1. Who we are and how to reach us

Weight Pocket is operated by JP Medicina de la Montaña LLC ("we", "us"). We are the data controller for the information described here.

• Mailing address: Urb Estancias del Golf, 121 Calle Miguel Rivera Texidor, Ponce, Puerto Rico 00730, USA
• Privacy contact: support@weightpocket.com
• Data Protection Officer: we have not appointed one: at our current scale the law does not require it (for Brazil, see §19). Privacy questions go to the contact above.
• EU/UK representative (GDPR Art. 27): we have not designated one. If we become required to, we will designate a representative and update this policy.

Weight Pocket is an educational coaching and wellness tool. It is not a medical device, not telemedicine, not an electronic medical record, and not a healthcare provider. Using the app does not create a doctor-patient relationship with us. Decisions about your health, your treatment and your medication stay between you and your own licensed healthcare provider.

2. Who this policy covers

This policy applies to:

• Members who use the app on their own.
• Members connected to an educator (coach) through the app.
• Educators / coaching staff who use the staff side of the app.

Age. Weight Pocket is for adults: people 18 and older. The app asks your age during sign-up and blocks accounts below that minimum, the profile editor applies the same minimum, and the server enforces it too: the database rules require an age between 18 and 120 when an account is created and whenever the age is changed, so the check does not depend on the app alone. We store your age in years, never your date of birth, and if a legacy date-of-birth field exists we delete it the next time you edit your profile.

We do not knowingly collect data from anyone under 18. If we learn that an account belongs to someone under 18, we delete the account and its data.

3. What we collect

We collect only what the features you use need.

• Account and identity — email, account ID, display name, profile photo, age in years, sex, height, your location as a place name (city, region and country) and your country's two-letter code, time zone. From you, at sign-up with Apple or Google and in Settings. Purpose: run your account. Legal basis: contract.
• Profile and goals — calorie, protein, fat, carb, step and water goals. From you. Purpose: personalise your targets. Legal basis: contract.
• Weight and body measurements — current, starting, goal and treatment-start weight; morning weight and body measurements in the daily log. From you or, for weight, from Apple Health or Health Connect if you connected them. Purpose: track progress. Legal basis: explicit consent (Art. 9(2)(a)).
• Daily log — energy, symptoms and their intensity, free-text notes, pain, injection reactions. From you. Purpose: show trends and support coaching. Legal basis: explicit consent.
• Nutrition and meals — meals, macros and water, stored per day. From you, your camera or a barcode. Purpose: log food and compute goals. Legal basis: explicit consent.
• Medication and injections — medication type, dose, brand, status and schedule; a dose history; the dose and the injection site in the daily log. From you. Purpose: reminders and dose history. Legal basis: explicit consent.
• Exercise and activity — exercises, steps and active minutes. From you, or from your device's health platform. Purpose: track activity. Legal basis: explicit consent.
• Device health data — steps, sleep, heart rate, resting heart rate and heart rate variability, stored as one snapshot per day, and body weight, which fills in your daily check-in. From your device (Apple Health or Health Connect), with your permission, or, for steps on iPhone, from your phone's own step counter. Purpose: fill in activity, recovery and your check-in. Legal basis: explicit consent.
• Behaviour and engagement signals — in-app events with timing-only metadata, learned daily routines, streaks, and which coaching insights you have already seen. Derived in the app. Purpose: nudges, streaks and coaching lines. Legal basis: our legitimate interest in making the app's coaching useful to you, or your consent.
• Photos — your profile photo is stored on our servers and readable by you and, if you connected one, by your educator (§7); any screenshot you attach to a feedback report is stored on our servers and readable only by you; meal and product photos are stored only on your phone — the photo you take is sent for recognition (§6.2) but never saved on our servers. From your camera or library. Purpose: food recognition, profile, support. Legal basis: explicit consent.
• Subscription data — your account ID, the product you bought and the store receipt, handled by RevenueCat; plan and renewal fields are written only by our server. From the App Store or Google Play. Purpose: manage your plan. Legal basis: contract.
• Device and technical data — your notification token; the time you last opened the app, whether you use iPhone or Android and the app version you run, saved in your account each time you open the app; and AI usage counters keyed to a hashed account ID. From your device. Purpose: deliver notifications, see that the service is working on each platform and version, support, security and quality. Legal basis: our legitimate interest in running a secure, working service.
• Diagnostics — crash reports and screen-view events, off unless you turn them on. From your device, only if you opt in. Purpose: fix bugs. Legal basis: consent.
• Consent records and audit trail — the consent type, the date and the policy version you accepted, in your account and in our audit trail. From the app, when you accept something. Purpose: prove we asked. Legal basis: legal obligation.

