Back

Privacy Policy

Last updated: 1 October 2026

Hasan Ahmed ("we", "us", "our", the "Application Owner") operates HealthCal AI (the "Service"). We are the data controller for personal data processed through the Service. This Privacy Policy explains what we collect, why, who we share it with, and the rights you have. By using the Service you agree to this Policy.

Your health data, in plain language

Your health metrics — including blood pressure, blood glucose, testosterone, heart rate, oxygen saturation, body temperature, weight, sleep, and food history — are securely processed by our managed cloud database and Lovable AI exclusively to power your private dashboard, trends, calorie estimates, fitness plans, and optional AI coaching. They are never sold, rented, redistributed, or shared with unauthorized third parties, and we never use them to train third-party AI models.

1. Data we collect

  • Account data — email address, login credentials, and an account identifier used to create and secure your account.
  • Health profile data — age, gender, height, current weight, target weight, systolic and diastolic blood pressure, and selected program (90 or 180 days). Provided by you to generate your transformation dashboard.
  • Daily health readings — blood pressure, blood glucose, testosterone, resting heart rate, oxygen saturation, body temperature, weight, sleep, measurement context, notes, and timestamps that you choose to log.
  • Food images you upload — sent to a third-party AI provider (Google Gemini) to estimate calories and generate commentary, then discarded.
  • Scan & program history — counts, timestamps, AI outputs, and generated plans used to render your dashboard and enforce free-tier limits.
  • Subscription data — plan, status, and billing period for the subscription you purchase via Paddle.
  • Technical data — IP address, device/browser identifiers, and basic usage telemetry, used for security and to improve the Service.

2. Why we use it

  • Provide and operate the Service, including the AI calorie scanner and 90/180-day dashboard (contract performance).
  • Enforce free-tier limits and process subscriptions (contract performance).
  • Prevent fraud, abuse, and security incidents (legitimate interests).
  • Respond to support requests and improve the Service (legitimate interests).
  • Comply with legal obligations.

3. Who we share it with

  • Lovable Cloud — secure managed database, authentication, and storage for your account, health readings, and plans.
  • Lovable AI — receives only the inputs needed to generate calorie estimates, fitness plans, and optional health-coaching summaries.
  • Paddle.com — our Merchant of Record. Paddle handles payments, tax, invoicing, refunds, and subscription management.
  • Professional advisers and authorities — only where required by law.

We do not sell your personal data, do not share it with advertising networks, and do not permit any processor to use it for their own marketing.

4. International transfers

Some of our processors are located outside the UK and EEA. Where this is the case, we rely on Standard Contractual Clauses, adequacy decisions, or equivalent safeguards to protect your data.

5. Security

We use industry-standard technical and organisational measures to protect personal data, including encrypted transport (HTTPS/TLS), encrypted at-rest storage via Supabase, role-based access controls, and audit logging. No system is perfectly secure; you use the Service at your own risk and should keep your credentials confidential.

6. Retention

Account, health profile, and scan data are kept while your account exists. We delete or anonymise personal data when it is no longer needed for the purposes above, or earlier upon valid request. Billing records may be retained for as long as required by tax and accounting law.

7. Your rights

Subject to local law, you can request access to your data, rectification, erasure, restriction, portability, or object to processing. You can also withdraw consent and lodge a complaint with your supervisory authority. We aim to respond within one month. To exercise these rights, email healthcalai@gmail.com.

8. Cookies

We use only essential cookies and similar storage to keep you signed in and to remember session preferences. We do not use marketing or advertising cookies.

9. Children

The Service is not directed to children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided personal data, contact us and we will delete it.

10. Health information disclaimer

Health metrics you provide are processed to generate AI estimates and dashboards for educational and entertainment purposes only. They do not constitute medical records, and AI-generated insights are not medical advice. See our Terms of Service for the full disclaimer.

11. Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the Service or by email. Continued use after changes take effect constitutes acceptance.

12. Contact

Questions about this Privacy Policy: healthcalai@gmail.com.