Privacy policy

Information under Article 13 of Regulation (EU) 2016/679 (GDPR) · Last updated: 26 October 2026

1. Introduction

iaiafit (the website iaiafit.com and the web app at iaiafit.com/app, which you can install on your phone's home screen) is a fitness journal: you log what you eat, your workouts, weight, sleep and steps, and an AI-based assistant helps you log them and writes summaries for you. This policy explains what personal data we process, why, on what legal basis, who we share it with, how long we keep it and what your rights are.

We process data in accordance with Regulation (EU) 2016/679 (GDPR), Romanian Law no. 190/2018 implementing the GDPR, Law no. 506/2004 (for cookies) and other applicable Romanian legislation.

2. Data controller

The controller that decides how and why your data is processed is:

We have not appointed a data protection officer (DPO), as the law does not require one in our situation. For any question or request about your data, write to us at [email protected].

3. Data we process

Almost all the data below is provided by you when you use the app. Technical data is generated automatically when the app communicates with the server.

Account data

• your email address: you sign in with a 6-digit code sent by email; it is required to have an account;
• if you choose to sign in with Google or Facebook (once this option is available): the email and name that account shares with us;
• passkeys, if you enable them: only the public key and the device name; your fingerprint or face never reach us, they stay on your phone;
• your chosen language, the account creation date and the date and time you gave your consent (see section 4).

Profile and journal

• profile: name, sex, age, height, current and goal weight, goal, general notes (habits, rules);
• journal: meals, workouts, weight, waist, steps, sleep (including sleep phases) and your notes about each day;
• data imported from Apple Health, only if you choose to upload the export file (steps, sleep, weight, workouts);
• AI-generated summaries, the questions you ask the assistant and its answers.

Photos

Photos you send to the assistant (for example of your plate or a food label) are passed to the AI provider to be read and are not stored on our servers. Only the text logged from them remains in your journal.

Voice dictation

When you dictate, speech recognition is performed by the built-in feature of your browser or operating system (for example by Apple or Google, depending on your device), under their own terms and privacy policy. We do not receive the audio, only the resulting text.

Feedback messages

When you send us feedback, we keep its text together with information about your device and browser (from the "User-Agent"), the app language and the day open in the app at the time, so we can understand and reproduce the issue.

Technical data

• the sign-in session (a cookie with a random identifier, see the Cookie policy);
• security events: IP address, approximate country, browser and device (User-Agent), sign-in attempts and suspicious requests;
• daily activity: which days you used the app and how many requests you made, without their content;
• the estimated cost of each AI call, so we can apply usage limits.

Emails

We only send emails needed for the service (sign-in codes, invitations). We do not send newsletters or marketing messages.

We do not use ads, we do not use analytics or marketing cookies or scripts, we do not build advertising profiles and we do not sell data to anyone.

4. Consent for health data

The first time you sign in, you tick two separate boxes:

1. that you are at least 18 years old and accept the Terms and conditions and this Privacy policy;
2. that you explicitly agree to us processing your health data (weight, sleep, nutrition, workouts) so the journal can work.

We store the date and time of your consent so we can prove it was given. Without this consent, the server refuses journal and AI requests, because the app cannot work without this data.

You can withdraw your consent at any time, as easily as you gave it: by deleting your account in the app or by emailing us at [email protected]. Withdrawal does not affect the lawfulness of processing carried out before it, but afterwards you can no longer use the journal, and your data is deleted as described in section 11.

5. Purposes and legal bases

Where we rely on legitimate interest, we have checked that it does not disproportionately affect your rights. You can object to this processing at any time (see section 12).

Automated decisions. We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). Targets, estimates and tips in the app are for guidance only; you decide whether and how to use them. Automatic AI usage limits (for example the number of requests per day) only regulate access to a free service.

6. Artificial intelligence

When you use the assistant, you are interacting with an artificial intelligence system, not a human. The assistant's messages, summaries, calorie and nutrient estimates and tips in the app are generated automatically by AI.

We use Claude models from Anthropic, PBC, via API, for:

• the assistant: logging from text, voice (the dictated text) or photos, and answering questions about your journal;
• day and period summaries, with calorie and nutrient estimates;
• short tips after you log something;
• interpreting your answers in the profile setup guide (at the start).

When you use one of these features, we send the provider only what is needed for the answer: your message, any photos, your profile data and the relevant days from your journal.