We never ask for your card number. Payments are handled by the App Store or Google Play, and receipt validation by RevenueCat (§8).

Location. We never store your GPS coordinates. Only when you tap the button that detects your location — at sign-up, to fill in your city, or in Settings — the app reads your position once, at reduced accuracy and only while you are using the app; your phone's operating system turns it into a place name, and we keep only that place name (city, region and country) and, when you detect it in Settings, your country's two-letter code. That code is the only part of your location ever sent to an AI provider (§6.2). On Android the app can only obtain approximate location: the precise-location permission is actively removed from the app.

4. Health data, Apple Health and Health Connect

Health data is the heart of this app, and it gets the strictest treatment.

• We use it only to run the features you use and, if you connected an educator, to show it to that educator.
• We never sell it. We never use it for advertising — the app contains no advertising, attribution or cross-app tracking SDK, and its Apple privacy manifest declares no tracking. We never use it for insurance, underwriting, employment screening or credit decisions.
• We never combine it with data from sources unrelated to the app's health features.
• The data you sync from your device, your weight, your medication and your symptoms are never sent to our AI providers: the requests we send them carry no such field. What they do receive — a meal or label photo and the few details listed in §6.2 — is described there.

If you connect Apple Health (iOS) or Health Connect (Android), we read exactly six data types and nothing else: steps, sleep, heart rate, resting heart rate, heart rate variability and body weight.

We only read. We never write anything back to Apple Health or Health Connect. On iOS we request authorisation with an explicitly empty write list; on Android every permission we request is read-only. iOS also requires us to declare a write purpose string; ours says, literally, that the app does not write data to Health.

We do not read your health data in the background. Background delivery is switched off and the corresponding iOS entitlement is deliberately left out, so every read happens while the app is open in front of you. In practice that is one snapshot per calendar day.

On iPhone, if Health data is unavailable, your steps can be counted by the phone's own pedometer, with your permission. On Android, connecting Health Connect also asks for the physical activity permission: the app uses the phone's step sensor only as a signal, while the app is open, to refresh your step count from Health Connect. It does not count your steps with that sensor and saves nothing from it.

You can revoke that permission at any time in your system settings — iOS: Settings → Health → Data Access & Devices → Weight Pocket; Android: Settings → Apps → Health Connect → App permissions. Revoking stops new data from flowing in. Data already synced is removed when you delete your account (§10).

5. Medication and other sensitive information

If you track a GLP-1 or any other medication, we store what you enter: the medication type, dose, brand, status and schedule; a dose history; and, in each daily log, the dose, the injection site, how you felt and any reaction. Your next and last dose dates are computed by our server from what you entered, not by the app.

This is sensitive information and we treat it as such:

• It is never included in a push notification (§13).
• It is never sent to any advertising or analytics service.
• It is never sent to our AI providers.
• It is visible to your connected educator only if you connected one (§7).
• Reminders are computed from what you entered; we do not obtain your prescriptions from anyone.

Your calendar. If you choose to save your next dose to your device calendar from Settings, the event we create does not name your medication and does not carry your dose — its title is a neutral dose reminder, and its notes carry only a neutral line saying the event was created by Weight Pocket and the tag we use to find and replace our own previous event. That event lives in your own calendar, not on our servers, so it can sync to iCloud or Google Calendar along with the rest of your calendar, and deleting your Weight Pocket account does not remove it. Only you can delete it. We never create that event on our own — it takes an explicit tap.

The app does not prescribe, adjust doses, diagnose or treat. If you have a medical question, or a symptom that worries you, contact your own doctor or emergency services.

6. AI features

The app uses AI in two very different ways, and the difference matters for your privacy.

6.1 On your device. Most of what feels "smart" runs locally and sends nothing anywhere: coaching lines, pattern detection, weight projection, nudges, streaks and food matching against the app's own databases. None of that leaves your phone.

6.2 In the cloud. Three features send data to an AI provider through our own server. Nothing else does — our server accepts exactly three AI actions and rejects anything else.

