1. Who we are and how to reach us

Weight Pocket is operated by JP Medicina de la Montaña LLC ("we", "us"). We are the data controller for the information described here.

• Mailing address: Urb Estancias del Golf, 121 Calle Miguel Rivera Texidor, Ponce, Puerto Rico 00730, USA
• Privacy contact: support@weightpocket.com
• Phone: +1 (787) 981-1679
• Privacy Officer: we have designated a Privacy Officer, a role in our organisation that answers for our compliance with this policy and with the privacy laws that apply to us. You can reach the Privacy Officer at support@weightpocket.com. In Brazil, the Privacy Officer acts as our data protection officer (encarregado) under the LGPD (§19).
• EU/UK representative (GDPR Art. 27): we have not designated one. If we become required to, we will designate a representative and update this policy.

Weight Pocket is an educational coaching and wellness tool. It is not a medical device, not telemedicine, not an electronic medical record, and not a healthcare provider. Using the app does not create a doctor-patient relationship with us. Decisions about your health, your treatment and your medication stay between you and your own licensed healthcare provider.

2. Who this policy covers

This policy applies to:

• Members who use the app on their own.
• Members connected to an educator (coach) through the app.
• Educators / coaching staff who use the staff side of the app.

Age. Weight Pocket is for adults: people 18 and older. The app asks your age during sign-up and blocks accounts below that minimum, the profile editor applies the same minimum, and the server enforces it too: our server rejects a sign-up whose age is outside 18–120, and the database rules reject any later change outside that range, so the check does not depend on the app alone. We store your age in years, never your date of birth, and if a legacy date-of-birth field exists we delete it the next time you edit your profile.

Age check with your app store. In US states whose law requires app developers to check age with the app store (today, Texas), the app also asks Apple or Google Play for your age range after you sign in. It does this only where Apple or Google tell it that this law applies to your account, and only to apply the minimum above: if the store says you are under 18, the app does not let you in. We do not store your age range or send it to our servers; your phone only remembers, for your account, that the check was passed, and that note is erased when you sign out. Where this law does not apply, the app does not ask.

We do not knowingly collect data from anyone under 18. If we learn that an account belongs to someone under 18, we delete the account and its data.

3. What we collect

We collect only what the features you use need.

• Account and identity — email, account ID, display name, profile photo, age in years, sex, height, your location as a place name (city, region and country) and your country's two-letter code, time zone. From you, at sign-up with Apple or Google and in Settings. Purpose: run your account. Legal basis: contract.
• Profile and goals — calorie, protein, fat, carb, step and water goals. From you. Purpose: personalise your targets. Legal basis: contract.
• Weight and body measurements — current, starting, goal and treatment-start weight; morning weight and body measurements in the daily log. From you or, for weight, from Apple Health or Health Connect if you connected them. Purpose: track progress. Legal basis: explicit consent (Art. 9(2)(a)).
• Daily log — energy, symptoms and their intensity, free-text notes, pain, injection reactions. From you. Purpose: show trends and support coaching. Legal basis: explicit consent.
• Nutrition and meals — meals, macros and water, stored per day. From you, your camera or a barcode. Purpose: log food and compute goals. Legal basis: explicit consent.
• Medication and injections — medication type, dose, brand, status and schedule; a dose history; the dose and the injection site in the daily log. From you. Purpose: reminders and dose history. Legal basis: explicit consent.
• Exercise and activity — the exercises and active minutes you log. From you. Purpose: track activity. Legal basis: explicit consent.
• Device health data — steps, sleep, heart rate, resting heart rate and heart rate variability, stored as one snapshot per day, and body weight, which fills in your daily check-in. From your device (Apple Health or Health Connect), with your permission, or, for steps on iPhone, from your phone's own step counter. Purpose: fill in activity, recovery and your check-in. Legal basis: explicit consent.
• Behaviour and engagement signals — in-app events with timing-only metadata, learned daily routines, streaks, and which coaching insights you have already seen. Derived in the app. Purpose: nudges, streaks and coaching lines. Legal basis: our legitimate interest in making the app's coaching useful to you, or your consent.
• Photos — your profile photo is stored on our servers and readable by you and, if you connected one, by your educator (§7); any screenshot you attach to a feedback report is stored on our servers and readable by you and our support team, never by your educator; meal and product photos are stored only on your phone — the photo you take is sent for recognition (§6.2) but never saved on our servers. From your camera or library. Purpose: food recognition, profile, support. Legal basis: explicit consent.
• Products you save from a label — the name, brand, serving, ingredients and nutrition facts you confirm, kept in your account. From you. If another member's reading of the same label matches yours, the product is published to the shared catalogue without your name or account ID. To count confirmations, stop abuse and remove your traces when you delete your account, our server keeps, readable only by our server, a coded (hashed) version of your account ID next to your reading. If you publish offensive or false content we may stop publishing your products; that block, with its reason, the product concerned and its date, is kept until we lift it or you delete your account. Legal basis: contract and our legitimate interest in a reliable catalogue.
• Subscription data — your account ID, the product you bought and the store receipt, handled by RevenueCat; plan and renewal fields are written only by our server. From the App Store or Google Play. Purpose: manage your plan. Legal basis: contract.
• Device and technical data — your notification token; the time you last opened the app, whether you use iPhone or Android and the app version you run, saved in your account each time you open the app; AI usage counters in your account, and AI usage metrics keyed to a hashed account ID; if you were invited as a tester, your email and the end date of your free access; and a record of which account holds each notification token, keyed by a hash of the token. From your device. Purpose: deliver notifications, see that the service is working on each platform and version, support, security and quality. Legal basis: our legitimate interest in running a secure, working service.
• Home-screen widgets — the app keeps a small summary of your day on your phone, in storage the app shares only with its own widget, so that a Weight Pocket widget can show it if you add one — today's calories, macros and number of meals logged, your water, when your next dose is due and whether it is an injection or a pill (never the medication's name or dose), and a short tip. It is never sent to us or to anyone else, and if the app is not opened for 72 hours the widget stops showing it. Anyone who can see your screen can see what the widget shows; remove the widget to stop it. The widget's water button adds water that the app saves the next time it opens. From the app. Purpose: show your day at a glance. Legal basis: the same as for the health data it summarises, listed above.
• Diagnostics — crash and error reports, performance traces, the screens you view and which app features you use, off unless you turn them on. From your device, only if you opt in. Purpose: fix bugs and learn which parts of the app are used. Legal basis: consent.
• Feedback and reports — what you send from Settings → Send Feedback or with a Report button: the category, your text (up to 500 characters) or the content you report (an AI-written sentence, the foods a scan detected, or a product's name), an optional screenshot, the app version, platform, language, the screen you were on and where your subscription came from. From you. Purpose: support, fixing problems and moderating the shared catalogue. Read by our team, never by your educator. Legal basis: our legitimate interest in supporting you and keeping the app safe.
• Consent records and audit trail — the consent type, the date and the policy version you accepted, in your account and in our audit trail. From the app, when you accept something. Purpose: prove we asked. Legal basis: legal obligation.

