1. Introduction
Welcome to Healthy Buddy ("we," "our," or "us"). Healthy Buddy is a mobile health and wellness application owned and operated by Healthy Buddy, registered in Spain.
We are committed to protecting your privacy and ensuring you understand how we collect, use, and safeguard your personal information. This Privacy Policy explains our practices regarding your data when you use the Healthy Buddy mobile application.
2. Information We Collect
2.1 Account Information
When you create an account, we collect:
- Email address
- Authentication credentials (via Firebase Authentication)
- Account identifiers from Google Sign-In or Apple Sign-In (if used)
- Display name (optional)
2.2 Health & Wellness Data
To provide our services, we collect data you voluntarily input, including:
- Nutrition Tracking: Food photos, meal descriptions, voice inputs for food logging, and AI-analyzed nutritional estimates
- Wellness Diary: Mood entries, emotional states, and AI-generated weekly insights
- Workout Tracking: Exercise types, duration, and estimated calories burned
- Intermittent Fasting: Fasting start/end times and fasting protocol preferences
- Supplements Tracking: Supplement names, dosages, and reminder schedules
- Challenges: Participation in Body/Mind/Soul wellness challenges
- Streak Data: Daily engagement metrics and streak history
2.3 Device & Technical Information
- Device type and operating system
- App version
- Timezone settings
- Language preferences
- Usage analytics linked to a pseudonymous account ID (see section 5)
2.4 Payment Information
Subscription payments are processed through RevenueCat and your device's app store (Apple App Store or Google Play Store) for in-app purchases, or through Stripe for web-based purchases made on our website. We do not directly collect or store your credit card or payment information. Stripe may collect your email address and payment details in accordance with their privacy policy.
2.5 Apple Health, Health Connect and Apple Watch
If you choose to connect Apple Health (iOS) or Health Connect (Android), Healthy Buddy reads your steps, active calories burned, workouts and distance, to show your activity and adjust your daily targets. We only read this data; the phone app does not write anything to Apple Health or Health Connect. You can revoke access at any time in your device's settings.
If you use the Healthy Buddy Apple Watch app to record a workout, it reads your heart rate and active calories during the session, shows them on the watch, and saves the finished workout to Apple Health.
Data from Apple Health and Health Connect is used only to provide app features. It is never used for advertising, never sold, and never shared with advertising or analytics platforms.
2.6 Social Feed and Profile
Healthy Buddy includes an optional social feed where you can follow other people and share your activity. If you use it, we process your display name, username, bio, profile photo, the people you follow and who follows you, and the posts, likes and comments you create.
- You choose who sees what: for each kind of activity (workouts, meals, fasting, supplements, habits) you can choose Public, Friends, Close friends or Nobody. By default, activity is visible only to people you have accepted as followers.
- Public is opt-in: nothing is shared with everyone in the app unless you choose it, and users under 18 cannot make their activity public.
- Weight and body measurements are never shared in the feed, and there is no setting to share them.
- Discovery: by default other users can find you by your username and you may appear in suggestions. You can turn both off in the feed privacy settings.
- Safety: you can block people and report posts or comments. Reports are reviewed by our team.
3. How We Use Your Information
We use your information to:
- Provide and improve our wellness tracking features
- Generate AI-powered nutritional analysis and wellness insights
- Send push notifications for reminders (supplements, fasting, mood logging)
- Track your progress and maintain streak data
- Process subscription payments through third-party providers
- Respond to your support requests
- Improve the app through usage analytics
- Ensure app security and prevent fraud
4. Data Storage & Security
Your data is stored securely using Firebase (Google Cloud Platform) services:
- Firebase Authentication: Secure user authentication and identity management
- Cloud Firestore: Encrypted database for user data
- Firebase Cloud Storage: Secure storage for food photos
We implement industry-standard security measures including:
- Data encryption in transit (TLS/SSL) and at rest
- Secure authentication protocols
- Access controls and regular security audits
- Firestore security rules to ensure users can only access their own data
5. Third-Party Services
We share data with the following third-party processors to provide our services:
5.1 Firebase / Google Cloud Platform
Used for authentication, database storage, and file storage. View Firebase Privacy Policy
5.2 AI Providers: Google (Gemini) and OpenAI
The AI features of Healthy Buddy, including Lomi, use large language models from Google (Gemini API) as our primary provider and from OpenAI as a backup when Google is unavailable. OpenAI is also used to transcribe voice inputs.
When you use an AI feature, we send only the content needed for that request: for example a food photo, a meal description, a voice recording, workout or supplement details, or the diary entries used for your weekly insights. Some requests include the first name you entered, so Lomi can address you.
- Sent from our servers, not your device: requests go from our backend to the provider, so the provider does not receive your device identifiers or IP address.
- No account identifiers: we do not send your email address or account ID to the AI providers.
- No model training: we use the paid API services of Google and OpenAI. Under their API terms, the content we send is not used to train or improve their models.
- Limited retention: the providers may keep requests for a limited period to detect abuse, as described in their terms, and then delete them.
