Privacy Policy

1. Introduction

Welcome to NutriMind. Nutrimind LLC, a South Carolina limited liability company with its registered office at 172 Ella Claire Dr, York, South Carolina 29745-8892, United States ("NutriMind," "we," "our," or "us"), operates the NutriMind mobile application and related services (the "Service"). We are committed to protecting your privacy and ensuring you understand how we collect, use, and safeguard your personal information. This Privacy Policy explains our practices regarding data collection and use when you use the Service.

By using NutriMind, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use our Service.

2. Information We Collect

2.1 Information You Provide

• Account Information: Email address and password when you create an account
• Profile Information: Name, age, gender, height, weight, activity level, and fitness goals
• Nutrition Data: Food logs, meal entries, calorie and macro tracking data
• Weight History: Weight entries you log over time
• Meal Plans: Custom and AI-generated meal plans
• Saved Recipes: Meals you save as recipes for quick re-logging
• Barcode History: Products you scan, stored locally for quick re-scanning
• Streak & Badge Data: Your logging streak and earned achievement badges
• Weekly Challenges: Challenge participation and completion status
• AI Coach Conversations: Your chat history with Macro Coach for personalized advice
• Social & Friends Data: Friend connections, friend codes, usernames, accountability partner relationships, and activity feed posts you choose to share
• Voice Input: When using speech-to-text for meal or exercise logging (including via the home screen widget), audio is processed on-device or by your device's speech recognition service
• Referral Information: Referral codes you create or use, and associated rewards
• Feedback & Bug Reports: Information you submit through in-app feedback forms
• App Preferences: Settings like dark mode, notification preferences, and privacy controls
• Direct Messages: Message content, sender and recipient identifiers, timestamps, read receipts, and message status when using the direct messaging feature between friends
• Coaching Data: Coach/client relationship status, coaching messages, coaching notes, meal plan edits, exercise routine edits, intake form responses, and day-specific notes when using the coaching feature
• Training Preferences (AI Routine v2): Training category, program methodology, periodization model, cycle length, variety level, structure mode, cardio mode, aesthetic priorities, performance goals, event date, mobility limitations, sleep hours and quality, stress level, job activity, loved/avoided exercises, and per-day training duration. These shape AI routine generation and the progressive overload engine
• 1RM Baselines: One-rep-max values you enter directly or estimate from working sets (via Brzycki/Epley formulas). Stored to dial in starting weights and prescribe %1RM for the progressive overload engine
• Session Results (Prescribed vs Actual): When you complete a routine exercise, we record the prescribed sets/reps/weight/RPE alongside what you actually performed. The progressive overload engine reads these to decide your next session's prescription and detect plateaus
• Strength Score Data: A motivational percentile and title band (Beginner / Novice / Intermediate / Advanced / Elite) computed from your 1RM baselines vs published lifting standards for adults of your sex and bodyweight. Daily snapshots are stored to display a trend chart. Comparison uses published standards only — not in-app cohort data unless you opt in
• Body Measurements: Waist, neck, hip, chest, arm, thigh, calf, and shoulder circumference measurements you log, and body fat percentage estimates calculated using the U.S. Navy method
• Blood Glucose Data: Blood glucose readings you enter manually or import from your device's health platform (e.g., Apple Health, Health Connect, or connected CGM devices). This is sensitive health data stored securely and never shared with third parties
• Sleep Data: Sleep duration, bedtime, wake time, and sleep stage breakdowns (deep, light, REM) that you log manually or import via Health Sync
• Wellness & Mood Data: Daily mood ratings, energy levels, stress levels, hunger levels, and optional notes you choose to log
• Readiness Data (HRV / Resting HR / Respiratory Rate): When you opt in, we read heart rate variability (HRV), resting heart rate, and respiratory rate from Apple Health, Google Health Connect, or a connected wearable provider. These are stored as one row per day along with your sleep score and a computed Readiness score (0–100). Readiness is sensitive health data; it is stored securely, never shared with third parties, and used only to power the Daily Readiness card and (for premium users) workout autoregulation. You may disable readiness imports at any time in Settings > Health Sync, which stops new data collection but does not retroactively delete prior days — those are removed when you delete your account
• Moderation Actions: If your account is suspended by an administrator, we record the suspension reason, the user-facing message displayed to you on next sign-in, the staff member who applied the action, and an optional expiry date. We do this only when an action is taken; ordinary use does not generate moderation records