We never ask for your card number. Payments are handled by the App Store or Google Play, and receipt validation by RevenueCat (§8).

Location. We never store your GPS coordinates. Only when you tap the button that detects your location — at sign-up, to fill in your city, or in Settings — the app reads your position once, at reduced accuracy and only while you are using the app; your phone's operating system turns it into a place name, and we keep only that place name (city, region and country) and, when you detect it in Settings, your country's two-letter code. That code is the only part of your location ever sent to an AI provider (§6.2). On Android the app can only obtain approximate location: the precise-location permission is actively removed from the app.

4. Health data, Apple Health and Health Connect

Health data is the heart of this app, and it gets the strictest treatment.

• We use it only to run the features you use and, if you connected an educator, to show it to that educator.
• We never sell it. We never use it for advertising — the app contains no advertising, attribution or cross-app tracking SDK, and its Apple privacy manifest declares no tracking (the only install attribution is Apple's own, built into iOS, and it carries no data of yours — §12). We never use it for insurance, underwriting, employment screening or credit decisions.
• We never combine it with data from sources unrelated to the app's health features.
• The data you sync from your device, your weight, your medication and your symptoms are never sent to our AI providers: the requests we send them carry no such field. What they do receive — a meal or label photo and the few details listed in §6.2 — is described there.

If you connect Apple Health (iOS) or Health Connect (Android), we read exactly six data types and nothing else: steps, sleep, heart rate, resting heart rate, heart rate variability and body weight.

We only read. We never write anything back to Apple Health or Health Connect. On iOS we request authorisation with an explicitly empty write list; on Android every permission we request is read-only. iOS also requires us to declare a write purpose string; ours says, literally, that the app does not write data to Health.

We do not read your health data in the background. Background delivery is switched off and the corresponding iOS entitlement is deliberately left out, so every read happens while the app is open in front of you. In practice that is one snapshot per calendar day.

On iPhone, if Health data is unavailable, your steps can be counted by the phone's own pedometer, with your permission. On Android, connecting Health Connect also asks for the physical activity permission: the app uses the phone's step sensor only as a signal, while the app is open, to refresh your step count from Health Connect. It does not count your steps with that sensor and saves nothing from it.

You can revoke that permission at any time in your system settings — iOS: Settings → Health → Data Access & Devices → Weight Pocket; Android: Settings → Apps → Health Connect → App permissions. Revoking stops new data from flowing in. Data already synced is removed when you delete your account (§10).

5. Medication and other sensitive information

If you track a GLP-1 or any other medication, we store what you enter: the medication type, dose, brand, status and schedule; a dose history; and, in each daily log, the dose, the injection site, how you felt and any reaction. Your next and last dose dates are computed by our server from what you entered, not by the app.

This is sensitive information and we treat it as such:

• It is never included in a push notification (§13).
• It is never sent to any advertising or analytics service.
• It is never sent to our AI providers.
• It is visible to your connected educator only if you connected one (§7).
• Reminders are computed from what you entered; we do not obtain your prescriptions from anyone.

Your calendar. If you choose to save your next dose to your device calendar from Settings, the event we create does not name your medication and does not carry your dose — its title is a neutral dose reminder, and its notes carry only a neutral line saying the event was created by Weight Pocket and the tag we use to find and replace our own previous event. To find it, the app looks through your calendar on the phone; it does not read, keep or send your other events. That event lives in your own calendar, not on our servers, so it can sync to iCloud or Google Calendar along with the rest of your calendar, and deleting your Weight Pocket account does not remove it. Only you can delete it. We never create that event on our own — it takes an explicit tap.

The app does not prescribe, adjust doses, diagnose or treat. If you have a medical question, or a symptom that worries you, contact your own doctor or emergency services.

6. AI features

The app uses AI in two very different ways, and the difference matters for your privacy.

6.1 On your device. Most of what feels "smart" runs locally and sends nothing anywhere: coaching lines, pattern detection, weight projection, nudges, streaks and food matching against the app's own databases. None of that leaves your phone.

6.2 In the cloud. Three features send data to an AI provider through our own server. Nothing else does — our server accepts exactly three AI actions and rejects anything else.

