Ren

Privacy Policy

Last updated: September 12, 2026

Front Back Labs Inc. ("Ren," "we," "us") operates the Ren consumer wellness app, ren.so, and related services (the "Service"). This policy describes how we handle personal information in the United States.

Information we collect

We collect:

  • account and contact information, such as your name, email address, and authentication identifiers;
  • profile and health information you enter, such as age, sex, goals, conditions, allergies, medications, pregnancy status, and lifestyle behaviors;
  • experiment information, including hypotheses, protocols, interventions, adherence, ratings, and results;
  • information you authorize us to receive from Apple Health, Fitbit, Google Health Connect, or other connected services, such as activity, heart rate, heart-rate variability, sleep, and workouts;
  • biomarker information extracted from lab tests you upload;
  • health insights and inferences generated from this information;
  • communications you send us;
  • device, log, and usage information, such as IP address, device and app details, pages or features used, and diagnostic data; and
  • a referral cookie set when you open someone's invite link to ren.so, used only to credit that person if you join the waitlist within 30 days.

We receive this information from you, your device, services you connect, and our service providers.

How we use information

We use information to operate the Service, run and interpret your experiments, generate AI-assisted responses, communicate with you, maintain and secure the Service, and comply with law. AI output is informational and is not medical advice.

Information we receive through the integrations providers (Apple Health, Google Health, Oura, and WHOOP) is used only to provide and improve the health and fitness features you use in Ren. We explicitly DO NOT use this data for:

  • Targeted advertising
  • Selling to data brokers
  • Providing to information resellers
  • Determining credit-worthiness
  • Lending purposes
  • User advertisements
  • Personalized advertisements
  • Retargeted advertisements
  • Interest-based advertisements
  • Creating databases
  • Training non-personalized AI and/or ML models

No person reads your data except with your consent, for security purposes such as investigating a bug or abuse, or where the law requires. Ren's use of information received from integration providers adheres to their corresponding user data policies, including the limited use requirements.

How we disclose information

We disclose information:

  • to providers that support hosting, databases, AI processing, analytics, communications, and customer support;
  • to connected services when you direct us;
  • when required by law or needed to protect rights and safety; and
  • as part of a merger, financing, acquisition, or sale of assets.

The consumer health data described above may be disclosed to these same categories of recipients. We have no affiliates with which we share consumer health data. Recipients may process information in the United States. Their own policies apply when you use their services.

Retention and security

We retain information for as long as needed for the purposes above, including legal and operational needs.

We protect sensitive health information with layered safeguards. Your health, experiment, and wearable information in Ren is secured in a database residing in the United States with the following safeguards:

  • Encrypted in transit. Every connection between your device, our services, and the database is encrypted with TLS. Database connections use certificate-authenticated TLS; there is no unencrypted path to your data.
  • Encrypted at rest. Cloud SQL encrypts the stored database, its backups, and its logs at rest.
  • Network isolation. The database has no public IP address and is only reachable over a private network by a single internal service.
  • Least privilege. Each backend service runs under its own identity with only the permissions it needs. The one service that can reach the database connects with separate least-privilege database roles: a dedicated role for health data and a different role for non-personal data.
  • Role-based access controls. Each service is granted only the minimum roles required for its job.
  • Per-user scoping. Every read and write is authorized against your authenticated account, and each of your records is scoped to you.
  • Logging limits. Health information, account identifiers, and the content of your prompts and AI responses are kept out of application logs, monitoring, and analytics.

While we implement robust security measures, no system is completely secure.

Your choices and rights

You can disconnect connected services and unsubscribe from marketing messages. Depending on your state, you may also have rights to access, correct, delete, or obtain a copy of your information, or to withdraw consent. Email privacy@ren.so to make a request. We may verify your identity and will respond as required by law.

For consumer health data, you may also ask whether we collect, share, or sell it; request a list of recipients; or withdraw consent to its collection or sharing. If we deny a consumer health data request, you may appeal by emailing privacy@ren.so with the subject "Health Data Appeal." If your appeal is denied, you may contact the Washington State Attorney General.

Children

The Service is for adults and is not directed to anyone under 18. Contact us if you believe a child has provided personal information.

Changes and contact

We may update this policy and will post the updated version here. Questions may be sent to privacy@ren.so.