you typed, not your position.)

Percy's memory, if you want it to follow you

By default, Percy's memory of you lives on your phone and we store no copy, which is why a new phone starts Percy from scratch. One switch in Me, then Privacy & data (Percy's memory), changes that. Turn it on and we hold a copy on our server, so it follows you to any device you sign in on.

What is held: what you told Percy about how you eat and move: your goal, how you eat, allergies, foods you do not eat, dislikes and likes, body areas to spare, your fitness level, your routine in your words, the kit you own, how you work, your home area (a neighbourhood you typed), roughly when you eat, and short notes that expire on their own ("flying tomorrow", "slept badly", "knee sore"). Some of that is health-related, which is why it only happens with your explicit yes.

What is not held: your readings, weight, medication reminders, Journey diary or conversations. Our server has no place to store them.

It starts off. Turn it off and we empty what we hold in the same moment. A separate button wipes the copy and leaves the switch on. It is deleted with your account. We keep a short record that you switched it on or off, and when (see "How long we keep things").

Helping Percy get better (your choice, off until you switch it on)

It is a switch of its own in Me, then Privacy & data, called "Help improve Percy". It is off until you switch it on, and Percy does not ask you about it during setup. Nothing is ticked for you. It is separate from the AI helper and from Percy's memory: leaving it off changes nothing about them, and the other way round. Percy works in full with it off. It is not part of the yes you give on the setup screen, which is why that yes does not cover it.

The words you are shown next to the switch are: "We keep your questions and Percy's answers, including anything about your health you type, without your name, for 180 days, so we can find where Percy gets it wrong and fix it. Only the NRC team reads them. Never sold, never used for ads." This section is the detail behind that line.

What we keep if you say yes. Each question you ask Percy and Percy's answer, as text, including anything about your health that you type into a question, whether Percy answered it itself or with an AI service. With each one we keep a short technical note about the turn: which screen, the meal slot, the hour of the day, your country and goal, how Percy worked the answer out, and how many allergies and food rules you have (a count, not the list).

What we take out first. Before anything is saved we replace email addresses, web links, long runs of digits such as phone numbers, and your own name with a marker. That cannot catch everything you type (another person's name, an address, a short number), so please do not type other people's details, prescriptions or test results.

Without your name, but not anonymous. We store it under a code, a scrambled form of your account number that only our server can work out. The code carries no name, email or account number, so the stored text cannot be tied to you by anyone who only sees the stored text. But the same code lets us find your questions again, which is how we delete them when you ask, so in law this is still your personal information, and we treat it that way.

What is not kept this way. Photos, and anything Percy read from a photo. A message that looks like an emergency or crisis. Your saved readings, diary, mood, meals and health answers (they stay on your phone; if you type a number into a question, that question is kept as typed).

How long. Up to 180 days, then it is deleted. Anything older than 180 days is no longer shown to our team, and we clear it out by hand until a scheduled clean-up is in place.

Who sees it, and for what. Access is limited to people at NRC on a short named access list. They open it on a private screen that shows the text and your code, not your name, email or account number. They read it to find where Percy gets things wrong and to fix Percy's rules, wording and tests. We do not sell it, we do not use it for advertising, and we do not give it to an AI company to train its models. We will not use it to train an AI model of our own without asking you again.

Switch it off, and it is deleted. Me, then Privacy & data, then "Help improve Percy", then "Switch it off and delete what you've kept". Everything we kept for you is deleted from our live system at that moment, in the same step as the switch. Copies in our encrypted backups are gone within 6 months and we do not use them to bring anything back. If you delete your account, it goes with it. "Delete my chat" in Me clears the conversation on your phone only; it does not remove the copy we keep under this switch. The file you can download from Me includes everything we kept for you. We keep a short record that you said yes or no, and when (no text), so we can show what you agreed to.

Percy and AI

Percy is an AI app. Some of what Percy does is done by rules built into the app and our server, with no AI involved (for example, adding up a day's food-energy figures and keeping your log). For the rest (reading a plate, reading a menu, written answers) Percy uses an outside AI service we pay for (we may use more than one), on paid business terms, run in the United States and on the providers' systems worldwide.

The AI helper is required. Percy needs it to work, so you must say yes before you can use Percy. On the setup screen, one tap on "I agree" does two things: Percy may save the health answers you give it, and the AI helper is switched on. The only other button is "Sign out"; if you tap it, nothing is saved or sent and you cannot use Percy. There is no "Not now". You are asked before you subscribe or pay. The server checks your yes on every request. It is not only a setting on your phone.

