Privacy Policy

1. Data Controller

The controller responsible for data processing under the General Data Protection Regulation (GDPR) is:

Philogaia UG (haftungsbeschränkt) Attilastr. 14 12529 Schönefeld Germany

Email: info@philogaia.com

2. Data We Process

Depending on how you use the app, we process the following categories of personal data:

• Account and sign-in data: When you sign in with “Sign in with Apple”, we receive a pseudonymous user identifier and — if you allow it — your name and email address.
• Profile and health data: age, sex, height, weight, health goals, dietary preferences, allergies and health priorities.
• Nutrition data: photos and descriptions of your meals and the estimates derived from them (calories, macro- and micronutrients).
• Voice input: when you speak a meal, your iPhone turns the recording into text right on the device. Only that text is sent to our analysis, just like a typed description — the audio recording is never transmitted or stored.
• Blood values: blood test documents you upload and the values extracted from them (if you use this feature).
• Activity, sleep and recovery data: from Apple HealthKit and — at your request — from your connected Oura account.
• Hydration and supplements: the hydration and supplement entries you log.
• Usage and log data: technical log data for operation, security and troubleshooting.
• App usage: on which days and how often you open the app (one number per day, linked to your account). We use this only internally to understand how the app is used and to improve it – no advertising, no sharing, no tracking across other apps.

3. Special Categories of Data (Health Data)

Much of the data above is health data and therefore a special category of personal data under Art. 9 GDPR. We process it solely on the basis of your explicit consent (Art. 9(2)(a) GDPR), which you give by using the relevant features and may withdraw at any time with future effect.

4. Purposes and Legal Bases

• Providing the app, your account and the companion features — Art. 6(1)(b) GDPR (performance of a contract).
• Processing health, nutrition and blood-value data to create personalized recommendations — Art. 9(2)(a) GDPR (explicit consent).
• Push notifications and reminders (for this we store your iPhone’s device token until you sign out or revoke the permission) — your consent, revocable at any time in settings.
• Security, stability and abuse prevention — Art. 6(1)(f) GDPR (legitimate interest).
• Analysing app usage (number of opens per day) to improve the app — Art. 6(1)(f) GDPR (legitimate interest). You can object at any time (info@philogaia.com); the figures are deleted together with your account.
• Shared mineral water list: when you confirm values we read from your mineral water label, the brand and its mineral values (never the photo) may be added to our shared list of brands, without any link to you. Until then we keep the suggestion with your account so we can check whether different people read the same values; it is deleted together with your account — Art. 6(1)(f) GDPR (legitimate interest in accurate values for everyone). You can object at any time (info@philogaia.com).

5. Service Providers (Processors and Recipients)

We use carefully selected service providers that process data on our behalf:

• Supabase — hosting of database, authentication and file storage.
• Vercel Inc. — hosting and delivery of the web and backend infrastructure.
• Anthropic PBC — analysis of meals and generation of the worded recommendations via the “Claude” AI model.
• OpenAI — recognition of your meal photos and descriptions, reading the mineral values from your mineral water label (we do not store that photo) and text recognition (OCR) of uploaded blood test documents.
• Ouraring (Oura Health Oy) — retrieval of your sleep and activity data, only if you actively connect your Oura account.
• Apple Inc. — “Sign in with Apple” and delivery of push notifications (Apple Push Notification service).

6. International Transfers

Some of the above providers process data in the USA. Where this is the case, we base the transfer on appropriate safeguards under Art. 46 GDPR (in particular the EU Standard Contractual Clauses) or on a certification under the EU-US Data Privacy Framework, where available.

7. Apple HealthKit

If you grant Philogaia access to Apple Health, we read only the values you authorize (e.g. activity, steps). HealthKit data is used solely to provide your health features. We do not use it for advertising or marketing and do not share it for such purposes. You can revoke access at any time in iOS settings.

8. Retention

We store your data for as long as your account exists and it is necessary for the stated purposes. If you delete your account, the associated personal data is deleted unless statutory retention obligations apply.

9. Your Rights

Under the GDPR you have the following rights:

• access to the data we hold about you (Art. 15),
• rectification of inaccurate data (Art. 16),
• erasure (Art. 17),
• restriction of processing (Art. 18),
• data portability (Art. 20),
• objection to processing (Art. 21),
• withdrawal of consent with future effect,
• lodging a complaint with a supervisory authority (Art. 77).

10. Deleting Your Account and Data

You can delete your account and the associated data at any time directly in the app (Profile → Delete account), or by contacting the address above.

11. Not a Medical Device

Philogaia is not a medical device and is not intended to diagnose, treat or cure any disease. The information provided does not replace professional medical advice.

12. Changes to This Policy

We update this privacy policy when our processing changes. The current version is always available in the app and on this page.