• Anthropic processes this data as a processor (Art. 28 GDPR), on our behalf, and does not use it to train its models;
• under its policy, Anthropic may temporarily retain data sent via the API (typically up to 30 days) for trust and safety and abuse prevention;
• to find nutrition values for certain products or restaurant dishes, the AI may run web searches; only the search query (for example the product name) is sent, and we do not intentionally include your name, email or other data that identifies you;
• AI usage has daily and monthly limits; after a certain monthly cost threshold, the app may switch to a cheaper model, and answer quality may vary;
• the assistant has built-in safety limits: it does not recommend medication, does not make diagnoses, and in emergencies tells you to call 112 (the EU emergency number);
• AI answers may contain mistakes; see the Terms and conditions for details.

7. Who we share data with

We only use providers needed to run the service. They process data on our behalf, as processors, under data processing agreements (Art. 28 GDPR), and only on our instructions:

Speech recognition for dictation is performed by your own browser or operating system (for example Apple or Google), which you use under their own terms; they are not our providers, and we do not send them any data.

We disclose data to public authorities only when the law requires us to. We do not sell or rent data.

8. Transfers outside the European Economic Area

Account and journal data is stored on a server in Germany. For AI features (Anthropic) and the Cloudflare network, some data may reach the USA. These transfers take place under Chapter V GDPR (Art. 44 et seq.): on the basis of the EU-US Data Privacy Framework where the provider is certified or, where it is not, on the basis of the standard contractual clauses approved by the European Commission, together with the additional safeguards offered by the provider. You can ask us for details about the safeguards used at [email protected].

9. How long we keep data

We may keep certain data longer only if the law requires it or if it is needed to establish, exercise or defend legal claims, and only for as long as necessary.

10. Data security

• all communication is encrypted (HTTPS/TLS);
• there are no passwords: you sign in with an email code or a passkey; our database stores only cryptographic hashes of codes and sessions, not their values;
• each account can access only its own data; administrative access is separate and additionally protected;
• we rate-limit attempts and requests and monitor suspicious requests;
• backups are encrypted and stored separately from the server.

No system is perfectly secure, but we take technical and organisational measures appropriate to the risk (Art. 32 GDPR). If a personal data breach occurs, we notify the Romanian supervisory authority (ANSPDCP) within 72 hours of becoming aware of it where the law requires (Art. 33 GDPR), and we inform you without undue delay if the breach is likely to result in a high risk to your rights (Art. 34 GDPR).

11. Deleting your account and data

You can delete your account at any time, directly in the app: Profile → Delete account and data. To confirm, you type your account email address. Your account, profile, entire journal, summaries, passkeys, sessions, feedback messages and AI usage records are deleted immediately and permanently. The data disappears from backups within 30 days at most.

Security events (for example sign-in attempts) remain until their 90 days expire, to protect the service, and are then deleted.

If you no longer have access to your account, email us at [email protected] from your account email address and we will delete it within 30 days at most.

12. Your rights

Under the GDPR (Art. 15–22), you have the following rights:

• right of access: you can find out what data we hold about you and ask for a copy;
• right to rectification: you can correct your data in the app at any time or ask us to do it;
• right to erasure ("right to be forgotten"): directly in the app, see section 11;
• right to restriction of processing, for example while we check whether data is accurate;
• right to data portability: you can receive the data you gave us in a structured, commonly used and machine-readable format; there is no export button in the app yet, so please request it by email;
• right to object to processing based on our legitimate interest;
• right to withdraw consent at any time, without affecting the lawfulness of earlier processing (see section 4);
• right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects you;
• right to lodge a complaint with ANSPDCP (see section 16).

To exercise any of them, email us at [email protected], preferably from your account email address so we can verify the request comes from you. We reply within one month of receipt; for complex or numerous requests this may be extended by two further months, in which case we will tell you within the first month and explain why. Exercising your rights is free of charge.

13. Cookies

We only use strictly necessary cookies (mainly one, for the sign-in session) and a few preferences saved in your browser. We do not use analytics, advertising or tracking cookies, so we do not show a consent banner. Details in the Cookie policy.

14. Minors

iaiafit may only be used by people aged 18 or over. We do not knowingly collect data about minors; if we find out that an account belongs to a minor, we delete it together with its data.

15. Changes to this policy

We may update this policy, for example when we add new features or providers. The date of the last update is shown at the top. If the changes are significant, we will let you know in the app or by email before they apply. If a change would involve using your health data for a new purpose, we will ask for your consent again.

16. Contact and complaints

For any question, request or concern about your data, write to us at [email protected].

You have the right to lodge a complaint with the supervisory authority:

You may also contact the supervisory authority of the EU member state where you live or work, or the competent court.

This English version is provided for convenience; in case of discrepancy, the Romanian version prevails.