What goes with a question. What the answer needs, and these things. This is the same list, in the same words, as "See everything that can go" on the setup screen and in Me, then Privacy & data:

• Your question, and the photo if you send one
• Up to your last 12 messages in the chat, including recipes and plans in those messages
• Your allergies and food rules. They are health-related and they go with your questions so the answer is safe for you
• Dislikes, what you’ve eaten today, and the meal, day and time of day
• Your goals (like lower cholesterol, blood sugar or blood pressure, or losing weight), how you eat, and your country
• Your weight, height and weigh-ins. If you’ve told me you have, or had, struggles with food, or you’d rather not say, or you tell me in the chat and ask me to hide your numbers, your weight, height, weigh-ins and “lose weight” goal never go
• Body areas to spare, your fitness level, your kit, how many sessions you’ve done, and your routine in your words
• How ready you said you feel today, if you typed it
• Up to six earlier notes you gave Percy (“knee sore”, “slept badly”)
• On food questions: dishes you turned down in the last 30 days, and dishes that worked for you
• Your daily food-energy number and how much of it you’ve used, if you set one
• A flag if you mention a health condition, so the answer is careful

What "weigh-ins" means in that list. What the app sends is your weight today, the single weight number in your profile, and your height. The weights you log over time are not sent, and neither are your other saved readings.

Your weight, height and the “lose weight” goal, said plainly. They go with a question unless Percy is in quiet mode for you. Quiet mode starts in one of two ways: you told Percy on the setup screen that you have, or had, struggles with food, or that you would rather not say; or you told Percy about it in the chat, and Percy asked once, “Want me to hide calories and numbers?”, and you said yes. In quiet mode, Percy hides calorie, carb, protein, fat and weight numbers, and your weight, height and “lose weight” goal never go to the AI. You can switch back in Me. If you tell Percy in the chat and say no to hiding your numbers, quiet mode does not start and your weight and height can still go with a question. If you have not answered Percy’s question about food, they go. Whatever you type in the chat goes to the AI as you typed it, whether or not quiet mode is on. The app checks all of this on your phone, and the app does not send your answer about struggles with food anywhere.

Never sent, whatever you choose: your saved blood sugar, blood pressure and cholesterol readings, the weights you log over time, and anything you import from Apple Health.

A workout you tell Percy about ("I did back and biceps for 60 minutes") is part of what you typed, so it goes to the AI with that message. Percy then files the workout on your phone.

What does not go: your name, email or account (Percy writes a stand-in for your first name and your phone puts your name back in after the answer returns); your saved readings, meaning your blood pressure, blood sugar and cholesterol values and the weights you log over time; your medication reminders; your Journey diary; your age, medicines, kidney and heart answers, pregnancy answers and past struggles with food from the health answers screen; or any photo you did not choose to send. If you type something into a question, it goes, numbers included. Percy only needs the food: please do not type or photograph prescriptions, test results or other people's details.

Why we use it. To answer your question, to read your plate or menu, to fit the answer to your goals, and to work out your daily calorie guide and your food and activity ideas.

Photos. A meal or menu photo goes to an outside AI service we pay for to be read, once. See "Meal photos" below.

What the AI services may do with it. The business terms for our paid use of these services say that prompts and responses are not used to improve or train the providers' products. The providers keep a record of requests for a limited period under their own terms and our account settings; we do not control all of it, and we cannot call back a request once it has been sent. They do not receive your name or your account from us. This is how Percy works for members; a small test build used only by people who work on Percy may run on different terms while a feature is being built, not the build you use.

What we do with it. We answer your question. We do not keep your photos. We keep your question and Percy's answer only if you switched on "Help improve Percy" (the section above); if it is off, we answer and do not keep them. We do not sell what you ask Percy, do not use it for advertising and do not give it to an AI company to train its models. We also keep counts: that you used one of today's AI answers (kept 14 days), and anonymous thumbs-up or thumbs-down verdicts with a reason from a fixed list, which carry no words of yours.

It can be wrong, and it does not replace your doctor. Under the message box Percy says: “Percy can make mistakes. Check important info.” Percy is education and decision support; it does not diagnose, dose or grade your readings. Your doctor outranks it, and us.

