Consumer Health Data Privacy Policy

Version 1.0 · Last updated: November 9, 2026 · Effective date: November 9, 2026

This policy explains how SPERA STUDİO YAZILIM PAZARLAMA ANONİM ŞİRKETİ ("Spera Studio", "we", "us") collects, uses and shares consumer health data through the iPhone app Pia: GLP-1 Tracker ("Pia").

It is written for Washington's My Health My Data Act, Nevada's consumer health data law (Senate Bill 370) and the consumer health data provisions of the Connecticut Data Privacy Act. We apply it to everyone in the United States who uses Pia.

It supplements our Privacy Policy (sperastudio.com/pia-privacy). Where the two differ on consumer health data, this policy applies.

Contents

• 1. Who we are
• 2. Consumer health data we collect
• 3. Where we get it
• 4. Why we collect and use it
• 5. Consumer health data we share, and with whom
• 6. Consent
• 7. Your rights
• 8. How to use your rights
• 9. Appeals
• 10. No geofencing
• 11. How we protect consumer health data
• 12. Changes to this policy
• 13. Contact us

1. Who we are

SPERA STUDİO YAZILIM PAZARLAMA ANONİM ŞİRKETİ (Spera Studio), a joint-stock company incorporated in Türkiye
Merdivenköy Mah. Dikyol Sk. B Blok No: 2B, Kadıköy, İstanbul, Türkiye
Email: [email protected] · Phone: +90 553 291 44 24

"Consumer health data" means personal information that is linked or reasonably linkable to you and that identifies your past, present or future physical or mental health, including information inferred or derived from other data.

2. Consumer health data we collect

Because Pia is a GLP-1 medication tracker, we treat all of the following as consumer health data:

• Medication and treatment: the medication you take (including a name you type), whether it is an injection or a pill, the injection device, your dose and unit, your dosing schedule, your treatment start date, and each dose you log with its date, amount, optional injection site, pain level and note.
• Body measurements: height; starting, current and goal weight; your weight entries; your weekly weight-loss pace and activity level. We also use your birth date and sex together with these.
• Symptoms and well-being: symptoms you log and their severity, symptom names you create, appetite, mood, whether you felt good that day, and notes.
• Nutrition and water: meals (time, name, type, calories and nutrients, foods and portions), favorite meals, nutrition and water goals, and water you log.
• Photos: progress photos of your body with their date and note, and photos of meals and nutrition labels you save.
• AI meal analysis: only if you allow it, the meal photo, label photo or description you choose to analyze, your language setting, and the nutrition estimate returned.
• Voice input: what you say while describing a meal. Apple's speech recognition turns it into text; we never receive or store the audio.
• Information we derive: BMI, weight change, treatment week, nutrition-goal estimates, trends and summaries in the app, and the AI nutrition estimates you save. Your doctor report is created on your iPhone from this data; we never receive it.
• Information that can show you use a GLP-1 tracker: your account details (email address and account identifiers), your subscription status, technical data such as IP addresses in our server logs, your daily count of AI analyses, and app usage events and crash reports (on by default; you can switch them off). Usage events and crash reports never contain your health entries, photos or notes, but because they come from a GLP-1 tracking app they can indicate that you use or are considering a prescription medication.
• Your consent choices: records of the consents you gave or withdrew.

We do not collect precise location, biometric data (Pia does not analyze faces or bodies), genetic data or data from Apple Health.

3. Where we get it

• From you: what you enter, photograph, pick with Apple's photo picker or say in Pia, and what you email us.
• From your iPhone: technical data when the app talks to our servers. Usage events and crash reports, unless you switch them off.
• Derived by Pia: calculations and summaries made from what you enter, such as BMI and trends.
• From OpenAI, through our server: nutrition estimates for meals you choose to analyze.
• From Open Food Facts: product details for barcodes you scan.
• From Apple or Google: your account identifier and email address when you sign in, and, from Apple through RevenueCat, your subscription status.

4. Why we collect and use it

We collect and use consumer health data only to:

• provide Pia's features to you: logging doses, weight, symptoms, meals, water and photos; showing your history, charts, BMI, nutrition goals and Journey; scheduling the dose reminders you set; and creating your doctor report on your iPhone;
• store, sync and back up your data in your account, so it is available on any iPhone you sign in to;
• estimate meal nutrition with AI, only if you allow it;
• manage your subscription;
• answer your questions and requests;
• keep Pia secure: prevent abuse, apply the daily limit on AI analyses and fix problems with our servers;
• understand how Pia is used and fix crashes with usage analytics and crash reports, which you can switch off at any time;
• create de-identified, aggregated statistics: totals and averages for groups of users, for example how many people using a given medication keep logging after 30 days, which features people use or which Pia Pro plans people choose, to understand trends, improve Pia and run our business. They don't identify you, and we don't try to re-identify anyone from them. Statistics already created stay after you withdraw consent or delete your account;
• comply with the law.

We do not sell consumer health data. We do not use it for advertising or marketing, we analyze it only in the de-identified, aggregated statistics above, and we do not use it to train AI models.

5. Consumer health data we share, and with whom

We do not share consumer health data with affiliates, and we do not share it with any third party for that party's own purposes, such as advertising.

Service providers (processors). These companies process consumer health data only on our instructions, under contracts that limit their use of it. Disclosing data to them is not "sharing" under Washington law, but we list them so you know where your data goes.

