1. Who we are

YAZIO GmbH, Kartäuserstraße 13a, 99084 Erfurt, Germany (help@yazio.com), is responsible for the processing described in this policy (the “controller” under the GDPR).

Data protection officer: Prof. Dr. Gernot Schmitt-Gaedke, c/o lexTM GmbH, Friedensstraße 11, 60311 Frankfurt am Main, Germany. You can also reach the data protection officer through help@yazio.com; please mark your message “For the data protection officer”.

This policy covers the Yazio GLP-1 app (“the app”). The privacy policy of the main Yazio app does not apply to it. If you live in Washington, our separate Washington Consumer Health Data Privacy Policy also applies. Residents of Nevada and Connecticut: see section 10.

2. In short

• Your logs stay on your iPhone. Doses, injection sites, side effects, weight, protein and meals are stored on your device. We do not receive them.
• Your iCloud, not ours. If iCloud sync is on, Apple keeps a copy in your own iCloud account so your data appears on your other devices. We cannot access it. You can turn sync off at any time.
• No account. You do not need a Yazio account to use the app.
• Meal photos are sent only when you take one, and only after you agree, to estimate protein and calories. We do not store them.
• No advertising or analytics trackers. We do not sell your data, use it for advertising, or use it to train AI models.

3. Data that stays on your device

• Medication name, dose, time, injection site, or pill intake: stored on your iPhone; your iCloud, if sync is on. We do not receive it.
• Side effects, weight, protein, meals, streaks, stickers, onboarding answers: stored on your iPhone; your iCloud, if sync is on. We do not receive it.
• Reminder schedule: stored on your iPhone (local notifications). We do not receive it.
• Widget content (streak, next dose date): stored on your iPhone. We do not receive it.
• Apple Health data (see below): stored on your iPhone, in the Health app. We do not receive it.

Because we never receive this data, we cannot see, restore or export it for you. You control it on your device (see section 8). Storing it on your device is strictly necessary to provide the app (§ 25(2) No. 2 TDDDG).

Apple Health. If you connect Apple Health, the app reads your steps, active energy, protein and weight to show them in the app, and saves the protein entries and weigh-ins you log to Apple Health. This happens only on your iPhone, with the permissions you grant in Apple Health; we do not receive this data, and Apple Health data is never used for advertising or shared with third parties. You can change the permissions at any time in the Health app or in your iPhone settings.
 

4. Data we process

4.1 Meal photos (AI food estimate)

What: the photo you take or choose (cropped and reduced in size before upload), a random identifier created on your device, and technical data such as IP address and time.

Why: to estimate the foods, portions, protein and calories in your meal, which you can check and edit before saving; and to prevent misuse of the service (rate limiting by device identifier).

Legal basis: your explicit consent, which we ask for in the app before your first photo (Art. 6(1)(a) and, as far as a photo may reveal information about your health, Art. 9(2)(a) GDPR). You can withdraw it at any time in the app under Your Stuff → Photo analysis; logging meals without a photo keeps working.

Recipients (processors): Cloudflare, Inc. (runs our server function) and OpenAI, L.L.C. (AI model that produces the estimate).

Storage: we do not store photos. The photo is discarded once the estimate is returned. Under its API terms, OpenAI does not use data sent through its API to train its models and may keep it for up to 30 days to detect abuse before deleting it.

About the estimate: it is produced automatically and can be wrong. It is not a medical or dietary assessment.

4.2 Subscription and purchases

What: Apple handles payment. Through RevenueCat we receive an anonymous app user ID, the product purchased, purchase, trial and renewal dates, subscription status and store country, and technical information such as device type, operating system and app version. We do not receive your name, Apple ID or payment details.

Why: to unlock your subscription, restore purchases, manage trials, and produce subscription statistics.

Legal basis: performance of the contract with you (Art. 6(1)(b) GDPR). We use this information only to provide and manage the subscription you purchased; we do not combine it with information about your health and do not use it to draw conclusions about you.

