Healti privacy policy

Nordic Prime Solutions AB (559349-6499), Löftesgatan 6, 214 58 Malmö, Sweden, is the controller for Healti. Contact us at info@webnox.se with questions about this policy or to exercise your rights.

• We collect what you log in the app, so the app can show it back to you and calculate your targets.
• We don't sell your data, show ads, or use advertising or analytics trackers.
• Health data from Health Connect stays on your phone. It is never sent to us and never used for advertising.
• Healti does not use AI services. Nothing you log is sent to an AI provider.
• You can delete your account and all of your data in the app at any time: Profile → Data → Delete account.

• Account. When you first open the app, we create an anonymous account identified by a random ID. If you sign up, we also store your email address, and your name if you sign in with Google.
• Profile. What you enter during setup: age, sex, height, weight, activity level and goal. We use it to calculate your daily targets.
• What you log. Meals (names, calories and macros), your own recipes, workouts (exercises, sets and weights), programs you follow, weight, water and daily check-ins.
• Barcodes and food searches. When you scan a barcode or search for a food, the barcode or search text is sent straight from your phone to Open Food Facts. It is not linked to your account.
• Camera. The camera is used only to scan barcodes, and only when you start a scan.
• Health data (optional, with your permission). If you connect Health Connect (Android), Healti reads steps, active calories, exercise sessions, weight, resting heart rate and blood pressure. The readings are stored and shown only on your phone and are not sent to our server. You can revoke access at any time in your phone's settings.
• Technical logs. Our server logs each request's route, status and timing. These logs contain your account ID but not what you logged.

We don't collect your location, contacts, advertising ID or other device identifiers.

• Contract. Your account, profile and logs are processed to run the app: storing and showing your log and calculating your targets.
• Explicit consent. Health data from Health Connect is read, on your phone only, after you allow it in the system permission screen. Health data is special-category data under the GDPR, and you can withdraw consent at any time by revoking the permission.
• Legitimate interest. Technical logs are processed for security and to prevent abuse.

We share data only with the providers that run the service, only for the purposes above, and under their data processing terms:

• Google Firebase (Google LLC): sign-in. Account ID, email and name.
• Railway (Railway Corp.): server hosting and database. Everything stored in your account.
• Open Food Facts: barcode and food lookups, sent straight from your phone. Only the barcode or search text, never your account.
• Apple and Google: app distribution, as described in their own privacy policies.

Our server and database are hosted by Railway in the United States. Firebase may also process data in the United States. Where data leaves the EU/EEA, it is protected by the providers' Standard Contractual Clauses.

We don't sell or rent your personal data, and we don't share it for advertising.

Healti's use of information received from Health Connect follows Google's Health Connect Permissions policy, including its Limited Use requirements (https://support.google.com/googleplay/android-developer/answer/12991134). In particular:

• health data is used only to show you your own summaries in the app, and it stays on your phone;
• it is not used for advertising, not sold, and not used to determine credit or insurance eligibility;
• no person reads it, except when you ask us for help with your own data, for security purposes, or to comply with the law.

We keep your data until you delete it or delete your account. Deleting your account removes it from our database immediately, and from our providers' backups within 30 days.

Anonymous accounts that are never signed up for are kept like any other account. You can delete one under Profile → Data → Delete my data.

Delete your account and all of its data in the app under Profile → Data → Delete account. You can also email info@webnox.se and we will delete it for you. We may need to confirm that the account is yours.

Under the GDPR you can:

• ask for a copy of your data,
• correct it,
• delete it,
• restrict or object to its processing,
• ask for a portable copy,
• withdraw consent.

You can delete your data in the app. For anything else, email info@webnox.se. We answer within 30 days.

You can also complain to a data protection authority. In Sweden, that is Integritetsskyddsmyndigheten (IMY), www.imy.se.

If you are under 13, you need a parent's or guardian's permission to use Healti. If you are a parent or guardian and believe your child has used Healti without permission, contact us and we will delete the account and its data.

Data is encrypted in transit (HTTPS). Every request is authenticated with a Firebase token and can only reach the account it belongs to. Access to our database is limited to the people who run Healti.

If we make material changes, such as introducing AI features, we will update this policy and tell you in the app before the change takes effect.