Taking your yes back, and what it costs you. Because Percy cannot work without the AI helper, there is no switch for it in the app. In Me, then Privacy & data, "Stop Percy's AI" explains this and takes you to "Delete my account". To take your yes back, delete your account. From then on nothing more is sent. You can also tap "Sign out", which stops Percy sending anything from that phone until you sign in and agree again. Taking your yes back means you can no longer use Percy. It does not cancel an Apple subscription: cancel that in iPhone Settings (see "Signing in, paying, and your subscription"). What our AI service providers already received with an earlier question cannot be called back. To clear what Percy keeps on your phone without deleting your account, use "Clear this phone"; to clear only the conversation, use "Delete my chat". We keep a short record that you said yes, which wording you saw and when, with no health details, so we can show you what you agreed to.

If you agreed to an earlier wording, or tapped "Not now" before, Percy asks you once more, because the AI helper is now required and the switch that turned it off is gone. Until you agree again, you cannot use Percy, and nothing is sent.

Some movement demonstration videos in the app were made with AI tools. They are fixed clips, the same for everybody, made once. Nothing about you is sent anywhere to make or show them.

Meal photos, menus and barcodes: the whole path

1. On your phone the picture is shrunk before it is sent.
2. It arrives at our server and is opened in memory only. We check it really is a picture, re-draw it (which removes the hidden data a camera attaches, including where it was taken) and shrink it again.
3. It is passed to an outside AI service we pay for to be read, only because you have tapped "I agree" (without it Percy cannot be used), so Percy can tell you what is on the plate and roughly what is in it. Your country goes with it so the dishes make sense.
4. It is released. We do not write the photo to a disk, a database, a file store, a backup or a log. Percy does not keep a photo library of your meals, and it does not save pictures into your own photo library. Our logs record only that a scan happened and how big it was.
5. Only the result comes back: dish names and numbers, after our server has bounded them and redone the arithmetic. Those live on your phone.

A menu photo takes the same path. The words of a meal you type in so Percy can estimate its calories are sent to the AI service the same way and not kept by us.

Barcodes. If a barcode is read, only its digits leave our server, to a free public food-label database. The request comes from us, not your phone, so that database does not see your IP address or anything about you.

The honest limit. While a photo is in flight it passes through our network provider and is read by an outside AI service we pay for. Each is a conduit or a reader, not a filing cabinet for us: the network provider keeps no copy, and the AI service may keep the request, photo included, for a limited period under its own terms.

Before 10 September 2026 the coaching programme stored meal photos. That storage was shut down and holds no photos today. Any copy left in an encrypted backup is gone within 6 months and we do not use it to bring anything back.

Counting how the app is used

The app tells our server which screen you opened, which action you took (for example "opened the app", "asked Percy", "snapped a meal"), which version of the app you were on, and when. Those come from a fixed list we set in advance, and the record has nowhere to put anything you type. We do not record your questions, meals, readings, name or any free text. It is tied to your account, because otherwise the numbers mean nothing. We look at it in groups, such as how many people came back on day three, not as a file on one person, and it is not sold or used for advertising. Our own server holds it; no analytics company is involved, and no coach or staff member has a screen for it.

This is on by default, and you can turn it off: Me, then Privacy & data, then "Counting app use". The switch is stored on that phone, so turn it off on each device you use. We keep these records for no more than 180 days, and a scheduled job deletes them. They are deleted with your account.

When the app breaks

If something crashes, the app sends us the error text, which screen you were on, the app version, and the description your browser gives of itself. No meal, no reading, no message to Percy, no name, no account and no IP address is kept with it. Web addresses, anything after a "?" in them, and any code that is not ours are cut out before it is stored. The report is not linked to your account. We keep crash reports 30 days, and a scheduled job deletes them.

Signing in, paying, and your subscription

• Signing in. You sign in with Google or Apple. We receive your name, verified email address and an account reference. We do not see your password. In the iPhone app, Percy keeps a sign-in token in your iPhone's Keychain, which is Apple's secure store on the phone, and sends it with each request so you stay signed in until you sign out. The iPhone app sets no cookies. If you ever sign in through a web browser instead, we set a sign-in cookie and a matching security cookie, which are strictly necessary to keep you signed in (24 hours, or 30 days if you choose to be remembered). We set no advertising or tracking cookies.
• Your subscription and trial. We keep the dates and status, so the app knows whether you are in your 3-day free trial (yearly plan), subscribed, or not subscribed. There is no free plan.
• The trial reminder. After a trial starts, the app can offer one optional reminder before the charge. It says "Your free trial ends soon" and "Cancel by <day> <time> to avoid being charged <price> for a year." It is a notification scheduled on your phone. Nothing about it is sent to a server. The reminder is cancelled if you sign out or delete your account, but your trial and Apple's charge are not: they continue until you cancel in iPhone Settings, at least 24 hours before the trial ends.
• Paying through Apple. Apple takes the payment and runs the billing. We receive and keep the product, dates and Apple's transaction reference, tied to a random code, not to your Apple ID or card. You cancel in Apple's subscription settings (iPhone Settings, your name, Subscriptions, Percy).
• Service emails. We may email you about your account and subscription, for example a price change or a refund. They carry your name and email and no health information.
• A partner link. If you arrived through a partner's link, we record that link's code against your account, so we can see where members come from.