2.2 Information Stored Locally Only (Never Uploaded)

2.3 Information Collected Automatically

• Device Information: Device type, model, operating system version, and app version
• Usage Data: Features used, screens visited, and interaction patterns (if analytics enabled)
• Performance Data: App performance metrics, load times, and responsiveness (for optimization)
• Crash Reports: Technical information when the app crashes, including device state, to help us fix issues
• Demographic Context: Aggregated, anonymized demographic data (age range, gender) to improve features for different user groups
• Camera Data: Photos you take for food scanning or exercise workout analysis are processed for AI analysis but not permanently stored on our servers
• Push Notification Tokens: Device identifiers for sending notifications (if enabled)

2.4 Information from Third Parties

• Authentication Providers: If you sign in with Google or Apple, we receive your name and email from those services
• Payment Providers: Subscription status from Apple App Store or Google Play (we don't receive payment card details)
• Wearable Device Providers: If you connect a Fitbit or Garmin account, we import fitness data from their APIs — steps, sleep, heart rate, workouts, active calories, and (when you opt in) heart rate variability, resting heart rate, and respiratory rate. Data sharing is governed by their respective privacy policies. You can disconnect at any time in Settings

2.5 Health Platform Integration (Optional)

If you enable Health Sync, NutriMind can read from and write to your device's health platform:

Important:

• Health Sync is entirely optional and disabled by default
• You control exactly which data types are synced in Settings
• Health data stays on your device and with Apple/Google's health platforms
• We do not store health platform data on our servers beyond what you log in NutriMind
• You can disconnect Health Sync at any time

3. How We Use Your Information

We use your information to:

• Provide and maintain the Service
• Calculate personalized nutrition goals based on your profile
• Analyze food images and exercise descriptions using AI to estimate nutritional content and calories burned
• Log workouts, track exercise calories burned, and manage workout sessions
• Generate personalized exercise routines based on your fitness goals, experience level, and equipment preferences
• Process voice input for hands-free meal and exercise logging, including via the home screen widget
• Generate personalized meal plans tailored to your goals and preferences
• Save and organize your favorite recipes
• Provide AI-powered coaching through Macro Coach
• Track your progress, streaks, achievements, and weekly challenges
• Enable social features including friends, activity feeds, and accountability partners
• Enable coaching features including coach/client relationships, coaching messages, meal plan collaboration, exercise routine management, and intake form processing
• Provide smart meal suggestions based on your eating patterns
• Process referral rewards and track referral program participation
• Send you push notifications and reminders (with your permission)
• Monitor app performance and fix crashes quickly
• Improve and optimize our Service based on usage patterns
• Respond to your feedback, bug reports, and support inquiries
• Enforce usage limits to ensure fair access for all users
• Comply with legal obligations

3.1 AI Processing & Data Minimization

When using AI features (food scanning, nutrition label scanning, exercise analysis, exercise routine generation, meal plans, Macro Coach), we practice data minimization:

• Only essential information is sent to AI services (e.g., food images, exercise descriptions, workout plan photos, fitness goals and preferences for routine generation, relevant dietary preferences)
• Personal identifiers are not included in AI requests
• AI-generated responses are associated with your account but processed without your identity

3.2 Push Notifications

With your permission, we send push notifications for:

• Meal Plan Ready: When your AI-generated meal plan is complete
• Meal Reminders: Scheduled reminders to log your meals
• Streak Reminders: Encouragement to maintain your logging streak
• Smart Suggestions: Personalized meal suggestions based on your habits
• Coaching Notifications: Messages from your coach or client, coaching request responses, meal plan updates, and exercise routine updates

You can manage notification preferences in Settings. Push notifications are optional and can be disabled at any time without affecting other app functionality.

3.3 Device Tokens

To deliver push notifications, we store a device token that identifies your device:

• Generated by Apple (APNs) or Google (FCM) when you enable notifications
• Stored securely in our database, linked to your user account
• Automatically removed when you disable notifications or delete your account
• Never shared with third parties except for delivery purposes

3.4 Social Features & Friends

When using social features, you control what information is shared:

• Friend Code: A unique code others can use to send you friend requests
• Username: Optional public username for friends to find you
• Activity Feed: Achievements, streaks, and milestones you choose to share with friends
• Accountability Partners: Friends you designate can see more detailed progress, including your daily food log entries (meal names, calories, macros, and logging times) when you enable this option
• Check-ins: Quick encouragement nudges between accountability partners (separate from direct messaging)

