Privacy.

1. Who We Are

NutraSafe is a product of NutraSafe Nutrition Ltd, a company registered in England and Wales (company number 16813697, registered office 52 Tarvin Road, Chester, United Kingdom, CH3 5DZ). Founded and led by Aaron Keen. "NutraSafe", "we", "us" and "our" mean NutraSafe Nutrition Ltd.

Contact: contact@nutrasafe.co.uk

3. Data We Collect

Provided by you

• Account details: email (required for login).
• App content: food logs, reactions, allergens, expiry-tracking entries, and optional photos.
• Health and fitness data: nutrition goals, weight, height, age, gender, workout activity (if you use the AI Coach feature).
• Apple Health (optional): if you connect Apple Health, we read your workouts, activity summary, steps, active energy, resting energy, heart rate, walking and running distance, body weight and water, and we write back the foods you log as dietary entries, plus water, workouts, body weight, active energy, distance and heart rate recorded in the app. Values we import, such as a weight or a workout, become part of your NutraSafe data and sync to your account like anything else you log. If you use the AI Coach, the weigh-ins, water, daily step totals, daily energy totals (resting and active) and workouts we take from Apple Health are part of what it reads (see Section 7a). For each workout that is what kind it was, when it started and finished, how long it lasted, the app that recorded it, and the distance and energy burned where Apple Health has them. We do not send any other Apple Health data to Google Gemini, and none to the search service. You can disconnect Apple Health at any time in the iOS Health app or Settings.
• Health Connect on Android (optional): if you connect Health Connect, we read your steps, active calories burned, total calories burned, basal metabolic rate, your most recent weight, workouts other apps have saved (with their distance and active calories) and water other apps have recorded. We write back the foods you log as nutrition entries (calories, macros, vitamins and minerals), plus the water, body weight and workouts you log in the app, with each workout's active calories and distance. We do not read or write heart rate in Health Connect. We use your steps and calories burned to show your activity in the diary and the weekly summary, workouts from other apps to show them in your workout history, and your most recent weight only to estimate the calories a workout burned when you have not entered your weight in the app. Water that other apps record becomes part of your NutraSafe water log and syncs to your account like anything else you log. If you use the AI Coach, today's steps and active calories, daily energy totals (resting and active), water and the workouts we take from Health Connect are part of what it reads (see Section 7a), with the same workout details as for Apple Health. We do not send any other Health Connect data to Google Gemini, and none to the search service. We do not use Health Connect data for advertising, we do not sell it, and we do not share it with anyone except as this section and Section 7a describe. Our use of data from Health Connect follows the Health Connect Permissions policy, including its Limited Use requirements. You can disconnect at any time in Health Connect, which you can open from NutraSafe under Settings → Health & reactions → Health Connect, or on Android 14 and later from your phone's Settings. Disconnecting stops any new reading or writing, but what we have already imported, such as water other apps recorded, stays in your NutraSafe data until you delete it or delete your account, and the AI Coach's copy stays until you withdraw AI data sharing or delete your account (see Section 8).
• AI Coach conversations: messages you send to the AI Coach (if you use this feature).
• What you say (optional): if you talk to the AI Coach in voice mode, log food by voice or speak a recipe, the app records what you say so that it can be written down. The recording is sent to Google Gemini for that (see Section 7a). We do not keep the recording and it is not saved on your phone. We keep the words, as your message to the coach or as the food or recipe you logged.
• Support messages you send to us.

Automatically collected

• Device and app information (e.g., IP address, device model, OS version, app version).
• Notification token (if you enable push notifications).
• Advertising identifier (only if you agree to ad measurement, see Section 7b).
• App usage statistics: the app uses Google Analytics for Firebase to count how it is used: when the app is first opened, how often and how long it is used, which screens are opened, sign-ins and sign-ups, the onboarding steps and your answer to "how did you hear about NutraSafe", what you chose when logging food during a fast, whether you have Pro, and the text of any sign-in or sign-up error. It also records when a reaction test starts and closes and how it ended. Google Analytics gives each install its own random identifier and receives your IP address and device details with each request. On iPhone and iPad the statistics are linked to your NutraSafe account ID, which lets us see which app version each account is on when we answer support requests. Your food diary, the foods you log and your searches are not sent to it. Apart from that app version lookup, we look at these statistics only as totals, to see which parts of the app work and where people get stuck. Google Analytics keeps the detailed records for 2 months and the per-install and per-account records for 14 months after the last use.
• In-app searches and barcode scans: the words you type into food search and the barcodes you scan, together with whether we found a match, which result you picked, and whether you gave up and created the food yourself. These are recorded against your account so we can find and fix gaps in our food database. We use them to improve search results and to decide which foods to add next. The raw records are deleted after 30 days (see Section 8).
• Barcodes we could not find: when you scan a barcode that is not in our database, the app saves a note in your account: the barcode, when you scanned it, how many times, and the meal and day you were logging for. We use it to tell you when we add that food and to let you add it to that meal in one tap. This is on by default and you can turn it off in Settings, which also deletes the notes already saved. Only app versions from the release that added this feature save these notes.