Who else touches your information

These are the companies that touch your information, what each receives, and where. We do not add a company that touches your information without updating this page. Each gets only what it needs to do its job.

Our own automation server runs on the same server. It is ours, not a third party's. One honest limit: Jason runs our server himself, so he can reach the database directly, the way the person who runs any small service can. What he cannot reach is what is not there: your readings, meals, diary and photos, and your conversations unless you switched on "Help improve Percy", in which case he can read the questions you let us keep (without your name).

Where your information is kept, and international transfers

Our server is in the European Economic Area (EEA), rented from a hosting provider. The database is not reachable from the internet. We are based in Malaysia and manage it from there. We back the server up every night; the backup is scrambled on our own machine before it leaves, and we have tested that a backup restores. Our off-site encrypted backups rotate: seven daily, four weekly and six monthly copies. Local nightly backups are kept for 14 days. A one-off safety copy made before an update is kept for 30 days at most. Anything you delete is gone from our backups within 6 months.

Sending information outside your country. To answer your questions, the items listed under "Percy and AI" are sent from our server to our AI service providers, in the United States and on the providers' systems worldwide. Our network provider also carries traffic through data centres worldwide, and Apple handles sign-in and billing in the iPhone app. Wherever your information travels, the commitments in this policy are what we hold ourselves to. The thing people worry about most, your saved readings, does not travel, because the app does not send them anywhere.

If you are in Malaysia: the Personal Data Protection Act 2010 (as amended in 2024), section 129, controls sending personal data out of Malaysia. We rely on your explicit consent, given when you tap "I agree" on the setup screen. That screen tells you in writing what is sent, to whom (the outside AI services we pay for, which may run outside Malaysia) and why, and that it is required: you cannot use Percy without it. We record that consent and the wording you saw. We also keep our own server in the EEA and send them only the items listed. You can take your consent back at any time, but because Percy needs the AI helper, taking it back means deleting your account (see "Percy and AI").

If you are in the UK or the EU: we rely on your explicit consent for sending information about your health to our AI service providers, given in the same way. Saying yes is a condition of using Percy, because the AI helper is the service and not an extra; we say so on the setup screen, before you pay.

How long we keep things

We do the deleting that is not built into the app by hand, so treat these as the periods we work to rather than a stopwatch. If the schedule changes, we change it here.

Your rights, and how to use them

Wherever you live, we work to one standard, and your local law wins if it gives you more. You can see what we hold, correct it, delete it, take a copy to use elsewhere, withdraw a consent, and object. In the UK and EU those are your rights under UK GDPR and GDPR; in Malaysia, under the Personal Data Protection Act 2010 (as amended in 2024); in Indonesia, under Law No. 27 of 2022; elsewhere, under your own law. We do not currently meet the thresholds for California's CCPA/CPRA, but we offer the same rights anyway.

United States: Washington, Nevada and Connecticut. If you live in Washington, Nevada or Connecticut, state health-data laws give you extra rights over information about your health, and we must publish a separate policy about it. Ours is the Consumer health data privacy policy. It says what health information we collect, why, who gets it, and how to see it, delete it, withdraw your consent or appeal, and it gives a 45-day answer time.

Do it yourself, in the app (Me, then Privacy & data):