3.5 Speech Recognition

When using voice input for meal or exercise logging (in-app or via the home screen widget):

• Audio is handled by the speech recognition built into your device or browser (for example the iOS Speech framework, an Android speech service, or your browser's speech API). Depending on your device, browser, and language, this may run entirely on-device or send audio to the third-party speech service your device or browser uses (typically Apple or Google, but possibly another provider) — never to NutriMind
• Audio data is not stored or transmitted to our servers
• Speech-to-text conversion happens on-device or through the speech service your device or browser uses (typically Apple or Google) — never through NutriMind
• You can disable microphone access at any time through your device settings

3.6 Data Export

You can export your data at any time through Settings > Export Data:

• CSV Format: Your nutrition logs in spreadsheet format
• PDF Report: A comprehensive summary of your progress

3.7 Direct Messaging

When using the direct messaging feature to send direct messages to friends:

• Data Collected: Message content, sender ID, recipient ID, timestamp, delivery status, and read receipts
• Purpose: To enable private direct messaging between connected friends
• Storage: Messages are stored securely using encryption at rest (AES-256) and in transit (TLS 1.3)
• Encryption: Messages are encrypted at rest using AES-256 via pgcrypto. Messages may be accessed for moderation purposes if reported
• Retention: Messages are retained for 90 days, then automatically deleted. You may delete messages at any time
• Moderation: We use reactive moderation based on user reports. We do not proactively scan message content
• Your Controls: Delete messages, block users, or disable messaging in Settings > Social Privacy
• Friends Only: You can only message mutual friends. Blocked users cannot message you

3.8 Coaching Features

When using the coaching feature to connect with a coach or manage clients:

• Relationship Data: Coach/client pairings, relationship status (pending, accepted, declined, removed), and invitation timestamps
• Coaching Messages: Message content, sender/recipient identifiers, timestamps, read receipts, and typing indicators exchanged between a coach and client
• Coaching Notes: Notes a coach writes about a client's progress, stored securely and visible only to the coach
• Meal Plan Edits: When a coach edits a client's meal plan, the changes, edit history, and coach attribution are stored
• Exercise Routine Edits: When a coach creates or edits a client's exercise routine, the changes and coach attribution are stored
• Intake Form Data: Responses submitted through the coaching intake form (e.g., health history, injuries, exercise preferences, goals) are stored and shared with your linked coach to personalize your program
• Day Notes: Day-specific notes attached to a client's meal plan by their coach, visible to the client
• Data Shared with Your Coach: If you accept a coaching relationship, your coach can view your nutrition logs, meal plans, exercise routines, macro targets, streaks, intake form responses, and progress data. Your coach cannot see your progress photos, friend list, or account credentials
• Data Shared with Your Client: If you are a coach, your display name and coaching messages are visible to your client
• Mutual Consent: Coaching relationships require acceptance by both parties. Either party can end the relationship at any time

Security: Coaching messages are encrypted at rest (AES-256) and in transit (TLS 1.3), with the same protections as direct messages

4. Third-Party Services

We use the following third-party services that may collect and process your data:

4.1 Google Gemini AI

We use Google's Gemini AI to analyze food images, analyze exercise descriptions and workout plans, generate personalized exercise routines, generate meal plans, and power Macro Coach. When using these features, relevant data is sent to Google's servers for processing. Google's privacy policy applies. Images and conversations are not permanently stored by Google.

4.2 Supabase (Database & Authentication)

We use Supabase to securely store your account data and nutrition logs. Supabase provides enterprise-grade security with encryption at rest and in transit.

4.3 Google Sign-In / Apple Sign-In

If you choose to sign in with Google or Apple, those services share your basic profile information (name and email) with us according to their privacy policies.

4.4 RevenueCat (Subscriptions)

We use RevenueCat to manage subscriptions. They process subscription status and purchase events according to their privacy policy. We do not receive or store your payment card details.

4.5 Google AdMob (Advertising)

Free users may see advertisements served by Google AdMob. AdMob may collect device identifiers and usage data for ad personalization.