Passwords are handled securely by Firebase Auth and are never visible to us.

Website visit counts. On our website we count anonymous page visits to understand how many people reach each page. This uses no cookies and stores no personal data: your IP address is turned into a one-way daily code on our server and is never stored, so visits cannot be linked back to you or across days. We record only the page visited and the site that referred you. This is separate from Google Analytics on the website, which runs only after you accept the cookie banner.

4. How We Use Your Data

• To provide and personalise your NutraSafe account.
• To sync, back up, and display your entries.
• To provide AI-powered coaching (see Section 7a below for full details).
• To troubleshoot, secure, and improve the service.
• To count how the app is used, so we can see which parts work and where people get stuck (see App usage statistics in Section 3).
• To reply to support requests.
• To tell you when we add a food you scanned that we did not have, and to help you add it to the meal you were logging (you can turn this off in Settings).
• To work out, in aggregate across all users, which foods are missing from our database and where search is failing, so we can fix both (see Section 5).

We do not use your diary, health or account data for advertising or profiling. The uses connected to advertising are the optional ad measurement described in Section 7b and Apple's install count described in Section 7c, and none of that data is part of either.

5. Access and Storage

Your data is stored with Google Firebase (Google LLC), which encrypts all data in transit (TLS) and at rest (AES-256).

As the data controller, NutraSafe Nutrition Ltd (acting through its founder Aaron Keen and any authorised staff) may technically access user data through the Firebase Console solely for:

• Bug investigation
• User support
• Maintaining database integrity and security
• Producing aggregate statistics that describe how the app is used as a whole

If the data came from Health Connect, we only look at it by hand if you ask us to, to keep the service secure, or because the law says we must.

Aggregate statistics never single you out. Before any such analysis your account identifier is replaced with a one-way code, results are only ever reported as totals and averages across many people, and no individual record appears in them. Typical examples are which meal of the day is logged most often, how many foods are missing from our database, and how often a search returns nothing.

We do not use this access for advertising, profiling, or building a picture of you as an individual.

6. Legal Basis (UK GDPR)

• Contract (Art. 6(1)(b)) to deliver the app and its features.
• Legitimate Interest (Art. 6(1)(f)) to maintain reliability and security, and to produce the aggregate, non-identifying statistics described in Section 5 so we can improve the food database and the app, to produce the app usage statistics described in Section 3, to take part in Apple's install count described in Section 7c, and to tell you when we add a food you scanned that we did not have. You can object to this at any time using the contact details in Section 13.
• Consent (Art. 6(1)(a)) for optional features such as notifications, camera and microphone access, AI Coach data sharing with Google Gemini, the photo scanning and voice features described in Section 7a, which send a photo or a recording to Google Gemini only when you take, choose or record one for them, and the optional ad measurement described in Section 7b.

7. Data Sharing and Transfers

Data is shared only with:

• Google Firebase (hosting, authentication, storage, and app usage statistics through Google Analytics for Firebase, see Section 3).
• Google Gemini (third-party AI service for AI coaching, see Section 7a).
• Meta Platforms, Inc. (measuring our own advertising on Facebook and Instagram, only if you agree, see Section 7b; Apple's install count, which Apple sends, is in Section 7c).
• Meilisearch, hosted for us on Fly.io (Fly.io, Inc., United States), the search service that powers food search in the app. Food records are copied to this service so they can be searched quickly. When you search, the app sends the words you type, or the barcode you scanned, directly to that service, and like any internet request that carries your device's IP address. When you create your own food, its copy carries the account identifier that marks it as yours, which is what keeps your personal and restaurant foods visible only to you. No email address, name, diary, or health data is sent.
• Authorities or law enforcement if legally required.

Where data is processed outside the UK/EU, Firebase relies on Standard Contractual Clauses. Fly.io stores and processes data in the United States and is certified under the EU-U.S. Data Privacy Framework and its UK Extension (see Fly.io's privacy statement).

We never sell, rent, or trade data.

