Privacy Policy

Also titled: Privacy Notice
Product: trei (also styled TREI) · displayed name: TREI-Confidence Between Doses
Site: https://trellismetabolic.com
This notice: https://trellismetabolic.com/privacy
Terms of Service: https://trellismetabolic.com/terms
Privacy choices: https://trellismetabolic.com/privacy/choices
Account deletion: https://trellismetabolic.com/account-deletion
Operator: BariAccess, LLC
Effective date: 24 August 2026
Last updated: 24 August 2026

This notice describes how BariAccess, LLC (“BariAccess,” “we,” “us,” or “our”) handles information when you use trei and trellismetabolic.com.

Companion document: Terms of Service.

This notice covers Apple App Store and HealthKit requirements, Google Play Data safety and Health Connect requirements, Spike production use, HIPAA transparency for a business associate of the named clinic, and California CCPA/CPRA notice-at-collection and consumer-rights notice.

HIPAA individual rights for protected health information held by the named clinic are also described in that clinic’s Notice of Privacy Practices. This Privacy Policy does not replace that notice. See §16.

1. Who we are

trei is operated by BariAccess, LLC. The clinic cohort named on this site is Bariatric Associates (V.E. Andrei MD Bariatric Associates, P.A.) (the “named clinic”). trellismetabolic.com is a product home, not a separate company.

BariAccess is not your treating provider and is not a health plan. The named clinic provides clinical care when you are an admitted patient of that clinic.

Registered office

BariAccess, LLC
39 State 12, Suite 2
Flemington, New Jersey 08822
United States

Notice and correspondence address

BariAccess, LLC
c/o V.E. Andrei MD Bariatric Associates, P.A.
200 South Orange Avenue, Suite 128
Livingston, New Jersey 07039
United States

Contact

• Product and privacy email: Valeriu@bariaccess.com
• Clinic correspondence email: v.andrei@bariatricassociates.com
• Telephone: +1-732-221-0504
• Privacy requests: https://trellismetabolic.com/privacy/choices and the emails above
• Account deletion (including after uninstall): https://trellismetabolic.com/account-deletion

If you write about privacy, put “Privacy” in the subject line.

2. What trei is, and the scope of this notice

trei is a GLP-1 wellness companion (displayed name: TREI-Confidence Between Doses). It does not diagnose, treat, cure, or prevent any medical condition. It does not change medication, dose, titration, or injection timing. It is not a medical device.

This notice covers:

• trellismetabolic.com (product home, activation, and website checkout);
• the trei iOS and Android applications;
• related membership, identity, notification, and clinic-admission systems operated by BariAccess.

It does not cover the named clinic’s independent medical record, website, or billing systems except where those systems send information to trei or receive it from trei. It does not cover device makers’ or sign-in providers’ own apps and sites.

Payment, when due, occurs on trellismetabolic.com. Membership state is recorded by BariAccess systems on Microsoft Azure. There is no in-app purchase.

The service is offered for use in the United States. See §19.

3. Identity and accounts

You may sign in with Apple, Google, or email through Microsoft Entra External ID. You do not need a Microsoft account.

Name and telephone used during activation help locate a candidate. They are not authentication credentials. Staff of the named clinic control clinical admission.

Downloading the app does not by itself create a clinical account. Clinic features unlock after staff admission.

4. Information we collect

We collect only what is needed to operate trei for the purposes in §6. A given category applies only if you use the related feature (for example, a wearable, voice, a photo upload, or website checkout).

4.1 Information you provide

4.2 Information from the named clinic (after admission)

The named clinic may provide identifiers and membership or program facts needed to match you to a candidate, admit you, and operate the admitted clinical experience. That information may be protected health information. See §16.

4.3 Optional wearable and health-platform data

If you connect a device or health platform in the trei app after clinic admission, we receive wellness and health-related observations through Spike Technologies Inc. and, on the phone, through Apple Health (HealthKit) or Health Connect. See §9.

Types we collect when the source supplies them: sleep duration, stages, timing, latency, efficiency, awake time, and interruptions; steps, active duration, intensity, distance, and energy; resting heart rate, heart-rate variability, respiratory rate, and SpO2; weight, BMI, and body fat; and, if you connect Freestyle Libre, glucose readings the device already records.

We request read access only. We do not request location or GPS. We do not write back to Apple Health or Health Connect.

4.4 Information collected automatically

We do not collect precise location. We do not read your SMS inbox, contacts, calendar, or photos except a photo you explicitly choose to upload.

4.5 Information we do not collect for advertising

We do not collect advertising identifiers (including IDFA) for tracking. We do not use session replay. We do not use health or wearable data for marketing.

