Privacy Policy

01Who we are

Healtly is provided by the company whose details are set out below. In this policy, “we” and “Healtly” refer to this company. For the purposes of the UK GDPR, the EU General Data Protection Regulation (GDPR) and the Turkish Personal Data Protection Law No. 6698 (KVKK), we are the data controller of your personal data.

02Scope

This policy covers the Healtly iOS app and the healtly.app website. Apple services such as the App Store, Apple Health and iCloud are, however, subject to Apple’s own privacy policy (opens in a new tab). If you use Sign in with Google, your Google Account is likewise subject to Google’s privacy policy (opens in a new tab).

03Data we process

Below you can see which data is kept where and who it is shared with.

So that the app also works offline, a copy of your account data is kept on your device and synced with your account when a connection is available. When you sign out, the copy on that device is deleted; your data stays in your account and comes back when you sign in again. If you back up your device to iCloud or to your computer, the copy on the device may be included in the backup as part of Apple’s backup service; your session key, however, is not included in backups and does not move to another device.

The app downloads the current food list from our server. Food searches are carried out on your device; what you search for is not passed on to us.

If you turn on meal reminders, your iPhone shows you a notification for meals whose time has passed without an entry. These reminders are scheduled on your device: the app on your device checks which meals you have logged, and no information is sent to our servers or to anyone else for this. You can turn reminders off at any time in the app under Profile › Meal Reminders, or on your iPhone under Settings › Notifications › Healtly.

We do not collect your location, your contacts or your advertising identifier; we do not track you in other apps or on other sites.

04Your account

You need to sign in to use Healtly; this way your plan and records are kept safely in your account and come back even if you change phones.

• Sign in with Apple: Apple sends us a user identifier it creates for you and, if you choose to share them, your name and email address. If you choose “Hide My Email”, we receive Apple’s relay address instead of your real address. Apple does not give us your password or any other details of your Apple account.
• Sign in with Google: Google sends us your Google Account ID, your name and your email address. We do not use or store any other information Google shares, such as your profile photo; Google does not give us your password or data such as your Gmail, contacts or files.
• Email and password: we receive your email address and the password you choose. Your password is not stored in plain text; only an irreversible hash of it is stored, and we cannot see it either. To confirm that the address is yours, and so that you can reset your password if you forget it, we send a 6-digit code to it that is valid for 10 minutes.
• Session: when you sign in, your device is given a random session key that is kept in your iPhone’s keychain; our server keeps only its hash. A session ends automatically 180 days after it was last used, and your open sessions are closed if your password is reset or changed.
• Linked sign-in methods: if the email address you sign in with through Apple or Google belongs to a Healtly account you created earlier, the sign-in methods are linked to the same account.
• Signing out and deletion: Profile › Account › Sign Out closes the session and deletes the copy on that device; your data stays in your account. Profile › Privacy and Data › Delete My Account permanently deletes your account and all of your data from our servers and from your device.

Because your account holds health data (such as your weight, height, age, meal, water and weigh-in records), we ask separately for your explicit consent to its processing when you create your account. This consent is separate from accepting the Terms of Use and is recorded together with the date it was given.

05Food recognition from photos

This feature is optional; you can also add your foods by searching for them or by hand. Before first use, the app explains the following to you and asks for your explicit consent; if you do not give your consent, no photo is sent. You can withdraw your consent at any time from the Profile › Privacy and Data section. When you use the feature, this is what happens:

• A downsized copy of the photo you take or choose from your photo library is sent to our server in Germany over an encrypted connection.
• The photo reaches our server together with your session; to prevent abuse, we apply a daily limit per account. Our server passes the photo to OpenAI for analysis or, if no response can be obtained from OpenAI, to Google’s Gemini service; in doing so it does not add your name, email address, profile details or account identifier.
• Our server does not save the photo or the analysis result. The result is returned to your device; the foods you choose to add to your diary are saved to your account like your other records.
• The providers may retain the content passed to them under their own terms — for example, for a limited period in order to prevent abuse. For details, you can see OpenAI’s privacy policy (opens in a new tab) and API data usage policies (opens in a new tab), and Google’s Gemini API terms (opens in a new tab) and privacy policy (opens in a new tab).