• Meal photo recognition — provider: Google Gemini. We send the photo you just took, your language, whether it is a barcode and whether it shows several foods, the names of foods you logged recently, the names of products already in your pantry, the hour of the day on your phone (0–23, without the date), the two-letter code of the country in your profile, technical capture details read from the photo (lens, brightness, distance) and, if you marked one on screen, the kind of reference object next to the food (such as a fork or a coin). The hour and the country help the model guess the type of meal and the cuisine; nothing else about your location is sent.
• Label reading — provider: OpenAI. We send the photo of the label, optionally a photo of the front of the package, and your language.
• Shopping advice — provider: OpenAI. We send your language, the period, counts by rating band, the dominant axis, the trend, and a list of product names with their rating band.

What is not sent in any of the three: your account ID, your name, your email, your weight, your medication, your symptoms, your notes, the data you sync from Apple Health or Health Connect, or your GPS coordinates.

Neither Google Gemini nor OpenAI operates under a Business Associate Agreement with us. That is why neither receives anything without your AI consent, and our server enforces it (§6.3). For the OpenAI requests we explicitly ask the provider not to store the content of the request. Both providers handle these requests under the data-processing terms of the paid services we use: they use them only to answer the request, they do not use them to train their models, and they may keep a copy for a limited time only to detect abuse (§8). Images are size-capped before they leave your phone.

6.3 Your control, and it is enforced on our server — not just in the app. AI processing runs on your consent. You can turn it off at any time in Settings → Privacy → AI data processing; we record the withdrawal with its date and the policy version. From that moment our server refuses the request before it reads any photo or product list you sent: without an active AI consent, no photo and no product list reaches Google or OpenAI. Turning it off disables the features that need it; it does not make past processing unlawful. This consent gate applies to member accounts. Educator and administrator accounts are exempt from it on our server.

6.4 Only your consent decides. Whether AI processes your data depends only on your AI consent, and our server refuses the request without it (§6.3). Connecting to an educator does not change that, whatever organisation they work for.

6.5 You always know it is AI. The app labels AI-generated content as such. You are never led to believe an automated feature is a human professional.

6.6 No automated decisions with legal effect. Nothing in the app makes a decision about you based solely on automated processing that produces legal effects or similarly significantly affects you. Scores, projections, nudges and AI estimates are information for you: they do not change your rights, your access or your price.

7. Your connected educator (coach)

Connecting with an educator is your decision, and nothing is shared until you make it. Before you connect, the app shows you what the educator will see, what they cannot do, and how to disconnect — and it records that you accepted.

What your educator can see — this is the complete list, enforced by our server-side database rules, not by the app:

• A summary of your profile that our server builds for them from a fixed list of fields: your name, your role in the app, your profile photo, your member ID, your age, sex and height, your starting, current and goal weights, a body mass index our server computes from your current weight and height, the date your account was created, the account identifiers of every educator you are connected to, your treatment start date, your dose history, your medication limited to seven fields (type, dose, frequency, next and last dose dates, status and an internal id), your health-focus mode, your step, calorie, protein, carbohydrate, fat and water goals, the date of your last log, and a seven-day nutrition aggregate (days with meals, days low in protein, average sodium).
• Your daily logs, in full: morning weight, energy, symptoms and their intensity, free-text notes, medication and dose, injection site and time, pain, injection reactions, your oral-dose and other check-offs, water, body measurements, and the times each entry was recorded.
• Your nutrition logs: meals, macros and water.
• Your exercise logs: exercises and active minutes.
• Your monthly summaries of nutrition and exercise: daily averages and counts, never free text.
• Your daily health snapshots: steps, sleep, heart rate, resting heart rate and heart rate variability.
• Your profile photo.

What your educator cannot see, because the rules block it: your profile document itself — your email, city, time zone, plan and subscription fields, consents and notification token are not in the summary —, your conversations with WiPi, your in-app activity events, your learned routines, the coaching insights you have already seen, your food-recognition history, your private product list, your usage counters, your feedback reports and the screenshots you attached to them, and any meal or product photo, which is never stored on our servers.

What your educator cannot do: change anything. They have read-only access. The rule that allows writing your data allows it only to you. There is no exception: coaching notes written by an educator were a feature retired in June 2026 and the rules no longer allow it at all. Their role is educational only: they do not treat you, do not diagnose you, do not prescribe or adjust medication, and do not give medical advice.

Progress reports. Your educator — and an administrator supporting the service — can create a PDF progress report from the data listed above (your weights, your medication and dose, your symptoms and your nutrition) and save or share it outside the app, for example with your doctor. Once that file leaves the app we cannot control or delete it.

How to disconnect. You can disconnect at any time from Settings → your coach → Disconnect. In a single server operation we remove the educator from your account, recompute whether you are still connected to anyone and delete the denormalised coach name we had stored. From that moment the rules stop granting them access to everything listed above, and we write an audit entry recording the disconnection.

What we cannot undo: anything the educator read or wrote down outside the app, and any archived note tree from the retired notes feature. That archive is never readable through the app again, and it is fully deleted when you delete your account — our deletion sweeps the entire staff data tree, not only the educators you are currently connected to, precisely because disconnecting does not remove it.

An educator can also end the connection from their side: the effect on your account is the same, and our server writes its own audit entry for it. If the educator also blocks you, so that you cannot connect to them again, your name and account ID stay in their block list until they unblock you or you delete your account.

8. Providers and international transfers

We share data only with the providers below, only for what the app needs, and never for advertising. We do not sell your personal information.

