Privacy Policy

1. Who We Are

Nutriva AI ("we", "us", "our") is the developer and publisher of the Nutriva AI mobile application available on the Apple App Store. We are responsible for determining how and why your personal data is processed.

If you have any questions about this Privacy Policy, you can contact us at nutrivaaiteam@gmail.com.

2. Information We Collect

2.1 Information You Provide Directly

• Account Information: Email address and display name when you register.
• Profile Data: Gender, date of birth, height, weight, activity level, dietary preferences, and health goals you enter during onboarding or at any time.
• Nutrition & Food Data: Meal descriptions, food photos, barcode scans, calorie and macro entries, water intake, and fasting logs you record.
• Body Measurements: Waist, chest, arms, hips, thighs, and neck measurements if you choose to log them.
• GLP-1 Mode: If you turn on GLP-1 mode: the medicine you choose, your dose schedule and reminder time, and your side-effect check-ins (appetite, nausea, constipation, energy). This stays on your iPhone (see Section 5).
• AI Coach Conversations: Messages you send to the AI coach (Marcus) and its replies are stored in your Nutriva account so the Coach can work, to protect the service from abuse, and so our team can check the safety and quality of its replies when needed. They are deleted when you delete your account (see Section 6).
• Feedback & Support: Any information you provide when you contact us for support.

2.2 Information Collected Automatically

• Device Information: Device model, operating system version, unique device identifiers, and app version.
• Usage Data: Which screens you open and which features you use (for example "scanned a meal" or "sent a Coach message"), app version and device type, via PostHog — see Section 8. Never your food, health values, photos or chat text. You can turn this off in Settings › Share Usage & Crash Data.
• Crash Reports: Stack traces, device model, iOS version, the screen you were on and app performance data if the app crashes, freezes or a request fails, via Sentry — see Section 8. No health or food data. You can turn this off in Settings › Share Usage & Crash Data.
• IP Address: Collected by our backend (Supabase) for security and abuse prevention purposes.
• Device identifier: If you apply a referral code, we store an identifier Apple assigns to Nutriva on your device (the identifier for vendor) with that referral, only to stop the same device from redeeming more than one referral. It is not used for advertising or tracking and is deleted with your account.

2.3 Information We Do NOT Collect

• We do not collect your precise location (GPS coordinates).
• We do not read your contacts, calendar, or messages.
• We do not show ads in the app and we do not include any advertising SDK. To see which of our own ads work, we use only Apple's privacy-preserving attribution (SKAdNetwork and Apple Search Ads attribution), which reports results to us in aggregate and never identifies you (see Section 8).
• We do not collect your advertising identifier (IDFA), we do not show Apple's tracking prompt, and we do not use your health, food, weight, GLP-1 or chat data for advertising.
• Our website (nutrivaai.com) does not use cookies, analytics or tracking scripts.
• We do not sell your personal data to third parties. Ever.

3. How We Use Your Information

We use your information for the following purposes:

We will never use your data for advertising profiling, selling to data brokers, or any purpose not listed above.

4. Third-Party Services & Data Sharing

We use the following trusted third-party services to operate the app. Each service receives only the minimum data necessary for its function:

We do not share your data with any other third parties. We may disclose your information if required by law, court order, or to protect the safety of users.

5. Health Data, Apple Health & GLP-1 Mode

Nutriva AI reads Apple Health (HealthKit) data only with your permission, and only for the data types you allow. Apple Health data is read on your device. Depending on what you allow, the app may read:

• Activity: activity rings, steps, active energy and workouts
• Sleep
• Heart rate, resting heart rate and heart rate variability (HRV)
• Blood oxygen
• Body weight and body measurements
• Dietary energy and macronutrient intake

The app uses this data to show your activity, sleep, readiness, stress and energy views and your weekly Health Review. With your permission, the app may also write nutrition data (calories, macros) and body weight back to Apple Health to keep your health records complete. You can change or withdraw these permissions at any time in the Health app or your device Settings.