5. How we collect information

We collect information:

• From you, when you sign in, activate, check out, use the app, message the practice, use the assistant, upload a lab report or meal photo, or contact us;
• Automatically, when you use the app or website (technical and operational data in §4.4);
• From Apple or Google, if you use those sign-in options;
• From the named clinic, after staff admission;
• From Spike Technologies Inc. and from Apple Health / Health Connect / Samsung Health, if you connect a source;
• From Stripe, Inc., limited payment-state confirmations (success, failure, membership-relevant status) — not clinical information.

6. How we use information

We use personal information to:

• authenticate you and maintain your account;
• locate a candidate at activation;
• process membership payment through Stripe on trellismetabolic.com;
• record membership state on BariAccess systems on Azure;
• deliver practice messages and, if you allow, push notifications;
• operate assigned wellness programs, check-ins, and education;
• compute BariAccess composites from optional wearable data (Spike is the courier; BariAccess formulas remain the judge);
• provide the in-app assistant, meal-photo analysis, and lab-report features;
• share accurate numbers with the named clinic when you are admitted;
• secure the service, prevent fraud and abuse, and debug failures;
• comply with law, including HIPAA where it applies;
• respond to access, correction, export, and deletion requests.

We do not use personal information, PHI, HealthKit data, Health Connect data, or wearable data for advertising, cross-context behavioral advertising, data brokering, employment eligibility, or insurance eligibility.

Ordinary product use does not authorize research or publication. See §15.

Oura. We will not train AI models on Oura data. Oura data is used only for authorized purposes: operating trei’s optional wearable composites and related wellness-companion display for you and, after admission, the named clinic.

Google Health / Health Connect. We request only read access for the sleep, activity, recovery-vital, and body-measure types needed to show your own baseline. We do not request location or GPS, do not write back, and do not use this data for ads.

7. How we share information

We disclose personal information only as follows.

7.1 Processors (service providers)

Listing a vendor does not transfer responsibility for trei away from BariAccess, LLC. A vendor that handles PHI does so under a business associate agreement or another HIPAA-compliant arrangement where HIPAA requires one. BariAccess, LLC and Spike Technologies Inc. have an executed HIPAA BAA, effective 17 August 2026, for Spike’s processing on behalf of BariAccess.

7.2 Other disclosures

We may disclose information:

• if you direct us to (for example, connecting a wearable);
• to professional advisers under confidentiality;
• to a successor in a merger, acquisition, or asset transfer, subject to this notice and HIPAA where they apply;
• when law, legal process, or a government request requires it, or to protect rights, safety, or the security of the service.

We do not sell personal information. We do not share it for cross-context behavioral advertising. See §17.

8. Website cookies and similar technologies

trellismetabolic.com uses cookies or similar technologies that are needed to run the site, keep a checkout or sign-in session, and protect against fraud. Stripe may set cookies as part of payment.

We do not use advertising cookies, third-party advertising pixels, or cross-site tracking for ads. We do not honor a “Do Not Sell or Share” control as an active opt-out because we do not sell or share as the CCPA defines those terms. If that changes, we will provide the required notice and honor Global Privacy Control (GPC) signals as Cal. Civ. Code § 1798.135 requires.

You can control cookies in your browser. Blocking essential cookies may prevent checkout or sign-in.

9. Wearables, Spike, HealthKit, and Health Connect

Connecting a device is optional. Connection happens in the trei app after clinic admission, not on trellismetabolic.com.

Spike is the courier; BariAccess formulas remain the judge. trei describes composites in ordinary words. It does not present vendor wellness scores as trei conclusions.

Connected sources

We do not send name, email, or medical-record numbers to Spike.

Wearable, HealthKit, and Health Connect data are not used for advertising, sale, or tracking.

Apple HealthKit. If you grant access, trei reads (does not write) sleep, heart, activity, and body measurements so you can see them against your own baseline. Your clinic program still works if you decline. HealthKit data is not stored in iCloud as BariAccess’s system of record; the system of record is BariAccess systems on Microsoft Azure (PostgreSQL and private blob storage). HealthKit data is not used for advertising or other use-based data mining.

Health Connect. If you grant access, trei reads only the types it uses: sleep; activity (steps, distance, exercise, energy); body composition (weight, height, body fat where available); and vitals (heart rate, resting heart rate, HRV, and related recovery measures where available). We do not use reproductive/cycle types. Connecting Health Connect is optional.

Revoking access. Disconnect the source in trei, and/or revoke trei in Apple Health, Health Connect, or the device maker’s account settings. We then stop new collection from that source. Already-received data is retained or deleted as §20 and HIPAA require.

