Is my health data private?

Yes. ThinShot is fully private and secure. Your data is never sold or shared with third parties.

Which medications does ThinShot support?

Ozempic, Wegovy, Mounjaro, Saxenda, Zepbound, and any custom GLP-1 medication.

Does it work on iPhone?

Yes — download free on the App Store. Also available as a web app on any browser — no download needed.

Can I cancel Pro anytime?

Yes. Cancel anytime with one click, no questions asked.

How is ThinShot different from MyFitnessPal or a spreadsheet?

ThinShot is built specifically for GLP-1 users. It tracks your shot day patterns, nausea cycles, dose history, and protein goals in one place — things no general app understands.

Can I share my data with my doctor?

Yes. Pro users can generate a PDF Doctor Report summarizing injections, side effects, weight progress, and medication levels — ready for any appointment.

What happens to my data if I cancel?

Your data is yours. Export everything from Settings at any time. If you cancel Pro your account stays on the free plan and your history is fully preserved.

Does it work if I switch medications?

Yes. You can log different medications at different times and your full history stays intact.

⚠️ PRE-LAUNCH — CONFIDENTIAL

ThinShot Legal Compliance Audit

Audit Date: May 17, 2026 · Auditor: Base44 Auto-Audit · Status: PRE-LAUNCH

⚠️ Have a licensed health tech attorney review findings before public launch.

Compliance Scorecard

Category	Checked	🟢 Compliant	🟡 Partial	🔴 Non-Compliant
Legal Pages	20	14	6	0
Consent & Gates	16	4	4	8
In-App Disclaimers	14	8	4	2
Data Rights	12	5	5	2
Signup Flow	14	6	4	4
Payment Compliance	14	8	4	2
Accessibility	16	4	10	2
Content Claims	10	6	4	0
Email Compliance	10	2	4	4
Security	8	4	4	0
Infrastructure	8	4	4	0
TOTAL	142	65	53	24

🔴 Non-Compliant Items (10 found)

Must fix before any public users.

NC-01Consent & Gates — 2B

ToS/Privacy Policy acceptance checkboxes at signup

Issue: The Onboarding flow (step 0) did NOT have consent checkboxes before this audit. Users were being onboarded without documented ToS acceptance.

Fix: ✅ FIXED — Added two unchecked-by-default consent checkboxes to Onboarding step 0. "Let's Get Started" button is disabled until both are checked.

Effort: Complete

NC-02Consent & Gates — 2C

Health data consent acknowledgment during onboarding

Issue: No dedicated health data consent step existed before collecting medication, weight, and injection data.

Fix: ✅ FIXED — Added a health data consent checkbox in Onboarding step 0 that explicitly states ThinShot is a tracking tool only, not medical advice.

Effort: Complete

NC-03Consent & Gates — 2A

Age verification gate (18+)

Issue: No age gate exists. A 16-year-old can create an account and have health data collected. COPPA violation risk.

Fix: ⚠️ PARTIAL FIX — The consent checkbox says "I am 18 or older" but there is no enforced date-of-birth check or hard block. A user can lie. Recommend adding a date-of-birth field with a calculated age check that hard-blocks creation if under 18.

Effort: Remaining: Add DOB input to onboarding with hard block if age < 18

NC-04Consent & Gates — 2D

Sage AI one-time disclaimer modal on first use

Issue: Sage opens immediately without any "first use" disclaimer modal. Users can interact with the AI health coach before ever seeing an explicit disclaimer.

Fix: ⚠️ NOT YET FIXED — Sage has a permanent footer disclaimer (compliant) but no first-use modal. Recommend storing sage_disclaimer_acknowledged in localStorage and showing a blocking modal on first open.

Effort: Remaining: ~2 hours — add first-use modal to SageChat component

NC-05Email Compliance — 9A

CAN-SPAM: Physical mailing address in reminder emails

Issue: The sendInjectionReminder function sends emails without a physical mailing address of J.T. Estates LLC in the footer. CAN-SPAM requires this on all commercial/transactional emails.

Fix: ⚠️ NOT YET FIXED — Update the sendInjectionReminder, shotDayPrepEmail, and muscleAlertEmail backend functions to include "J.T. Estates LLC, New York, USA" and an unsubscribe link in the email footer.

