Privacy Policy

Version 1.0 · Last updated: November 9, 2026 · Effective date: November 9, 2026

This Privacy Policy explains how SPERA STUDİO YAZILIM PAZARLAMA ANONİM ŞİRKETİ ("Spera Studio", "we", "us") handles personal data when you use Pia: GLP-1 Tracker ("Pia"), our iPhone app, the online services behind it, and when you contact us about Pia.

Pia is for adults aged 18 and over. It is available on the App Store in every country except Türkiye.

Related documents:

• Consumer Health Data Privacy Policy (for Washington, Nevada, Connecticut and other US residents): sperastudio.com/pia-health-privacy
• Terms of Use: sperastudio.com/pia-terms

You can open this policy at any time in the app under Settings › Privacy Policy.

Contents

• Summary
• 1. Who we are and how to reach us
• 2. Key terms
• 3. The data we collect
• 4. Where your data comes from
• 5. How we use your data and our legal bases
• 6. Your health data and your consent
• 7. AI meal analysis
• 8. Photos
• 9. Voice input
• 10. Barcode lookups
• 11. Doctor report
• 12. Reminders and notifications
• 13. Subscriptions and payments
• 14. App analytics and crash reports
• 15. Who receives your data
• 16. No sale, no targeted ads, no tracking
• 17. International data transfers
• 18. How long we keep data
• 19. How we protect your data
• 20. Signing out, deleting data and deleting your account
• 21. Getting a copy of your data
• 22. Your rights and how to use them
• 23. Information for specific regions
• 24. Children
• 25. Data breaches
• 26. Changes to this policy
• 27. Contact us

Summary

This is a short overview. The full sections below give the details.

• Who we are. Spera Studio, a company in Istanbul, Türkiye, makes Pia and is responsible for your data. Contact: [email protected].
• What we collect. Your account details from Sign in with Apple or Google (mainly your email address), the health information you enter (medication, doses, injection sites, weight, symptoms, mood, appetite, meals, water, notes), photos you add, your settings, and technical data such as IP addresses in our server logs.
• Health data only with your explicit consent. We ask for a separate consent before Pia stores any health data. You can withdraw it at any time; because Pia can't work without it, withdrawing deletes your account and its data.
• Where it is stored. On your iPhone and in your Pia account on servers in the United States run by our hosting provider, Supabase. Our team works from Türkiye.
• AI meal analysis is optional. Only after you allow it, the meal photo, label photo or description you choose is sent through our server to OpenAI in the US to estimate nutrition. You can turn it off in Settings › Privacy › AI Meal Analysis. OpenAI does not use it to train its models and may keep it for up to 30 days to detect misuse (longer only in the cases in section 7). Estimates can be wrong.
• Analytics and crash reports. Pia uses Google Analytics for Firebase to see how the app is used and Firebase Crashlytics to find crashes. Usage analytics is off in the EEA, the UK and Switzerland unless you turn it on, and on elsewhere. Crash reports are on everywhere. You can switch either off at any time in Settings › Privacy, and Pia works the same. Neither ever contains your health entries, photos or notes.
• What we never do. We do not sell personal data. We do not use health data for advertising or marketing. Beyond providing Pia to you, we use it only in de-identified, aggregated statistics that don't identify you (see section 5). We never use your photos for marketing. We do not track you across other companies' apps or websites, and Pia does not use your device's advertising identifier.
• Your doctor report is created on your iPhone. We never receive it. It leaves your phone only if you share it.
• You are in control. You can edit or delete entries, delete your whole account in the app (Settings › Account › Delete Account), and ask us by email for a free copy of your data.
• Things that may surprise you. Our servers log IP addresses. If your iPhone can't recognize speech on the device, Apple's servers may process what you say. Deleted data can stay in encrypted backups for up to 30 days and in server logs for up to 90 days. Apple and Google keep their own records under their own policies.

1. Who we are and how to reach us

Data controller

SPERA STUDİO YAZILIM PAZARLAMA ANONİM ŞİRKETİ (Spera Studio)
A joint-stock company incorporated in Türkiye
Registered office: Merdivenköy Mah. Dikyol Sk. B Blok No: 2B, Kadıköy, İstanbul, Türkiye
MERSİS No.: 0781117081700001 · İstanbul Trade Registry No.: 1155473 · Göztepe Tax Office, Tax ID 7811170817
Email: [email protected] · Phone: +90 553 291 44 24

Privacy Officer. Our Privacy Officer handles all privacy questions and requests. Write to "Privacy Officer, Spera Studio" at [email protected] or at the postal address above. For specific regions, the Privacy Officer also acts as our privacy officer under Québec law, our encarregado under Brazilian law, our data protection officer contact under Singapore law and our grievance contact under Indian law (see section 23).

2. Key terms

• Personal data means information about you as an identifiable person. Some laws call it "personal information".
• Health data means information about your physical or mental health. In Pia, we treat everything you log about your treatment and body as health data: medication and doses, injection sites, pain, weight, height, BMI, symptoms, mood, appetite, meals and nutrition, water, photos of your body and your notes.
• Your account is the Pia account you create with Sign in with Apple or Google. Pia requires an account.
• Settings means Pia's own Settings screen, which you open with the gear icon on the Profile tab. When we mean the iPhone's Settings app, we say "iOS Settings".
• Service providers (also called processors) are companies that handle data for us, on our instructions and under contract.
• Sync means copying your data between your iPhone and your account, so it is backed up and can be restored on another iPhone.