Your device maker’s privacy policy also applies to data in that maker’s cloud.

10. In-app assistant, voice, photos, and lab reports

• Assistant. Text you send, and voice audio if you allow the microphone, are processed to reply. Replies are not medical advice. Voice is used to provide the conversation, not for advertising.
• Meal photos and lab reports. Files you choose to upload are processed for nutrition analysis or lab-report display. They are not used to diagnose, treat, or change medication.

You can deny microphone or camera permission. Features that need the permission will not run; the rest of trei continues.

11. Practice messages and notifications

Practice messages and push notifications are not emergency services, are not guaranteed timely, and follow the named clinic’s approved escalation procedure.

For emergencies, call 911.

Push-notification tokens are used only to deliver notifications you allowed. You can disable notifications in device settings.

12. Advertising, tracking, sale, and AI training

• No ads in trei.
• No tracking as Apple defines tracking (linking this app’s data to third-party data for advertising, or sharing with a data broker).
• No sale of personal information; no sharing for cross-context behavioral advertising.
• Wearable and health data are not used for advertising or marketing.
• We will not train AI models on Oura data.
• We do not train general-purpose foundation models on your PHI or wearable data.
• We do not use session replay or broad third-party behavioral analytics.

13. Minors

trei and trellismetabolic.com are not directed to children under 13. We do not knowingly collect personal information from a child under 13. That is the Children’s Online Privacy Protection Act, 15 U.S.C. §§ 6501–6506, and the FTC’s COPPA Rule, 16 C.F.R. Part 312.

This site does not offer a self-serve under-18 clinical signup. A person under 18 cannot create a clinical trei membership by completing a form on this website.

Clinical admission of a person under 18 requires guardian authority through the named clinic, not through self-serve website signup. Staff of the named clinic must complete that admission. The guardian (parent or legal guardian) must have authority to consent to the minor’s clinical participation.

If we learn that we collected personal information from a child under 13 without required parental consent, we will delete that information and close any related account, except where a short retention is required by law or to complete deletion.

If you believe a child under 13 has submitted information, or that a person under 18 obtained a clinical signup without guardian authority, contact us using §1.

We do not have actual knowledge that we sell or share the personal information of consumers under 16.

14. Your choices

We will verify requests as law requires. We may need information to match you to an account. An authorized agent may submit a CCPA request with proof of authority.

Deletion: when we delete an account, we remove or de-identify personal information except where a legal hold, HIPAA retention, tax, or payment-record duty requires a longer period. The named clinic may still hold PHI in its designated record set under its own retention rules.

15. Research

Ordinary product use does not authorize research or publication.

Quality improvement and operations are not a blanket research authorization. If BariAccess or the named clinic later wants to compare formulas, study longitudinal hypotheses, or publish results, that work requires a defined protocol, legal / privacy / clinical review, IRB review or a documented determination where applicable, and a separate optional authorization when required. Using trei does not grant that authorization.

16. HIPAA

16.1 Who is the covered entity

V.E. Andrei MD Bariatric Associates, P.A. is a health care provider. When it transmits health information in electronic form in connection with a HIPAA standard transaction, it is a covered entity under the Health Insurance Portability and Accountability Act of 1996, as amended, and the HIPAA Rules at 45 C.F.R. Parts 160 and 164.

BariAccess, LLC operates trei. BariAccess is not a health plan and is not a health care clearinghouse. BariAccess is not your treating provider. trei does not diagnose, treat, or change medication.

16.2 When information is PHI

Information is protected health information (PHI) when it is individually identifiable health information created, received, maintained, or transmitted by a covered entity or its business associate in relation to health care, payment for health care, or health care operations, as defined in 45 C.F.R. § 160.103.

After clinic admission, some information handled in trei in connection with the named clinic may be PHI. That can include identifiers used to match you to a candidate, membership state used for care coordination, practice messages, assistant or upload content used in the admitted experience, and wearable or other health-related data used in the admitted clinical experience.

Website checkout is built so that Stripe receives email and payment information only. We do not send height, weight, drug, diagnosis, or medical-record numbers to Stripe.

16.3 Business associate role

When BariAccess creates, receives, maintains, or transmits PHI on behalf of the named clinic, BariAccess acts as a business associate of that clinic under 45 C.F.R. § 160.103. In that role BariAccess may use and disclose PHI only as permitted by HIPAA, the applicable business associate agreement, and this notice.

Listing a vendor in §7 does not make that vendor a covered entity. A vendor that handles PHI for BariAccess or the clinic does so only under a business associate agreement or another HIPAA-compliant arrangement, where HIPAA requires one.