06Apple Health

If you give permission, Healtly shares the following data with Apple Health (HealthKit):

• What we write: the energy and macros (protein, carbohydrate, fat) of the foods you log, your water intake and your weight records.
• What we read: your daily activity (active energy, i.e. the calories you burn; step count; walking and running distance; exercise time), plus water records and weight measurements from other sources. These are shown to you on the app’s Diary and Progress screens; you can read below which of them are saved to your account.

Of what we read from Apple Health, only the active calories you burn and the weight measurements from other sources are entered in your diary, and so they are stored in your account like your other records. Step count, distance, exercise time and water records from other sources are only shown on screen and are not sent to our servers. Data from Apple Health is not used for advertising, marketing or profiling and is not sold; like the other records in your account it is stored only on our hosting provider’s servers and is not shared with any other third party. Healtly does not save this data to iCloud; if you back up your device to iCloud, the copy on your device may be included in Apple’s backup, as described above. You can change the permissions at any time on your iPhone under Settings › Health › Data Access & Devices, and you can use the Health app to delete the records Healtly has written. When you sign out, the records written to Health stay in place; when you delete your account, you can choose to remove them too.

07Purposes and legal bases

• Your account and the app’s core functions (signing in, plan, diary, tracking, syncing between devices): performance of the contract between us, namely the Terms of Use.
• Your health data (your body measurements, meal, water and weigh-in records): because this is special category data under the GDPR (and sensitive personal data under the KVKK), the explicit consent you give when you create your account. As the service works with this data, the way to withdraw your consent is to delete your account; withdrawal does not affect the lawfulness of the processing carried out before it.
• Food recognition from photos: performance of the contract between us, namely the Terms of Use. You start the feature, and the result comes back to you.
• Apple Health sync: your explicit consent, which you give on the iOS permission screen and can withdraw at any time.
• Meal reminders: your permission, which you give on the iOS notification permission screen and can withdraw at any time; the reminders are scheduled only on your device.
• Security, and detecting abuse and errors (technical logs): our legitimate interest in keeping the service secure and running.
• Responding to support requests: the steps needed to fulfil your request, and our legitimate interest.
• Complying with our legal obligations: to the extent required by the legislation we are subject to.

We do not sell your data; we do not use it for profiling or targeted advertising. Plan calculations and AI estimates are for information purposes: we do not make automated decisions about you that produce legal or similarly significant effects.

08Sharing and international transfers

We share data only with the following parties, who help us provide the service:

• Hetzner Online GmbH (Germany): hosts our servers and the data in your account. Privacy policy (opens in a new tab)
• Resend, Inc. (United States): sends the verification and password reset codes when you sign in with email; it processes only your email address and the content of the email. Privacy policy (opens in a new tab)
• RevenueCat, Inc. (United States): the infrastructure we use to track your subscription. It processes App Store purchase records (plan, dates, price, country) together with a random identifier for your account and the app and operating system version; it does not receive your name, email address or health data. Privacy policy (opens in a new tab)
• OpenAI and, as a fallback, Google (United States): analyse your food photo only when you use photo recognition.
• Apple: operates Sign in with Apple, purchases, the App Store and, if you give permission, Apple Health; it processes this data on its own behalf and in accordance with its own policy.
• Google: if you use Sign in with Google, Google operates the sign-in screen and confirms your identity to us; it processes your sign-in data on its own behalf and in accordance with its own policy.
• Cloudflare and Google (United States): only when you email our support address. Cloudflare forwards your message to our mailbox, which is hosted by Google.
• Competent authorities: only when, and to the extent that, a legal obligation requires it.

Our company is in the United Kingdom, and our servers and the data in your account are in Germany (European Union); the AI providers may process images, our email provider Resend may process account emails, our subscription infrastructure RevenueCat may process subscription records, and Cloudflare and Google may process support correspondence, in the United States. For this reason, the data in your account, your subscription records, your email address and, when you use photo recognition, your image may be transferred outside the country you are in. If you use Healtly from Türkiye, this is an international transfer within the meaning of Article 9 of the KVKK. For these transfers we rely on the safeguards provided for by the legislation in force — adequacy decisions and the standard contractual clauses entered into with the providers.