• Meal photo recognition — provider: Google Gemini. We send the photo you just took, your language, whether it is a barcode and whether it shows several foods, the names of foods you logged recently, the names of products already in your pantry, the hour of the day on your phone (0–23, without the date), the two-letter code of the country in your profile, technical capture details read from the photo (lens, brightness, distance) and, if you marked one on screen, the kind of reference object next to the food (such as a fork or a coin). The hour and the country help the model guess the type of meal and the cuisine; nothing else about your location is sent.
• Label reading — provider: OpenAI. We send the photo of the label, optionally a photo of the front of the package, and your language.
• Shopping advice — provider: OpenAI. We send your language, the period, counts by rating band, the dominant axis, the trend, and a list of product names with their rating band.

What is not sent in any of the three: your account ID, your name, your email, your weight, your medication, your symptoms, your notes, the data you sync from Apple Health or Health Connect, or your GPS coordinates.

Neither Google Gemini nor OpenAI operates under a Business Associate Agreement with us. That is why neither receives anything without your AI consent, and our server enforces it (§6.3). For the OpenAI requests we explicitly ask the provider not to store the content of the request. Both providers handle these requests under the data-processing terms of the paid services we use: they use them only to answer the request, they do not use them to train their models, and they may keep a copy for a limited time only to detect abuse (§8). Images are size-capped before they leave your phone.

6.3 Your control, and it is enforced on our server — not just in the app. AI processing runs on your consent. You can turn it off at any time in Settings → Privacy → AI data processing; we record the withdrawal with its date and the policy version. From that moment our server refuses the request before it reads any photo or product list you sent: without an active AI consent, no photo and no product list reaches Google or OpenAI. Turning it off disables the features that need it; it does not make past processing unlawful. This consent gate applies to member accounts. Educator and administrator accounts are exempt from it on our server.

6.4 Only your consent decides. Whether AI processes your data depends only on your AI consent, and our server refuses the request without it (§6.3). Connecting to an educator does not change that, whatever organisation they work for.

6.5 You always know it is AI. The app labels AI-generated content as such. You are never led to believe an automated feature is a human professional.

6.6 No automated decisions with legal effect. Nothing in the app makes a decision about you based solely on automated processing that produces legal effects or similarly significantly affects you. Scores, projections, nudges and AI estimates are information for you: they do not change your rights, your access or your price.

7. Your connected educator (coach)

Connecting with an educator is your decision, and nothing is shared until you make it. Before you connect, the app shows you what the educator will see, what they cannot do, and how to disconnect — and it records that you accepted.

What your educator can see — this is the complete list, enforced by our server-side database rules, not by the app:

• A summary of your profile that our server builds for them from a fixed list of fields: your name, your role in the app, your profile photo, your member ID, your age, sex and height, your starting, current and goal weights, a body mass index our server computes from your current weight and height, the date your account was created, the account identifiers of every educator you are connected to, your treatment start date, your dose history, your medication limited to seven fields (type, dose, frequency, next and last dose dates, status and an internal id), your health-focus mode, your step, calorie, protein, carbohydrate, fat and water goals, the date of your last log, your most recent steps, sleep and resting heart rate with the time they were measured, and a seven-day nutrition aggregate (days with meals, days low in protein, average sodium).
• Your daily logs, in full: morning weight, energy, symptoms and their intensity, free-text notes, medication and dose, injection site and time, pain, injection reactions, your oral-dose and other check-offs, water, body measurements, and the times each entry was recorded.
• Your nutrition logs: meals, macros and water.
• Your exercise logs: exercises, steps and active minutes.
• Your monthly summaries of nutrition and exercise: daily averages and counts, never free text.
• Your daily health snapshots: steps, sleep, heart rate, resting heart rate and heart rate variability.
• Behavioural logs, alerts, signals and nudge deliveries, if any exist for your account.
• Your profile photo.

What your educator cannot see, because the rules block it: your profile document itself — your email, city, time zone, plan and subscription fields, consents and notification token are not in the summary —, your conversations with WiPi, your in-app activity events, your learned routines, the coaching insights you have already seen, your food-recognition history, your private product list, your usage counters, your feedback reports and the screenshots you attached to them, and any meal or product photo, which is never stored on our servers.

