Kohler can "de-identify [the user’s] data for lawful purposes." I mean exactly how would that ever be justified? "Hey, we see a man-sized log in the bowl. There's only supposed to be women there. The perp must be in that house!!!"

That is very strangely worded, to a degree they I wonder if maybe the wordsmithing was outsourced to either an ai or someone who didn't do English very well. Or if it's meant to be confusing.

But the linked privacy policy talks about making anonymous (aka de-identified) bulk data sets and using them for "lawful business purposes" (aka anything they want that's not illegal).

IP address, device identifier, mother's maiden name, SSN, etc etc