• Google Cloud / Firebase (Auth, Firestore, Functions, Storage, Cloud Messaging, Hosting, App Check) — receives your account, all the data in your account, your files and your notification delivery, for identity, database, backend, file storage, push, website and anti-abuse. The database is in the nam5 United States multi-region and every backend function runs in us-east1. Safeguard: a Business Associate Agreement accepted on 2026-06-06 for the weightpocket.com organisation, plus the standard contractual clauses in Google's own terms.
• Google Gemini — receives the meal photo and the fields listed in §6.2. No account ID, no name, no clinical field. Purpose: meal photo recognition. Reached at the global Gemini API endpoint. No BAA: blocked server-side without your AI consent.
• OpenAI — receives the label photo, or the list of product names with their rating band, as listed in §6.2. No account ID, no clinical field. Purpose: label reading and shopping advice. United States. No BAA: same server-side block, and we ask OpenAI not to store the request.
• RevenueCat — receives your Firebase account ID in the clear, the product ID and the store receipt. No clinical data. Purpose: subscription and receipt validation. No BAA, and it is the only subscription route we have.
• Apple App Store / Google Play — receive the purchase and the receipt, under their own terms.
• Expo push service — receives, directly from your phone, your device's push token and an installation identifier it uses to issue our notification token; from our server, that token and the generic notification text. United States. Bodies are generic by construction (§13).
• USDA FoodData Central — receives a barcode or a food search string. No account ID. United States. Public API, called through our server.
• Open Food Facts — our server sends it a barcode or a search string, with no account ID and under a single technical identity. When the app shows a product photo that comes from Open Food Facts, your phone downloads that image directly from Open Food Facts' image servers, which therefore see your device's IP address and device type, as with any image on the web; nothing else about you is sent. France / global. Public database.
• Sentry (Functional Software, Inc.) — only if you opt in: sanitised crash and error reports (the error type, its code, the call stack, the app version and your phone's model and operating system; the error message is dropped before it is stored, §12) and performance traces (how long the app's operations take, with a sanitised screen name), identified by a hash of your account ID. It does not store your IP address. No screen recording, no screenshots and no record of your taps. United States. No BAA, which is exactly why it never receives health data (§12).
• PostHog (PostHog, Inc.) — only if you opt in: the screens you view, app actions from a closed list (for example, opening the subscription screen or starting a scan), when you open and close the app, and your role, your plan and where your subscription came from, identified by a hash of your account ID. Your IP address is anonymised and your location is not looked up. No session recording and no automatic capture of your taps or of text. United States. No BAA, which is exactly why it never receives health data (§12).
• Operational alerts (GitHub and Anthropic) — when our systems detect a technical incident, an alert with technical information only (error codes, counters, the app version and the affected function), automatically cleaned of email addresses and account identifiers, is filed in our private code repository on GitHub, and an AI assistant from Anthropic may read it together with our source code to help us diagnose it. They receive no account, health record or log of yours. United States.

The same protection, or we do not send it. The providers that receive data linked to you — Google Cloud / Firebase, Google Gemini, OpenAI, RevenueCat, the Expo push service, Sentry and PostHog — handle it only to provide their service to us, under the data-processing terms that govern that service, and must give it the same protection this policy does and that the App Store and Google Play rules require: keep it confidential and secure, use it only for that service, and neither sell it nor use it for advertising. The two public food databases receive only a barcode or a search text from our server, with nothing that identifies you, and Apple and Google handle your purchase as the store you bought from. If a provider could not give that protection for a kind of data, we would not send it that data — which is why the AI providers receive no account ID and no health record (§6.2), and why Sentry and PostHog receive no health data (§12).

The answers we get back from the two food databases are cached on our servers for reuse: the cache is keyed by a hash of the query, carries no account ID, and expires on its own — 90 days for USDA, 7 days for Open Food Facts.

Where your data lives. Your data is stored on Google Cloud infrastructure in the United States, and the AI, notification, diagnostics and food-database providers above are also reached in the United States or globally. If you use the app from the EEA or the UK, that is an international transfer.

Safeguards for those transfers. For Google Cloud, the EU-U.S. Data Privacy Framework (and its UK Extension) and the standard contractual clauses in Google's data processing terms. For the other providers, the mechanism each publishes: the Data Privacy Framework and its UK Extension, or the European Commission's Standard Contractual Clauses with the UK Addendum. Write to support@weightpocket.com and we will tell you which mechanism applies to a given provider and how to obtain a copy of it.

9. How long we keep your data

While your account exists:

• Account, profile, goals, weights, medication — kept until you delete them; there is no automatic expiry.
• Daily logs and daily health snapshots — kept until you delete them.
• Nutrition and exercise detail — kept while your account exists. We may replace item-by-item detail older than 24 months with a monthly summary (daily averages and counts, never free text), and we delete the detail only after that summary has been written and verified.
• Behaviour and engagement events — set to expire 12 months after they are written. You can also purge them yourself at any time.
• Food-recognition history — set to expire 12 months after it is written.
• Your conversation with WiPi — capped at the 100 most recent messages.
• Coaching insights already shown — capped at 500 entries, pruned weekly.
• Profile photo — kept until you replace it or delete your account, plus the backup copy described below.
• Feedback and reports — kept while your account exists; deleted with it (§10).
• Feedback screenshots — deleted after 90 days and gone completely, backup copy included, within about 98 days.
• Data-export bundles — deleted after 7 days and gone completely, backup copy included, within about 15 days; the download link itself expires in 15 minutes.
• Consent records — the life of the account, mirrored in the audit trail.
• Deletion records — when you delete your account we keep a marker with your account ID and the date of deletion (§10), and a record of the cleanup of your stored files, with your account ID and anything still left to delete, if any, which expires after 180 days.
• Audit trail — 6 years, append-only. See below.
• Subscription webhook events — 180 days.
• AI usage metrics, keyed to a hashed account ID — 90 days.
• Food-search cache, which carries no account ID — 90 days for USDA, 7 days for Open Food Facts.
• Notification delivery receipts, which carry your device's notification token but no account ID — 30 days.
• Diagnostics, if you turned them on — kept on each provider's servers, with the hash of your account ID, for the period of the plan we use: Sentry keeps crash and error reports and performance traces for 30 days; PostHog keeps screens and actions for 1 year.
• Automated backups — database backups are kept for up to 35 days, rolling. Any other stored file that is deleted or replaced, such as your profile photo, is kept as a backup copy for 35 days and then for a 7-day recovery window before it is purged for good.
• Data stored on your phone — until you delete it (see §10 and §12).