7a. AI Coach, Photo Scanning and Voice, Third-Party AI Data Sharing

NutraSafe includes an optional AI Coach feature powered by Google Gemini, a third-party AI service provided by Google LLC. This feature is entirely opt-in, you must give explicit consent before any data is shared.

Photos you scan

Three optional features send a photo to Google Gemini so it can be read: the AI meal scan (a photo of your plate), the pack scanner (photos of a product's label, ingredients list or nutrition table) and recipe import from a photo. The photo is sent for that one request, to produce the result you asked for, and nothing is sent unless you take or choose a photo for one of these features. Text you type into recipe import is sent the same way. Google does not use this data to train its models.

If the meal scan can't match a packet in your photo to a product we hold, we keep the brand and name it read, and how often it comes up, with nothing that links it to you.

What you say

Three optional features record what you say and send the recording to Google Gemini so it can be written down: voice mode in the AI Coach, logging food by voice, and speaking a recipe into recipe import. A recording is sent for that one request, and nothing is recorded unless you start one of these features. We do not keep the recording and it is not saved on your phone. What we keep is the words, as your message to the coach or as the food or recipe you logged. In voice mode the coach also listens to the recording itself, and when it answers aloud the text of its reply is sent to Google Gemini to be turned into speech. Google does not use this data to train its models.

Voice mode and logging food by voice send a recording only once you have agreed to AI data sharing on a screen that names voice recordings. In both, the words you see while you are speaking come from your phone's own speech recognition. On iPhone and iPad that is Apple's, and iOS may send what you say to Apple to be recognised, under Apple's privacy terms. If you have not agreed to AI data sharing, logging food by voice uses those words and sends no recording.

What data is sent to Google Gemini

• Your nutrition goals and progress
• Your food diary: foods, amounts, nutrients and additives
• Weigh-ins and water, including any from Apple Health, and water from Health Connect
• Daily step totals and daily energy burned (resting and active) from Apple Health
• On Android, today's steps and active calories, and daily energy burned (resting and active), from Health Connect
• Workouts, fasts and reactions you log
• Workouts recorded in Apple Health or Health Connect: what kind each was, when it started and finished, how long it lasted, the app that recorded it, and the distance and energy burned where Apple Health or Health Connect has them
• Basic profile information (height, weight, age, sex, activity, and your first name if you have set one)
• Photos you attach in a coaching conversation
• Recordings of what you say in voice mode, and the text of the coach's replies when you have them read aloud
• Your coaching conversation messages

What we never send to Google Gemini

• Your email address or your location
• Photos, other than the ones you take or choose for the scanning features above or attach in the coach
• Recordings, other than the ones you make in the voice features above
• Apple Health data other than weigh-ins, water, daily step and energy totals, and the workout details above
• Health Connect data other than steps, energy burned, water and the workout details above
• Payment or financial information

How your data is protected

• Data is processed by Google Gemini in real time, only to generate coaching responses, read the photos you scan, write down what you say and read the coach's replies aloud.
• Your data is not used by Google for AI model training.
• All data is encrypted in transit (TLS).
• Google LLC provides equivalent data protection as described in their Privacy Policy and Gemini API Terms of Service.

Your consent and control

• Before using the AI Coach, you are asked to review what data will be shared and give explicit consent.
• When we add to what is shared, as we did with workouts from Apple Health and Health Connect and with voice recordings, you are asked again before any of it is sent.
• You can revoke AI data sharing consent at any time in Settings → App settings → Privacy & data → AI data sharing.
• Revoking consent stops the AI Coach sharing anything with Google Gemini straight away, voice recordings included. The scanning and recipe features only ever send what you take, choose, type or record for them.
• You can continue using all other NutraSafe features without the AI Coach.

7b. Optional Ad Measurement (Meta)

We advertise NutraSafe on Facebook and Instagram, which are run by Meta Platforms, Inc. To see which of those ads lead to people using the app, the app can tell Meta when certain things happen. This is optional and off unless you agree. The app asks you first, and on iPhone and iPad Apple's own tracking permission has to be allowed as well. If your version of the app has never asked you, it does not do this.

What is sent to Meta if you agree

• That you opened the app, including the first time after installing it.
• That you created an account.
• That you started a subscription or a free trial. Not the price, the product or any payment details.
• Your device's advertising identifier (Apple's IDFA on iPhone and iPad, the advertising ID on Android), which is how Meta matches your device to an ad.
• Technical details that Meta's software sends with each request, such as your IP address, device model, operating system and app version, language, time zone and network.