16.4 Permitted uses and disclosures of PHI

For PHI, HIPAA permits use and disclosure for treatment, payment, and health care operations, 45 C.F.R. § 164.506, and other uses and disclosures that HIPAA allows or requires, including those that need your authorization, 45 C.F.R. § 164.508, and those that you may agree to or object to, 45 C.F.R. § 164.510.

We apply the minimum necessary standard, 45 C.F.R. § 164.502(b), where it applies.

We do not use PHI or wearable data for advertising. Ordinary product use does not authorize research or publication. Research use of PHI, if ever sought, requires an authorization or another HIPAA pathway, such as 45 C.F.R. § 164.512(i), and is not granted by using trei.

16.5 Your HIPAA rights (PHI)

For PHI, you have the rights described in the HIPAA Privacy Rule, including:

• Access. To inspect or obtain a copy of PHI in a designated record set, 45 C.F.R. § 164.524.
• Amendment. To request amendment of PHI in a designated record set, 45 C.F.R. § 164.526.
• Accounting of disclosures. To receive an accounting of certain disclosures, 45 C.F.R. § 164.528.
• Restriction. To request a restriction on uses or disclosures, 45 C.F.R. § 164.522(a).
• Confidential communications. To request confidential communications, 45 C.F.R. § 164.522(b).
• Notice. To receive a Notice of Privacy Practices from the covered entity, 45 C.F.R. § 164.520.
• Complaint. To complain to the clinic or to the U.S. Department of Health and Human Services, Office for Civil Rights, 45 C.F.R. § 160.306. See https://www.hhs.gov/hipaa/filing-a-complaint.

You may start an access, correction, export, or deletion request for trei at https://trellismetabolic.com/privacy/choices. Account deletion is also available at https://trellismetabolic.com/account-deletion if the app is uninstalled. Requests that concern the clinic’s designated record set may be routed to the named clinic so that the covered entity can respond as HIPAA requires.

This Privacy Policy is not the clinic’s Notice of Privacy Practices. Ask the named clinic for that notice.

16.6 Breach notification

If unsecured PHI is breached, notification follows the HIPAA Breach Notification Rule, 45 C.F.R. §§ 164.400–164.414, and, where they apply, HITECH and state law.

17. California (CCPA / CPRA)

This §17 applies to California residents and to personal information subject to the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, Cal. Civ. Code §§ 1798.100–1798.199.100 (the “CCPA”). It is also the notice at collection required by Cal. Civ. Code § 1798.100(a).

“Personal information,” “sell,” “share,” “sensitive personal information,” and “business purpose” have the meanings in Cal. Civ. Code § 1798.140.

HIPAA-covered PHI processed in our business-associate role is not subject to the CCPA to the extent Cal. Civ. Code § 1798.145(c)(1)(A) excludes it. Other information — for example website checkout identifiers that are not PHI — may still be CCPA personal information.

17.1 Categories collected, sources, and purposes

In the prior 12 months we have collected, or we collect in connection with trei and trellismetabolic.com, these CCPA categories:

We do not collect precise geolocation, biometric templates for identification, or education records.

17.2 Sensitive personal information

The following may be sensitive personal information under Cal. Civ. Code § 1798.140(ae): account log-in with a credential; health information; biometric-adjacent wearable data after optional device connection; glucose readings if you connect Freestyle Libre.

We use sensitive personal information only to provide trei, resist security incidents, and comply with law — the purposes in Cal. Civ. Code § 1798.121(a). We do not use or disclose it to infer characteristics for advertising. You may request that we limit use and disclosure of sensitive personal information to those permitted purposes at https://trellismetabolic.com/privacy/choices. Because we already so limit it, we may fulfill that request by confirming the limitation.

17.3 Disclosures in the prior 12 months

We disclose personal information to the processors in §7.1 for the business purposes in §6 and §17.1. We do not disclose it for cross-context behavioral advertising.

We have not sold or shared personal information as defined in the CCPA.

17.4 We do not sell or share

We do not sell personal information as defined in Cal. Civ. Code § 1798.140(ad).

We do not share personal information for cross-context behavioral advertising as defined in Cal. Civ. Code § 1798.140(ah).

Wearable data is not used for advertising.

Because we do not sell or share, we do not offer a “Do Not Sell or Share My Personal Information” opt-out as an active choice. If that ever changes, we will provide the notice and opt-out required by Cal. Civ. Code §§ 1798.120 and 1798.135, including the honor of GPC signals.