4.7 Firebase Analytics

We use Firebase Analytics to understand how users interact with NutriMind. This helps us improve features and fix issues. Firebase Analytics may collect:

• App usage patterns (screens visited, features used)
• Device information (device type, OS version)
• App performance metrics

4.8 Firebase Cloud Messaging

We use Firebase Cloud Messaging (FCM) for Android and Apple Push Notification service (APNs) for iOS to deliver push notifications. These services:

• Process device tokens to route notifications to your device
• Do not have access to your nutrition data content
• Are governed by Google's and Apple's respective privacy policies

4.9 Sentry (Crash Reporting & Performance)

We use Sentry to monitor app stability and performance. When the app crashes or experiences issues, Sentry collects:

• Device type, model, and operating system version
• App version and build number
• Error stack traces and crash reports
• Performance metrics (app load times, screen transitions)
• Anonymized user context (age range, gender) to identify issues affecting specific user groups

4.10 Apple HealthKit (iOS)

If you enable Health Sync on iOS, NutriMind integrates with Apple HealthKit:

• Reads steps, workouts, and weight to provide comprehensive tracking
• Writes nutrition and water data so you have a complete health picture
• All HealthKit data is subject to Apple's privacy protections
• Data is never uploaded to our servers; it stays in Apple's ecosystem
• See Apple's HealthKit privacy policy for details

4.11 Google Health Connect (Android)

If you enable Health Sync on Android, NutriMind integrates with Health Connect:

• Reads steps, active calories, distance, exercises, heart rate, and weight from Health Connect
• Writes nutrition and hydration records back
• All Health Connect data is protected by Google's privacy standards
• Data remains on your device and within Google's ecosystem
• See Google's Health Connect privacy policy for details

5. Your Privacy Controls

NutriMind gives you control over your privacy through in-app settings:

6. Data Storage & Security

Your data is stored securely using Supabase's cloud infrastructure with:

• Encryption in transit (TLS 1.3)
• Encryption at rest (AES-256)
• Row-level security policies ensuring you can only access your own data
• Regular security audits and penetration testing
• Server-side rate limiting to prevent abuse

6.1 Local Data Security

• Biometric credentials: Stored in platform-secure storage (iOS Keychain / Android Keystore)
• Widget data: Encrypted using AES-GCM before storage
• Progress photos: Stored in app-private storage, not accessible to other apps

7. Data Retention

We retain your data for as long as your account is active:

• Active accounts: Data retained indefinitely while you use the service
• Nutrition logs: Logs older than 2 years may be archived to optimize performance
• Social data: Friend connections and activity feed posts retained until you remove them or delete your account
• Challenge history: Weekly challenge participation and results retained for your records
• Saved recipes: Retained until you delete them or your account
• Deleted accounts: All data permanently deleted within 30 days
• AI Macro Coach conversations: Message content, conversation titles, and previews are encrypted at rest. Conversations are retained while active — one you don't use for 90 days is deleted automatically, and no message is kept longer than 365 days. You can delete conversations yourself at any time, and all are deleted with your account
• Crash reports: Retained for 90 days to identify and fix issues
• Messages: Direct messages automatically deleted after 90 days. Manually deleted messages removed immediately
• Coaching data: Coach/client relationships, coaching messages, notes, meal plan edits, exercise routine edits, and intake form responses retained while the relationship is active. Coaching messages follow the same retention policy as direct messages. Coaching notes, edits, and intake data are deleted when the relationship is ended or the account is deleted
• Non-coaching notifications: General notifications (meal reminders, streak alerts, etc.) are automatically deleted after 3 days. Coaching-related notifications are retained for the standard 90-day period

8. Your Rights

Depending on your location, you may have the following rights:

• Access: Request a copy of your personal data (use Export Data feature)
• Correction: Update or correct inaccurate data in your profile
• Deletion: Request deletion of your data ("right to be forgotten")
• Portability: Export your data in machine-readable format (CSV)
• Opt-out: Opt out of analytics and personalized advertising
• Withdraw Consent: Disable features that require consent (notifications, biometrics)

To exercise these rights, use the in-app settings or contact us at privacy@getnutrimind.com.

9. Children's Privacy

NutriMind is intended for users 18 years of age and older. We do not knowingly collect personal information from anyone under 18. If you are under 18, please do not use this Service. If you are a parent or guardian and believe your child under 18 has provided us with personal information, please contact us immediately at privacy@getnutrimind.com.

We verify age during account registration. Users must confirm they are 18 or older to create an account.

The minimum age of 18 reflects the nature of our social and messaging features, which require maturity to use safely.