When you delete your account, everything above that belongs to you is deleted from the live database in the same operation, with these exceptions you should know about: the audit trail (below); the deletion marker, which holds only your account ID and the date and exists so that a session that was still open cannot recreate the account; the cleanup record of your stored files, for 180 days, and any stored file that could not be deleted at once, until the retries described in §10 remove it; the food-search cache, which carries no account identifier at all, and the delivery receipts, which carry your device's notification token but no account identifier; and backup copies: database backups until the 35-day rotation overwrites them, and backup copies of your stored files for at most 35 days plus a 7-day recovery window. The AI providers hold no account of yours: what we send them carries no account ID, they process it to answer the request, and any copy they keep to detect abuse is deleted on their own schedule (§6.2, §8). What you shared with PostHog by turning diagnostics on is deleted: in that same operation we ask PostHog to delete your profile and your events, we repeat the request in the retries described in §10, and PostHog finishes deleting them on its servers in the background. What you shared with Sentry is not deleted in that operation: it carries a hash of your account ID, not the ID itself, and expires on the period above.

The audit trail outlives your account for the long term, and the deletion marker for 30 days — you should know it. Every privileged action — granting or withdrawing a consent, connecting or disconnecting an educator, exporting your data, deleting your account, granting a privileged role — is written to an append-only audit log that only our server can write and that nobody can edit or delete. It records that an action happened — who, what and when — and never your health content. We keep it for 6 years so that we can show we met our obligations and establish or defend legal claims (GDPR Art. 17(3)(b) and (e); LGPD Art. 16 and Art. 7, VI); six years is also the period HIPAA sets when we act for an organisation subject to it (§164.316(b)(2)(i) / §164.530(j)). It is therefore retained after you delete your account, and it contains your account identifier. After 6 years plus a one-week buffer it is purged automatically, monthly, and the purge itself leaves only counters — never health data.

Where the law requires it (tax records, fraud prevention), we may keep specific records for the legally mandated period.

10. Your rights

You have these rights over your data, wherever you live. We do not make you argue for them. The paths below are those of the member app; if you are an educator, Export My Data and Delete Account are in Settings → Privacy & data.

• Access / portability — Settings → Privacy → Export My Data. We build a JSON bundle of your data and give you a download link. For the files we store for you (your profile photo, screenshots), the bundle carries the list of those files, not their content; for a copy of a file, write to support@weightpocket.com. One export per 24 hours, and you must have signed in within the last five minutes; if not, the app asks you to sign in again and retries. The link expires in 15 minutes and the file is deleted from our storage after 7 days; its backup copy follows §9.
• Rectification — edit the value in the app, or write to us. Corrected immediately.
• Erasure — Settings → System → Delete Account. Before anything is deleted the app asks you to confirm twice, to unlock with your device passcode or biometrics if you have them set up, and to sign in again; the server accepts the deletion only with a sign-in within the last five minutes, and it is irreversible. In one operation it deletes your profile document and all of its sub-collections, your summary row, your subscription events, your AI usage metrics, your feedback reports, your tester entry, any retired appointment and message records, your entire coaching-notes tree across every educator, every file we hold for you in storage, and your entry in our authentication system; the app wipes the meal and product photos and the local caches stored on that phone. Some secondary clean-ups are done on a best-effort basis: your subscription events, AI usage metrics, feedback reports, tester entry, notification-token records, your traces in the shared product catalogue, and your account ID or name inside other people's records (an educator's member or block list, coach-side codes and messages). If one of them fails, the rest of the deletion still completes and our daily clean-up job retries it — except your tester entry, which is not retried: a daily job removes it once your free access ends, and that access lasts at most 90 days. Until then it remains, or you can write to us and we remove it. If a stored file cannot be deleted at that moment, the deletion of your account still completes, we record what is left and an automated job retries it once a day for up to 14 days; if a file is still there after that, the job stops and is recorded in our audit trail for us to finish by hand — we never report a file as deleted before it is. If any part of the coaching-notes deletion fails, the whole operation fails and we do not report your account as deleted.
• Withdraw consent — Settings → Privacy → AI data processing (switch it off); Settings → Privacy → Share diagnostics; Settings → your coach → Disconnect. It takes effect at once: AI processing and sharing with your educator are enforced on our server (§6.3, §7); diagnostics stop on your device at once (§12). Past processing stays lawful.
• Restriction / objection — write to support@weightpocket.com. We answer within the deadlines below.
• Complaint — your data protection authority. See §16.

What the export contains and what it does not. The bundle carries everything we delete — an invariant enforced by an automated check in our codebase — with two declared exceptions: the connection codes an educator creates, which are linking credentials rather than data about you; and, if you are an educator, the list of members you blocked, which is data about them (GDPR Art. 15(4)). The audit trail is also excluded, and the bundle itself says so and explains why.

What the export does not include, because it never left your phone: the scan-and-purchase memory of the shopping feature, your offline check-in queue and your local error log are stored only on that device. They are deleted when you delete your account.