We do not have actual knowledge that we sell or share the personal information of consumers under 16. This site does not offer a self-serve under-18 clinical signup. See §13.

We do not offer financial incentives for personal information (Cal. Civ. Code § 1798.125).

17.5 Your CCPA rights

Subject to CCPA exceptions, California residents may:

• Know and access the personal information we collect, use, disclose, sell, or share, Cal. Civ. Code §§ 1798.110, 1798.115.
• Correct inaccurate personal information, Cal. Civ. Code § 1798.106.
• Delete personal information, Cal. Civ. Code § 1798.105.
• Opt out of sale or sharing, Cal. Civ. Code § 1798.120 (not applicable while we do not sell or share).
• Limit use and disclosure of sensitive personal information, Cal. Civ. Code § 1798.121.
• Non-discrimination for exercising CCPA rights, Cal. Civ. Code § 1798.125.

Submit requests at https://trellismetabolic.com/privacy/choices, or by email to Valeriu@bariaccess.com or by mail to the notice address in §1. Account deletion is also available at https://trellismetabolic.com/account-deletion if the app is uninstalled.

We will verify the request as Cal. Civ. Code § 1798.140(ak) and the CCPA regulations require. An authorized agent may submit a request as Cal. Civ. Code § 1798.185 and the regulations allow, with proof of authority.

We will respond within 45 days, or as extended once by 45 days with notice, Cal. Civ. Code § 1798.130(a)(2).

You may also request, once per year, the information described in California’s Shine the Light law, Cal. Civ. Code § 1798.83, by writing to the address in §1 with “Shine the Light” in the request. We do not disclose personal information to third parties for their direct marketing.

18. Other U.S. state privacy rights

If you are a resident of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, or Montana, you may have rights under that state’s consumer privacy law to access, correct, delete, obtain a copy, and opt out of targeted advertising, sale, or certain profiling.

We do not engage in targeted advertising, sale, or profiling that produces legal or similarly significant effects as those statutes describe. Submit requests at https://trellismetabolic.com/privacy/choices. We will handle them as the applicable statute requires. HIPAA-covered PHI remains governed by HIPAA where the state law yields to it.

19. International visitors and GDPR

trei and trellismetabolic.com are directed to users in the United States. We do not offer the service to the EU, EEA, or United Kingdom as a targeted offering, and we do not maintain an EU representative under GDPR Article 27.

If you access the service from outside the United States, you understand that information is processed in the United States. Do not use trei if you need a GDPR-controller relationship that this notice does not establish. If that offering changes, we will update this notice and, where required, execute appropriate transfer terms.

Spike’s own processor audits and the BariAccess–Spike BAA are vendor records. They do not make BariAccess a GDPR controller for EU residents unless and until we offer the service there.

20. Retention and security

We keep information only as long as needed to operate trei, meet the clinic’s records duties, resolve disputes, and comply with law.

When we delete an account, we remove or de-identify personal information except where a legal hold, HIPAA retention, tax, or payment-record duty requires a longer period. The named clinic’s designated record set follows the clinic’s retention schedule.

System of record. Membership and clinical-experience data are recorded on BariAccess systems on Microsoft Azure in the United States, using PostgreSQL and private blob storage — not iCloud, not consumer cloud-drive as the source of record.

We use administrative, technical, and physical safeguards appropriate to the nature of the information, including HIPAA Security Rule safeguards in 45 C.F.R. Part 164, Subpart C, where that Rule applies. Transmission uses TLS. No safeguard is perfect.

21. Data location

BariAccess systems that operate trei run on Microsoft Azure in the United States. Spike Technologies Inc. processes wearable courier data, lab-report files, and meal-photo content as its contract and BAA provide. Stripe, Inc. processes payment in accordance with Stripe’s terms. Apple and Google process sign-in and, if you connect them, health-platform data under their terms.

22. Governing law for this notice

Interpretation of this Privacy Policy, and disputes about it that are not controlled by HIPAA, the CCPA, or another mandatory privacy statute, follow the same governing-law, venue, and arbitration terms as the Terms of Service at https://trellismetabolic.com/terms (New Jersey law; individual arbitration; Essex County, New Jersey). Those terms do not limit a right that HIPAA, the CCPA, COPPA, or another privacy statute gives you and does not allow to be waived.

23. Changes

We may update this notice by posting the revised notice at https://trellismetabolic.com/privacy and updating the effective date at the top of this page. The published version at that URL controls. Material HIPAA changes that require a revised Notice of Privacy Practices will be handled by the named clinic as 45 C.F.R. § 164.520 requires.

*© 2026 BariAccess, LLC. Effective 24 August 2026.*