Skip to content

Legal

Privacy Policy

Last updated: July 15, 2026

Introduction

This Privacy Policy explains how your information is collected, used, shared, and protected when you use the HealthBuddy mobile app for iPhone and Apple Watch (the "App"), including workout tracking, routines and training programs, body measurements, nutrition logging, automatic repetition counting, and related features.

The App is provided by Bartłomiej Żabicki, a sole proprietor established in Poland ("we," "us," or "our"), who acts as the data controller for the personal data described here. Contact: support@gethealthbuddy.com. Registered address: ul. Podgórska 3, 32-010 Baranówka, Poland · NIP: PL6821775165.

We comply with applicable data protection laws, including the EU General Data Protection Regulation (GDPR). This Policy should be read together with our Terms and Conditions.

1. Information We Collect

We collect only the data needed to run the App and its features:

  • Account and profile data: your first name, email address, and gender. If you register or sign in using Sign in with Apple or Sign in with Google, we receive a unique identifier and the email address those services share with us. Passwords are stored only in hashed form; we never store them in plain text.
  • Profile settings: optional details such as date of birth, height, activity level, preferred units, and rest-timer preferences, used to personalize calculations and recommendations.
  • Training and fitness data you log: routines, exercises, sets, reps, weights, workout sessions, personal records, training programs, and body measurements (e.g., weight, body-fat percentage, and other measurement types). During workouts tracked on Apple Watch, we may also record workout-related metrics such as heart rate and active energy burned.
  • Nutrition and supplement data you log: foods, meals, calories, macronutrients, water intake, nutrition goals, and supplements you choose to record.
  • Apple Health (HealthKit) data: only with your explicit permission, the App reads from and writes to Apple Health. See Section 4 for the specific data types and important limitations.
  • Motion and sensor data: to power automatic repetition counting, the App collects motion-sensor data (accelerometer, gyroscope, and device-orientation values) from Apple Watch and, if you use them, from compatible AirPods/headphones during workouts. See Section 5 for how this is used and shared.
  • Camera and photos: if you use the food scanner, the App accesses your camera to scan barcodes and, for the AI food-recognition feature, lets you take or select a photo of your meal. See Section 6 for how food photos are processed.
  • Subscription and purchase data: if you buy a premium subscription, the purchase is processed by Apple through the App Store, and subscription status is managed via RevenueCat. We receive your subscription and entitlement status; we do not receive or store your full payment-card details.
  • Device, technical, and usage data: automatically collected information such as device model, operating-system version, app version, language/region, general usage and feature-interaction events, diagnostic and crash reports, and IP address, used for operating, securing, troubleshooting, and improving the App.

2. How We Use Your Information and Legal Bases

We process your personal data for the following purposes and on the following legal bases under the GDPR:

  • To provide the App and your account — creating and managing your account, storing your workouts, measurements, nutrition and settings, syncing across your devices, and providing support. Legal basis: performance of a contract (Art. 6(1)(b)).
  • To provide health, fitness, and nutrition features you choose to use — some data you log (such as body measurements, heart rate, or nutrition) may qualify as health-related data. Legal basis: your explicit consent, given by choosing to use these features and by granting the relevant permissions (Art. 9(2)(a)); you can withdraw consent at any time.
  • To count repetitions and improve our detection models — processing motion-sensor data to estimate repetitions and to develop and improve our repetition-counting technology. Legal basis: our legitimate interest in operating and improving the App, and/or your consent where required (Art. 6(1)(f) / Art. 6(1)(a)).
  • To communicate with you — sending account, security, and transactional messages (e.g., password reset and welcome emails), and, where permitted, product updates. You can opt out of non-essential messages. Legal basis: contract and/or consent.
  • To measure, secure, and improve the App — analytics, crash reporting, fraud prevention, and stability and performance improvements. Legal basis: legitimate interest and/or consent, depending on the tool and your jurisdiction.
  • To comply with law — meeting legal, tax, and accounting obligations and responding to lawful requests. Legal basis: legal obligation (Art. 6(1)(c)) and/or legitimate interest.

We do not sell or rent your personal data, and we do not use it for third-party targeted advertising. The App does not access your device's advertising identifier (IDFA).

3. Third-Party Services We Share Data With

We share limited data with the trusted service providers ("processors") below, only as needed to run the App, each under appropriate data-protection terms. We do not sell your data to any of them.