Deleting your account also deletes it from our authentication system, so you cannot sign back in. Anonymous aggregates that cannot be linked back to you may remain — for example, a product published to the shared food catalogue stays there, with no identifier of any kind once your account is deleted.

Response times: within one month for GDPR requests (extendable as the law allows), within 45 days for CCPA/CPRA requests, and within the shorter deadline that the law of your country sets, if there is one (§16). We may need to verify your identity first. Authorised agents may act for you with signed authorisation.

Consumer health data (Washington, Nevada, Connecticut and other states). We also publish a separate Consumer Health Data Privacy Policy, limited to what those laws require, at https://weightpocket.com/consumer-health-data. This section repeats its substance so that you have everything in one place.

• What it is. "Consumer health data" means information linked or reasonably linkable to you that identifies your past, present or future physical or mental health status. For Weight Pocket that includes your weight and body measurements, the medications you log with their dose and injection site, your symptoms, your meals and nutrition, your exercise, the health data you sync from your device, and the notes you write.
• Where it comes from. From you, from the device platforms you authorise (Apple Health, Health Connect), from your iPhone's own step counter if you allow it, and from us, when we derive it from those data: your body mass index, weekly and monthly nutrition and activity summaries, and the messages WiPi shows you. We do not buy consumer health data from data brokers.
• What we do with it. Only what §3 and §4 describe: run the features you use and, if you connected one, show your educator the data listed in §7. Never for advertising, ad targeting or profiling.
• We do not sell it. We have never sold consumer health data. Under the Washington My Health My Data Act a sale would require a separate, specific valid authorisation signed by you; because we do not sell, we neither seek nor rely on any such authorisation.
• Your consent. We ask for it in a separate step at sign-up, apart from our Terms, and we record it with its date and the version of this policy; members who joined earlier are asked once, inside the app. We collect the health data you enter only to provide the features you ask for. Each further step takes its own affirmative action from you: connecting a health platform (Apple Health, Health Connect or your step counter), connecting an educator, and AI processing. You can withdraw each of them at any time — AI processing in Settings → Privacy → AI data processing, sharing with your educator in Settings → your coach → Disconnect, and access to Apple Health, Health Connect or your step counter in your phone's system settings (§4); withdrawal stops future processing and may disable the features that depend on it. Giving your consent to process your health data is voluntary, but the app cannot work without it; it is withdrawn by deleting your account (Settings → System → Delete Account).
• Your rights. You may confirm what we collected and with whom we shared it, access it, withdraw your consent, and delete your consumer health data — in the app, or by writing to support@weightpocket.com. We respond within 45 days for Washington requests, extendable once by 45 days where reasonably necessary, and we will not discriminate against you for exercising any of these rights.
• Right to appeal. If we decline to act on your request we will tell you why. You may appeal by replying to our response, or by writing to support@weightpocket.com with the subject line "Health Data Appeal". We answer an appeal within 45 days. If we deny your appeal you may contact your state Attorney General: in Washington online at https://www.atg.wa.gov/file-complaint, and in other states through your state Attorney General's website.
• Biometrics. We do not create, capture or store biometric identifiers such as faceprints. Photos are analysed only to recognise food, and any Face ID / Touch ID app lock is handled entirely by your device, which returns only a success or failure signal to us.

US state privacy laws. If you live in a US state with a consumer privacy law — including California, Connecticut, Colorado, Virginia, Oregon and Texas — you have the rights listed above, and we process your health data, which those laws treat as sensitive, only with your consent. We do not sell your personal data, do not use it for targeted advertising, do not profile you in furtherance of decisions with legal or similarly significant effects, and do not use it to train large language models. We answer within 45 days, extendable once by 45 days where reasonably necessary, in which case we tell you why. If we decline your request you may appeal by replying to our answer or by writing to support@weightpocket.com with the subject line "Privacy Appeal"; we answer within 45 days and, if we deny it, we tell you how to complain to your state Attorney General. In California we use sensitive personal information only for the purposes allowed by Cal. Code Regs. tit. 11, §7027(m).

11. Security

• Encryption in transit. Everything the app sends travels over HTTPS, both to our servers and to every external provider.
• Encryption at rest. On our servers, Google Cloud's default encryption at rest. On your phone, the sensitive local store is encrypted with AES-256 using a key held in your device's secure keystore; if the device offers no secure keystore, we do not write that data at all rather than write it unprotected.
• Access rules. Server-side rules decide who can read each document. Your data is readable by you and, if you connected one, by your educator: the rule checks, on every single request, both that they hold a staff role and that their identifier is inside your own list of connected educators. Your account and your logs are also readable by our administrators, who do not need any connection, in order to operate and support the service — but not the daily records you sync from Apple Health or Health Connect (steps, sleep, heart rate, resting heart rate and heart rate variability): those are readable only by you and by an educator you connected. Body weight is different: once you accept the weight your device proposes, it is saved in your check-in like one you type, and our administrators can read it like the rest of your logs. Everything not explicitly allowed is denied.
• The server decides who is staff, not the token. Staff and admin access is resolved against the server-side record, so withdrawing a role takes effect immediately instead of waiting for a session to expire; a mismatch between the token and the record is denied and logged.
• Recent sign-in for sensitive operations. Four operations require that you authenticated within the last five minutes: deleting your account, exporting your data, granting a privileged role and granting tester access. If we cannot tell when you authenticated, the operation is refused.
• App lock. You can require Face ID, Touch ID or your device passcode to open the app, with a re-lock window of 1, 2, 3 or 5 minutes. For educators and administrators it is mandatory, not optional, because they see other people's health data. The biometric never leaves your device: iOS or Android returns only success or failure, and if your device has no credential enrolled the lock fails closed.
• Device attestation (App Check). The app attaches a proof that it is the real app running on a real device — App Attest on iOS, Play Integrity on Android, reCAPTCHA v3 on the web. Today we collect that signal in observation mode: no request is refused for lacking it.
• Audit trail. Privileged actions are written to an append-only audit log kept for 6 years (§9).
• Notifications carry no health content (§13).
• Provider keys never ship with the app. Every external API key lives only on our servers.