AI Coach: only when you use the AI Coach and your question is about your health, Nutriva can send a short summary of the relevant numbers with your question, such as your weight trend, steps, active energy, sleep, resting heart rate, HRV or blood oxygen, so Marcus can answer (see Section 6). Apple Health data is not sent to AI providers for anything else.

This use of HealthKit data complies with Apple's HealthKit guidelines.

GLP-1 mode

GLP-1 mode is optional and off until you turn it on. If you use it, the medicine you choose, your dose schedule and reminder time, and your side-effect check-ins are sensitive health data. We use them only to show your dose-day card and reminder, your protein target and your check-in history in the app.

• Where it is stored: only on your iPhone, in the app's private storage, in a separate file for each Nutriva account. It is not synced to our servers and is excluded from iCloud and device backups, so it is not restored on a new iPhone. Dose-day reminders are scheduled on your iPhone by iOS.
• AI Coach: shared with Marcus only if you turn on "Share with Marcus" in GLP-1 mode (it is off by default). When it is on, your medicine, where you are in your dose week and your most recent check-in are sent with your questions to the AI Coach (processed by OpenAI, see Section 6). You can turn it off at any time.
• Never sold or used for advertising: GLP-1 data is never sold, never used for advertising or marketing, and never sent to PostHog, Sentry or any advertising service. Usage analytics may record that a GLP-1 mode screen or check-in was used, but never which medicine, your schedule or your check-in answers.
• Export and deletion: your check-ins are included when you export your data. Signing out keeps the file on that iPhone for when you sign back in; deleting your account deletes it.

6. AI Features

Nutriva AI uses AI models from OpenAI (GPT models) to analyze food photos, labels, menus and meal descriptions, to power the AI Coach (Marcus), and to write health insights and weekly reviews. If OpenAI is temporarily unavailable, food and meal estimates may be processed by Google (Gemini API) instead.

What is sent

• Food analysis: the photo or description you submit and your app language. We do not send your name or email.
• AI Coach: your message, the recent conversation, and the context Marcus needs to answer: your first name, goal, weight and goal weight, height, age, sex, activity level, diet preference, today's food and water totals, recent averages, recent meal names and anything you asked Marcus to remember. When your question is about your health, a short summary of relevant Apple Health numbers is included (see Section 5). If you turned on "Share with Marcus" in GLP-1 mode, your medicine, where you are in your dose week and your most recent check-in are included too (off by default). Email, phone numbers and card numbers typed into a message are removed before sending.

You choose whether to allow this: the app asks before the first AI request, and you can change it in Settings at any time. AI features are not available without that permission; everything else keeps working.

OpenAI and Google process these requests under their API terms and, by default, do not use API data to train their models. Your Coach conversations are stored in your Nutriva account so the service works and is protected from abuse, and they are deleted when you delete your account.

AI-generated responses are based on statistical models and may contain inaccuracies. Never use AI food estimates or coaching advice for medical purposes, including insulin dosing. Marcus is an AI, not a doctor or dietitian.

Reported replies and safety checks

If you report a reply from the AI Coach, the reply, the question you asked just before it, the reason you chose, your app version and language are stored with your account so our team can review them. Reports are deleted after 90 days, or earlier if you delete your account.

Before your message reaches the AI, Nutriva checks it on our server for signs of a medical emergency or self-harm. When it finds one, it shows a fixed message pointing to emergency help instead of an AI answer. These checks keep no copy of your message.

7. In-App Purchases & Subscriptions

Nutriva AI offers an auto-renewing subscription, Nutriva Pro. New accounts, created with version 2.1 of the app or later, start with Nutriva Pro (a free trial or introductory offer may apply for eligible new subscribers); accounts created before then keep their free plan. All payment transactions are processed by Apple (App Store) — we never receive or store your payment card details.