View Gemini API Terms · View OpenAI API Data Privacy
5.3 PostHog (App Analytics)
We use PostHog, hosted in the European Union, to understand how the app is used and to fix problems. PostHog receives app events (such as screens viewed and features used), device and app details, and a pseudonymous account ID. To understand which features help which people, it also receives your age range, gender and main goal. It does not receive your meals, diary entries, photos, weight or measurements. View PostHog Privacy Policy
5.4 AppsFlyer (Install Attribution)
We use AppsFlyer to measure which advertising campaign, if any, led to an app install, a sign-up or a subscription. AppsFlyer receives these events, device details and a pseudonymous account ID. On iOS, your device's advertising identifier is shared only if you allow tracking when the app asks. Your health data is never shared with AppsFlyer. View AppsFlyer Privacy Policy
5.5 RevenueCat
Manages subscription processing and payment entitlements. View RevenueCat Privacy Policy
5.6 Stripe
Processes web-based subscription payments for users who purchase through our website. Stripe may collect your email address, payment method, and billing information. View Stripe Privacy Policy
5.7 Apple & Google
App store platforms process payments and may collect additional data per their privacy policies.
5.8 TikTok (Pixel & Events API)
Our website (healthybuddy.app) uses the TikTok Pixel and the TikTok Events API to measure the performance of our advertising campaigns, attribute conversions, and improve audience targeting. The following events may be tracked: page view, content view (quiz landing), quiz completion, lead capture (when you submit your email), checkout view, payment information entered, and subscription completed.
We share with TikTok: a SHA-256 hashed version of your email address (so TikTok cannot read it directly), your IP address, your user agent, and TikTok-specific identifiers when present (the ttclid URL parameter set when you arrive from a TikTok ad, and the _ttp first-party cookie). Subscription value and currency are also shared at the moment of purchase. We do not share your name, your password, or any of your in-app health data with TikTok.
The legal basis is your consent (where required by your jurisdiction) and our legitimate interest in measuring advertising effectiveness. You can opt out of TikTok ad personalization in your TikTok account settings, and you can block the pixel and the cookie via browser tracking protection or an ad-blocker. View TikTok Privacy Policy.
5.9 Meta (Facebook Pixel)
Our website also uses the Meta (Facebook) Pixel for advertising measurement on Facebook and Instagram, with the same scope as the TikTok Pixel above (page views, quiz events, checkout events, subscription events). Hashed personal identifiers and IP/user-agent may be shared with Meta. View Meta Privacy Policy.
5.10 Cloudflare
Our website is served through Cloudflare's content delivery network for performance and security (DDoS protection, bot mitigation). Cloudflare may process IP addresses and other technical data. View Cloudflare Privacy Policy.
6. Health Data Sensitivity
- The health and wellness data you provide is considered sensitive personal information.
- We do not sell your health data to third parties.
- We do not share your health data with advertising platforms.
- Health data sent to our AI providers is used only to answer your request, not to train their models (see section 5.2).
- Activity you share in the social feed is visible only to the people you choose (see section 2.6).
- Health data is processed solely to provide app functionality.
- AI analysis is for informational purposes only, not medical advice.
- Consult a qualified healthcare provider before making dietary changes based on app data.
7. Your Rights
You have the right to:
- Access: Request a copy of your personal data
- Rectification: Correct inaccurate or incomplete data
- Erasure: Request deletion of your data ("right to be forgotten")
- Portability: Receive your data in a portable format
- Objection: Object to certain types of data processing
- Restriction: Request limited processing of your data
- Withdraw Consent: Withdraw consent at any time for consent-based processing
To exercise these rights, contact us at [email protected].
8. GDPR Compliance (EU Users)
If you are located in the European Economic Area (EEA), you are protected by the General Data Protection Regulation (GDPR).
Legal Bases for Processing
- Contract: Processing necessary to provide the app's services
- Consent: Processing based on your explicit consent (e.g., push notifications)
- Legitimate Interests: App improvement and security
Data Protection Officer
For GDPR-related inquiries, contact: [email protected]
9. CCPA Compliance (California Users)
If you are a California resident, the California Consumer Privacy Act (CCPA) provides additional rights:
- Right to Know: What personal information we collect and how it's used
- Right to Delete: Request deletion of your personal information
- Right to Opt-Out: Opt out of the sale of personal information (Note: We do not sell your data)
- Right to Non-Discrimination: We will not discriminate against you for exercising your rights
To submit a CCPA request, contact: [email protected]
10. Data Retention & Deletion
We retain your data as follows:
- Active Accounts: Data is retained as long as your account is active
- Inactive Accounts: Data may be deleted after 24 months of inactivity
- Deletion Requests: Data is permanently deleted within 30 days of a valid request
- Backup Copies: May persist in encrypted backups for up to 90 days
To request data deletion, contact [email protected] or use the in-app account deletion feature.
11. Cross-Border Data Transfers
Your data may be processed in countries outside your residence, including the United States (where Google and OpenAI process AI requests and some Firebase services run).
For EU users, we ensure adequate protection through:
- EU-approved Standard Contractual Clauses (SCCs)
- Adequacy decisions where applicable
- The EU-U.S. Data Privacy Framework, where the provider is certified
13. Children's Privacy (COPPA)
Age Requirement: Healthy Buddy is designed for users aged 16 and older. We do not knowingly collect personal information from children under 16.
If you believe a child under 16 has provided us with personal information, please contact us immediately at [email protected] and we will delete the data.
14. Changes to This Policy
We may update this Privacy Policy periodically. When we make significant changes:
- We will update the "Last Updated" date at the top
- We may notify you via email or in-app notification
- Continued use after changes constitutes acceptance
15. Contact Us
For privacy-related questions or to exercise your rights, contact:
Healthy Buddy
Email: [email protected]