3. The data we collect

3.1 Overview table

"Contract" means the processing is needed to provide Pia to you under our Terms of Use. "Explicit consent" means the separate consent described in section 6 or section 7. Retention is explained in more detail in section 18.

3.2 Text you type

Several fields are free text: notes on doses, symptoms, check-ins and photos; medication and symptom names you create; meal names; and meal descriptions. We store whatever you type there. Please don't type information you don't want stored, such as other people's details.

3.3 Data that stays on your iPhone

Some data is kept only on your iPhone and never sent to us:

• The answers you give during setup before you create your account. They are sent to your account only when you create it. If you stop setup before that, they stay on your iPhone until you delete the app.
• Camera settings (timer, flash, guide, front camera), your photo display preference in Journey, a cached copy of your subscription status, sync bookkeeping and the date you last cleared your recent meals.
• Your notification permission and Pia's language, which are iOS settings.
• The generated doctor report (see section 11).

Pia does not store or sync your data in iCloud. Like other app data, what Pia keeps on your iPhone (including photos) can be included in backups of your iPhone that you make with iCloud Backup or a computer. Those backups are controlled by you and Apple.

3.4 What we do not collect

• We don't ask for your name. (If you sign in with Google, Google includes it in the sign-in data it sends; see row A above.)
• We don't collect your precise location. Pia has no location permission, and we remove location data from photos. Our server logs record only an approximate location, such as a country or city, derived from your IP address. Google Analytics, while it is on, does the same.
• We don't access your contacts or your full photo library. You pick photos one at a time with Apple's photo picker.
• We don't collect biometric identifiers. Pia doesn't analyze faces or bodies, measure body shape or create face or body templates. The camera's pose guide is a simple drawing.
• We don't use your device's advertising identifier (IDFA).
• We don't read Apple Health (HealthKit) data.
• We don't see or store your payment card details.
• We don't record or keep audio.

3.5 What happens if you don't provide data

You need an account to use Pia, so you must sign in with Apple or Google. To use the tracking features, you must give the health-data consent in section 6; Pia cannot track your treatment without it. Everything else is optional. If you skip an optional item, only the feature that needs it is unavailable. For example, without AI consent you can still enter meals by hand.

4. Where your data comes from

• From you: everything you enter, photograph, pick or say in Pia, and what you send us by email.
• From Apple or Google when you sign in: an account identifier and your email address. Apple may give a "Hide My Email" relay address. Google also sends your name and profile-picture link. Pia does not request your name from Apple.
• From Apple, through RevenueCat: your App Store purchases and subscription status.
• From OpenAI, through our server: nutrition estimates for the meals you choose to analyze.
• From Open Food Facts: product details for barcodes you scan.
• Automatically: technical data when the app talks to our servers. Also, only as described in section 14, analytics and crash data.

We don't buy personal data, and we don't receive data about you from data brokers or advertising networks.

5. How we use your data and our legal bases

We use personal data only to:

1. Provide Pia: your account, logging, history, charts, BMI, nutrition-goal estimates, Journey, reminders and the doctor report.
2. Sync and back up your data so it survives a new iPhone and appears on any iPhone you sign in to.
3. Estimate nutrition with AI, only if you allow it.
4. Manage subscriptions and give you the features you paid for.
5. Answer you and handle your privacy requests.
6. Keep Pia secure and working: prevent abuse, apply the daily limit on AI analyses and investigate problems.
7. Improve Pia and fix crashes using usage analytics and crash reports (see section 14) and de-identified, aggregated statistics (see below).
8. Meet legal obligations and protect our rights, for example to keep records of consent or respond to lawful requests.

The legal basis for each category is in the table in section 3.

Legitimate interests we rely on (GDPR Art. 6(1)(f)): keeping our servers and your account secure, preventing fraud and abuse, finding and fixing technical problems and crashes, and, outside the EEA, the UK and Switzerland, understanding how Pia is used through usage analytics (see section 14). We limit this data to technical and usage information. It never includes the content of your health records. You can object to this processing (see section 22).

De-identified and aggregated statistics. We combine data from many accounts, including health data, into statistics that show only totals and averages for groups of users. For example: how many people using a given medication keep logging after 30 days, which features people use, or which Pia Pro plans people choose. We use them to understand trends, improve Pia and run our business. They don't identify you, we don't try to re-identify anyone from them, and we don't sell them or use them for advertising. Your health-data consent covers this use (see section 6). Statistics already created stay after you delete your data or your account, because they don't identify you.

What we don't do with your data:

• We do not use health data for advertising or marketing. Beyond providing Pia to you, we use it only in the de-identified, aggregated statistics described above.
• We do not sell personal data or use it for targeted advertising.
• We do not use your personal data to train AI models, and our AI provider does not use it to train its models under the terms we use.
• We do not currently send marketing emails. If we ever do, we will ask first where the law requires it, and we will never use your health data to choose who receives them.