Subscription status is verified through RevenueCat, which receives your anonymised device identifier and purchase receipt from the app store to confirm your entitlements. RevenueCat does not receive your name, email, or health data.

For subscription management, cancellations, and refunds, please use your device's subscription management settings:

• iPhone: Settings → [Your Name] → Subscriptions

Refund requests are handled by Apple according to its refund policies. Deleting your Nutriva account does not cancel an App Store subscription; cancel it separately in your Apple ID settings.

8. Analytics, Crash Reporting & Ad Measurement

To find and fix bugs and to see which features are used, Nutriva AI sends crash and error reports to Sentry and usage events to PostHog. They carry your random account ID, never your name, email or phone number, and never your food, photos, Apple Health data, weights or Coach messages. Apple Health data is never used for analytics. Neither tool is used for advertising or to track you across other apps and websites.

Ad measurement (Apple only). To learn which of our ads bring new users, the app uses Apple's own privacy-preserving attribution: SKAdNetwork, where Apple tells an ad network, in aggregate and with a delay, how many installs from its ads were opened or started a subscription, and Apple Search Ads attribution (AdServices), which tells us which Apple Search Ads campaign led to an install. Neither identifies you, neither uses your advertising identifier (IDFA), and neither is tracking, so the app does not show Apple's tracking prompt. No health, food, weight, GLP-1, photo or chat data is ever part of it.

Your choice. Usage events (PostHog) are off in the EU/EEA, the UK and Switzerland until you allow them; elsewhere they are on by default. Crash reports are on until you turn them off. Turn all of this off any time in the app: Profile › Settings › Share Usage & Crash Data. Apple may also share anonymous crash reports with us if you allow it in iPhone Settings › Privacy & Security › Analytics & Improvements.

9. Camera, Microphone & Photo Library

The app requests access to these device capabilities for the following specific purposes:

• Camera: To capture photos of food for AI-powered calorie analysis, and to scan barcodes.
• Microphone: To enable voice food logging — you can describe a meal by speaking. Audio is processed on-device or sent to the AI model for transcription only; raw audio is not stored.
• Photo Library: To allow you to select an existing photo of food for AI analysis, or to set your profile picture.

These permissions are optional. The app will function without them, but some features will be unavailable. You can revoke permissions at any time in your device Settings.

10. Data Retention

You can delete your account and all your data at any time in the app: Profile → Account → Delete account (also reachable from the subscription screen's Account button), or by emailing nutrivaaiteam@gmail.com. Deleting your account removes your data from our servers, including your food, water and weight logs, your AI Coach conversations and any referral records, and deletes your GLP-1 mode data from the iPhone you delete it on. If you signed in with Apple, Nutriva is also disconnected from your Apple ID. Account deletion is permanent and irreversible. It does not cancel an App Store subscription; cancel that in your Apple ID settings.

11. Data Security

We take the security of your data seriously:

• On-device storage: Data on your device is kept in the app's private storage (the iOS app sandbox), protected by iOS, and synced to your Nutriva account.
• Data in transit: All communication between the app and our servers uses TLS 1.2+ encryption.
• Cloud storage: Account and sync data is stored in Supabase, which is hosted on infrastructure with SOC 2 Type II certification.
• Access controls: Only you can access your data. We use row-level security policies to ensure users cannot access other users' data.
• No plaintext passwords: Passwords are hashed and never stored in plaintext.

Despite our best efforts, no method of data transmission or storage is 100% secure. If you discover a security vulnerability, please report it to nutrivaaiteam@gmail.com.

If something goes wrong: if a security breach affects your data, including any unauthorised sharing of health data, we will notify you and the relevant authorities (such as the US Federal Trade Commission) as the law requires.

12. International Data Transfers

Nutriva AI is available globally. If you are located outside the United States, your data may be transferred to and processed in the United States or other countries where our service providers operate. We rely on the following safeguards for such transfers:

• Standard Contractual Clauses (SCCs) approved by the European Commission, where applicable.
• Our third-party providers (Supabase, PostHog, Sentry, OpenAI, Google) maintain their own appropriate transfer mechanisms.