09Retention periods

• Data in your account: is kept for as long as your account is open. When you use the Delete My Account option in the app, your account and all of your data are deleted from our servers immediately and permanently; copies remaining in backups kept for technical reasons disappear within the backups’ normal cycle.
• Subscription records: when you delete your account, your record at RevenueCat is deleted too. Apple keeps your purchase history in accordance with its own policy.
• The copy on your device: is removed from your device when you sign out, delete your account or delete the app; copies in device backups are subject to Apple’s backup settings.
• Sessions: are deleted 180 days after they were last used, when you sign out or when you delete your account. Email verification and password reset codes are valid for 10 minutes and are deleted shortly afterwards.
• Food photos: are not stored on our servers and are processed only while the analysis request is in progress. The providers’ retention periods are subject to their own terms.
• Technical logs: are kept for the limited period needed for security and debugging, and are then deleted.
• Support correspondence: is kept until your request is resolved and, after that, for a reasonable period in case of follow-up questions.

10Security

• All connections between the app and our servers are encrypted (HTTPS/TLS).
• Your password is stored only as an irreversible hash, and our server keeps only the hash of your session key. Failed sign-in attempts are limited.
• The data in your account can be reached only through a session opened with your account; each request reaches only that account’s data.
• The copy on your device sits in the protected area that iOS sets aside for apps, and your session key in your iPhone’s keychain. We recommend that you protect your device with a passcode, Face ID or Touch ID and, if you sign in with email, choose a password you don’t use anywhere else.

No system is completely secure. If a breach affecting your personal data occurs, we will make the notifications required by the legislation.

11Your rights

You can exercise most of your rights directly from within the app:

• Deleting your account and data: in the app, Profile › Privacy and Data › Delete My Account permanently deletes your account and all of your data from our servers and from your device; if you wish, the records Healtly has written to Apple Health are deleted as well. Deleting the app removes only the copy on the device; your account and the data in it remain.
• Accessing and correcting your data: you can view, edit or delete your profile details and records in the app. If you would like a copy of the data in your account, just write to us.
• Withdrawing your consent for health data: all you need to do is delete your account.
• Withdrawing your photo consent: all you need to do is turn off the “Food Recognition from Photos” switch under Profile › Privacy and Data.
• Apple Health: you manage the permissions and records from the Health app on your iPhone.
• Reminders: you turn them on and off under Profile › Meal Reminders, or on your iPhone under Settings › Notifications › Healtly.
• Subscription: you manage and cancel it from your App Store account settings.

For requests other than these, you can write to destek@healtly.app. We will respond to your request within 30 days at the latest; we may ask for additional information to verify your identity.

United Kingdom and European Union

Under the UK GDPR and the EU GDPR, you have the right to access your data, to ask for it to be corrected and erased, to ask for processing to be restricted, to object to processing, to ask for your data to be ported, and to withdraw the consent you have given at any time. If you are not satisfied with our response, you can lodge a complaint with the Information Commissioner’s Office (ICO) (opens in a new tab) in the United Kingdom or, in the EU, with the data protection authority (opens in a new tab) of the country where you live.

Türkiye

Under Article 11 of the KVKK, you have the following rights:

• to learn whether your personal data is processed and, if it has been processed, to request information about it;
• to learn the purpose of the processing and whether the data is used in accordance with that purpose;
• to know the third parties to whom it is transferred, within the country or abroad;
• to ask for it to be corrected if it has been processed incompletely or inaccurately, to ask for it to be erased or destroyed when the conditions are met, and to ask for the third parties to whom it has been transferred to be notified of these operations;
• to object to a result to your detriment arising from its analysis exclusively by automated systems;
• to claim compensation for your damage if you suffer damage as a result of unlawful processing.

You can send your application to the email address above. If you are not satisfied with our response, you have the right to lodge a complaint with the Turkish Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) (opens in a new tab).

United States

We do not sell your personal information and do not share it for behavioural advertising purposes. If the laws of the state where you live give you rights such as the right to know, to correct, to delete and not to be discriminated against for exercising these rights, you can exercise them via the address above.

12Children

Healtly is not designed for anyone under 18; if you are under 18, you should not use the app. We do not knowingly collect data from anyone under 18. If you become aware of such a situation, write to us; if we hold any data, we will delete it.

13Our website and cookies

healtly.app does not use cookies; it contains no analytics, advertising or social media trackers. Fonts are loaded from our own server; no request goes to a third-party service. The information you enter into the “Try your plan” calculator is processed in your browser; it is not sent to us. When you visit the site, our server may keep the technical logs described above.

14Changes

We may update this policy as the app evolves. The current text is always on this page, and the date at the top changes. We will separately announce, in the app or on this site, updates that significantly change the way we process your data.

15Contact

You can reach us with any question or request about privacy: