Privacy Policy

About this policy

KidneyMate is operated by Jordi Rodriguez, an individual entrepreneur registered as an autónomo in Spain ("KidneyMate", "we", "us", or "our").

This Privacy Policy explains what information KidneyMate collects and processes, why we use it, how it is handled, and the choices available to you.

KidneyMate helps adults track food, fluids and nutrition, review food information, and organize recipes, meal plans, grocery lists and pantry items. It is initially offered to users in the United States and European Union.

We do not sell your personal information. We do not use your personal information for behavioral advertising.

1. Information We Collect

Account Information

When you create an account, we process information such as:

• Email address and account identifiers
• Authentication information necessary to maintain your account and session
• Profile information and preferences, such as display name and measurement units

Your password is handled through our authentication provider and is not stored by KidneyMate in plain text.

Health and Nutrition Records

When you use tracking and food features, we process records associated with your account, including:

• Daily nutrient and fluid targets and nutrition preferences
• Food consumption and fluid intake history, including dates, meals, quantities and portions
• Nutrient values, source information and your corrections
• Saved Foods and saved meal snapshots for reuse

Historical health preferences, such as previously selected diabetes, high blood pressure, fatty liver or kidney-stone considerations, may remain in existing account records. These condition-selection controls are not currently available. You can contact us about retained preferences.

Nutrition records and targets support tracking and nutrition displays. KidneyMate does not use them to diagnose a medical condition or determine a medically appropriate diet.

Recipes and User Content

We may process content you create, save, or modify, including:

• User-created, imported and saved recipes, ingredients and instructions
• Servings, nutrition information, notes and tags
• Recipe Books and favorites
• Dated Meal Plan assignments and planned servings
• Saved Grocery snapshots and checked shopping items
• Pantry information and remembered pantry items

Recipe Imports

KidneyMate allows you to import recipes using:

• Text you paste into the app
• A website URL you provide
• A photo or screenshot you select or capture

When you use AI-assisted recipe import, the submitted content may be processed by our server infrastructure and by an AI service provider in order to extract and structure recipe information.

Images

Photos you select from your library or capture with your camera may be resized or compressed on your device, then sent to our backend and AI provider. This includes food and meal photos for recognition, nutrition-label photos for extraction, and recipe photos or screenshots for recipe import.

Analysis images are processing inputs, not automatically saved recipe photos. Food names, quantities, nutrient values and other results you choose to save become account records. Temporary processing and provider retention are described in Section 6.

If you choose to save an image as a recipe photo, that image may be stored in cloud storage and associated with your account.

Voice and Food Descriptions

Native speech recognition uses your device platform’s speech service. Depending on the device, language and service, audio may be processed remotely by Apple, Google or another device speech provider. Native recognition is not guaranteed to work entirely offline.

If you explicitly choose cloud transcription, KidneyMate creates a temporary voice recording and sends it through our backend to OpenAI to turn it into text. This is separate from native speech recognition.

You can edit speech transcripts and typed food descriptions before requesting meal analysis. Analysis sends that text for AI parsing and food-reference matching. The app saves reviewed food and nutrition records when you add them, rather than maintaining a raw recording or full-transcript archive.

Lookups, Support and Diagnostics

Food searches and barcode scans generate lookup requests to food-data services. If you contact us, we receive your contact details and message. Supporting infrastructure may process request metadata, errors and usage counters for reliability, account protection and usage limits.

2. How We Use Information

We use information to:

• Create and manage your KidneyMate account
• Track food, fluid intake and nutrition against your selected targets
• Save foods, meal snapshots and corrections for reuse
• Recognize foods and meals, extract label information and provide supported nutrient estimates
• Transcribe spoken descriptions when requested and interpret food descriptions
• Find reference-food and barcode product information
• Provide recipe-management and meal-planning features
• Generate grocery lists and maintain pantry memory
• Personalize nutrition displays
• Import and structure recipes
• Store recipe photos you choose to save
• Synchronize your information across sessions
• Protect accounts and prevent abuse
• Enforce service and usage limits
• Maintain and improve service reliability
• Process account-deletion requests
• Respond to support and privacy requests

We do not sell your personal information.

We do not use your health-related information for advertising.

Where the GDPR applies, we rely on Article 6(1)(b) for account management and requested service operations that are necessary to perform our agreement with you, such as maintaining your account and saving and synchronizing content you ask us to store. Health-related processing also requires the explicit consent described in Section 11.

We rely on Article 6(1)(f) for processing necessary for our legitimate interests in account security, abuse prevention and service reliability, where those interests are not overridden by your rights and freedoms. Where processing is necessary to meet a legal obligation, such as responding to legally required data-protection requests, we rely on Article 6(1)(c).

3. Service Providers

Different services receive the information needed for their role. They do not all receive the same account data or submitted content.

Supabase

We use Supabase for authentication, account data and user-owned database records, private recipe-image storage, Edge Functions and supporting infrastructure. Submitted analysis content passes through authenticated backend functions. Our production Supabase project is hosted in AWS us-east-1 in the United States.

OpenAI

We use the OpenAI API for selected features: recipe extraction from text, website content or images; food and meal photo analysis; nutrition-label extraction; food-description parsing and reference matching; supported nutrient estimation; and optional cloud audio transcription. Depending on the feature you request, OpenAI receives the relevant image, recording, text, food information or candidate reference data.

KidneyMate does not send your KidneyMate password to OpenAI.

These requests do not include your full account profile. Content you submit can nevertheless contain identifying or health-related information, so avoid including personal details that are not needed for the feature.