Automated decisions. We make no decisions about you that have legal or similarly significant effects based solely on automated processing. AI nutrition values and goal suggestions are estimates you can change. The daily limit on AI analyses is a technical limit that applies equally to everyone.

New purposes. We will not use your data for a new purpose that is incompatible with these purposes without telling you first and, where the law requires, asking for your consent. We will ask for your consent before using health data we already hold in a materially different way.

6. Your health data and your consent

Tracking your treatment is what Pia does, so most of what you enter is health data. Because of that, we rely on your explicit consent to process it (GDPR and UK GDPR Art. 9(2)(a), and similar rules elsewhere). In the United States, our Consumer Health Data Privacy Policy also applies.

How we ask. During setup, before your first health question, a separate full screen explains which health data Pia processes, why and how to withdraw, and links to the full consent statement. You give consent by tapping Agree and Continue.
This consent is separate from accepting our Terms of Use. We record the version of the consent text, your choice, and the date and time.

What it covers. Storing and using the health data listed in rows B to E and G of the table in section 3, on your iPhone and in your account, to provide Pia's features to you, and using it in the de-identified, aggregated statistics described in section 5. It does not cover AI meal analysis, which has its own optional consent.

If you don't give it. Pia cannot track your treatment without this consent, so you won't be able to use Pia. It is the only consent Pia depends on. We don't make AI analysis a condition of using Pia.

How to withdraw. Go to Settings › Privacy › Health Data and tap Withdraw Consent, or email [email protected]. Withdrawing does not affect the lawfulness of what we did before.

What happens when you withdraw. Pia can't work without this consent, so withdrawing it deletes your Pia account and its data, exactly like Settings › Account › Delete Account (see section 20), and we stop collecting health data. It doesn't cancel an App Store subscription; cancel that with Apple. If you want to keep your records, ask for a copy first (see section 21).

Our promises about health data. We use it to provide Pia's features to you and in the de-identified, aggregated statistics described in section 5. We do not sell it. We do not use it for advertising or marketing. We do not share it with anyone for their own purposes. We do not store it in iCloud.

7. AI meal analysis

Pia can estimate the nutrition of a meal from a photo of the meal, a photo of a nutrition label, or a description you type or say. This feature is optional.

Your permission comes first. The first time you start an analysis, Pia explains what is sent and to whom, and asks for your explicit permission. Nothing is sent until you tap Allow. We record your choice with the date, time and text version. You can withdraw at any time in Settings › Privacy › AI Meal Analysis. Without it, you can still enter meals by hand, scan barcodes and use your recent and favorite meals.

What is sent. Only for the analysis you start:

• the one photo, label photo or text description (up to 1,000 characters) you choose; photos are resized and their metadata, including location, is removed first;
• your language and region setting (for example "en-US"), so the results come back in your language;
• fixed instructions written by us.

The request goes from your iPhone to our server, and our server sends it to OpenAI. Our server checks that you are signed in and counts successful analyses against the daily limit. As with any request, our server logs record your IP address (see section 18).

What is not sent to OpenAI. Your name, email address, account ID, IP address, other entries or health records, and any identifier that links the request to you. OpenAI sees our server, not you. However, OpenAI does receive whatever is visible in your photo or written in your description. Please don't include people, faces, documents or details you don't want analyzed.

What OpenAI does with it. OpenAI (OpenAI OpCo, LLC, USA) processes the request as our service provider under its API data processing terms. Under the API terms we use, OpenAI does not use this content to train or improve its models. We tell OpenAI not to store the response for later use. OpenAI may keep requests and responses for up to 30 days to detect abuse, unless the law requires longer, and content its safety systems flag can be kept longer for review. Processing happens in the United States.

What we keep. Our server does not store the photo, description or answer. Our logs record only technical details such as the type of analysis, the model, whether it worked and how long it took. If you save the meal, the meal and its foods are stored like any other meal, and for photo and label scans the analyzed photo is stored with it (see section 8). If you cancel, nothing from the scan is kept.

Results are estimates. The values come from an AI model. They can be wrong, and they are not medical or nutrition advice. Check and edit them before you save. Don't rely on them for medical decisions; talk to your doctor.

8. Photos

Progress photos.

• You take them with Pia's camera or pick them with Apple's photo picker. Pia never gets access to the rest of your photo library.
• When you add a photo, Pia makes a new JPEG copy. This removes the original metadata, including location. Before that, Pia reads the original capture date to suggest a date for the photo.
• Progress photos are stored on your iPhone with iOS Data Protection and in your account in a private storage area that only your account can access.
• Pia doesn't analyze your photos. No face recognition, no body measurement and no AI. Progress photos are never sent to OpenAI.
• Photos leave your account only if you share them yourself with the iOS share sheet. Shared images carry no date, weight, dose or metadata.
• We never use your photos for marketing or advertising.

Meal and label photos. When you analyze a meal photo or a label photo, Pia keeps the analyzed version (resized, metadata removed) only if you save the meal. It is stored on your iPhone and in your account. Deleting the meal deletes its photo.

Deleting. Deleting a photo or meal removes the photo file from your iPhone and from our storage. Photo files are not part of our database backups.