Effort: Remaining: ~1 hour — update 3 email backend functions

NC-06Email Compliance — 9B

Marketing email opt-in field

Issue: No marketing_email_opt_in field exists on UserSettings. If any product update or marketing emails are sent, this is a CAN-SPAM/GDPR violation.

Fix: ⚠️ NOT YET FIXED — Add marketing_email_opt_in (boolean, default false) to UserSettings entity. Show opt-in option in Settings.

Effort: Remaining: ~1 hour — entity update + Settings UI

NC-07Data Rights — 4A

Download My Data — incomplete export

Issue: The current export only includes medications, side effects, weights, and settings. Missing: NutritionLog, JournalEntry, PhotoLog, UserAchievements, UserPoints, BodyLog, NutritionGoals.

Fix: ⚠️ PARTIAL FIX — Filename is now date-stamped (thinshot-export-YYYY-MM-DD.json). Need to add all missing entities to the export.

Effort: Remaining: ~30 min — add missing entities to handleExport in Settings

NC-08Data Rights — 4B

Delete My Account — email-only flow (no in-app deletion)

Issue: The Delete My Account flow redirects to an email mailto: link. CCPA requires timely, self-service deletion capability. Email-only is not sufficient for a digital product.

Fix: ⚠️ NOT YET FIXED — Build a proper in-app deletion flow that deletes all user entities, cancels Stripe subscription, and logs the user out. The email fallback can remain as a secondary option.

Effort: Remaining: ~3 hours — backend function + UI confirmation flow

NC-09Consent & Gates — 2E

Policy update notification system

Issue: No tos_version field stored per user. No mechanism to show users when Terms or Privacy Policy change and require re-acceptance.

Fix: ⚠️ NOT YET FIXED — Add tos_version and tos_accepted_at to UserSettings. On login, check current app version against stored version. If mismatch, show non-dismissable re-acceptance modal.

Effort: Remaining: ~2 hours — entity field + login-time check + modal

NC-10Payment Compliance — 6A

Pre-checkout disclosures

Issue: The /upgrade page shows pricing but: (1) the Terms/Privacy links are not visible before clicking the upgrade button, (2) no explicit "next billing date" shown, (3) the Terms billing section previously showed "$7.99/month" (incorrect — was fixed to $4.99/$29.99).

Fix: ✅ PARTIAL FIX — Terms billing amount corrected to $4.99/mo or $29.99/yr. Remaining: Add ToS + Privacy Policy links and "cancel anytime" note directly under the Upgrade button on /upgrade page.

Effort: Remaining: ~20 min — add legal links to Upgrade page

🟡 Partial Compliance Items (10 found)

Fix within 30 days of launch.

P-01Legal Pages — 1C

Cookie Policy

Cookie Policy page exists at /cookie-policy and is linked from all footers. However, opt-out mechanism for non-essential cookies is not present (though only essential cookies are stated to be used).

P-02Legal Pages — 1D

Accessibility Statement

Accessibility page exists and is linked. However, it has no specific contact email for accessibility issues or stated response time.

P-03In-App Disclaimers — 3D

Blog article disclaimers

✅ FIXED — All blog articles now show a medical disclaimer banner at the top. However, "Last reviewed" date per article is not implemented — it would need to be a BlogPost entity field.

P-04In-App Disclaimers — 3E

Progress Photos privacy notice

No privacy notice on the /photos page explaining photos are private, not shared, and how to delete them.

P-05In-App Disclaimers — 3G

Referral program terms notice

✅ FIXED — Referral terms notice now appears below the copy-link button in Settings.

P-06Accessibility — 7B

ARIA labels on interactive components

Hydration drops, momentum rings, quick log arrows, and modal dialogs lack proper aria-labels, aria-labelledby, and role="dialog" attributes.

P-07Accessibility — 7C

Keyboard navigation

Custom buttons (dose calculator tap counter, toggle switches) may not be keyboard accessible. Focus indicators are browser-default and may not meet the 2px minimum.

