Balanzo
Draft – this page has not been legally reviewed yet. Must be approved by a lawyer before launch, per the GDPR art. 9 requirements for health data. [Company name], registration number and address need to be filled in with the real details.

Privacy Policy

Version 1 (draft) – not yet published

Data controller

Balanzo is operated by [Company Name ApS], reg. no. [XXXXXXXX], [Address] ("we", "us", "Balanzo"). If you have questions about this privacy policy or our processing of your data, you can contact us at hello@balanzo.dk.

What data we process

We process the following types of information about you, depending on how you use the app:

  • Account information: email and password
  • Onboarding information: goal, level, training equipment, training days
  • Biometric information: weight, height, age, sex – used to calculate your personal calorie and protein target
  • Health information: any health conditions you disclose yourself, plus measurements you enter yourself, such as weight, resting heart rate and sleep
  • Training and diet data: exercises, sets, reps, meals and foods you log
  • Photos of meals, if you use photo scanning – sent to our AI provider for analysis, but not stored by us
  • Conversations with Vera: the messages you write to Vera and her replies, plus short facts Vera saves about you (e.g. an injury or a preference). You can view and delete what Vera remembers under Settings, and delete the conversation in the chat
  • Payment information: handled by Stripe – we only store your subscription status, never your card details
  • Device and usage data: technical information about how you use the app

Purposes of processing

We use your data to:

  • Create and manage your account
  • Generate and continuously adjust your training and diet plan
  • Give you personal explanations of your plan from Vera
  • Let you chat with Vera, your coach in Balanzo (an AI feature), who uses your own logs to give personal answers and can suggest changes to your plan (which you must approve yourself)
  • Recognize food in photos you upload
  • Manage your subscription and payment
  • Provide you with customer support
  • Send you one email when Balanzo opens, if you have joined the waitlist (consent)

Legal basis

Our processing is based on: (1) your explicit consent to processing of health data under GDPR article 9(2)(a), which you give during onboarding, (2) the processing being necessary to fulfil our agreement with you to provide the app, and (3) in certain cases our legitimate interest in securing and improving the service.

You can withdraw your consent at any time by deleting your account under Settings.

Health data (GDPR article 9)

Your training, diet, and biometric data are special categories of personal data under GDPR article 9. We collect a separate, explicit consent from you during onboarding before we process this data – without this consent, we cannot give you a personal plan.

Who we share data with

We use the following data processors to provide the service:

  • Supabase (EU region) – database and login hosting
  • Stripe – handling payment for your subscription
  • Anthropic – AI provider for food photo recognition, personal explanations and chat with Vera

Data processing agreements

All data processors above are bound by data processing agreements in accordance with GDPR article 28. We never sell your data to third parties, and we never use your health data for marketing.

Transfers of data outside the EU/EEA

Your data is primarily hosted with Supabase in an EU region and generally does not leave the EU/EEA. When you use AI features (food photo scanning, personal explanations, chat with Vera), the relevant data is sent to Anthropic, which is based in the US. This transfer takes place under recognized transfer mechanisms (the EU-U.S. Data Privacy Framework or standard contractual clauses) – [to be confirmed specifically by a lawyer].

Retention period

We retain your data for as long as your account is active. If you delete your account, your data is permanently removed, except for information we are legally required to retain for longer, e.g. bookkeeping records for payments. [Specific retention period for inactive accounts still needs to be set.]

Children

Balanzo is not intended for people under 16, and we do not knowingly collect data from children under this age.

Your rights

As a data subject, you have the right to:

  • Access the data we hold about you
  • Have inaccurate data corrected
  • Have your data deleted ("the right to be forgotten")
  • Withdraw your consent
  • Object to the processing
  • Receive your data in a portable format (data portability)
  • Lodge a complaint with the supervisory authority (in Denmark: datatilsynet.dk)

You can exercise your rights to export and deletion directly under Settings in the app, or by writing to hello@balanzo.dk.

Contact

If you have questions about this policy or our data processing, you can contact us at hello@balanzo.dk.