Privacy Policy

1. Data we process

• Account: email, name, sign-in method, language, time zone, region, subscription status.
• Profile and health: age or birth date, sex, height, weight, goals, activity level, allergies, diet, health conditions and notes you enter.
• Food diary: food photos and text you submit, recognised dishes and nutrient values, corrections, favourites, meal plans.
• Imported data: steps, activity, sleep, weight, heart rate and lab results from Apple Health, Health Connect, Strava, FHIR files, and diaries from Cronometer or MyFitnessPal — only the categories you allow.
• Messages: chats with your dietitian, AI coach conversations and the coach's memory of your preferences, video call metadata (calls are not recorded).
• Professionals: professional profile, licence details you provide, organisation, billing contact and invoices.
• Technical: device type, app version, IP address, crash and usage logs, cookies on our websites (see section 9).
• Payments: handled by the app stores and payment providers; we receive the subscription status, not your card number.

2. Why we process it and on what basis

• To provide the Service you asked for — logging, analysis, tracking, coach, dietitian connection, billing (performance of our contract with you).
• To process health data — your explicit consent, given at sign-up and when you connect integrations; you can withdraw it at any time, which stops the related features.
• To keep the Service secure, prevent abuse and fix errors (our legitimate interests).
• To improve recognition and features using your corrections and usage, in a way that does not identify you outside the Service (legitimate interests; you can object).
• To send newsletters and offers — only with your separate consent.
• To meet legal obligations, for example tax records and responses to lawful requests.

We do not sell your personal data, show you advertising, or share health data with advertisers.

3. AI processing

Food photos, food descriptions, coach messages and lab documents you upload are sent to AI model providers (currently Google Gemini, with OpenAI or OpenRouter as fallback) to produce an answer. We send only what the task needs and do not include your name or email. Providers process this data on our instructions; we choose service terms under which they do not use it to train their models where the provider offers that option.

4. Your dietitian and nutrition centre

When you connect to a dietitian, they can see your profile, diary, progress, imported health data, lab results, plans, chat with you and, if you allow it, a summary of your AI coach conversations. If the dietitian works in a centre, its administrators and supervisors can see what they need to manage your care. The dietitian can export your record (PDF, CSV, FHIR) for their own records. When you disconnect, their access ends; copies they already exported are their responsibility as an independent professional.

5. Who else receives data

Service providers that process data on our behalf under contract:

• Hosting and database: Supabase (EU, Frankfurt), Hetzner Online (EU), Cloudflare (storage of photos and files, network), Google Cloud (network proxy).
• AI: Google (Gemini API), OpenAI, OpenRouter.
• Payments: Apple, Google, Stripe, YooKassa; in the Gulf region Tap, Moyasar, Tamara.
• Messaging: Resend and Unisender (email), Firebase Cloud Messaging (push notifications), Telegram (if you use our bot).
• Integrations you enable: Apple Health, Health Connect, Strava, Google Calendar.

We disclose data to authorities only when required by a valid legal request, and to a buyer or successor of the Service under the same protections.

6. Where data is stored

Your data is stored mainly in the European Union. Some providers (for example AI providers) process data in other countries, including the United States. Where the law requires, we rely on contractual safeguards for such transfers. If the law of your country requires data to be kept in that country, contact us before using the Service.

7. How long we keep it

We keep your data while your account exists. When you delete your account we delete your personal data from our systems within 30 days, and from backups when they expire, except records we must keep by law (such as invoices). Data a dietitian exported before you disconnected is held by that dietitian.

8. Your rights and choices

• Access and copy your data, including in a machine-readable format.
• Correct inaccurate data in the app or by asking us.
• Delete your account in the app or at c0r.ai/delete-account.
• Withdraw consent: disconnect an integration or a dietitian, turn off newsletters, or stop processing of health data by deleting it.
• Object to processing based on our legitimate interests.
• Complain to the data protection authority of your country.

Write to support@c0r.ai from the email linked to your account. We reply within 30 days.

9. Cookies

Our websites use cookies that are needed to sign you in and keep the site working, and, only with your consent, analytics cookies. You can change your choice in the cookie banner at any time. The mobile app does not use advertising identifiers.

10. Security

We encrypt data in transit and at rest, restrict access by role and by row-level security in the database, keep secrets out of code and review changes before release. No system is completely secure; if a breach affects you, we will tell you and the authorities as the law requires.

11. Children

The Service is for adults aged 18 and over. If we learn that a child has given us personal data, we will delete it.

12. Changes to this policy

We will tell you about material changes in the app or by email before they take effect and update the date above. Where a change requires your consent, we will ask for it.

13. Contact

• Email: support@c0r.ai
• Operator: Erarta FZE, Sharjah Publishing City Free Zone, Sharjah, United Arab Emirates
• Website: c0r.ai