What your educator cannot do: change anything. They have read-only access. The rule that allows writing your data allows it only to you. There is no exception: coaching notes written by an educator were a feature retired in June 2026 and the rules no longer allow it at all. Their role is educational only: they do not treat you, do not diagnose you, do not prescribe or adjust medication, and do not give medical advice.

How to disconnect. You can disconnect at any time from Settings → your coach → Disconnect. In a single server operation we remove the educator from your account, recompute whether you are still connected to anyone and delete the denormalised coach name we had stored. From that moment the rules stop granting them access to everything listed above, and we write an audit entry recording the disconnection.

What we cannot undo: anything the educator read or wrote down outside the app, and any archived note tree from the retired notes feature. That archive is never readable through the app again, and it is fully deleted when you delete your account — our deletion sweeps the entire staff data tree, not only the educators you are currently connected to, precisely because disconnecting does not remove it.

An educator can also end the connection from their side: the effect on your account is the same, and our server writes its own audit entry for it. If the educator also blocks you, so that you cannot connect to them again, your name and account ID stay in their block list until they unblock you or you delete your account.

8. Providers and international transfers

We share data only with the providers below, only for what the app needs, and never for advertising. We do not sell your personal information.

• Google Cloud / Firebase (Auth, Firestore, Functions, Storage, Cloud Messaging, Hosting, App Check) — receives your account, all the data in your account, your files and your notification delivery, for identity, database, backend, file storage, push, website and anti-abuse. The database is in the nam5 United States multi-region and every backend function runs in us-east1. Safeguard: a Business Associate Agreement accepted on 2026-06-06 for the weightpocket.com organisation, plus the standard contractual clauses in Google's own terms.
• Google Gemini — receives the meal photo and the fields listed in §6.2. No account ID, no name, no clinical field. Purpose: meal photo recognition. Reached at the global Gemini API endpoint. No BAA: blocked server-side without your AI consent.
• OpenAI — receives the label photo, or the list of product names with their rating band, as listed in §6.2. No account ID, no clinical field. Purpose: label reading and shopping advice. United States. No BAA: same server-side block, and we ask OpenAI not to store the request.
• RevenueCat — receives your Firebase account ID in the clear, the product ID and the store receipt. No clinical data. Purpose: subscription and receipt validation. No BAA, and it is the only subscription route we have.
• Apple App Store / Google Play — receive the purchase and the receipt, under their own terms.
• Expo push service — receives your device notification token and the generic notification text. United States. Bodies are generic by construction (§13).
• USDA FoodData Central — receives a barcode or a food search string. No account ID. United States. Public API, called through our server.
• Open Food Facts — receives a barcode or a search string. No account ID, and our server calls it with a single technical identity, so your device's IP address never reaches them. France / global. Public database, called through our server.
• Firebase Analytics, Crashlytics and Performance — only if you opt in: screen names, closed-vocabulary events, sanitised crash reports and latency traces, identified by a hash of your account ID. These three are not covered by the Google BAA, which is exactly why they never receive health data (§12).

The same protection, or we do not send it. The providers that receive data linked to you — Google Cloud / Firebase, Google Gemini, OpenAI, RevenueCat and the Expo push service — handle it only to provide their service to us, under the data-processing terms that govern that service, and must give it the same protection this policy does and that the App Store and Google Play rules require: keep it confidential and secure, use it only for that service, and neither sell it nor use it for advertising. The two public food databases receive only a barcode or a search text from our server, with nothing that identifies you, and Apple and Google handle your purchase as the store you bought from. If a provider could not give that protection for a kind of data, we would not send it that data — which is why the AI providers receive no account ID and no health record (§6.2), and why the analytics tools receive no health data (§12).

The answers we get back from the two food databases are cached on our servers for reuse: the cache is keyed by a hash of the query, carries no account ID, and expires on its own — 90 days for USDA, 7 days for Open Food Facts.

Where your data lives. Your data is stored on Google Cloud infrastructure in the United States, and the AI, notification and food-database providers above are also reached in the United States or globally. If you use the app from the EEA or the UK, that is an international transfer.

Safeguards for those transfers. For Google Cloud, the Business Associate Agreement and the standard contractual clauses built into Google's terms. For the other providers, the transfer mechanism each of them publishes for European and UK data — participation in the EU-U.S. Data Privacy Framework, or the European Commission's Standard Contractual Clauses in its data processing terms. Write to support@weightpocket.com and we will tell you which mechanism applies to a given provider and how to obtain a copy of it.