Recipients: Apple (payment and App Store, as an independent controller) and RevenueCat, Inc. (processor).

Storage: for as long as you have a subscription with us and for 12 months after it ends. Records we must keep under tax and commercial law (such as invoices and payment records) are kept for up to 10 years.

4.3 Support requests

If you contact us, we process your name, email address and the content of your message to answer you (Art. 6(1)(b) or (f) GDPR). If you choose to tell us about your health, we process that information on the basis of your explicit consent given by sending it (Art. 9(2)(a) GDPR). Our customer support software provider processes these messages on our behalf as a processor. We delete support conversations 24 months after closing them.

4.4 App Store and crash data

Apple processes downloads, ratings and reviews under its own privacy policy. If you have chosen to share analytics with app developers in your iPhone settings, Apple gives us aggregated usage statistics and crash reports, which do not identify you.

5. What we do not do

• No advertising, no tracking tools, no sharing with advertising networks or data brokers
• No sale of your data
• No profiling and no automated decisions with legal or similarly significant effects (Art. 22 GDPR)
• No use of your data to train AI models, including large language models
• No medical advice, diagnosis or dose recommendations

6. International transfers

Cloudflare, OpenAI and RevenueCat are based in the United States. Transfers rely on the EU-US Data Privacy Framework where the recipient is certified under it, and otherwise on the EU standard contractual clauses (Art. 46(2)(c) GDPR).

7. How long we keep data

• Logs on your device and in your iCloud: Until you delete them; we never hold them
• Meal photos: Not stored by us; deleted by OpenAI within 30 days
• Subscription records: 12 months after your subscription ends; tax and accounting records up to 10 years
• Support messages: 24 months after the conversation is closed

8. Your rights and controls

Under the GDPR you have the right to access, rectification, erasure, restriction of processing, data portability and objection, and to withdraw consent at any time with effect for the future. You can also complain to a supervisory authority, for example the Thuringian State Commissioner for Data Protection and Freedom of Information (TLfDI) or the authority in your country.

In the app (Your Stuff):

• Delete all my data deletes your logs on this iPhone and the copy in your iCloud. It cannot be undone and does not cancel your subscription.
• iCloud sync turns the copy in your own iCloud on or off. When you turn it off, the copy in your iCloud is deleted and your data stays on this iPhone.
• Photo analysis lets you withdraw consent for AI meal estimates.
• Cancel your subscription in your App Store account settings.

If you delete the app without first using “Delete all my data” or turning off iCloud sync, a copy of your logs may remain in your iCloud. Reinstall the app and use one of these options to remove it.

For all other requests, contact help@yazio.com. Because you use the app without an account, we may ask for information that lets us find your data, such as the order ID from your App Store receipt.

9. Age

The app is intended for adults aged 18 and over.

10. Residents of US states

Washington. Our separate Washington Consumer Health Data Privacy Policy explains how we handle consumer health data under Washington’s My Health My Data Act and how to exercise your rights.

Nevada and Connecticut. Some information we process may be “consumer health data” under Nevada law (NRS 603A) and the Connecticut Data Privacy Act: the fact that you subscribe to a GLP-1 app, meal photos you choose to send for an estimate, and health information in support messages. Sections 4 to 7 describe what we collect, why, from which sources, and who receives it.

We collect this information only as necessary to provide what you request (your subscription, an answer to your message) and, for meal photos, after asking for your consent in the app before your first photo. You can withdraw consent for meal photos at any time under Your Stuff → Photo analysis or by contacting us.

We do not sell consumer health data, use it for targeted advertising, or use it for profiling.

You can ask us to confirm whether we process your consumer health data, give you access to it, including a list of the third parties we shared it with, delete it, and, in Connecticut, correct it or give you a portable copy.

To make a request, email help@yazio.com. We respond within the time limits of applicable law. If we decline your request, you can appeal by replying to our decision; if we deny your appeal, you can contact the Nevada Attorney General or the Connecticut Attorney General.

11. Changes

We will tell you in the app about material changes to this policy and ask for your consent again where the law requires it.