13. Children's Privacy

We do not collect personal data from:

• Children under 13 (United States / worldwide default)
• Children under 16 or applicable local minimum age (EU/EEA)
• Children under 13 (United Kingdom)

If a parent/guardian believes their child provided data without consent, contact nutrivaaiteam@gmail.com immediately. We will delete the account and all data within 72 hours.

Age verification relies on self-declared date of birth at signup. The app does not accept a date of birth under 13. If you live somewhere with a higher minimum age, you may not use the app until you reach it.

14. Your Rights (General)

Regardless of where you live, you have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request that we correct inaccurate or incomplete data.
• Deletion: Request that we delete your account and personal data.
• Portability: Request your data in a structured, machine-readable format (CSV export available in-app).

To exercise any of these rights, contact us at nutrivaaiteam@gmail.com. We will respond within 30 days. Alternatively, you can delete your account directly from the app under Profile → Account → Delete account.

15. California Residents (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to Know: You can request to know what personal information we have collected about you, the categories of sources, our business purposes, and the categories of third parties we share it with.
• Right to Delete: You can request deletion of your personal information, subject to certain exceptions.
• Right to Correct: You can request correction of inaccurate personal information.
• Right to Opt-Out of Sale: We do not sell personal information to third parties. You do not need to opt out.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.
• Sensitive Personal Information: We use health data only to provide the app and keep it secure, so there is nothing to limit.

To submit a CCPA request, email nutrivaaiteam@gmail.com with the subject line "CCPA Request". We will verify your identity before processing the request.

Washington and Nevada residents: see our Consumer Health Data Privacy Policy for your rights over consumer health data.

16. European Users — GDPR Rights

Legal basis for processing: consent, contract performance, legitimate interests, legal obligations. For health data (a special category under Article 9 GDPR), we rely on your explicit consent, which you give when you enter it, connect Apple Health or use AI features. You can withdraw it at any time by deleting the data or your account, or by turning the feature off.

Your rights: Access · Rectification · Erasure · Portability · Restriction · Objection · Withdraw Consent

To exercise rights: email nutrivaaiteam@gmail.com — we respond within 30 days.

Complaints: You may lodge a complaint with your local EU Data Protection Authority.

International transfers: Data stored in the US. EU data transfers use Standard Contractual Clauses (SCCs).

Data retention: Data kept while account is active. Delete account at any time in Profile → Account → Delete account. All data permanently removed within 30 days.

17. Push Notifications

With your permission, Nutriva AI may send you push notifications for:

• Meal logging reminders
• Fasting timer alerts
• GLP-1 dose-day reminders, if you turn them on in GLP-1 mode (scheduled on your iPhone; they can be late or missed, so don't rely on them alone)
• Streak and goal milestone notifications
• Weekly AI summary reports

Push notification permissions are requested at app launch. You can disable notifications at any time in your device's Settings → Notifications → Nutriva AI. Disabling notifications will not affect core app functionality.

18. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other reasons. When we make material changes, we will:

• Update the "Last updated" date at the top of this policy.
• Send you an in-app notification if the changes are significant.
• For major changes affecting EU users, we may seek fresh consent where required by GDPR.

We encourage you to review this policy periodically. Continued use of the app after changes take effect constitutes your acceptance of the updated policy.

19. Contact Us

If you have questions, concerns, or requests relating to this Privacy Policy or your personal data, please contact us:

• Email: nutrivaaiteam@gmail.com
• Support: nutrivaaiteam@gmail.com · nutrivaai.com/support
• Delete your account: in the app, Profile → Account → Delete account (step-by-step guide at nutrivaai.com/support#delete-account), or email us.

We aim to respond to all privacy requests within 30 days. For complex requests, we may extend this period by up to 2 additional months and will notify you of any extension.