Privacy Policy

Hewett Health ("the App") is a personal fitness and nutrition tracking application. This Privacy Policy explains what information the App collects, how it is used, and your rights in relation to that information.

1Information we collect

Hewett Health collects the following information — either provided by you, accessed with your permission, or collected automatically to operate and improve the App:

• Personal profile data (first name, age, height, weight, biological sex, fitness goals)
• Workout logs (exercises, sets, reps, weight, dates)
• Nutrition data (foods logged, calories, macronutrients)
• Bodyweight entries and personal records
• Sleep logs and fasting timer data
• Location data, used for GPS activity and route tracking (see Section 4)
• Health and fitness data read from Apple Health or Health Connect, with your permission (see Section 5)
• Photos you choose to submit for AI food scanning (processed in real time, not stored)
• Your email address, if you choose to create an account for cloud backup (see Section 3)
• Anonymous usage and analytics data — app interactions, feature usage, and funnel and performance events — collected via PostHog to help us improve the App (see Section 8)

2How your data is stored

By default, all of your personal logs and health data are stored locally on your device using the device's local app storage, and the App does not require an account to use any of its core features.

If you choose to create an account (see Section 3), your data is additionally backed up to our secure cloud database so it can be restored if you change or reinstall your device. Creating an account is entirely optional — the App works fully offline without one.

3Account creation and cloud backup (optional)

Hewett Health offers an optional account feature so you can back up your data and restore it on a new device. If you choose to sign in:

• You provide only your email address — we do not use passwords. You sign in with a one-time 6-digit code sent to your email.
• Your account is created and authenticated using Supabase, a database and authentication provider. Your data is stored on Supabase's infrastructure in the EU (London, UK).
• Sign-in code emails are delivered using Resend, an email delivery service.
• Once signed in, the App backs up the workout, nutrition, sleep, weight, and other logged data described in Section 1 to your account so it can be restored on any device you sign into.
• Your cloud-stored data is private to your account and protected by row-level security — it cannot be accessed by other users, and is not sold, shared, or used for advertising.

You can sign out at any time without losing your local data, and you can permanently delete your account and all associated cloud data from within the App (see Section 12).

Supabase's privacy policy: supabase.com/privacy. Resend's privacy policy: resend.com/legal/privacy-policy.

4Location data

Hewett Health accesses your device's location to provide GPS-based activity tracking and to display your route on the map within the Activity feature.

Background location: With your permission, the App continues to track your location in the background — that is, while the App is minimised or your device is locked — so that your route and distance keep recording for the duration of an activity such as a run, walk or cycle. Background tracking only occurs while you have an activity actively in progress, and stops when you end the activity.

Your location and route data are stored locally on your device as part of your activity history and, if you have created an account, backed up to your cloud account as described in Section 3. Location data is never sold, never shared with third parties for advertising, and is never used for tracking purposes.

5Health & fitness data (Apple Health / Health Connect)

With your explicit permission, the App reads health and fitness data from Apple Health (on iOS) or Health Connect (on Android) to calculate your daily wellness scores and display your metrics. This may include steps, distance, active energy, heart rate, resting heart rate, heart rate variability, sleep, and workout data.

This data is read on-device and used to generate your scores and insights. It is stored locally on your device and, if you have created an account, backed up to your cloud account as described in Section 3. It is not sold or shared with third parties for advertising. Beyond your optional cloud backup, health data is only transmitted from your device where you use the AI insight feature described in Section 6, which sends your computed scores (not your raw health records) to generate a personalised summary.

6AI features and third-party services

Premium AI features (AI food scanning, food search, AI meal plans, AI workout generation, training and nutrition chat, and AI health insights) send data to Anthropic's API to generate responses. Depending on the feature, this may include:

• Food photos you submit for scanning
• Text you send to the nutrition or training chat
• Food search terms you enter
• Your profile information (goals, calorie targets) used to personalise plans
• Your computed health scores used to generate insight summaries

These requests are processed through our secure server proxy. Anthropic's privacy policy applies to data processed by their API: anthropic.com/privacy.

The App also uses the Open Food Facts database for barcode product lookup. Barcode lookups are performed using the scanned product barcode only. Open Food Facts privacy policy: world.openfoodfacts.org/privacy.

7Subscriptions

Premium subscriptions are managed by RevenueCat and processed through the App Store or Google Play. We do not collect or store your payment card details — these are handled entirely by Apple or Google. RevenueCat receives your purchase and subscription status, linked to your device and, if you have created an account, your account identifier, so that your entitlement can be recognised across devices. RevenueCat's privacy policy: revenuecat.com/privacy.

8Analytics

To understand how the App is used and to improve it, Hewett Health uses PostHog, a product-analytics service. PostHog collects usage and interaction data — such as which screens and features you open, in-app events, and aggregate funnel and performance metrics — along with basic technical information about your device type and app version.

This analytics data is used only to diagnose problems and improve the App. It does not include the content of your health, nutrition, workout or location logs. Analytics data is processed by PostHog on our behalf; PostHog's privacy policy applies to data they process: posthog.com/privacy.

We also use Sentry for crash and performance monitoring, so we can detect and fix technical issues. Sentry's privacy policy: sentry.io/privacy.

If you have any questions about analytics data, or wish to opt out, please contact us at the address below.

9What we do not collect

• We do not collect payment card details or financial information (subscriptions are handled securely by the App Store and Google Play)
• We do not store your personal logs on our servers unless you choose to create an account for cloud backup (see Section 3) — by default, everything stays on your device
• We do not use advertising networks, advertising trackers, or sell your data to anyone
• We do not share your personal data with any third party except as described in Sections 3, 5, 6, 7 and 8

10Health data disclaimer

11Children's privacy

Hewett Health is not directed at children. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will take steps to delete it.

12Data deletion

Local data: You can delete all your locally stored data at any time from within the App via Settings → Clear All Data. This permanently removes all data from your device and is immediate and irreversible.

Account and cloud data: If you have created an account, you can permanently delete your account and all associated cloud-backed data from within the App via Settings → Account & Backup → Delete Account. This removes your account and your data from our cloud database immediately and cannot be undone. Deleting your account does not remove data already stored locally on your device, and does not cancel or affect any active subscription — subscriptions are managed separately through the App Store or Google Play.

Analytics data collected via PostHog (Section 8) may be retained separately in accordance with PostHog's own data retention practices; contact us if you wish to request its removal.

13Changes to this policy

We may update this Privacy Policy from time to time. We will notify users of significant changes within the App. Continued use of the App after changes constitutes acceptance of the updated policy.

14Your rights

Under UK GDPR, you have the right to access, correct, and delete your personal data. Data stored locally on your device can be accessed or deleted directly through the App at any time. Data stored in your cloud account can be deleted through the in-app account deletion feature described in Section 12, or by contacting us directly. For any questions about data held by third-party services (Anthropic, Supabase, Resend, RevenueCat, PostHog, Sentry), please contact them directly using the links provided above.