Effective date: 3 November 2026

Updated 3 November 2026: this version adds my Instagram account, the services that handle it and the AI assistant I use.

 

This page explains how Sturdy Shelf handles "consumer health data", as Washington's My Health My Data Act defines it: information linked to you that could show something about your physical or mental health. Sturdy Shelf is run by one person, Ahmed Sameer Bahlawan (shown as Ahmad Bahlawan on Gumroad), based in Saudi Arabia.

This site does not ask for health information. No form on it asks about your health, weight, medication or age. But because Sturdy Shelf sells a guide for people taking a GLP-1 medication, some ordinary information could be read as health information. This page lists that information and what happens to it.

 

1. WHAT I MAY COLLECT, AND WHY

a) Purchase details. If you buy or download a guide from Sturdy Shelf (including the free sample), Gumroad (the checkout service) passes me order details, such as your email address, what you bought and when. Buying the guide could suggest that you, or someone close to you, uses a prescribed GLP-1 medication.

Why: to deliver your purchase, handle refunds and questions about your order, and keep the business records the law requires.

b) Anything you choose to tell me. My email address is for questions about a guide or an order. I ask you not to include medical details. If you include them anyway, I receive them.

Why: only to read and answer your message. I delete the message from my inbox within 30 days of my last reply. If it passed through Composio, its copy stays for up to one year.

c) Visit information. When you visit, Wix (the service that hosts this site) can record your IP address, browser and device type, the pages you view (for example, the Eat Enough page) and when. Some of this goes to Wix on every visit, through its essential cookies and its platform monitoring and error reporting, which keep the site working and secure. Visit statistics are collected only if you accept analytics cookies in the cookie banner. The cookie banner, run by Usercentrics, records your choice (a consent ID, the time and whether you accepted or declined) and keeps it for 12 months.

Why: to keep the site working and secure and, if you agree, to see in general terms how many people visit which pages. I don't use visit information to work out anything about anyone's health.

 

d) Instagram comments and messages. If you comment or message @sturdy.shelf on Instagram, I receive your handle, your name if your profile shows one, and what you write. Asking for the free menu could suggest that you, or someone close to you, uses a GLP-1 medication. Comments are public, and they stay on the post until you or I delete them. I ask you not to include medical details. If you include them anyway, I receive them. Manychat sends the first automated messages. My AI assistant, Claude (Anthropic), connected through Composio, reads new comments and messages, writes me a daily summary and sends replies I approve. My daily summary lists only your handle and a link while a reply is waiting.

Why: only to send what you asked for and to answer you. I don't delete Instagram messages on a schedule. They stay in my Instagram inbox and Manychat until you ask me to delete them, or until I close the account. If you ask, I'll delete them within 30 days. That doesn't remove the copy in your account or what Instagram and Anthropic keep under their own policies, and Composio keeps what passes through it for up to one year.

I don't use any of this to draw conclusions about your health, I don't use it for advertising, and I don't use it for any purpose not listed here. If that ever changes, I'll ask for your consent first.

 

2. WHERE IT COMES FROM

- From you, by email or through your purchase on Gumroad.

- From you, through comments and messages on Instagram, received through Instagram and Manychat.

- From your browser or device, through cookies and similar tools placed by Wix, and through the cookie banner, run by Usercentrics, which records your cookie choice.

 

3. WHAT IS SHARED, AND WITH WHOM

I don't sell consumer health data. The service providers below handle it for me. Instagram (Meta) and Anthropic use what they receive under their own privacy policies, as described below. I don't share it with anyone else.

The information in section 1 is handled for me by these kinds of service providers, only to run the site, the checkout, my email and my Instagram account:

- website hosting (Wix.com Ltd.), including its platform monitoring and error reporting, for visit information;

- the cookie banner (Usercentrics GmbH), for your cookie choice;

- online checkout and file delivery (Gumroad, Inc.), for purchase details;

- automated Instagram messages (Manychat, Inc.), for comments and messages;

- the connection for my AI assistant (Composio, Sampark Inc), for Instagram comments and replies, and the emails in my inbox that it reads;

- email (my email provider, Google (Gmail)), for messages and replies.

I don't have any affiliates. I would disclose information to a government authority only if the law required it.

Instagram (Meta) and Anthropic, which makes my AI assistant, handle what they receive under their own privacy policies. I've turned off the setting that lets Anthropic train its models on my chats. Anthropic's policy lists exceptions, such as chats flagged for safety review.

 

4. CONSENT

I collect purchase details, messages and Instagram comments only as needed to give you what you asked for: your guide, your free menu, your refund or my reply. Visit statistics are collected only with your consent through the cookie banner. You can withdraw that consent at any time with the cookie settings button on this site.

 

5. YOUR RIGHTS AND HOW TO USE THEM

You can ask me to:

- confirm whether I hold or share consumer health data about you, and give you a copy, with a list of every service provider it went to and a way to contact them;

- delete it. I'll delete it from my records, including my email, my Instagram inbox, Manychat and any copies or backups I keep, and tell the services in section 3 about your request;

- stop collecting and sharing it, by withdrawing your consent.

How: email abahlawan@gmail.com with the subject "Health data request". You don't need an account. If you bought a guide, write from the email address you used at checkout so I can confirm the request is yours; if you wrote on Instagram, include your handle; if I can't confirm it, I may ask for a little more information.

This is free. I'll act on your request within 30 days. If a request is unusually complex I may need up to 45 more days; if so, I'll tell you why within the first 30 days. Using these rights won't change how I deal with you.

If I say no: you can appeal by replying to my answer with the word "Appeal". I'll reply in writing within 45 days, explaining what I did or didn't do and why. If I still say no, you can complain to the Washington State Attorney General: https://www.atg.wa.gov/file-complaint