9. Voice input

You can describe a meal out loud. Pia uses your microphone only while you are dictating, and only after you grant microphone and speech recognition permission in iOS.

Speech is turned into text by Apple's speech recognition. When your iPhone supports on-device recognition for your language, the audio is processed on your iPhone. Otherwise, Apple's servers process the audio under Apple's Privacy Policy. Pia never records, stores or sends the audio to us. Only the resulting text appears in the description box, where you can edit it before you analyze it.

If you don't want Apple to process your voice, type your description instead. You can turn off microphone or speech recognition access at any time in iOS Settings.

10. Barcode lookups

When you scan a barcode, Pia reads it on your iPhone. Your iPhone then asks Open Food Facts, an open food database run by a French non-profit association, for the product. Open Food Facts receives the barcode number, your IP address and the app's name and version. The product photo is loaded from Open Food Facts' servers.

This request goes directly from your iPhone to Open Food Facts, not through us. Open Food Facts handles it under its own privacy policy, which says it keeps IP logs for up to 3 years. Barcode lookups are not sent to AI. Open Food Facts data can contain errors, so check it before saving.

11. Doctor report

Pia can create a PDF summary for your healthcare provider.

• It is created on your iPhone. We never receive or store it.
• It contains only the period and sections you choose. Data from sections you leave out is not read. Pia doesn't put your name on it.
• It is saved in a temporary folder on your iPhone. iOS may clear it, and Pia deletes it when you sign out or delete your account.
• It leaves your iPhone only if you share it with the share button in the preview.

Once you share it, the recipient's own privacy practices apply. A healthcare provider may have its own legal duties for it, which can include HIPAA in the US.

12. Reminders and notifications

Dose reminders are local notifications scheduled on your iPhone. Pia does not use push notifications and does not collect a push token.

Pia asks for notification permission only if you choose to turn on reminders. Reminders work as an extra; you can use Pia without them. The notification text is generic ("Dose reminder" / "You scheduled a dose reminder for today.") and doesn't name your medication or dose, but it can appear on your lock screen. Your reminder setting and time are synced to your account so they come back on a new iPhone. You can turn reminders off in Pia or in iOS Settings.

13. Subscriptions and payments

Pia Pro is sold through Apple's App Store. Apple processes your payment. We never see or store your card details.

We use RevenueCat to manage subscriptions. RevenueCat receives your purchase and subscription transactions from Apple, linked to your random Pia account ID. We don't give RevenueCat your email, your name or any health data. Our server keeps a copy of your subscription status (whether Pro is active, the product, the store and the expiry date) and a short record of each subscription event (its ID, type and time). It does not keep the full event details.

You manage or cancel your subscription with Apple, in your Apple Account's subscription settings (on iPhone: Settings › your name › Subscriptions). Deleting Pia or your account does not cancel a subscription. Refunds are handled by Apple under Apple's policies. Apple keeps its own purchase records under Apple's Privacy Policy.

14. App analytics and crash reports

Pia uses two services from Google: usage analytics and crash reports. You can switch each off at any time in Settings › Privacy › Usage Analytics and Settings › Privacy › Crash Reports, and Pia works exactly the same either way. Each switch applies to the iPhone you set it on.

• Usage analytics is on by default, except in the EEA, the UK and Switzerland, where it stays off unless you turn it on. Pia uses your App Store country to decide; if it can't tell, usage analytics stays off.
• Crash reports are on by default everywhere.

When you change a switch while signed in, we record your choice with the date and time.

Usage analytics (Google Analytics for Firebase). While usage analytics is on, Pia sends Google information about how the app is used: which screens and features you open (for example, that an entry or a report was created, never what it contains), which setup steps you completed, subscription events (product, price, trial status), the app version, device model, iOS version, language and a random app-instance identifier. Google derives your approximate country, region and city from your IP address; Google states that it does not log or store the IP address itself.

Crash reports (Firebase Crashlytics). Unless you switch crash reports off, when Pia crashes it sends Google a technical report: the error and where in the code it happened, the app's state at the time (including, if usage analytics is on, the screens you had just used), device and iOS details, and random installation identifiers created by Crashlytics and Firebase. While crash reports are off, nothing is sent.

What we never send to Google. No medication names, doses, injection sites, weight, height, BMI, age, sex or goals, and no bands or ranges of them. No symptoms, mood or appetite. No meals, foods, nutrition values or AI results. No photos and nothing you type. No name, email, Pia account ID or Apple or Google account ID. This applies to event names, event details, user properties, crash logs and crash details alike. We do not use your setup answers to group or target users in Google Analytics.

Legal basis. In the EEA, the UK and Switzerland, usage analytics relies on your consent, which you give by turning it on (GDPR and UK GDPR Art. 6(1)(a), with the ePrivacy rules on device access). Elsewhere, we rely on our legitimate interest in understanding how Pia is used so we can improve it, where the law requires a legal basis. Crash reports rely on our legitimate interest in finding and fixing crashes and keeping Pia stable (Art. 6(1)(f)). You can switch either off at any time, which also works as an objection. We use this data only to understand how Pia is used, fix errors and improve the app. Turning a switch off doesn't affect processing before you did.

How it is set up.