Google on iPhone and iPad

On iPhone and iPad, once Apple's tracking permission is allowed for NutraSafe, Google Analytics for Firebase in the app can also read the advertising identifier and send it to Google for ad measurement, including linking app installs to Google ads. Turning off Ad measurement in the app does not stop this. Turning off tracking for NutraSafe in Settings → Privacy & Security → Tracking does, and if tracking is not allowed it cannot read the identifier at all.

What we never send to Meta

• Your food diary, reactions, allergens, weight or any other health information.
• Your name, email address or account identifier.
• Your searches, barcode scans, photos or AI Coach conversations.
• Payment or financial information.

What Meta does with it

Meta matches these events to ads shown on Facebook and Instagram and reports back to us, as totals, how many people an ad led to open the app, create an account or start a subscription. We do not receive anything from Meta that identifies you. Meta can link what the app sends with information it holds from other apps and websites. It also uses it to target and deliver ads, to personalise what people see on its own services, and to keep those services secure, as set out in the Meta Business Tools Terms and Meta's Privacy Policy.

Who is responsible

For measuring and reporting on our advertising, NutraSafe Nutrition Ltd is the controller and Meta Platforms, Inc. acts as our processor. For collecting this information in the app and sending it to Meta, we and Meta Platforms, Inc. are joint controllers. What Meta does with it afterwards, it does as an independent controller. Meta Platforms, Inc. is in the United States, and the transfer is made under the UK data transfer terms that form part of the Meta Business Tools Terms.

Your consent and control

• The legal basis is your consent (Art. 6(1)(a)). The same consent covers reading the advertising identifier from your device under the Privacy and Electronic Communications Regulations.
• Saying no changes nothing about how NutraSafe works.
• You can change your mind at any time in Settings → App settings → Privacy & data → Ad measurement. On iPhone and iPad you can also turn off tracking for NutraSafe in Settings → Privacy & Security → Tracking. On Android you can reset or delete your advertising ID in your phone's ads settings.
• Turning it off stops the app sending anything new. It cannot recall what has already been sent, and Meta's software may make its own technical requests until you close the app.
• To control how Meta uses activity that other apps and websites share with it, including for ad targeting, use Your activity off Meta technologies in your Facebook or Instagram settings.
• Signing out of NutraSafe resets the choice, so the next person to use the phone is asked afresh.

7c. Apple's Install Count (iPhone and iPad)

The iPhone and iPad app is registered with Apple's install counting system, SKAdNetwork. Google Analytics for Firebase, which is part of Google Firebase and built into the app, does this when the app starts. It happens for everyone and does not depend on your ad measurement choice in Section 7b or on Apple's tracking permission.

If you install NutraSafe after seeing an app ad that uses Apple's system, for example on Facebook, Instagram or Google, Apple later tells that ad network that one of its ads led to an install, and tells any other ad networks whose ads you saw that theirs did not. Apple may include a small value (a number, or low, medium or high) that the app's analytics software sets. Apple sends this at least a day later, with your country and whether it was a reinstall, but without your advertising identifier or anything else that identifies you or your device, and with less detail when few people installed from the same ad. The app itself sends nothing to Meta for this, and we only see totals.

8. Retention Periods

• Active accounts: data retained while the account remains active.
• Deleted accounts: data removed or anonymised within 30 days; backups purged within 90 days.
• Support emails: kept up to 24 months for audit and dispute resolution.
• Raw search and scan logs: deleted after 30 days. Only aggregate totals (how often a search returned nothing, which foods are missing) are kept beyond that.
• Notes of barcodes we could not find: deleted 60 days after you last scanned the barcode, when you add or dismiss the food, when you turn the feature off in Settings, or when you delete your account.
• Ad measurement: your choice is stored on your phone. We keep no copy of what is sent to Meta. Meta keeps it for as long as its own policies say.

9. Your Rights

Under UK GDPR you can request to:

• Access your personal data
• Correct inaccurate information
• Delete your data ("Right to be Forgotten")
• Restrict or object to processing
• Receive a portable copy of your data

To export or download a copy, follow manage your data. Or contact contact@nutrasafe.co.uk to exercise these rights.

You may also contact the Information Commissioner's Office (ICO) at ico.org.uk.

10. Security

We use industry-standard security controls (encryption, access restrictions, monitoring). No system is 100% secure; please keep your device updated and use a strong password.

11. Children

NutraSafe is not intended for use by anyone under 16. If we learn we hold data for a child under 16 without consent, we will delete it promptly.

12. Changes to This Policy

We may update this policy periodically. Updates will be posted in-app and on our website with a new effective date. Material changes will be clearly communicated before they take effect.