9. How long we keep your data

While your account exists:

• Account, profile, goals, weights, medication — kept until you delete them; there is no automatic expiry.
• Daily logs and daily health snapshots — kept until you delete them.
• Nutrition and exercise detail — kept while your account exists. We may replace item-by-item detail older than 24 months with a monthly summary (daily averages and counts, never free text), and we delete the detail only after that summary has been written and verified.
• Behaviour and engagement events — set to expire 12 months after they are written. You can also purge them yourself at any time.
• Food-recognition history — set to expire 12 months after it is written.
• Your conversation with WiPi — capped at the 100 most recent messages.
• Coaching insights already shown — capped at 500 entries, pruned weekly.
• Profile photo — kept until you replace it or delete your account, plus the backup copy described below.
• Feedback screenshots — deleted after 90 days and gone completely, backup copy included, within about 98 days.
• Data-export bundles — deleted after 7 days and gone completely, backup copy included, within about 15 days; the download link itself expires in 15 minutes.
• Consent records — the life of the account, mirrored in the audit trail.
• Deletion records — when you delete your account we keep a marker with your account ID and the date of deletion (§10), and a record of the cleanup of your stored files, with your account ID and anything still left to delete, if any, which expires after 180 days.
• Audit trail — 6 years, append-only. See below.
• Subscription webhook events — 180 days.
• AI usage metrics, keyed to a hashed account ID — 90 days.
• Food-search cache, which carries no account ID — 90 days for USDA, 7 days for Open Food Facts.
• Notification delivery receipts, which carry no account ID — 30 days.
• Automated backups — database backups are kept for up to 35 days, rolling. Any other stored file that is deleted or replaced, such as your profile photo, is kept as a backup copy for 35 days and then for a 7-day recovery window before it is purged for good.
• Data stored on your phone — until you delete it (see §10 and §12).

When you delete your account, everything above that belongs to you is deleted from the live database in the same operation, with these exceptions you should know about: the audit trail (below); the deletion marker, which holds only your account ID and the date and exists so that a session that was still open cannot recreate the account; the cleanup record of your stored files, for 180 days, and any stored file that could not be deleted at once, until the retries described in §10 remove it; the anonymous cache and delivery receipts that carry no account identifier at all; and backup copies: database backups until the 35-day rotation overwrites them, and backup copies of your stored files for at most 35 days plus a 7-day recovery window. The AI providers hold no account of yours: what we send them carries no account ID, they process it to answer the request, and any copy they keep to detect abuse is deleted on their own schedule (§6.2, §8).

The audit trail and the deletion marker are what outlive your account for the long term, and you should know it. Every privileged action — granting or withdrawing a consent, connecting or disconnecting an educator, exporting your data, deleting your account, granting a privileged role — is written to an append-only audit log that only our server can write and that nobody can edit or delete. It records that an action happened — who, what and when — and never your health content. HIPAA requires us to keep it for at least six years (§164.316(b)(2)(i) / §164.530(j)), so it is retained after you delete your account, and it contains your account identifier. After 6 years plus a one-week buffer it is purged automatically, monthly, and the purge itself leaves only counters — never health data.

Where the law requires it (tax records, fraud prevention), we may keep specific records for the legally mandated period.

10. Your rights

You have these rights over your data, wherever you live. We do not make you argue for them. The paths below are those of the member app; if you are an educator, Export My Data and Delete Account are in Settings → Privacy & data.