• Get a copy. "Also get what NRC holds" downloads a file (machine-readable, plus a plain summary) of what is on our server: your account and dates, your switches and their history, Percy's memory, the questions and answers we kept under "Helping Percy get better" and your yes/no history for it, your activity counts, your daily AI use, and your partner link. "Download everything" gives you what is on the device. For safety we ask you to sign in again first. The download does not yet include your payment records or any coaching-era notes: ask us and we send them.
• Delete. "Delete my account" shows you exactly what will go, then asks you to type DELETE MY DATA and to sign in again. It removes your content and your identity (your email, name and sign-in references) from our server. If you pay through Apple, deleting your information does not cancel your Apple subscription, and we cannot cancel it for you. The app warns you before it deletes. To stop Apple billing you, cancel in iPhone Settings: tap your name, then Subscriptions, then Percy, then Cancel Subscription. If you do not, Apple may keep charging you. "Clear this phone" clears the device, which we cannot reach.
• Switch things off. Percy's memory, "Help improve Percy" (off until you switch it on) and "Counting app use" (on until you switch it off) each have their own switch in the same place. Switching off "Help improve Percy" deletes what we kept for you at once. Withdrawing any of those does not cost you anything else in Percy. The AI helper and the health answers have no switch, because Percy cannot work without them. "Stop Percy's AI" in the same place explains this and leads to "Delete my account". To withdraw that consent, delete your account (above); you can also use "Clear this phone" for what is on the device, and "Delete my chat" for the conversation.
• Anything else, email [email protected]. We check it is really you, answer promptly, and within the time the law that applies to you requires, and tell you if we need longer and why. We do not charge for this.

What deletion does not remove, and the reasons: (1) payment, subscription and tax records, which the law makes us keep (stripped of what we can); (2) the record of what you agreed to (the choice, the wording version, the date; not the text of a question), with no name, so we can prove what you agreed to; (3) encrypted backups, which clear within 6 months and are not used to bring a deleted account back; (4) in rare cases, records we are legally required to hold while a claim or legal hold applies: we will tell you that we cannot delete yet and what to expect. And, as above, we cannot delete what is on your phone, or what our AI service providers already received with an earlier question.

Portability. The downloaded file is in a standard format you can take elsewhere. Where Malaysian law gives you the right to have your data sent directly to another provider, ask us and we will do it where it is technically possible.

Complaining. You do not have to come to us first, though we would rather you did. In the UK: the Information Commissioner's Office (ico.org.uk). In Malaysia: the Personal Data Protection Commissioner. In the EU: your national data-protection authority. In the United States: your state attorney general (in Washington, atg.wa.gov). Elsewhere: your local authority.

Automated decisions. Percy suggests and you decide. Percy does adjust some things automatically from what you tell it: for example, if you tell Percy on the setup screen that you have, or had, struggles with food, or tell it in the chat and say yes when it asks whether to hide your numbers, it enters quiet mode: it holds back weight and calorie numbers and workout prompts and sends no weight or height to the AI. You can change what you told Percy at any time in the app, and you can ask us to look at it ourselves.

Why we are allowed to use your information

For readers in the UK and EU, and useful everywhere:

• Running your account and subscription: because we have a contract with you.
• Health-related information you give Percy and that goes to the AI (your allergies and food rules, your goals, weight and height, the conditions you mention, Percy's memory on our server, and anything you type): only with your explicit consent, given on the setup screen with "I agree" (and for memory and "Help improve Percy", on their own switches in Me). The yes on the setup screen is a condition of using Percy, because the AI helper is how Percy works; it is not an optional extra, and we do not bundle anything unrelated into it (memory, "Help improve Percy" and "Counting app use" are separate). It is asked before you pay. Withdrawing it means deleting your account, since there is no AI-off switch. UK and EU: UK GDPR and GDPR Article 6(1)(a) and Article 9(2)(a). Malaysia: the Personal Data Protection Act 2010, sections 6 and 40, which treat information about physical or mental health as sensitive personal data needing explicit consent, and section 129 for sending it outside Malaysia (see "international transfers" above). Indonesia: Law No. 27 of 2022, where health information is specific personal data that needs your explicit consent. In the United States, in Washington (the My Health My Data Act), Nevada (SB 370) and Connecticut, and wherever else a state health-data law applies, this yes is the consent those laws ask for (see our Consumer health data privacy policy). Saying no on the setup screen means you cannot use Percy; you pay nothing and nothing is sent. Withdrawing stops anything further being sent; it does not reach back to what our AI service providers already received with an earlier question.
• Questions and answers we keep to make Percy better (which can include health details you type): only with your explicit consent (UK and EU: UK GDPR and GDPR Article 6(1)(a) and Article 9(2)(a); Malaysia: PDPA 2010 sections 6 and 40, which treat information about physical or mental health as sensitive personal data needing explicit consent; United States: Washington, Nevada and Connecticut health-data laws, where this yes is the consent they ask for). It is its own choice, a switch in Me, then Privacy & data, that starts off and is never pre-selected. You can withdraw it at any time, as easily as you gave it, and withdrawing deletes what we kept. Leaving it off does not cost you anything in Percy.
• Counting how the app is used, crash reports, and keeping the service secure (including the access log): our legitimate interest in knowing whether the app works and in not being attacked, balanced against your privacy, which is why these carry no free text and no account on crash reports.
• Tax and accounting records: a legal obligation in Malaysia.
• Our record of what you agreed to: our interest in being able to show it.