P-08Security — 10C

Auth security details

Session management and brute force protection are handled by Base44 platform infrastructure — compliance depends on Base44's security posture, which should be verified.

P-09Infrastructure — 11B

Privacy/Terms accessible without login

/privacy and /terms are public routes. /cookie-policy and /accessibility are now also public routes. All confirmed accessible without authentication.

P-10Email Compliance — 9C

Subscription confirmation email

Stripe sends a default receipt. A custom branded ThinShot confirmation email with cancellation instructions is not implemented.

🟢 Compliant Items (14 found)

✓1A — Privacy Policy: All 13 required sections present, last-updated date prominent, contact info included
✓1B — Terms of Service: All 16 sections present including prominent health disclaimer box, governing law (NY), referral terms
✓1E — Legal page visual standards: 14px+ text, clear headings, links functional, pages are public
✓3A — Footer disclaimer on all in-app pages via LegalFooter component (includes Privacy + Terms links + © J.T. Estates LLC)
✓3B — Sage chat: permanent amber disclaimer strip always visible above input bar
✓3C — Dose Calculator: amber warning card above the calculator, cannot be dismissed
✓3F — Doctor Report disclaimer: amber notice added above Generate button in Settings
✓6B — Subscription management: Cancel subscription flow with confirmation dialog, "Pro access until [date]" messaging
✓6C — Cancellation flow: Clear dialog, access preserved until period end, toast confirmation
✓8A — In-app health claims: No "clinically proven" language found; copy uses general framing
✓8C — Achievement copy: No medically efficacious claims in achievement text
✓10A — HTTPS: App runs over HTTPS (Base44 infrastructure enforced)
✓10B — User data isolation: Base44 RLS enabled on all health entities
✓11A — Legal contact: hello@thinshot.app and privacy@thinshot.app both listed in policies

⚡ Launch Blocker Summary

❌ NO — ThinShot cannot legally launch publicly today. The following blockers must be resolved first:

NC-01 ✅ Fixed — ToS consent checkboxes now in onboarding

NC-02 ✅ Fixed — Health data consent checkbox now in onboarding

NC-03 ⚠️ Remaining — Age hard-gate (DOB field + block if under 18)

NC-04 ⚠️ Remaining — Sage first-use disclaimer modal

NC-05 ⚠️ Remaining — Physical address + unsubscribe link in all emails

NC-06 ⚠️ Remaining — marketing_email_opt_in field (default false)

NC-07 ⚠️ Remaining — Complete data export (add missing entities)

NC-08 ⚠️ Remaining — In-app account deletion (not email-only)

NC-09 ⚠️ Remaining — ToS version tracking + re-acceptance modal

NC-10 ⚠️ Remaining — Legal links on /upgrade pre-checkout page

📋 Recommended Next Steps

1.Implement DOB age gate in Onboarding (block if under 18)

2.Add Sage first-use disclaimer modal (store in localStorage)

3.Update all 3 email backend functions with CAN-SPAM footer (address + unsubscribe)

4.Add marketing_email_opt_in to UserSettings entity + Settings UI

5.Expand handleExport to include all entity types

6.Build proper in-app account deletion backend function

7.Add tos_version to UserSettings + re-acceptance modal on login

8.Add legal links (Terms / Privacy) under Upgrade button on /upgrade page

9.Schedule attorney review of Privacy Policy and Terms of Service language

10.Set 30-day deadline for all 🟡 Partial items

11.Re-run this audit after all fixes applied

12.Run audit again quarterly or after any major feature addition

⚠️ Attorney Review Required

Regardless of technical compliance, these items need licensed legal review before launch:
• Final Privacy Policy language (especially HIPAA adjacency statement)
• Final Terms of Service language (limitation of liability clause)
• HIPAA applicability determination (are you a business associate of any covered entities?)
• State-specific health data law compliance (NY SHIELD Act, CMIA for CA users, TX THIPA)
• FTC enforcement risk for AI health guidance without clinical validation
• App Store submission review (17+ age rating, health data labels)

ThinShot Internal Compliance Audit · Generated May 17, 2026 · Base44 Auto-Audit System
This report is for internal use only. Not a legal opinion. Consult a licensed attorney.