• Access / portability — Settings → Privacy → Export My Data. We build a complete JSON bundle of your data and give you a download link. One export per 24 hours, and you must have signed in within the last five minutes; if not, the app asks you to sign in again and retries. The link expires in 15 minutes and the file is deleted from our storage after 7 days; its backup copy follows §9.
• Rectification — edit the value in the app, or write to us. Corrected immediately.
• Erasure — Settings → System → Delete Account. Before anything is deleted the app asks you to confirm twice, to unlock with your device passcode or biometrics if you have them set up, and to sign in again; the server accepts the deletion only with a sign-in within the last five minutes, and it is irreversible. In one operation it deletes your profile document and all of its sub-collections, your summary row, your subscription events, your AI usage metrics, your feedback reports, your tester entry, any retired appointment and message records, your entire coaching-notes tree across every educator, every file we hold for you in storage, and your entry in our authentication system; the app wipes the meal and product photos and the local caches stored on that phone. Four secondary records — your subscription events, your AI usage metrics, your feedback reports and your tester entry — are deleted on a best-effort basis: if one of them cannot be deleted, the rest of the deletion still completes and that record remains until it expires under §9 or until you write to us and we remove it. If a stored file cannot be deleted at that moment, the deletion of your account still completes, we record what is left and an automated job retries it once a day for up to 14 days; if a file is still there after that, the job stops and is recorded in our audit trail for us to finish by hand — we never report a file as deleted before it is. If any part of the coaching-notes deletion fails, the whole operation fails and we do not report your account as deleted.
• Withdraw consent — Settings → Privacy → AI data processing (switch it off); Settings → Privacy → Share diagnostics; Settings → your coach → Disconnect. It takes effect at once and is enforced on our server (§6.3, §7); past processing stays lawful.
• Restriction / objection — write to support@weightpocket.com. We answer within the deadlines below.
• Complaint — your data protection authority. See §16.

What the export contains and what it does not. The bundle carries everything we delete — an invariant enforced by an automated check in our codebase — with two declared exceptions: the connection codes an educator creates, which are linking credentials rather than data about you; and, if you are an educator, the list of members you blocked, which is data about them (GDPR Art. 15(4)). The audit trail is also excluded, and the bundle itself says so and explains why.

What the export does not include, because it never left your phone: the scan-and-purchase memory of the shopping feature, your offline check-in queue and your local error log are stored only on that device. They are deleted when you delete your account.

Deleting your account also deletes it from our authentication system, so you cannot sign back in. Anonymous aggregates that cannot be linked back to you may remain — for example, a product you chose to publish to the shared food catalogue carries no identifier of any kind and stays in the catalogue.

Response times: within one month for GDPR requests (extendable as the law allows), within 45 days for CCPA/CPRA requests. We may need to verify your identity first. Authorised agents may act for you with signed authorisation.

Consumer health data (Washington, Nevada, Connecticut and other states). We also publish a separate Consumer Health Data Privacy Policy, limited to what those laws require, at https://weightpocket.com/consumer-health-data. This section repeats its substance so that you have everything in one place.

• What it is. "Consumer health data" means information linked or reasonably linkable to you that identifies your past, present or future physical or mental health status. For Weight Pocket that includes your weight and body measurements, the medications you log with their dose and injection site, your symptoms, your meals and nutrition, your exercise, the health data you sync from your device, and the notes you write.
• Where it comes from. From you, from the device platforms you authorise (Apple Health, Health Connect), from your iPhone's own step counter if you allow it, and from nowhere else. We do not buy consumer health data from data brokers.
• What we do with it. Only what §3 and §4 describe: run the features you use and, if you connected one, show your educator the data listed in §7. Never for advertising, ad targeting or profiling.
• We do not sell it. We have never sold consumer health data. Under the Washington My Health My Data Act a sale would require a separate, specific valid authorisation signed by you; because we do not sell, we neither seek nor rely on any such authorisation.
• Your consent. We ask for it before we process, separately from our terms, and each connection (a health platform, an educator) takes its own affirmative action from you. You can withdraw it at any time — AI processing in Settings → Privacy → AI data processing, sharing with your educator in Settings → your coach → Disconnect, and access to Apple Health, Health Connect or your step counter in your phone's system settings (§4); withdrawal stops future processing and may disable the features that depend on it.
• Your rights. You may confirm what we collected and with whom we shared it, withdraw your consent, and delete your consumer health data — in the app, or by writing to support@weightpocket.com. We respond within 45 days for Washington requests, extendable once by 45 days where reasonably necessary, and we will not discriminate against you for exercising any of these rights.
• Right to appeal. If we decline to act on your request we will tell you why. You may appeal by replying to our response, or by writing to support@weightpocket.com with the subject line "Health Data Appeal". We answer an appeal within 45 days. If we deny your appeal you may contact your state Attorney General.
• Biometrics. We do not create, capture or store biometric identifiers such as faceprints. Photos are analysed only to recognise food, and any Face ID / Touch ID app lock is handled entirely by your device, which returns only a success or failure signal to us.

Residents of California and of other states with privacy statutes also have the right to limit the use of sensitive personal information. We do not sell or share personal information for cross-context behavioural advertising, so there is nothing to opt out of; ask us and we will confirm it in writing.

