Privacy Policy

1. Who we are

Vitaminly is operated by [LEGAL ENTITY NAME] (“Vitaminly”, “we”, “us”), registered at [REGISTERED ADDRESS]. We are the data controller for the information described here.

For anything in this policy, reach us at hello@studioflorez.com.

2. What we collect

Account information

When you create an account we store your email address and an authentication credential. If you use Sign in with Apple or Google, we receive the identifier and email that service returns — including Apple's private relay address if you choose to hide your email. We never see your password for those services, and passwords for email sign-up are hashed by our authentication provider and are not readable by us.

Your cabinet and your logs

The supplements you add, their dosages and forms, how much stock you have left, and every dose you log with its timestamp. This is the core of the product; without it there is nothing to analyse.

Health profile

Optional details you enter yourself so the analysis means something: your health goals, time zone, and — if you provide them — conditions, medications, age range and similar factors. These drive the interaction checks and deficiency-risk estimates. You can use the app without entering any of it; you'll get generic analysis instead of personalised analysis.

Apple Health data

Only if you grant permission, and only these categories:

• Read: sleep analysis, heart rate, and dietary Vitamin C, Vitamin D, iron and calcium.
• Write: the same four dietary nutrients, so doses you log in Vitaminly appear in Apple Health.

You can revoke this at any time in iOS Settings → Health → Data Access & Devices. Revoking it stops the flow immediately; it does not retroactively delete data already synced, which you can remove by deleting your account.

Camera

The scanner needs camera access to read barcodes and labels. This processing happens on your device. We do not upload, store or transmit camera frames or photographs of your bottles. What leaves your device is the result — a barcode number or extracted product text — used to look the product up.

Guide conversations

Messages you send to the Vitaminly Guide, along with relevant context from your cabinet and health profile, are sent to an AI provider to generate a response. We also keep a per-day request count per user to enforce usage limits and prevent abuse. See section 5 for who processes these.

Technical information

Standard operational data: IP address and request metadata reaching our backend, app version, and error information needed to keep the service running and secure.

[CONFIRM] This policy assumes Vitaminly runs no third-party analytics or advertising SDKs. If you add crash reporting, product analytics or an attribution SDK, this section and section 5 must be updated before that build ships.

This website

This site sets no cookies and runs no analytics or tracking scripts. Fonts are loaded from Google Fonts, which means Google receives your IP address and user-agent when the page loads. Our host receives standard server logs.

3. What we never do

4. How we use it

• To run the app — keeping your cabinet, logs and streaks, and syncing them across your devices.
• To identify products you scan, by matching them against supplement databases.
• To generate analysis — interaction checks, duplicate actives, cumulative dosage ceilings and deficiency-risk estimates based on your profile.
• To answer your questions through the Guide.
• To send you dose reminders and Live Activities, if you enable them.
• To keep the service working and secure — debugging, abuse prevention and rate limiting.

[LAWYER: confirm lawful bases] Where GDPR applies, we rely on contract for running the app you signed up for, explicit consent for health data (Article 9(2)(a)), and legitimate interests for security and abuse prevention. You can withdraw consent at any time by revoking permissions or deleting your account.

5. Who we share it with

We use a small number of service providers. They process data on our instructions and may not use it for their own purposes.

[VERIFY BEFORE PUBLISHING] Confirm the current data-retention and model-training terms of your OpenRouter account and the downstream providers, and make sure training on your traffic is disabled. State the actual retention window here rather than a general assurance. If you sign a DPA with any provider, reference it.

We may also disclose information if legally required to, or to protect the rights and safety of our users — and if [LEGAL ENTITY NAME] is ever involved in a merger or acquisition, your information may transfer as part of that, in which case we will tell you before it happens.

6. Product lookups

When you scan a bottle, Vitaminly may query public supplement databases — the NIH Dietary Supplement Label Database, OpenFoodFacts and the FDA National Drug Code Directory — to identify the product.

These requests contain the barcode or product name only. They do not contain your identity, your account, or anything from your health profile. Those services will see the request and your IP address, as with any web request. Around 2,000 products are cached on your device, so many scans resolve without any network request at all.

7. Storage and retention

Your account data is stored on Supabase infrastructure in [REGION — e.g. US East]. We keep it for as long as your account exists.

• Account, cabinet and logs — kept until you delete your account, then removed as described in section 9.
• Cached product data on your device — expires after 7 days, with the cache capped at 100 MB and old entries evicted automatically.
• Guide usage counts — retained on a rolling daily basis for rate limiting.
• Server logs — [STATE RETENTION PERIOD].

8. Your rights

Depending on where you live you may have the right to access your data, correct it, delete it, export it in a portable format, restrict or object to processing, and withdraw consent. If you are in the EU or UK you also have the right to complain to your data protection authority; if you are in California, you have rights under the CCPA/CPRA including the right not to be discriminated against for exercising them.

Exercise any of these by emailing hello@studioflorez.com. We will respond within [30 DAYS / APPLICABLE PERIOD]. We may need to verify your identity first — for health data, that matters.

9. Deleting your account

You can delete your account and all associated data from inside the app, under Profile. No email, no support ticket, no retention offer.

Deletion removes your profile, cabinet and ingestion logs. Data written to Apple Health lives in Apple Health and is yours to remove there. Backups are purged within [BACKUP RETENTION WINDOW]. We may retain the minimum necessary to meet legal obligations or resolve disputes.

10. Security

Data is encrypted in transit over HTTPS and at rest by our hosting provider. Access to production data is restricted. API keys for third-party services are held in server-side edge functions and never shipped in the app, so they cannot be extracted from a device.

No system is perfectly secure, and we won't pretend otherwise. If we become aware of a breach affecting your personal data, we will notify you and the relevant regulator as required by law.

11. Children

Vitaminly is not intended for children under [13 / 16 — depends on your markets], and we do not knowingly collect their information. If you believe a child has given us personal data, email us and we will delete it.

12. International transfers

Our providers operate in the United States and elsewhere, so your information may be transferred outside your country. Where required, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses. [LAWYER: confirm mechanism per provider]

13. Changes to this policy

If we change how we handle your data we will update this page and move the “last updated” date. For material changes — a new category of data, a new provider, a new purpose — we will notify you in the app before the change takes effect, and where the law requires it, ask for consent again.

14. Contact

Questions, requests, or something in here that doesn't match what you're seeing in the app: hello@studioflorez.com.

[IF REQUIRED] If you are in the EU or UK and we are required to appoint a representative or Data Protection Officer, their details go here.

A reminder that isn't a privacy matter but matters anyway: Vitaminly is a wellness and organisation tool. It is not a medical device and does not diagnose, treat, cure or prevent any disease. Always talk to a qualified clinician before starting, stopping or changing a supplement or medication.