OpenAI Defaulted Health Data Sharing to On. Bite Never Built a Way to Turn It Off.

On September 14th, OpenAI changed how ChatGPT Health treats your data the moment you connect it. Health launched in January with an explicit ask-first model: connect Apple Health, MyFitnessPal, or Function, and ChatGPT would check with you before pulling that data into an answer. As of the 14th, that changed for new connections. Unless you’ve touched your Plugins settings, a freshly connected Health source now defaults to “Allow low-risk actions,” meaning ChatGPT can use your nutrition and fitness data when it’s relevant without asking each time, pausing you only for something OpenAI classifies as sensitive, like emailing your training data to someone else. OpenAI’s stated reason is blunt: more than 70% of Health users were already clicking yes every single time anyway, so the constant asking had become friction for the majority to protect a minority who can still flip it back to ask-first in Settings whenever they want.

I don’t think that trade is indefensible on its own. Asking someone the same question for the fortieth time when they’ve answered the same way forty times in a row is exactly the kind of friction I’d want gone from Mr Bite too. But the whole justification leans on that last clause, the settings toggle being real and findable. So instead of just nodding along at OpenAI’s call, I went and checked whether Bite’s own version of this choice holds up. It doesn’t, in a plainer way than anything OpenAI just shipped.

Bite has one consent screen, AiConsentSheet, gating everything. The first time you use any AI feature, food photo, voice log, chat, recipe import, document scan, it names the three services actually doing the work, DeepSeek, OpenAI, and Mistral, lists what each one sees, and gives you two buttons: Allow and continue, or Not now. Tap Allow once and ai_processing_consent_v1 is written to your device and never asked again for the life of the install. Not per provider, not per feature. One bundled yes covers your chat messages and health context going to DeepSeek, your meal photos and voice notes going to OpenAI, and any document you upload going to Mistral, indefinitely. Decline and nothing is written, so the next AI tap asks the identical bundled question again, which is its own small annoyance but at least an honest one.

Here’s what I couldn’t find anywhere in the app: a settings row, a toggle, a “review AI permissions” screen, anything that lets you revisit that Allow after you’ve tapped it. I grepped every place the consent flag is written or read, and it comes down to exactly two writers, the onboarding step and the fallback sheet, and zero places that ever read it back to you as something you could reconsider. Our own Privacy Policy does list “Withdraw Consent” among your rights in section 7, right next to Access and Deletion. But exercising it means emailing privacy@nutriflex.app and waiting up to 30 days for a reply, not tapping a switch. OpenAI’s new default at least ships attached to a real Settings → Plugins → Health control you can flip either direction, instantly, per connection. Ours ships attached to a mailbox.

Once you’ve tapped Allow on Bite, whether you’re seventeen and clicking through onboarding to get to the app, or forty-five and actually reading the four bullet points first, that yes covers three companies and four categories of your data for as long as the app stays installed, and the only documented way back is an email that takes up to a month. I went looking for a reason this doesn’t need a Settings entry and didn’t find one. The copy already exists in AI_CONSENT_COPY. The storage key already exists. What’s missing is a single row in Settings that calls setAiProcessingConsent(false) and a moment’s confirmation, which is not a big build. The uncomfortable part is that “small build, still hasn’t happened” describes more of what I find when I go looking than I’d like.

BITE of the Week: Widgets, a Tour, and a First Week Without a Confirmation Tax

1.14.0 is the biggest release we’ve shipped since I started writing this newsletter, and as of September 16th it’s live on Android (versionCode 145, 100% rollout on Play) and sitting in Apple review after a genuinely awkward path to get there: build 111 of the previous version, 1.13.0, was rejected in App Store Connect and never shipped on iOS, so this release quietly folds that entire version’s worth of work in as its own delta, resubmitted by renaming the rejected 1.13.0 listing to 1.14.0 (App Store Connect only allows one editable version at a time) and attaching a new build. It’s submitted, not approved, as I write this.

What’s actually in it: a home-screen widget on both platforms, four tiles (Manual, Voice, Photo, Scan) plus food search, one tap from your lock screen instead of an app open. An eight-stop guided tour through the app’s key actions in Mr Bite’s own voice, for new accounts automatically and offered to existing ones. A reworked first week: recommended targets you can adjust instead of just accept, a plainer AI-processing consent step (the same AiConsentSheet I just spent four paragraphs on), and your very first log happening straight out of Mr Bite’s welcome message instead of a blank Today screen. And the one I actually care about most: tell Mr Bite what you ate in chat and it logs it straight to your diary, no confirmation round-trip. That fix came out of a real audit of two weeks of production transcripts that found the model had learned to fake its own confirmation prompts, one user tapping “Yes” seven times on the same message because nothing was actually pending.

Three Quick Bites

1. A meta-analysis of 87 clinical trials, published September 15th in the European Heart Journal and led by researchers at Tabriz University of Medical Sciences, found a “sweet spot” of 60 to 100 grams of whole grains a day, about three to five servings, for the biggest measurable improvements in body weight, blood pressure, cholesterol, and blood glucose. Benefits started appearing around 90 grams a day, roughly two slices of whole wheat bread and a bowl of oatmeal, with diminishing or unclear returns past the top of that range. ScienceDaily

2. On August 25th, the FDA authorized Abbott’s Libre Duo 10 Day, the first wearable in the world cleared to continuously track both glucose and ketones from a single sensor, for people two years and older with diabetes who use insulin or other glucose-lowering medication. The device sends a real-time smartphone alert when ketones climb, meant to catch diabetic ketoacidosis early enough to act on it, backed by six studies across more than 600 patients. FDA

3. The Nutrition Business Journal’s 2026 report, released September 15th, put the combined U.S. sports nutrition and weight-management market at $93.81 billion for the year, with sports hydration and energy drinks alone accounting for 68.7% of total sales. The category is closing in on $100 billion with no sign of slowing, which is worth sitting with the next time a nutrition claim on a label feels more like marketing copy than science. GlobeNewswire

Tool of the Week: Klaro

Since this issue is about how far a single bundled consent screen falls short of a real, revisitable one, this week’s pick is the open-source tool built to do consent properly. Klaro is a free, MIT-licensed consent manager that lets you ask permission per purpose or per provider rather than as one all-or-nothing screen, remembers each choice individually, and gives people an actual place to come back and change their mind. It’s built for websites rather than mobile apps, so it isn’t a drop-in fix for Bite, but the shape of what it does, granular, named, and reversible, is exactly the shape our own consent screen is missing. Klaro on GitHub

Thanks for reading. If you want a coach that’s honest about the switch it hasn’t built yet, Mr BITE is free on iOS and Android.

Michael, building Mr BITE