11. Security

• Encryption in transit. Everything the app sends travels over HTTPS, both to our servers and to every external provider.
• Encryption at rest. On our servers, Google Cloud's default encryption at rest. On your phone, the sensitive local store is encrypted with AES-256 using a key held in your device's secure keystore; if the device offers no secure keystore, we do not write that data at all rather than write it unprotected.
• Access rules. Server-side rules decide who can read each document. Your data is readable by you and, if you connected one, by your educator: the rule checks, on every single request, both that they hold a staff role and that their identifier is inside your own list of connected educators. Your account and your logs are also readable by our administrators, who do not need any connection, in order to operate and support the service — but not the daily records you sync from Apple Health or Health Connect (steps, sleep, heart rate, resting heart rate and heart rate variability): those are readable only by you and by an educator you connected. Everything not explicitly allowed is denied.
• The server decides who is staff, not the token. Staff and admin access is resolved against the server-side record, so withdrawing a role takes effect immediately instead of waiting for a session to expire; a mismatch between the token and the record is denied and logged.
• Recent sign-in for sensitive operations. Four operations require that you authenticated within the last five minutes: deleting your account, exporting your data, granting a privileged role and granting tester access. If we cannot tell when you authenticated, the operation is refused.
• App lock. You can require Face ID, Touch ID or your device passcode to open the app, with a re-lock window of 1, 2, 3 or 5 minutes. For educators and administrators it is mandatory, not optional, because they see other people's health data. The biometric never leaves your device: iOS or Android returns only success or failure, and if your device has no credential enrolled the lock fails closed.
• Device attestation (App Check). The app attaches a proof that it is the real app running on a real device — App Attest on iOS, Play Integrity on Android, reCAPTCHA v3 on the web. Today we collect that signal in observation mode: no request is refused for lacking it.
• Audit trail. Privileged actions are written to an append-only audit log kept for 6 years (§9).
• Notifications carry no health content (§13).
• Provider keys never ship with the app. Every external API key lives only on our servers.

No system is perfectly secure and we do not claim otherwise. If a breach affects your data we will notify you and the authorities as the law requires — including the FTC Health Breach Notification Rule (16 CFR Part 318) for US users, GDPR Art. 33-34 for EEA/UK users, and the applicable state breach statutes.

12. Analytics and crash reports

Diagnostics are off unless you turn them on. Analytics and crash collection are disabled in the app's own build configuration and only start if you switch them on in Settings → Privacy → Share diagnostics. That switch is the only thing that decides it.

When they are on:

• These services never receive health data. No weight, no meal, no medication, no symptom, no note, no photo.
• The identifier we send is a hash of your account ID, never the ID itself, and the only user properties we send are your role, your plan and where your subscription came from.
• Crash reports are sanitised before they leave your phone: we keep the error class, the error code and the call stack, and we deliberately drop the error message and any metadata the calling code attached, because either of them could echo something you typed. Only errors of medium severity or above are sent at all.
• Turning diagnostics off deletes the analytics identifier and the user properties from your device; signing out does the same.

We use no advertising SDKs, no third-party trackers and no cross-app tracking identifiers, and the app's Apple privacy manifest declares exactly that. We do not use the microphone: the microphone permission is switched off in both components that could request it and is not declared on either platform.

We do not publish over-the-air updates: the update mechanism is disabled on both platforms.

13. Notifications

We send reminders and coaching nudges if you allow notifications. The text is always generic — for example, "Time for your check-in". A notification can tell you that a check-in or a dose is due, but it never names the medication, the amount, a food, a weight or a symptom.

Delivery goes through the Expo notification service, which receives your device token and the notification text. We keep the delivery receipt for 30 days, without any account identifier, to detect and clean up dead device tokens.

You can turn notifications off at any time in your device settings. When you sign out, we remove your notification token from your account before signing you out and cancel every reminder already scheduled on that phone, so that the next person to use it receives nothing.

14. Changes to this policy

When we change this policy we update the effective date and the version number. For material changes we notify you inside the app — we do not send a push notification about policy changes. Whenever the version of this policy changes and you are connected to an educator, the app shows you the sharing notice again and asks you to accept it; you can postpone it, and it does not lock the app. New members accept the current version of the Terms and of this policy during sign-up, and the app records which version each member accepted. Each acceptance is recorded with its date and the version you accepted, both in your account and in our audit trail, in a single operation that either records both or neither.