No system is perfectly secure and we do not claim otherwise. If a breach affects your data we will notify you and the authorities as the law requires — including the FTC Health Breach Notification Rule (16 CFR Part 318) for US users, GDPR Art. 33-34 for EEA/UK users, and the applicable state breach statutes. We notify the authorities and the people affected within the deadline each law sets: in Brazil, the ANPD within 3 business days; in Canada, the Office of the Privacy Commissioner of Canada as soon as feasible when the breach creates a real risk of significant harm and, in Quebec, the Commission d'accès à l'information promptly when it presents a risk of serious injury; in Colombia, the Superintendencia de Industria y Comercio (SIC), and in Panama, the Autoridad Nacional de Transparencia y Acceso a la Información (ANTAI), as their laws require.

12. Analytics and crash reports

Diagnostics are off unless you turn them on. We use Sentry for crash and error reports and performance traces, and PostHog to learn which screens and features of the app are used (§8). Neither is started on your phone until you switch on Settings → Privacy → Share diagnostics. That switch is the only thing that decides it.

When they are on:

• These services never receive health data. No weight, no meal, no medication, no symptom, no note, no photo.
• The identifier we send is a hash of your account ID, never the ID itself, and the only user properties we send are your role, your plan and where your subscription came from.
• The error message is dropped: for the app's own errors we keep the error class, the error code and the call stack, along with the app version and your phone's model and operating system, and we deliberately drop the error message and any metadata the calling code attached — on your phone, before they are sent — because either of them could echo something you typed. When the app closes because of a system-level crash, that report does not go through this cleaning on the phone; Sentry's server replaces the error message before storing it. Of the app's own errors, only those of medium severity or above are sent.
• Performance traces measure how long the app's operations take and carry only a sanitised screen name, with no identifiers in it.
• No screen or session recording, no screenshots, and no automatic capture of your taps or of what you type. Sentry does not store your IP address; PostHog anonymises it and does not look up your location.
• Turning diagnostics off stops sending, closes Sentry and deletes the analytics identifier and the user properties from your device; signing out does the same.

We use no advertising SDKs, no third-party trackers and no cross-app tracking identifiers, and the app's Apple privacy manifest declares exactly that. We do not use the microphone: the microphone permission is switched off in both components that could request it and is not declared on either platform.

Install attribution from ads (iPhone only). If you install the app after tapping one of our ads — for example on Meta or TikTok — Apple's own ad-attribution system, built into iOS (SKAdNetwork / AdAttributionKit), may tell that ad network that the ad led to an install. Apple sends that signal itself, with a delay and without any identifier of you or your device. The app's only part is a single call to Apple the first time it opens: it does not read your device's advertising identifier, does not ask permission to track you, and sends nothing to Meta, TikTok or any other ad network — no health data, no account data, no usage data. The Android app does not do this.

We do not publish over-the-air updates: the update mechanism is disabled on both platforms.

13. Notifications

We send reminders and coaching nudges if you allow notifications. The text is always generic — for example, "Time for your check-in". A notification can tell you that a check-in or a dose is due, but it never names the medication, the amount, a food, a weight or a symptom.

Delivery goes through the Expo notification service, which receives your device token and the notification text. We keep the delivery receipt for 30 days — it carries your device's notification token but no account identifier — to detect and clean up dead device tokens.

You can turn notifications off at any time in your device settings. When you sign out, we remove your notification token from your account before signing you out and cancel every reminder already scheduled on that phone, so that the next person to use it receives nothing.

14. Changes to this policy

When we change this policy we update the effective date and the version number. When the version changes, the app tells you the next time you use it: a screen summarises what changed, links to this policy and to the Terms, and asks for any consent you have not given yet; tapping Continue records that you accepted the new version. We do not send a push notification about policy changes. If you are connected to an educator, the app also shows you the sharing notice again and asks you to accept it; you can postpone that one, and it does not lock the app. New members accept the current version of the Terms and of this policy during sign-up, and the app records which version each member accepted. Each acceptance is recorded with its date and the version you accepted, both in your account and in our audit trail, in a single operation that either records both or neither.

We record these consents this way. For members: AI processing, the educational disclaimer, sharing with your educator, the processing of your health data and your acceptance of the Terms and of this policy. For educators: their acceptance of the Terms, of this policy and of the obligations of their role, which they give before using the educator workspace and again when the version changes. §6.3, §7 and §10 explain how to withdraw AI processing and sharing with your educator. The educational disclaimer is an acknowledgement, not a permission, so there is nothing to withdraw; your consent to process your health data and your acceptance of the Terms are not withdrawn from inside the app — the app cannot work without them, so if you no longer give them, you delete your account (§10).

15. HIPAA — what it means for you

Most members use Weight Pocket directly, and in that case HIPAA does not apply to us: we are not your healthcare provider. Where an organisation subject to HIPAA uses Weight Pocket with the people it serves, that organisation is the covered entity and, if we sign a Business Associate Agreement with it, we act as its business associate under that agreement. Today we have no such agreement with any organisation.

Connecting to an educator — including one whose organisation is subject to HIPAA — does not block or limit any feature: AI processing depends only on your AI consent (§6.3), and diagnostics only on their switch (§12).