  • Apple — App Store distribution, in-app purchases, Sign in with Apple, push notifications (APNs), and Apple Health/HealthKit (processed on your device).
  • Google — Sign in with Google, app analytics, crash reporting, app configuration and integrity checks, and secure cloud storage for the motion data described in Section 5.
  • Anthropic — powers the AI food-recognition feature; meal photos or descriptions you submit to the food scanner are sent to Anthropic to identify the food (see Section 6).
  • RevenueCat — manages and validates your subscription entitlements.
  • Adjust — measures app installs and marketing attribution (without accessing your device's advertising identifier).
  • TelemetryDeck — privacy-focused usage analytics.
  • Mailgun — delivers transactional emails such as password-reset codes and welcome messages.
  • Our hosting provider — the App's own backend (accounts, workouts, measurements, nutrition) is hosted on secured infrastructure located within the European Union.

We may also disclose data where required by law, court order, or lawful request, or where necessary to establish, exercise, or defend legal claims, or to protect the rights, safety, and security of our users, the public, or us.

4. Apple Health (HealthKit)

With your explicit permission, the App integrates with Apple Health to enhance your experience:

  • Data we may read (when you grant access): workouts, heart rate, activity summaries, active energy, exercise and stand time, body mass, height, body-fat percentage, and dietary values (protein, energy, carbohydrates, fat, and water).
  • Data we may write (when you grant access): workouts completed in the App, body measurements, and nutrition entries (protein, energy, carbohydrates, fat, and water).
  • Strict limitations: information obtained from Apple Health is used only to provide App features you request. We will never use Apple Health data for advertising, marketing, or data-mining, and we will never sell it or share it with third parties for those purposes.

Apple Health data is stored on your device and synced by Apple under Apple's own privacy terms. You can review or revoke the App's Health permissions at any time in the iOS Health app or Settings.

5. Motion Data and Repetition Counting

  • To automatically count repetitions, the App collects motion-sensor readings (accelerometer, gyroscope, and orientation values) from Apple Watch and, if used, from compatible AirPods/headphones during your workouts.
  • This motion data is uploaded to secure cloud storage so we can operate the feature and improve the accuracy of our repetition-counting models.
  • Motion data is linked to your account identifier only if you have enabled the option to help improve the App / model training in your settings. If that option is off, motion data is not associated with your identity.
  • You can disable motion tracking by declining or revoking the motion permission on your device, and you can turn off the improvement option at any time in settings.

6. Camera, Photos, and the AI Food Scanner

  • The food scanner uses your device camera to read product barcodes for quick nutrition logging.
  • For AI food recognition, a photo you take or select — or a text description of your meal — is sent to our AI provider (Anthropic) to identify the food and estimate its nutrition. This processing happens to return a result to you; the image is not retained by us after processing, and it is not used to build advertising profiles.
  • AI-generated nutrition results are estimates and may be inaccurate. Do not rely on them for medical, allergy, or other critical decisions.

7. Data Security

  • We use industry-standard safeguards, including encryption in transit (HTTPS/TLS), hashed passwords, access controls, and secured infrastructure, to protect your data.
  • No method of transmission or storage is completely secure. While we work hard to protect your information, we cannot guarantee absolute security, and you use the App at your own risk.

8. International Data Transfers

Your account data is stored on servers we operate within the European Union. Some of our service providers (for example, those in Section 3 based in the United States) may process certain data outside the European Economic Area (EEA). Where that happens, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses or an adequacy decision, to protect your data.

9. Data Retention

  • We keep your personal data for as long as your account is active or as needed to provide the App and the purposes described here.
  • When you delete your account (in the App's settings), we delete your associated personal data promptly and in any event within 30 days, except where we must retain limited information — for example, records needed to comply with legal, tax, or accounting obligations, to prevent fraud or abuse, or a record of your deletion request and any optional feedback you provide.
  • Data that is aggregated or anonymized so that it can no longer identify you may be retained and used without further notice.

10. Your Rights

Subject to applicable law, you have the right to:

  • Access, correct, or receive a copy of your personal data (portability).
  • Delete your account and personal data.
  • Restrict or object to certain processing, and withdraw consent at any time (without affecting processing already carried out).
  • Lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (UODO).

You can delete your account directly in the App's settings, or exercise any of these rights by emailing support@gethealthbuddy.com. We will respond within the timeframe required by law (generally one month).

11. Children's Privacy

The App is not intended for children. You must be at least 16 years old (or the minimum age of digital consent in your country) to use the App, or have verifiable parental or guardian consent. We do not knowingly collect personal data from children below that age; if we learn that we have, we will delete it promptly.

12. Changes to This Privacy Policy

We may update this Policy to reflect changes to the App, our providers, or legal requirements. We will post the updated version here and, where appropriate, notify you in the App or by email. The "Last updated" date above indicates the latest revision. Continued use of the App after changes take effect constitutes acceptance.

13. Contact Us

For any privacy questions or to exercise your rights, contact Bartłomiej Żabicki at support@gethealthbuddy.com.