Privacy Policy — NutriXP

Last updated: 10/09/2026

1. Who is responsible for your data?

The NutriXP app is published by:

• Legal name: Wearefullxp
• Legal form: [e.g. SAS / sole trader]
• Company number: registration in progress
• Address: France — registered address published upon registration
• Contact: contact@nutrixp.app

This data controller determines the purposes and means of processing your personal data.

• Data Protection Officer: not appointed

2. In short

Most of your data stays on your phone. Your meals, generated projections, history and photos are stored locally. Only your profile and account credentials are kept on our servers.

3. What data, why, and on what legal basis?

3.1 Account and identification

3.2 Profile and goals

First name or nickname, age, sex, height, weight, target weight, activity level, desired pace, dietary preferences, allergens, stated goals and obstacles.

• Purpose: calculate your nutritional needs and personalise recommendations and projections.
• Legal basis: performance of contract.
• Note: some of these (weight, height, allergens) are health data. See §4.

3.3 Nutrition

Meal photos, detected foods, quantities, calories and macronutrients, daily history.

• Purpose: analyse your meals with AI and maintain your food diary.
• Legal basis: performance of contract.
• Storage: your diary is stored locally on your device.

3.4 Body photos and AI projection

When you use the projection feature, the photo you provide is transmitted encrypted to our AI providers to be analysed and transformed.

• Purpose: estimate your body composition and generate an illustrative image of your "dream version".
• Legal basis: your explicit consent — you trigger each projection by a deliberate action, and you may stop using the feature at any time.
• Retention: the original photo and the result are saved on your device. They are not kept on our servers. Our providers delete them after processing (see §6).
• Important: generated images are illustrative simulations. They are neither a medical prediction nor a guarantee of results.

3.5 Connected health data (optional)

If you allow it, the app reads from Apple Health (iOS) or Health Connect (Android):

• your steps,

• your active calories,

• your weight.

• Purpose: adjust your daily targets and pre-fill your profile.

• Legal basis: your explicit consent, revocable at any time in your phone's settings.

• Access: read-only. The app never writes to your health record.

• This data is never shared with advertising partners.

3.6 Purchases and subscription

Subscription status, purchase history, transaction identifier.

• Purpose: grant access to Premium features and manage tokens.
• Legal basis: performance of contract.
• Note: we never see your payment details. Payment is handled by Apple or Google, never by us.

3.7 Analytics (subject to your consent)

Anonymised usage events (screens viewed, features used), linked to a random device identifier, with no name or email.

• Purpose: understand which features help and fix friction points.
• Legal basis: your consent, requested at first launch and revocable at any time.
• If you decline, no analytics are sent.

3.8 Advertising

For non-subscribers, rewarded ads are served through Google AdMob.

• Purpose: fund free use of the app.
• Legal basis: consent (personalised ads) or legitimate interest (non-personalised ads), depending on your choice in the consent dialog.
• Premium subscribers see no ads.

3.9 Technical data

App version, operating system, language, time zone, error logs.

• Purpose: security, abuse prevention, bug fixing.
• Legal basis: legitimate interest (Art. 6.1.f GDPR).

4. Health data: a specific commitment

Some of the data you entrust to us — weight, height, body photos, allergens, Apple Health / Health Connect data — falls under the special categories of GDPR Article 9.

We process it solely on the basis of your explicit consent, given by a clear action on your part (granting health access, starting a projection). You may withdraw that consent at any time, without justification, by disabling the relevant feature or deleting your account.

This data is never used for advertising, never shared with data brokers, and never used to train artificial intelligence models.

5. NutriXP is not a medical device

NutriXP is a wellness and motivation app. It provides no diagnosis, treatment or medical advice.

• Nutritional estimates are approximate and may contain errors.
• Body projections are AI-generated illustrative images, not a prediction of your actual outcome.
• Consult a healthcare professional before making significant changes to your diet or physical activity — especially if you have a medical condition, are pregnant, or have a history of disordered eating.

6. Who do we share your data with?

We use processors who act on our instructions. None of them may use your data for their own purposes.

On retention by our AI providers: your photos pass through for processing, then are deleted by those providers under their own policies (typically within hours to days). Our own servers keep no copy. These providers do not use them to train their models.

Transfers outside the European Union: some providers are based in the United States. Such transfers are covered by the European Commission's Standard Contractual Clauses and/or the Data Privacy Framework, depending on the provider.

7. How long do we keep your data?

After you delete your account, your data is erased within 30 days, save for any legal retention obligation.

8. Your rights

Under the GDPR you have the right to:

• Access — obtain a copy of the data we hold about you.
• Rectification — correct inaccurate data (profile data is editable directly in the app).
• Erasure — request deletion of your account and data.
• Restriction — request that processing be paused pending verification.
• Portability — receive your data in a machine-readable format.
• Object — object to processing based on legitimate interest.
• Withdraw consent — at any time, without affecting the lawfulness of processing already carried out.

How to exercise them: write to contact@nutrixp.app. We respond within one month.

If our response does not satisfy you, you may lodge a complaint with your national supervisory authority. In France, that is the CNIL: www.cnil.fr, 3 place de Fontenoy, 75007 Paris.

9. Minors

NutriXP is intended for people aged 16 and over.

If you are under 16, you must not use the app without the consent of a parent or legal guardian. We do not knowingly collect data from children without such consent. If you are a parent and believe your child has provided us with data, write to contact@nutrixp.app and we will delete it.

10. Security

We implement appropriate technical and organisational measures: encrypted transport (HTTPS/TLS), token-based authentication, API keys stored server-side and never embedded in the app, restricted data access, and abuse limits.

No system is infallible. Should a breach occur that is likely to result in a risk to your rights, we will notify you and the supervisory authority in accordance with GDPR Article 33.

11. Changes to this policy

We may update this policy to reflect changes in the app or in the law. For material changes, you will be notified in the app before they take effect. The last-updated date appears at the top of this document.

12. Contact

For any question about this policy or your data:

contact@nutrixp.app Wearefullxp — France — registered address published upon registration