LAFYA
Privacy & Data Consent Agreement
Plain-language disclosure of what we collect, why we collect it, and what you control.
Version 1.1 · Effective date: [DATE] · Last updated: [DATE]
1. What You're Agreeing To — Plain English First
Before the legal language, here's exactly what LAFYA does with your information in plain terms:
✅ What we DO
- Scan product barcodes and labels to show what is in them
- Track the ingredients and additives you encounter over time
- Record the daily check-ins you enter yourself
- Use all of the above to give you personalized coaching
- Send a summary of your data to our AI provider to generate coaching messages
❌ What we DON'T do
- Sell your health data to third parties
- Share your data with insurers or employers
- Use your data for advertising
- Access your camera for face scanning or take any biometric readings
- Make medical diagnoses or replace your doctor
2. What Data We Collect
LAFYA collects the following categories of information to operate the service:
| Data type | Examples | Why we collect it |
|---|---|---|
| Self-reported check-ins | Energy, sleep, digestion, alertness and stress (rated 1–5 in daily check-in) | To track how you feel over time and identify patterns |
| Product scans | Scanned barcodes and labels, detected ingredients and additive counts | To show what is in the products you scan |
| Supplement log | Supplement names and dates you enter yourself | To keep a record you can review |
| Derived insights | Descriptive patterns across your scans and check-ins | To show your own patterns back to you |
| Account data | Email address, display name, account preferences | To operate your account and communicate with you |
| Usage data | App screens visited, features used, session duration | To improve the app experience (never linked to health data for advertising) |
3. How We Use AI — What This Means for Your Data
LAFYA Coach, the personalized coaching feature, is powered by Google Gemini models, accessed through the Lovable AI Gateway. Here is exactly what happens when LAFYA Coach generates a message for you:
- Your data is assembled into a context package. This includes your recent scan history and check-in scores from the past 7–30 days.
- That package is sent to the model provider's API. It is transmitted securely over HTTPS. The provider processes it to generate your coaching message.
- Your data is not used to train models. Requests are processed and discarded by the provider under LAFYA's gateway terms.
- The coaching message is returned and displayed to you. LAFYA stores the generated message in your account history so your coach can reference prior conversations.
- Your raw health data stays on LAFYA's servers. Only a structured summary is sent to the provider per session — never your full account history in a single request.
Important: LAFYA Coach is not a medical provider
LAFYA Coach describes patterns in your own logged data. It does not diagnose conditions, prescribe medications, or replace the advice of a licensed healthcare provider. If you experience symptoms that concern you, please consult a doctor.
4. Who We Share Your Data With
LAFYA does not sell your data. We share data with the following service providers only to the extent necessary to operate the app:
| Party | What they receive | Why |
|---|---|---|
| Lovable AI Gateway (Google Gemini) | Structured health data summary per coaching session | To generate personalized coaching messages. Not used for model training. |
| [Cloud hosting provider] | Encrypted account and health data | Secure storage of your LAFYA account data. |
| Analytics (optional) | Anonymized usage events only — never health data | To understand how features are used and improve the app. |
5. Your Rights & Controls
You have the following rights over your data at any time:
View — Access your data
Download a full export of everything LAFYA holds about you from Settings → Data & Privacy → Export my data.
Edit — Correct your data
Update or correct any manually entered information at any time within the app.
Delete — Delete specific data
Remove individual check-ins, supplement entries, or scan results from your history at any time.
Full deletion — Delete your account
Permanently delete your account and all associated data: Settings → Account → Delete account. Deletion is permanent and irreversible. We will confirm deletion within 30 days.
Opt out — Opt out of AI coaching
You can disable LAFYA Coach entirely from Settings → Coach. When disabled, no data is sent to the AI provider. Product scanning and check-ins continue to work.
6. How Long We Keep Your Data
| Data type | Retention period | Reason |
|---|---|---|
| Scan history | Account lifetime or until deleted | Long-term pattern detection |
| Daily check-in data | Account lifetime or until deleted | Trend tracking and coaching personalization |
| Coach conversation history | 90 days rolling | Enables coach to reference recent sessions |
| Account data | Until account deletion | Required to operate your account |
7. Regulatory Disclosures
HIPAA
LAFYA is a direct-to-consumer wellness application and is not a HIPAA-covered entity. We are not a healthcare provider, health plan, or healthcare clearinghouse, and we do not have business associate relationships with covered entities. As a result, HIPAA does not govern this agreement. However, we apply equivalent standards of care to the handling of your health data.
California Residents (CCPA / CPRA)
If you are a California resident, you have the right to know what personal information we collect, the right to delete it, the right to correct it, and the right to opt out of sale or sharing. LAFYA does not sell personal information. To exercise your California rights, contact us at privacy@lafya.health.
EU / UK Residents (GDPR / UK GDPR)
Health data is a "special category" under GDPR requiring explicit consent. By tapping "I agree" below, you provide that explicit consent. Your legal basis for processing is Article 9(2)(a) — explicit consent. You may withdraw consent at any time by deleting your account. Withdrawing consent does not affect the lawfulness of processing prior to withdrawal. For data subject requests, contact privacy@lafya.health.
FTC Health Breach Notification
In the event of a data breach involving your health information, LAFYA will notify affected users within 60 days, consistent with the FTC's Health Breach Notification Rule.
8. Your Consent
By tapping "I agree" during LAFYA onboarding, you confirm that:
- You are 18 years of age or older.
- You have read and understood this agreement.
- You consent to LAFYA collecting and processing the health data described in Section 2.
- You consent to your data being sent to LAFYA's AI provider to generate coaching messages, as described in Section 3.
- You understand that LAFYA Coach is not a medical service and does not replace professional healthcare advice.
You can withdraw consent at any time
Disabling LAFYA Coach (Settings → Coach) stops all data from being sent to the AI provider immediately. Deleting your account (Settings → Account → Delete account) permanently removes all your data within 30 days. Neither action affects your right to use product scanning and check-ins independently.
9. Contact & Updates
For any privacy questions, data requests, or concerns:
Email: privacy@lafya.health
Response time: within 5 business days
If we make material changes to this agreement, we will notify you via in-app notice and email at least 14 days before the changes take effect. Continued use of LAFYA after that date constitutes acceptance of the updated agreement. If you do not accept the changes, you may delete your account before they take effect.