When you ask for a feature that needs it. These companies receive data directly and handle it under their own policies, only when you use the feature:

When the law requires it. We may disclose consumer health data if the law requires us to, for example under a valid court order.

6. Consent

Consent to collect. Before your first health question, Pia asks for your consent on its own full screen. The screen tells you which categories of data Pia collects, why (including the de-identified, aggregated statistics in section 4) and how to withdraw, and links to the full consent statement. You give consent by tapping Agree and Continue. Accepting our Terms of Use is not consent; it is a separate step. We record your choice with the date, time and version of the text.

Optional features and settings. AI meal analysis asks for its own consent before the first analysis.
Usage analytics and crash reports are on by default, and you can switch either off at any time in Settings › Privacy. None of these is a condition of using Pia.

Consent to share. We share consumer health data only as described in section 5. If we ever want to share it for another purpose, we will first ask for your separate consent, describing what we would share, with whom and why.

No sale. We do not sell consumer health data. Selling it would require your signed, separate authorization, and we do not ask for one.

Withdrawing consent. You can withdraw any consent at any time in Pia's Settings › Privacy (open the Profile tab, then the gear icon) or by emailing [email protected].

• Pia can't work without your health-data consent, so withdrawing it deletes your Pia account and its data, as described in section 7, and collection stops. It doesn't cancel an App Store subscription.
• Withdrawing AI consent stops AI analysis. You can still enter meals by hand.
• Switching off usage analytics stops collection and resets the analytics identifier on your iPhone, and we use Google's deletion tools for data already collected. Switching off crash reports stops collection and deletes unsent reports from your iPhone.

7. Your rights

You have the right to:

• Confirm and access: know whether we collect, share or sell your consumer health data, and get a copy of it, together with a list of every third party and affiliate we have shared it with or sold it to and an email address or other online way to contact each of them. (We have no affiliates that receive it, and we have not sold it.)
• Delete: have your consumer health data deleted. You can delete your whole account in the app at Profile › Settings › Account › Delete Account. Deletion removes the data from our hosting provider, revokes Pia's Sign in with Apple access and asks RevenueCat to delete your customer record. Copies in our encrypted backups are overwritten within 30 days, and server logs within 90 days, well within the 6-month limit the law allows. AI requests that OpenAI holds are not linked to your account and are kept for up to 30 days, or longer only if the law requires it or OpenAI's safety systems flag them for review. Google deletes analytics data within 2 months and crash reports within 90 days. Where the law requires, we also tell other third parties that received your data about your deletion request.
• Withdraw consent: at any time, as described in section 6.
• Correct: fix inaccurate data. You can edit most entries in the app.
• Get a portable copy: receive your data in a commonly used, machine-readable format.
• Opt out of sale, targeted advertising and profiling: we do none of these, so there is nothing to opt out of.
• Not be discriminated against for using these rights.

8. How to use your rights

• In the app: delete entries, photos or your account; change your consents in Settings › Privacy.
• By email: write to [email protected]. You don't need to create an account to make a request.
• By mail: Spera Studio, Merdivenköy Mah. Dikyol Sk. B Blok No: 2B, Kadıköy, İstanbul, Türkiye.

Verification. We confirm requests through the email address linked to your Pia account. If you use Apple's Hide My Email, Apple forwards our message to you.

Authorized agents. Someone you authorize can make a request for you where the law allows. We may ask for proof of the authorization and confirm the request with you.

Timing. We respond within 45 days of receiving your request. If we need more time, we may extend this once by another 45 days and will tell you why within the first 45 days.

Cost. Requests are free. The law lets us charge for more than two requests a year; we don't.

9. Appeals

If we decline your request, in whole or in part, you can appeal. Reply to our decision or email [email protected] with "Appeal" in the subject line, and tell us which request you are appealing.

We will answer your appeal in writing within 45 days of receiving it, explaining what we did and why.

If we deny your appeal, you can contact the Attorney General of your state:

• Washington: Washington State Office of the Attorney General, online complaint form at atg.wa.gov/file-complaint
• Nevada: Office of the Nevada Attorney General, ag.nv.gov
• Connecticut: Office of the Connecticut Attorney General, portal.ct.gov/ag

10. No geofencing

Pia does not collect your precise location and has no location permission. Our server logs, and Google Analytics while it is on, record only an approximate location, such as a country or city, derived from your IP address. We do not use geofences, around health care facilities or anywhere else, to identify, track, collect data from or send messages to anyone.

11. How we protect consumer health data

We limit access to consumer health data to the people and service providers who need it to provide Pia. Data is encrypted in transit and at rest. Our database rules let each account read only its own records, and photos are kept in private storage areas that only your account can access. Our service providers may use consumer health data only as our contracts allow. More detail is in section 19 of our Privacy Policy.

12. Changes to this policy

Before we collect a new category of consumer health data, use it for a new purpose or share it in a new way, we will update this policy and ask for your consent. We will tell you about material changes by email and, where possible, in the app at least 30 days before they take effect. The version and dates at the top show the current version.

13. Contact us

Privacy Officer, Spera Studio
Merdivenköy Mah. Dikyol Sk. B Blok No: 2B, Kadıköy, İstanbul, Türkiye
Email: [email protected] · Phone: +90 553 291 44 24