Helthfit Privacy Policy

Effective date: September 10, 2026 · Last updated: September 10, 2026

Helthfit ("we", "us", "our") is the nutrition and habit-tracking app and its website at helthfit.com. This policy explains what personal data the Helthfit app and website collect, why, and the choices you have. Helthfit provides general wellbeing guidance and is not a medical device or a source of medical advice.

1. Data we collect

Account data — your name, email address, and a securely hashed password.
Health & fitness data you enter — profile inputs (gender for calorie estimation, age, height, weight, activity level, goal), logged meals and their nutrition values, daily metrics (steps, exercise minutes, water, sleep, weight, waist), workout plans and sessions.
Subscription data — your subscription status and, for Google Play purchases, the purchase token used to verify the subscription with Google. Card details are handled by Google Play or Stripe and are never sent to or stored by us.
Care reports — if you choose to prepare a report for a clinician, the report contents (encrypted at rest) and the recipient email address.
Progress photos — if you add them, the image files you upload. They are held in access-controlled file storage, served only over short-lived signed links, and removed when you delete the photo or your account.
Technical data — IP address and coarse request metadata in security logs and an audit trail of privacy-relevant actions (sign-in, export, deletion, consent). We do not store health values in these logs.
Health platform data — if you connect Apple Health or Android Health Connect, only the specific data types you approve, used only to populate your in-app metrics. You can revoke access at any time.

We do not use advertising identifiers, we do not run third-party analytics or crash-reporting, we do not sell personal data, and we do not share it with data brokers.

2. Why we use it (legal bases)

To provide the service you asked for — performance of a contract.
To keep the service secure and prevent abuse — legitimate interests.
To process your subscription — performance of a contract.
Health and care-report data — processed only with your explicit consent, which you can withdraw at any time.

3. Third parties

Hosting / database — Fly.io (application hosting and the managed PostgreSQL database), with data stored in Frankfurt, Germany.
Open Food Facts and USDA FoodData Central — when you search or scan a food, the search text or barcode is sent to these food databases to retrieve nutrition information. No account data is sent.
Google Play Billing and/or Stripe — payment processing and subscription lifecycle.
Email delivery — a transactional email provider sends password-reset and account emails on our behalf.
Push notifications — if you allow notifications, Firebase Cloud Messaging (Google) delivers them to your device.

4. Retention

Account and health data are kept until you delete your account. Care reports expire 30 days after creation. Security and audit logs are kept for about 13 months. After deletion we remove your health data immediately and retain only a minimal tombstone record so the account cannot be re-created with the same identifier.

5. Your rights

You can access, correct, export, and delete your data:

Export — More → Export my data in the app, any time.
Delete — More → Delete account in the app, or, without installing the app, at /delete-account.html.
Depending on where you live you may also have the right to object to or restrict processing and to lodge a complaint with your data protection authority.

6. Security

Passwords are hashed with bcrypt. Sensitive fields (care-report contents, any stored health-platform credentials) are encrypted with AES-256-GCM. Data is transmitted over HTTPS. Access to production data is limited to authorised staff.

7. Children

Helthfit is not directed to children under 16 and you must be at least 16 (or the age of digital consent in your country) to create an account.

8. Changes

We will post any changes here and, for material changes, notify you in the app or by email before they take effect.

9. Contact

Helthfit · [email protected]