We do not claim to be "HIPAA certified": no such certification exists. Our BAA status with each provider is summarised in §8 — and it is not uniform: Google Cloud is covered, while Gemini, OpenAI, RevenueCat and the Expo push service are not.

16. Contact and complaints

• Privacy questions and rights requests: support@weightpocket.com
• Phone: +1 (787) 981-1679
• Postal: JP Medicina de la Montaña LLC, Urb Estancias del Golf, 121 Calle Miguel Rivera Texidor, Ponce, Puerto Rico 00730, USA
• We answer within one month (GDPR) or 45 days (CCPA/CPRA). If the law of your country sets a shorter deadline, we answer within that one: in Colombia, 10 business days for a query and 15 business days for a claim; in the Dominican Republic, 5 business days; in Panama, 10 business days for access and 5 business days for correction or cancellation; in Brazil, 15 days for a full answer to an access request (§19).

If you are in the EEA or the UK you may lodge a complaint with your national data protection authority. If you are in the United States you may also contact your state Attorney General. If you are in Brazil you may lodge a complaint with the Autoridade Nacional de Proteção de Dados (ANPD). If you are in Canada you may complain to the Office of the Privacy Commissioner of Canada and, if you are in Quebec, to the Commission d'accès à l'information. If you are in Colombia, to the Superintendencia de Industria y Comercio (SIC). If you are in Panama, to the Autoridad Nacional de Transparencia y Acceso a la Información (ANTAI). The Dominican Republic has no general data protection authority: there you may bring a habeas data action before the courts (Law 172-13, art. 17).

17. Where our nutrition data comes from

Food composition data comes from three public sources, and we want you to know which is which. USDA FoodData Central (U.S. Department of Agriculture) — a public-domain work of the U.S. government. TACO, Tabela Brasileira de Composição de Alimentos, 4th edition, published by NEPA/UNICAMP (Brazil). And packaged-product and barcode data from Open Food Facts: © Open Food Facts contributors, made available under the Open Database License (ODbL). None of these organizations endorses Weight Pocket or is responsible for how we present their data, and any error you find in the app is ours to fix, not theirs.

18. Our website

This policy also covers weightpocket.com. The site sets no cookies and runs no analytics or advertising script. It remembers the language you picked in your browser's local storage, on your device only. To display some of its pages it loads fonts from Google Fonts, which receives your IP address and browser details when a page loads, under its own privacy terms. Like any web server, our hosting provider (Google Firebase Hosting) may record your IP address, browser type and the time of each request in order to serve the site and keep it secure. The contact page opens your own email application; we receive only what you choose to send.

19. Additional information for Brazil (LGPD)

If you are in Brazil, the Lei Geral de Proteção de Dados (Law 13.709/2018) applies to our processing of your data, and this section adds what it requires.

• Controller and contact: JP Medicina de la Montaña LLC, Urb Estancias del Golf, 121 Calle Miguel Rivera Texidor, Ponce, Puerto Rico 00730, USA, support@weightpocket.com. That mailbox is our channel for data subjects. Our data protection officer (encarregado) is our Privacy Officer (§1), whom you can reach at support@weightpocket.com.
• Legal bases: your specific and highlighted consent for health data (Art. 11, I); performance of the contract for account and subscription data (Art. 7, V); our legitimate interest for technical and engagement signals (Art. 7, IX); compliance with a legal obligation for consent and audit records (Art. 7, II).
• Your rights (Art. 18): confirmation that we process your data; access; correction of incomplete, inaccurate or outdated data; anonymisation, blocking or deletion of unnecessary or excessive data; portability; deletion of data processed with your consent; information about the entities with which we shared your data; information about the option of not consenting and its consequences; and withdrawal of consent. You exercise them in the app (§10) or by writing to support@weightpocket.com. We answer an access request in full within 15 days and the rest without undue delay.
• International transfer (Art. 33): your data is stored and processed in the United States by the providers listed in §8, under the safeguards described there.
• Complaints: you may contact the Autoridade Nacional de Proteção de Dados (ANPD).

20. Additional information for Canada, Colombia, the Dominican Republic and Panama

If you are in Canada, Colombia, the Dominican Republic or Panama, the privacy law of your country applies to our processing of your data — in Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) and, in Quebec, the Act respecting the protection of personal information in the private sector; in Colombia, Law 1581 of 2012 and Decree 1377 of 2013; in the Dominican Republic, Law 172-13; in Panama, Law 81 of 2019 — and this section adds what those laws require.

• Who answers for your data: JP Medicina de la Montaña LLC, Urb Estancias del Golf, 121 Calle Miguel Rivera Texidor, Ponce, Puerto Rico 00730, USA, is responsible for your data, and our Privacy Officer (§1) answers for our compliance. Contact: support@weightpocket.com.
• Where your data is: your data is stored and processed in the United States by the providers listed in §8. While it is there, it may be accessible to the courts, law enforcement and national security authorities of the United States under United States law.
• Health data is sensitive: your weight, body measurements, medication, symptoms, meals and the data you sync from your device are sensitive data under these laws. Giving them is voluntary, but the app cannot work without them, because recording them is the service it provides; if you do not want to give them, you can choose not to create an account or delete it at any time (§10). (Colombia: Decree 1377 of 2013, art. 6; Dominican Republic: Law 172-13, art. 75.)
• Transfer to the United States: we send your data to the United States because it is necessary to provide the service you ask for — the app's servers are there (§8) — and with the consent you give at sign-up to the processing described in this policy.
• Your rights: you exercise the rights your law gives you — access, correction, update, deletion and withdrawal of consent, among others — in the app as described in §10, or by writing to support@weightpocket.com. We answer within the deadlines in §16.
• Complaints: see §16 for the authority of your country.