If something goes wrong

If your information is affected by a breach, we notify the regulator and the people affected as the law that applies requires. Depending on where you live, that can include:

• Malaysia: the Personal Data Protection Commissioner, under the Personal Data Protection Act 2010 (as amended in 2024).
• UK and EU: the supervisory authority (in the UK, the Information Commissioner's Office), under UK GDPR and GDPR.
• United States: the Federal Trade Commission's Health Breach Notification Rule and any state breach law that applies.
• Singapore: the Personal Data Protection Commission, under Singapore's Personal Data Protection Act.

Where more than one law applies to you, we follow what each of them requires. We have tested that our backups restore.

If you were a coaching member

The 2026 coaching programme has ended. Records from it (your application, check-ins, messages, Jason's private notes, safety-check results and payment records) are kept only to answer a complaint or a claim, on the schedule your Member Agreement and the old policy set: check-ins, logs, notes and your account about 30 days after your programme ended; messages 6 months after; the screening result and medicine flags up to 12 months; safety-event records six years from the later of your last record and the end of your programme; payment and tax records 7 years. We delete on that schedule by hand; if you find a record that is older than its period, tell us and we will delete it. You can ask for a copy of any of it, including the coach's notes, or for it to be deleted early, at any time.

The website

This section is about normalrangeclub.com, not the app.

• No advertising trackers, no profiling, no cross-site tracking. We use no analytics service, we set no cookies, and nothing we put on this site stores anything on your device or reads anything from it, which is why there is no cookie banner. One thing we do not control: the network provider in front of our sites asks your browser to keep a short-lived setting, seven days, so that if a connection to us fails, your browser can report the failure back to it. It is technical diagnostics about the connection, not about you, it does not identify you, and we do not receive those reports.
• Do Not Track and Global Privacy Control. We do not track you across other websites or apps, and we do not sell or share your information for advertising, so there is nothing for those signals to switch off.
• The Percy waitlist. If you join the waitlist, we use your email to tell you when Percy is in the App Store and Google Play, and to send you Jason's emails until then: about one a week at most, unsubscribe in one click, not sold or passed on to anyone for their own purposes. After launch we send the launch email and ask before sending anything more. We also note which page or link brought you (for example a Facebook post), read from the address you arrived at, so we know which posts work. Nothing is stored on your device and nothing follows you to other sites. Like most email services, our email-list provider records whether an email was opened or a link in it was clicked; we use that only to see which emails are useful, and for nothing else. We keep a record of the box you ticked, the exact words beside it, the date and time, and when you clicked the confirm link in our email. Nothing is added until you click it. Brevo, our email-list provider, holds the list for us in the European Union. The waitlist is not open in the EU or the EEA.
• The free guide. If you ask for the free guide, we use your email to send it (through our email provider). If, and only if, you also tick the second box, we add you to Jason's email list: usually about one email a week, unsubscribe in one click, not sold or passed on for anyone else's marketing. When you tick a box we keep a record of which box, the exact words beside it, the date and time, and the IP address it came from, for as long as we hold what it relates to.
• Our web server's access log keeps your IP address, the time, the page, the page you came from and your browser's description of itself. We use it to spot attacks and fix what is broken, not to profile you and not for marketing. It stays on our own server in the European Economic Area (EEA) and is deleted after 30 days. Jason reads it.
• Ebooks bought in the past. If you bought an ebook from us before, the seller of that ebook still holds that purchase record under its own privacy policy. We can see the email address you bought with, so we can still help you with a purchase you already made.

Children

Percy and this website are for adults: you must be 18 or over, or the age of majority where you live if that is higher. They are not directed at anyone younger and we do not knowingly take anyone younger. If we learn we have, we close the account and delete what we hold. If you are a parent or guardian and think a child has used Percy, email [email protected].

Changes

If this policy changes, we update this page and the version at the top, and we keep the old versions. If a change is material (anything about what we collect, who receives it, or what we do with it) we tell you before it takes effect. A change that would need a fresh yes from you gets a fresh yes from you; it does not get a quiet edit to this page. This update is one of those: it is why Percy asks members who agreed to an earlier wording, or tapped "Not now", once more.

Questions about any of this: [email protected], or the support page. See also the Terms and Conditions.