• We use the version of Google Analytics that cannot access your device's advertising identifier (IDFA), and we turn off collection of the device's vendor identifier (IDFV).
• Google signals, ad personalization and all Google Analytics data-sharing settings are off. Pia is not linked to Google Ads or AdMob. We have opted out of Crashlytics Crash Insights, which would otherwise use crash data across apps.
• We don't attach a user ID to analytics or crash data, so it isn't linked to your name, email or account. It is still tied to random identifiers on your device, so we don't call it anonymous.
• Because this data is not linked with other companies' data for advertising and is not shared with data brokers, it is not "tracking" as Apple defines it.

Google's role and where the data goes. Google LLC processes this data as our processor and service provider: Crashlytics under the Firebase Data Processing and Security Terms, and Google Analytics under the Google Ads Data Processing Terms. Google may use the sub-processors it lists. Google may process the data in the United States and in other countries where it has facilities. For transfers from the EEA, the UK and Switzerland, Google's terms rely on the EU–US Data Privacy Framework (Google states that it complies with it) and on the Standard Contractual Clauses.

Retention and withdrawal. We set Google Analytics to keep user-level and event-level data for 2 months. Google deletes data past that period in a monthly process, so some of it can remain for a few more weeks. Google keeps aggregated reports, which don't identify you. Crashlytics deletes crash reports after 90 days. If you switch analytics off, collection stops, Pia resets the app-instance identifier on your iPhone and we use Google's deletion tools for the data already collected. If you switch crash reports off, collection stops and any crash reports not yet sent are deleted from your iPhone.

15. Who receives your data

We share personal data only as described below. Our service providers act on our instructions under written contracts.
Those contracts require them to protect your data at least as well as this policy describes, to use it only to provide their service to us, and to help us honor your rights. Apple, Google (for sign-in) and Open Food Facts act independently under their own privacy policies.

We do not give personal data to affiliates, data brokers, advertisers or social networks.

People you choose. When you share a photo, a comparison or a doctor report, you decide who receives it. Their own practices then apply.

Legal requests and safety. We may disclose personal data if we must by law, for example in response to a valid court order, or where it is necessary to protect someone's life or safety, or to establish, exercise or defend legal claims. Where the law allows, we will tell you first.

If our business changes. If Spera Studio is involved in a merger, acquisition or sale of assets, personal data may pass to the new owner, who must keep protecting it as this policy describes. We will tell you before that happens, and you can delete your account.

16. No sale, no targeted ads, no tracking

• We do not sell personal data, including consumer health data, and we have not done so.
• We do not share personal data for targeted or cross-context behavioral advertising. Pia shows no ads.
• We do not track you. We do not link data from Pia with data from other companies' apps, websites or offline sources for advertising or advertising measurement, and we do not share it with data brokers. Pia does not access your device's advertising identifier. That is why Pia doesn't show Apple's App Tracking Transparency prompt.
• We do not use health data for advertising or marketing, and we never use your photos for marketing.
• We do not disclose personal information to third parties for their direct marketing purposes.

17. International data transfers

Where your data goes.

• Your iPhone. Data you enter is stored there first.
• United States. Your account and synced data, including health data and photos, are stored by Supabase on Amazon Web Services servers in Northern Virginia. RevenueCat and OpenAI also process data in the US. So does Google, for Firebase analytics and crash reports.
• Türkiye. Spera Studio is based in Türkiye, and our team accesses data from there when needed for support, maintenance and security.
• France. Your iPhone contacts Open Food Facts directly when you scan a barcode.

Türkiye. When you use Pia, you give your data directly to us, a company based in Türkiye. Türkiye does not have an adequacy decision from the European Commission, and we treat it the same way under UK and Swiss law. Turkish law, including its rules on access by public authorities, may differ from the law where you live. We apply the protections in this policy to your data wherever we access it, and we limit access to what our work requires.

United States. For Supabase, OpenAI and RevenueCat we do not rely on the EU–US Data Privacy Framework. For Google, whose terms rely on the Data Privacy Framework (Google states that it complies), the Standard Contractual Clauses also apply. When we send personal data from the EEA, the UK or Switzerland to our US service providers, we use the European Commission's Standard Contractual Clauses, with the UK Addendum or UK International Data Transfer Agreement and the Swiss amendments as needed. The US has laws that can allow public authorities to access data. We choose providers with strong security, encrypt data in transit and at rest, and send each provider only what it needs.

Getting a copy. You can ask us for a copy of the safeguards we use (commercial details may be removed) by emailing [email protected].

18. How long we keep data

We keep personal data only as long as we need it for the purposes in this policy. Unless a row says otherwise, "until you delete your account" means we delete the data from our live systems as soon as your deletion is complete (see section 20).

We may keep specific data longer only where the law requires it or to establish, exercise or defend legal claims, and only for as long as needed.

