Privacy Policy

Account Registration:

• Email address
• Password (stored as a cryptographic hash by Supabase Auth — plaintext passwords are never stored)
• First name

Profile Information:

• Age (year of birth)
• Gender (optional; used for personalization only)
• Health goals (up to 3 selected from a predefined list)

Supplement and Health Data:

• Supplement products scanned, searched, or added to your stack or watchlist
• Quality Scores, Fit Scores, and analysis outputs from scans and searches
• Daily supplement intake logs (which supplements marked as taken and at what time)
• Supplement reminder schedule (supplements, times, days of week)
• Health questionnaire responses (35-item assessment across 8 wellness domains)
• Laboratory test reports and blood test results you upload (including biomarker values and reference ranges)
• Analysis outputs (stored to enable longitudinal health tracking)

Uploaded Content:

• Images of supplement product labels (front label and supplement facts panel)
• Photographs or PDF files of laboratory reports and blood test documents

Communications:

• Feedback submissions (emoji ratings, written comments)
• Support emails and in-app communications

• Device information: device type, operating system version, unique device identifiers
• App usage data: screens viewed, features used, tap interactions, session duration
• Performance data: crash reports, error logs, and technical performance metrics
• Network information: approximate geographic location derived from IP address (city/region level — not precise GPS)
• Push notification token (only if you grant notification permission)

• Precise real-time GPS or location data
• Device contacts, calendar, or messaging data
• Biometric identifiers used for identification purposes (fingerprints, face geometry, voice prints)
• Advertising identifiers (IDFA) — we do not use cross-app tracking
• Financial account numbers or payment card details (processed exclusively by Apple)
• Social media credentials or social graph data
• Browsing history from other apps or websites

Data Linked to You (associated with your SuppsBuddy account):

• Contact Info: Email address, first name
• Health & Fitness: Health goals, questionnaire responses, lab data, supplement stack, intake logs
• User Content: Uploaded supplement images, lab report files
• Identifiers: Account/user ID
• Usage Data: App interactions, feature usage
• Diagnostics: Crash reports, performance data

Data Not Linked to You: Aggregated, de-identified supplement product popularity statistics.

We do NOT use your data for: third-party advertising, advertising measurement, cross-app tracking, or data broking.

• Authenticate identity and maintain your account
• Generate Quality Scores, Fit Scores, and Stack Scores for supplements
• Process supplement label images via ScanIQ analysis
• Store and display your supplement stack, watchlist, and intake logs
• Generate and manage your supplement schedule and push notification reminders
• Process health questionnaire responses into educational domain assessments
• Analyze uploaded laboratory reports to generate educational biomarker interpretations
• Generate personalized supplement protocol recommendations
• Power the Intelligence Engine for stack-protocol comparison analysis

• Analyze aggregated usage patterns to improve product design and feature development
• Debug technical issues, crashes, and performance problems
• Develop and test new features and model improvements

• Respond to support requests and feedback
• Send transactional communications (password resets, security alerts, material policy changes — cannot be opted out of)
• Send optional product updates and feature announcements (may be opted out of at any time)

• Comply with applicable laws, regulations, and legal processes
• Enforce our Terms & Conditions
• Detect, prevent, and respond to fraud, abuse, or security incidents
• Protect the rights, safety, and property of SuppsBuddy, users, and the public

OpenAI Note: Data transmitted to OpenAI is processed solely to generate your analysis results. We contractually require that OpenAI not use your data to train general OpenAI models.

• Right to Know: Request disclosure of categories and specific pieces of personal information we collect, use, and disclose
• Right to Delete: Request deletion of your personal information (subject to legal exceptions, including Legal Holds)
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt-Out of Sale/Sharing: We do not sell or share personal information for advertising
• Right to Limit Use of Sensitive Personal Information: Request we limit use of sensitive personal information to service-providing purposes only
• Right to Non-Discrimination: We will not discriminate against you for exercising any CCPA/CPRA right

To exercise California rights: Email support@suppsbuddy.com with subject “California Privacy Request.” Response within 45 days.

• Right of Access (Article 15): Request a copy of personal data we process
• Right to Rectification (Article 16): Request correction of inaccurate data
• Right to Erasure (Article 17): Request deletion in specified circumstances
• Right to Restriction of Processing (Article 18): Request processing restriction
• Right to Data Portability (Article 20): Request data in structured, machine-readable format
• Right to Object (Article 21): Object to processing based on legitimate interests
• Rights Related to Automated Decision-Making (Article 22): Not to be subject to solely automated decisions with legal effect (see Section 8)

Legal Bases for Processing:

• Contract Performance (Article 6(1)(b)): Processing necessary to provide the Service
• Legitimate Interests (Article 6(1)(f)): Fraud prevention, security, service improvement
• Explicit Consent (Article 9(2)(a)): Processing of sensitive health data — withdrawable by deleting your account

To exercise GDPR rights: Email support@suppsbuddy.com with subject “GDPR Data Rights Request.” Response within 30 days. You have the right to lodge a complaint with your local supervisory authority.