There are four consents we record this way: AI processing, the educational disclaimer, sharing with your educator, and your acceptance of the Terms and of this policy. §6.3, §7 and §10 explain how to withdraw AI processing and sharing with your educator. The educational disclaimer is an acknowledgement, not a permission, so there is nothing to withdraw; and your acceptance of the Terms is not withdrawn from inside the app — if you no longer accept them, you delete your account (§10).

15. HIPAA — what it means for you

Most members use Weight Pocket directly, and in that case HIPAA does not apply to us: we are not your healthcare provider. Where an organisation subject to HIPAA uses Weight Pocket with the people it serves, that organisation is the covered entity and, if we sign a Business Associate Agreement with it, we act as its business associate under that agreement.

Connecting to an educator — including one whose organisation is subject to HIPAA — does not block or limit any feature: AI processing depends only on your AI consent (§6.3), and diagnostics only on their switch (§12).

We do not claim to be "HIPAA certified": no such certification exists. Our BAA status with each provider is summarised in §8 — and it is not uniform: Google Cloud is covered, while Gemini, OpenAI and RevenueCat are not.

16. Contact and complaints

• Privacy questions and rights requests: support@weightpocket.com
• Postal: JP Medicina de la Montaña LLC, Urb Estancias del Golf, 121 Calle Miguel Rivera Texidor, Ponce, Puerto Rico 00730, USA
• We answer within one month (GDPR) or 45 days (CCPA/CPRA).

If you are in the EEA or the UK you may lodge a complaint with your national data protection authority. If you are in the United States you may also contact your state Attorney General. If you are in Brazil you may lodge a complaint with the Autoridade Nacional de Proteção de Dados (ANPD).

17. Where our nutrition data comes from

Food composition data comes from three public sources, and we want you to know which is which. USDA FoodData Central (U.S. Department of Agriculture) — a public-domain work of the U.S. government. TACO, Tabela Brasileira de Composição de Alimentos, 4th edition, published by NEPA/UNICAMP (Brazil). And packaged-product and barcode data from Open Food Facts: © Open Food Facts contributors, made available under the Open Database License (ODbL). None of these organizations endorses Weight Pocket or is responsible for how we present their data, and any error you find in the app is ours to fix, not theirs.

18. Our website

This policy also covers weightpocket.com. The site sets no cookies and runs no analytics or advertising script. It remembers the language you picked in your browser's local storage, on your device only. To display its pages it loads fonts and style and script libraries from third-party content networks (Google Fonts, the Tailwind CSS CDN and jsDelivr), which receive your IP address and browser details when a page loads, under their own privacy terms. Like any web server, our hosting provider (Google Firebase Hosting) may record your IP address, browser type and the time of each request in order to serve the site and keep it secure. The contact page opens your own email application; we receive only what you choose to send.

19. Additional information for Brazil (LGPD)

If you are in Brazil, the Lei Geral de Proteção de Dados (Law 13.709/2018) applies to our processing of your data, and this section adds what it requires.

• Controller and contact: JP Medicina de la Montaña LLC, Urb Estancias del Golf, 121 Calle Miguel Rivera Texidor, Ponce, Puerto Rico 00730, USA, support@weightpocket.com. That mailbox is our channel for data subjects. We have not appointed a data protection officer (encarregado), as Resolution CD/ANPD 2/2022 allows for small-scale processing agents; if that changes, we will name one here.
• Legal bases: your specific and highlighted consent for health data (Art. 11, I); performance of the contract for account and subscription data (Art. 7, V); our legitimate interest for technical and engagement signals (Art. 7, IX); compliance with a legal obligation for consent and audit records (Art. 7, II).
• Your rights (Art. 18): confirmation that we process your data; access; correction of incomplete, inaccurate or outdated data; anonymisation, blocking or deletion of unnecessary or excessive data; portability; deletion of data processed with your consent; information about the entities with which we shared your data; information about the option of not consenting and its consequences; and withdrawal of consent. You exercise them in the app (§10) or by writing to support@weightpocket.com. We answer an access request in full within 15 days and the rest without undue delay.
• International transfer (Art. 33): your data is stored and processed in the United States by the providers listed in §8, under the safeguards described there.
• Complaints: you may contact the Autoridade Nacional de Proteção de Dados (ANPD).