19. How we protect your data

We use measures suited to sensitive health data, including:

• Encryption in transit: the app talks to our servers and service providers over encrypted (TLS) connections.
• Encryption at rest: our hosting provider encrypts stored data (AES-256).
• Account separation: database rules let each account read only its own records, and all changes go through checked server functions. Photos are in private storage areas that only your account can access.
• On your iPhone: sign-in tokens are kept in the iOS Keychain. Progress photos and the doctor report are stored with iOS Data Protection. Keep your iPhone locked with a passcode, because iOS uses it to protect app data.
• Least privilege: server keys stay on our servers and are never in the app. Our team accesses data only when needed.
• Minimal logging: our server logs exclude health content, meal photos, descriptions and AI answers.
• Data minimization: each provider receives only what it needs. For example, OpenAI gets no account details and RevenueCat gets no health data.
• Trusted providers: our main providers maintain independent security certifications such as SOC 2.

No system is perfectly secure. If something goes wrong, we will act as described in section 25.

20. Signing out, deleting data and deleting your account

Deleting single items. You can edit or delete entries, meals and photos in the app at any time.

Signing out (Settings › Account › Sign Out):

• Pia first tries to send any unsent changes to your account. If some can't be sent, Pia tells you and signs out only if you confirm that they will be lost.
• Pia then removes your account's data from that iPhone: records, photos and the doctor report.
• Your data stays in your account and comes back when you sign in again.
• Device settings such as camera preferences stay on the iPhone. Your consent choices belong to your account and are not carried over to another account on the same iPhone.

Deleting your account (Settings › Account › Delete Account). You can delete your account in the app; you don't need to contact us. When you confirm, our server:

1. revokes Pia's Sign in with Apple access (if you used Apple);
2. asks RevenueCat to delete your customer record;
3. deletes all your progress, meal and label photos from storage;
4. deletes your subscription event records;
5. deletes your account and everything linked to it: profile, health records, meals, preferences, consent records, subscription status and AI count.

Only after the server finishes does Pia erase everything on that iPhone, including settings and any setup answers, and cancel any pending reminder. If a step fails, the server stops and your account and the data on your iPhone stay, but steps already completed, such as revoking Apple sign-in access or deleting photos, are not undone. Pia tells you, and you can try again; the server then completes the remaining steps. Deletion is permanent.

What deletion doesn't do, and what may remain:

• It doesn't cancel your App Store subscription. Cancel it with Apple (see section 13).
• Backups and logs: deleted data stays in encrypted backups for up to 30 days and in server logs for up to 90 days. One log line records that your random account ID was deleted.
• After deletion we keep no record that links to your account, except these backups and logs.
• OpenAI may still hold recent AI requests for up to 30 days, or longer in the cases described in section 7.
• Apple keeps its purchase records. Google keeps listing Pia among the apps connected to your Google Account until you remove it in your Google Account's security settings.
• Open Food Facts keeps its logs under its own policy.
• Analytics and crash data are not linked to your account. Google deletes them on its own schedule: analytics event data after 2 months (in a monthly process) and crash reports after 90 days.
• De-identified, aggregated statistics stay, because they don't identify you.
• Anything you already shared, and backups of your iPhone made before deletion, are outside our control.

21. Getting a copy of your data

You can ask for a copy of your personal data at any time, free of charge.

• How: email [email protected], ideally from the email address linked to your Pia account. If you use Apple's Hide My Email, write from any address and tell us; we'll confirm through your account email, which Apple forwards to you.
• Identity check: we confirm the request through the email address linked to your account before sending anything.
• What you get: your account details, health records, meals, preferences, consent records and photos, in a commonly used, machine-readable format (such as JSON or CSV, with photos as JPEG files).
• Delivery: as an encrypted file or through a download link that expires.
• Timing: within one month (EU, UK and most countries), 45 days (United States) or 30 days (Switzerland), or sooner if your local law requires.

You can see and edit most of your data directly in the app.

22. Your rights and how to use them

Depending on where you live, you have some or all of these rights. We offer them to all users wherever we reasonably can.

• Access: confirm whether we process your data and get a copy, including information about how we use it and whom we disclose it to.
• Correction: fix inaccurate data. Most data can be edited in the app.
• Deletion: delete items or your whole account in the app, or ask us.
• Portability: receive data you gave us in a machine-readable format and have it sent to another service where technically possible.
• Withdraw consent: at any time, in Settings › Privacy or by email. Withdrawing your health-data consent deletes your account (see section 6). This doesn't affect processing before you withdrew.
• Object or restrict: object to processing based on legitimate interests, or ask us to limit processing in certain cases.
• No automated decisions: we don't make decisions about you based solely on automated processing that have legal or similarly significant effects.
• Opt out of sale, targeted advertising and profiling: we don't do any of these, so there is nothing to opt out of.
• Non-discrimination: we won't treat you differently for using your rights.
• Complain: contact us, and you can also complain to a data protection authority (see section 23).

How to make a request. Use the in-app controls, or email [email protected], or write to our postal address in section 1. You don't need to create an account to make a request.

Verification. To protect you, we confirm requests through the email address linked to your account. We ask only for what we need to verify you.

Authorized agents. Where the law allows, someone you authorize can make a request for you. We may ask for proof of authorization and confirm your identity directly.

Response times. We respond without undue delay:

• EU, EEA, UK and most other countries: within one month, extendable by up to two further months for complex or numerous requests (we'll tell you within the first month);
• United States: within 45 days, extendable once by 45 days (we'll tell you within the first 45 days);
• Switzerland: within 30 days;
• sooner where your local law requires.