10. International Transfers

Your data may be transferred to and processed in countries other than your own, including the United States. We ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs) for EU data transfers
• Data Processing Agreements with all service providers
• Encryption of data in transit and at rest

11. GDPR (EU & UK Users)

If you are located in the European Economic Area (EEA) or the United Kingdom (UK), you have additional rights under the General Data Protection Regulation (GDPR) and the UK GDPR:

• Right to access, rectify, or erase your personal data
• Right to restrict or object to processing
• Right to data portability
• Right to withdraw consent at any time
• Right to lodge a complaint with a supervisory authority

For UK users, the Privacy and Electronic Communications Regulations (PECR) also apply to electronic marketing and the use of cookies and similar technologies.

UK users may lodge complaints with the Information Commissioner's Office (ICO), the UK's independent supervisory authority for data protection.

Legal Basis for Processing

• Contract Performance: Providing the Service you signed up for
• Legitimate Interests: Improving the Service, preventing fraud
• Consent: Optional features (notifications, analytics, personalized ads)

12. CCPA/CPRA (California)

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to know what personal information is collected
• Right to know if personal information is sold or disclosed
• Right to opt out of the sale or sharing of personal information
• Right to request deletion of personal information
• Right to correct inaccurate personal information
• Right to limit the use and disclosure of sensitive personal information
• Right to non-discrimination for exercising your rights

13. Canada (PIPEDA & Law 25)

If you are located in Canada, you have rights under the Personal Information Protection and Electronic Documents Act (PIPEDA) and, if you are in Quebec, under Quebec's Act Respecting the Protection of Personal Information in the Private Sector (Law 25):

• Right to access your personal information held by us
• Right to request correction of inaccurate or incomplete information
• Right to withdraw consent for the collection, use, or disclosure of your personal information
• Right to file a complaint with the Office of the Privacy Commissioner of Canada (OPC), or with the Commission d'accès à l'information (CAI) if you are in Quebec

Quebec-Specific Rights (Law 25)

• Express consent is required before collecting, using, or disclosing your personal information for tracking or profiling purposes
• Confidentiality by default: we ensure the highest level of confidentiality is applied by default to our privacy settings

14. Brazil (LGPD)

If you are located in Brazil, you have rights under the Lei Geral de Proteção de Dados (LGPD):

• Right to confirm the existence of data processing
• Right to access your data
• Right to correct incomplete, inaccurate, or outdated data
• Right to anonymization, blocking, or deletion of unnecessary or excessive data
• Right to data portability to another service provider
• Right to deletion of personal data processed with your consent
• Right to revoke consent at any time
• Right to file a complaint with the ANPD (Autoridade Nacional de Proteção de Dados), Brazil's national data protection authority

Legal Bases for Processing

• Consent: We process your data based on your explicit consent where required
• Legitimate Interest: We may process data for our legitimate interests, such as improving the Service and preventing fraud

15. Latin America

If you are located in Latin America, you may have additional rights under local data protection laws. Below is a summary of key rights in selected countries:

Argentina (Personal Data Protection Act, Law 25.326)

Express consent is required for the processing of personal data. Argentina has EU adequacy status. You have the right to access, rectify, and delete your personal data.

Colombia (Law 1581 of 2012)

Prior, express, and informed authorization is required for data processing. You have the right to access, update, rectify, and delete your personal data. Complaints may be filed with the Superintendencia de Industria y Comercio (SIC).

Peru (Law 29733)

Free, prior, informed, and express consent is required for data processing. You have rights of access, rectification, cancellation, and opposition (ARCO rights).

Mexico (LFPDPPP)

You have ARCO rights (Access, Rectification, Cancellation, Opposition). A privacy notice is provided through this policy. Express consent is required for the processing of sensitive personal data.

Chile (Law 21.719)

Chile's GDPR-style data protection law, effective December 2026, establishes rights of access, rectification, cancellation, and opposition. We are committed to compliance as this law comes into force.

To exercise any of these rights, use the in-app privacy settings or contact us at privacy@getnutrimind.com.

16. Policy Changes

We may update this Privacy Policy from time to time. When we make material changes:

• We will update the "Last Updated" date at the top of this policy
• We will notify you via in-app notification or email for significant changes
• Your continued use of the Service after changes constitutes acceptance

17. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us:

• Data controller: Nutrimind LLC, a South Carolina limited liability company
• Registered office: 172 Ella Claire Dr, York, South Carolina 29745-8892, United States
• Privacy inquiries: privacy@getnutrimind.com
• General support: support@getnutrimind.com