The FTC Rolled Back Its Health App Breach Guidance. Bite's Privacy Policy Never Had One to Roll Back.

On September 9th, the FTC rescinded its 2021 policy statement on breaches by health apps and connected devices. That statement, issued five years ago on a contested 3-2 vote, had stretched the FTC’s old Health Breach Notification Rule to cover apps like ours, apps that sit outside HIPAA because we’re not a hospital or an insurer. It went further than the rule’s plain text: unauthorized sharing of your data with a third party could count as a reportable “breach” on its own, even with no hack involved, and a health app could be treated something like a healthcare provider for notice purposes. The FTC’s own explanation for killing it was blunt: the statement is “obsolete,” because the Commission already rewrote the actual rule in 2024 to cover health apps and connected devices directly, so the old interpretive memo was just extra paper doing nothing the codified rule doesn’t already do.

I read that and had the same reaction I’ve had to every regulatory story I’ve covered in this newsletter: don’t take the headline’s word for it, go check what it actually means for us. And the answer here is more reassuring than the other stories, then less reassuring. The reassuring part: the 2024 rule is still fully in force. It explicitly covers “health apps” and “connected devices” that aren’t covered by HIPAA, which is exactly Bite’s category. If we ever had a breach involving unsecured, identifiable health information for 500 or more people, we would be required to notify every affected person without unreasonable delay, no later than 60 days after discovering it, and to notify the FTC too. Nothing about September 9th changed that. The looser part that got rescinded was the aggressive interpretive layer sitting on top, not the underlying legal duty.

So I did what I did for the last two issues: I went and checked whether Bite’s own paperwork reflects a duty we already have, regardless of what any policy statement says this month. It doesn’t. Section 5 of our Privacy Policy, “Data Security,” lists what we do to prevent a breach: encryption in transit and at rest, access controls, regular security assessments, encrypted Google OAuth tokens. It says, correctly, that no method of transmission is 100% secure. And then it says nothing else. There is no sentence anywhere in that section, or anywhere in the document, committing to tell you if those protections fail. Section 7, “Your Privacy Rights,” lists seven rights you can exercise: access, correction, deletion, portability, objection, restriction, and withdrawing consent. Being told if your meal photos, your weight history, or your AI chat logs were exposed isn’t one of them. I searched the whole file for the word “breach.” It appears exactly once, in the Terms section, and it’s about you breaching our Terms and Conditions, not the other way around.

I don’t think this is a case of anyone deciding not to write a breach clause. I think it’s the same shape of gap I keep finding: nobody has gotten around to it, because nothing has forced the question yet. But “nothing has forced it yet” describes most privacy incidents right up until the day it doesn’t. MyFitnessPal, the app most people would compare us to, had 150 million accounts compromised in a single 2018 breach. That’s not a hypothetical I’m reaching for, it’s the exact product category we’re in, and it’s sitting in our own competitive research doc as a fact we already know.

The FTC’s story this month was about deleting a redundant memo because the real rule already does the job. Ours is smaller: the real rule already applies to us whether we’ve written it down or not, and right now our Privacy Policy reads as if that rule doesn’t exist. Fixing it doesn’t need an engineer. It needs one new paragraph in Section 5, committing to notify affected users and naming a real timeframe, ideally well inside that 60-day statutory ceiling, not up against it. Until that paragraph exists, the honest way to describe our current posture isn’t “compliant,” it’s “unwritten.”

BITE of the Week

Two commits landed on main this week, both still part of 1.15.0, which RELEASE_NOTES.md marks “not yet built” as of the last version bump. Nothing here is live yet; 1.14.0 stays what’s actually in your hands, Android at build 146 fully rolled out, iOS build 115 still sitting in App Review as of my last update.

The first, “First session,” tears out the sign-up wall. A finished quiz now drops you straight into the app on an anonymous Supabase session instead of stopping you at a account screen; you’re asked to keep your progress later, on Today from day one and again in Profile, and signing up at that point claims everything you already did. Onboarding itself shrank from five questions to three, activity and pace now default to moderate and steady and adjust later from the targets card. The “Recommended targets” page is gone entirely, replaced by a “Your targets” card that appears on Today once your first meal lands, and after that first log Mr Bite asks what’s next and books one reminder for it, cancelled the moment a second meal shows up. It needs three things outside the commit itself to actually work in production: anonymous sign-ins enabled on the Supabase project, a migration applied, and the claiming function deployed.

The second, “Glass chrome,” is a rebuild of the app’s top and bottom navigation into a shared glass-style kit so the settings menu and the tools menu can’t visually drift apart again, plus a real fix for tab-switch lag: the active tab and a menu-open flag used to live inside a memoised context value that every tab screen re-rendered on, and now live in module-level stores that only the navigator reads. The quick-add dock at the bottom is transform-only now, driven by tap-intent counters instead of animation state, which is what was causing it to occasionally reopen itself or eat a tap meant for something else. On Android specifically, the system nav bar is hidden through expo-navigation-bar, with a new insets fix so the composer and nav pill stop jittering when the keyboard opens and closes.

Three Quick Bites

1. A study of more than 112,000 people, led by Dr. Mathilde Touvier at INSERM and published in the European Heart Journal on September 20th, found eight common food preservatives, including ascorbic acid, sodium ascorbate, sodium erythorbate, and rosemary extract, associated with higher rates of hypertension and cardiovascular disease over up to eight years of follow-up. These are the “natural antioxidant” preservatives added to stop food from browning or turning rancid, not the artificial ones usually singled out, which is exactly the kind of ingredient a “clean label” scan would wave through. ScienceDaily

2. Researchers at Hokkaido University, publishing in Food Research International and covered by ScienceDaily on September 16th, mapped 196 lipid molecules across 56 japonica rice varieties and found that black and green pigmented rice contain fats not previously detected in rice at all, alongside starch that digests measurably slower than white rice. In simulated digestion, the pigmented varieties produced a slower rise in blood sugar, making them a plausible ingredient for anyone managing glucose response through food choice rather than substitution. ScienceDaily

3. On September 3rd, STAT News reported that the FDA’s new TEMPO pilot, which lets select generative-AI health devices reach real-world patients before full marketing authorization while the agency studies them in use, accepted its first four products, including ones from Cadence and Limbic. It’s a genuine policy shift: until now, no FDA-authorized device has run on generative AI or an LLM at all, and TEMPO is the agency choosing to learn from real deployments instead of waiting for the evidence bar it normally requires first. STAT News

Tool of the Week: Have I Been Pwned

Since this issue is about the gap between having a legal duty to notify people and actually writing that commitment down, this week’s pick is the free tool built for the moment a company doesn’t. Have I Been Pwned, run by security researcher Troy Hunt, lets anyone check whether their email address has turned up in a known data breach, MyFitnessPal’s 2018 breach included, and offers a free notification service that emails you the moment your address appears in a new one. It’s not a substitute for a company actually telling you, but it’s the backstop that exists precisely because too many companies don’t. Have I Been Pwned

Thanks for reading. If you want a coach that would actually tell you, Mr BITE is free on iOS and Android.

Michael, building Mr BITE