Requests are free. If a request is manifestly unfounded or excessive, we may refuse it or, where the law allows, charge a reasonable fee; we'll explain why.

Complaints and appeals. If you're unhappy with how we handled your data or a request, tell us first at [email protected]. We will acknowledge your complaint within 30 days and tell you what we will do. US residents can appeal a decision (see section 23.4). You can also complain to the authority where you live, work or where you think the problem happened (see section 23).

23. Information for specific regions

The sections above apply everywhere. This section adds what specific laws require.

23.1 European Economic Area (GDPR)

• Controller: see section 1.
• Legal bases: see the table in section 3. Health data is processed on the basis of your explicit consent (Art. 9(2)(a)). AI meal analysis has its own explicit consent. Usage analytics is off unless you turn it on, which is your consent. Crash reports rely on our legitimate interests, and you can switch them off.
• Device storage: Pia stores on your iPhone only what the app needs to work. Google Analytics stays off until you turn it on; until then, nothing is sent to Google Analytics. Crashlytics is on unless you switch it off, and we use it only to find and fix crashes.
• Transfers: see section 17. Türkiye has no adequacy decision. Transfers to our US providers use the Standard Contractual Clauses.
• Rights: Articles 15 to 22 GDPR, as described in section 22. Withdrawing consent doesn't affect earlier processing.
• Complaints: you can complain to the supervisory authority in the EU or EEA country where you live, work or where the alleged infringement took place. Because we have no EU establishment, any authority can handle your complaint. The European Data Protection Board lists them at edpb.europa.eu.

23.2 United Kingdom (UK GDPR and Data Protection Act 2018)

• Controller: see section 1.
• Legal bases and rights: as for the EEA. Health data relies on your explicit consent.
• Transfers: for US providers we use the UK International Data Transfer Agreement or the UK Addendum to the Standard Contractual Clauses. We treat Türkiye as a country without UK adequacy regulations.
• Complaints: please complain to us first. We acknowledge complaints within 30 days, investigate and tell you the outcome without undue delay. You can also complain to the Information Commissioner's Office at ico.org.uk.

23.3 Switzerland (FADP)

• Controller: see section 1.
• Sensitive data: health data is sensitive personal data, which we process with your express consent.
• Disclosure abroad: your data is disclosed to Türkiye and the United States (and France, if you scan barcodes). For US providers we use the Standard Contractual Clauses with the amendments recognized by the Swiss Federal Data Protection and Information Commissioner (FDPIC).
• Access requests: answered within 30 days.
• Complaints: you can contact the FDPIC at edoeb.admin.ch.

23.4 United States

Consumer health data. Our Consumer Health Data Privacy Policy explains how we handle consumer health data under Washington's My Health My Data Act, Nevada's consumer health data law (SB 370) and Connecticut's data privacy law. We apply it to all US users.

Your state privacy rights. Many US states give residents rights over their personal data. Whether or not a state's law applies to us, we offer all US users the rights in section 22: to know and access (including what we've inferred and a list of the third parties we've disclosed data to), correct, delete, get a portable copy, withdraw consent, and appeal. We process sensitive data, including health data, only with your consent and only as needed to provide the features you use.

• Sale and targeted advertising: we do not sell personal data or use it for targeted advertising or profiling with legal or similarly significant effects, so no opt-out is needed.
• AI training: we do not use your personal data to train large language models.
• How to request: in the app or by email (see section 22). Authorized agents may submit requests.
• Response time: 45 days, extendable once by 45 days.
• Appeals: if we deny your request, you can appeal by replying to our decision or emailing [email protected] with "Appeal" in the subject. We will answer in writing within 45 days. If we deny your appeal, you can contact your state's Attorney General.

Do Not Track (California). Pia does not track you across third-party websites or apps over time, and we don't let third parties collect personal information about your activity across other websites or apps through Pia. Because we don't do that kind of tracking, we don't change our practices in response to "Do Not Track" browser signals.

Global Privacy Control. We do not sell or share personal data for targeted advertising, so a Global Privacy Control signal has nothing to opt you out of in Pia. If we receive a GPC signal from your browser on our online services, we treat it as a request to opt out of any sale or targeted-advertising sharing for that browser.

California "Shine the Light." We do not disclose personal information to third parties for their direct marketing purposes.

HIPAA. Spera Studio is not a "covered entity" or "business associate" under the US Health Insurance Portability and Accountability Act (HIPAA). HIPAA generally doesn't apply to what you enter in Pia. We protect it as this policy and our Consumer Health Data Privacy Policy describe, and as consumer health privacy laws require. If you share a report with your healthcare provider, the provider's own duties, which may include HIPAA, apply to its copy.

23.5 Canada, including Québec

• Privacy officer: our Privacy Officer (Responsable de la protection des renseignements personnels), Spera Studio, [email protected], at the address in section 1.
• Consent: we ask for your express consent for health data.
• Outside Canada: your data is stored and processed outside Québec and Canada, in the United States and Türkiye (see section 17). Laws there may allow authorities to access it. Before communicating personal information outside Québec, we assess whether it will be adequately protected.
• Complaints: contact us first. You can also complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, in Québec, the Commission d'accès à l'information (cai.gouv.qc.ca).

23.6 Australia

• Overseas disclosure: we disclose personal information to recipients in the United States and Türkiye (and France, if you scan barcodes), as described in sections 15 and 17.
• Access and correction: see sections 21 and 22.
• Automated decisions: Pia makes no automated decisions that could significantly affect your rights or interests. AI meal analysis produces estimates for you to review. The daily limit on AI analyses applies equally to everyone.
• Complaints: email us first. We'll respond within 30 days. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

23.7 New Zealand

We receive some information from third parties: your account identifier and email (and, with Google, name and profile-picture link) from Apple or Google, and your purchase and subscription status from Apple through RevenueCat (see section 4). You can complain to the Office of the Privacy Commissioner at privacy.org.nz.

23.8 Brazil (LGPD)

• Encarregado (data protection officer): our Privacy Officer, Spera Studio, [email protected]. You can write in Portuguese.
• Sensitive data: health data is dado pessoal sensível. We process it with your specific and highlighted consent, given on its own screen.
• Rights: the LGPD rights to confirmation, access, correction, anonymization, blocking or deletion of unnecessary data, portability, information about sharing, information about refusing consent, and withdrawal of consent.
• International transfers: to the United States and Türkiye, as described in section 17. We use the standard contractual clauses approved by Brazil's National Data Protection Authority (ANPD).
• Complaints: you can petition the ANPD at gov.br/anpd.

23.9 Japan (APPI)

• Business operator: Spera Studio, address in section 1. The name of our representative director is available on request.
• Special care-required information: we acquire health information only with your prior consent.
• Foreign transfers: your data is provided to recipients in the United States and Türkiye. The Personal Information Protection Commission publishes information about those countries' data protection systems at ppc.go.jp. Our service providers are bound by contract to protect your data with measures equivalent to the APPI, and we check that these measures continue. You can ask us for more information about them.
• Requests: you can ask us to disclose, correct, add to, delete, stop using or stop providing your retained personal data by emailing [email protected].

23.10 South Korea (PIPA)

Health information is sensitive information, which we process only with your separate consent. Your data is processed overseas, as listed below. You can refuse an overseas transfer by not using the related feature, withdrawing the related consent, or deleting your account; refusing transfers to Supabase means Pia can't provide your account.

Apple, Google (Sign-In) and Open Food Facts receive data directly as independent companies (see section 15). You can complain to the Personal Information Protection Commission (pipc.go.kr) or the KISA Privacy Center (privacy.kisa.or.kr).

23.11 India (DPDP Act)

You can access, correct, update and erase your personal data, withdraw consent as easily as you gave it (Settings › Privacy or by email), and raise a grievance with our Privacy Officer at [email protected]. If we don't resolve your grievance, you can complain to the Data Protection Board of India.

23.12 Singapore (PDPA)

Our data protection officer contact is our Privacy Officer at [email protected]. We transfer data abroad only to recipients bound to protect it to a comparable standard. You can complain to the Personal Data Protection Commission at pdpc.gov.sg.

23.13 Other countries

• Mexico: your health data is sensitive data (datos personales sensibles), processed only with your express consent. You can exercise your access, rectification, cancellation and opposition rights by email.
• Saudi Arabia: health data is sensitive data, processed only with your explicit consent. This policy is available in the app before you create an account. You can complain to the Saudi Data and AI Authority (SDAIA).
• Israel: whether each item is required or optional, and what happens if you don't provide it, is shown in section 3.
• South Africa: you can complain to the Information Regulator at inforegulator.org.za.
• Everywhere else: if your local law gives you more rights than this policy describes, we will honor them. Contact us.

24. Children

Pia is only for adults aged 18 and over and is not directed to children. During setup, Pia asks for your birth date and does not let anyone under 18 continue. We do not knowingly collect personal data from anyone under 18. If we learn that we have, we will delete the account and its data. If you believe a minor is using Pia, contact us.

25. Data breaches

If a security incident affects your personal data, we will investigate, take steps to limit the harm, and notify the authorities and affected users as the law requires, without undue delay. For example, the GDPR requires us to notify the competent authorities within 72 hours where notification is needed, and US rules, including the FTC Health Breach Notification Rule, may require us to notify you, the FTC and in some cases the media. We will tell you what happened, what data was involved, what we are doing and what you can do. We will contact you by email at the address linked to your account (Apple forwards messages to Hide My Email addresses) and, where we can, by a notice in the app.

26. Changes to this policy

We update this policy when our practices or the law change. The version number and dates at the top show the current version.

• For material changes, such as new data, a new purpose or a new recipient, we will tell you by email and, where possible, in the app at least 30 days before the change takes effect, unless the law requires a change sooner.
• Where a change needs your consent, for example a new use of health data, we will ask for it and won't apply the change to you without it.
• Minor changes, such as clearer wording, take effect when we publish them.

You can ask us for earlier versions of this policy.

27. Contact us

Privacy Officer, Spera Studio
SPERA STUDİO YAZILIM PAZARLAMA ANONİM ŞİRKETİ
Merdivenköy Mah. Dikyol Sk. B Blok No: 2B, Kadıköy, İstanbul, Türkiye
Email: [email protected]
Phone: +90 553 291 44 24

Version history