We have disabled optional OpenAI sharing of model feedback, evaluation and fine-tuning data, and API inputs and outputs for model improvement. This is separate from API call logging and provider security or abuse-monitoring retention. Call logging is enabled, and we do not have a special Zero Data Retention agreement. Retention depends on the endpoint, provider policies and applicable requirements.

Food Data and Speech Services

USDA FoodData Central supplies reference-food search results and nutrition information. Our backend sends search terms, food identifiers or supported barcode queries, not your full account profile. We acknowledge USDA FoodData Central as a source of reference nutrition data.

Open Food Facts supplies barcode and product information. Barcode requests are sent directly from your device and include normal network metadata, such as your IP address. Selected product information and your corrections may be saved with your food records. Source and ODbL licence links are available in Profile under Legal.

Native speech services may process audio under the platform provider’s policies. Their processing is separate from the optional OpenAI cloud transcription described above.

4. Website Recipe Import

If you submit a recipe URL, KidneyMate may retrieve content from that webpage in order to identify and structure the recipe.

The URL may also be stored with the imported recipe as source information.

Retrieval contacts the website from our backend, and hostname checks use a DNS service. These services receive the relevant request and network metadata. Recipe content may then be sent to OpenAI for extraction.

KidneyMate does not use this feature to monitor your general browsing activity.

5. Data Storage and Security

KidneyMate uses technical and organizational measures intended to protect your information.

These include measures such as:

• Account authentication
• User-specific database access controls
• Private storage for user recipe images
• Server-side handling of privileged credentials
• Usage limits and abuse protections

The app also stores authentication session information, preferences and caches on your device so it can keep you signed in and restore parts of your experience. Temporary media files may be created during selection, recording or image preparation. Local storage is distinct from your account records in our database.

No online service can guarantee absolute security.

6. Data Retention

Your account data and saved content, including nutrition and fluid records, saved foods and meals, recipes and stored recipe images, are generally retained while your account remains active, unless you delete individual content or request account deletion.

Keeping an account open does not by itself justify retaining health-related data after consent is withdrawn. Information without another valid legal basis for retention must not be kept indefinitely. Any continued retention of limited records, backups or provider information must be legally justified; withdrawal does not trigger automatic deletion in the app. You can request deletion of personal data through support@kidneymate.app or delete your account.

Analysis images, voice recordings and unsaved descriptions are used for processing rather than automatically added to your saved content. The app attempts to remove temporary files in its cleanup flows, but some cache copies may remain until the app or operating system clears them. Cancelling a request does not recall content already received by a provider.

Provider-side processing records, API call logs and security or abuse-monitoring logs may be retained under the relevant provider’s policies and applicable requirements. Disabling optional model-improvement sharing does not disable all such retention. We do not apply a single retention period to every provider or type of record.

Where database backups are enabled, backup copies may be retained for a limited period according to our hosting provider’s backup and retention policies. Deleted information may remain in backup copies until those copies expire.

Backup expiry is separate from retention of operational logs and other provider records. It is not a guaranteed deadline for deletion of every copy.

Certain limited records may be retained when reasonably necessary for:

• Security
• Fraud and abuse prevention
• Legal compliance
• Resolving disputes
• Verifying or completing deletion requests, including deletion-job and recovery records

7. Account Deletion

KidneyMate provides an in-app account deletion feature.

When you delete your account, KidneyMate initiates deletion of data associated with your account, which may include:

• Profile information, account preferences and retained health preferences
• Food and fluid journals, Saved Foods and saved meals
• Account-owned nutrition corrections, including barcode corrections
• User-created and imported recipes, Recipe Books and favorites
• Stored recipe images
• Meal Plan assignments and planned servings
• Grocery snapshots, shopping checkmarks and Pantry information

Deletion removes account data from active systems through several steps. Image cleanup and local cleanup may need additional processing or retries. Follow any retry instructions shown in the app. This does not mean all copies are removed immediately: existing backups, where enabled, and applicable provider or limited deletion-verification records may remain as described in Section 6.

If you cannot access the app or need help with deletion, contact support@kidneymate.app. We may need information to verify that the request concerns your account.

Deleting an account is different from Clear Plan. Clear Plan removes the active Meal Plan and its dated assignments; it does not delete saved Grocery snapshots, shopping checkmarks or Pantry memory.

8. Your Choices and Rights

Depending on the feature, you may:

• Edit or delete food and fluid entries and manage saved foods and meals
• Edit or delete recipes and remove recipe images
• Edit nutrition targets and preferences
• Modify meal plans, grocery lists and pantry information
• Choose whether to use camera, photo or voice features and manage device permissions
• Sign out of your account
• Delete your KidneyMate account

Depending on applicable law, you may have rights to access your personal data, correct it, request deletion, restrict or object to processing, and receive portable copies. Where processing is based on consent, you may withdraw it without affecting the lawfulness of processing before withdrawal. These rights have conditions and exceptions.

You can withdraw health-related and nutrition data consent in Profile, under Legal. Processing that depends on that consent must stop after withdrawal. The current app blocks new consent-dependent feature requests by pausing access to personalized features, but this protection does not fully cover older app versions or direct authenticated API requests. Other signed-in devices may continue until their next consent check at startup or when returning to the app. Withdrawal cannot recall content already received by a provider.

Withdrawal does not automatically delete your account or previously saved records. Legal information, privacy requests and account deletion remain available, and you may give consent again later. You can request deletion of personal data or delete your account as described in Sections 6 and 7.

To make a privacy request, contact support@kidneymate.app and describe what you need. We may ask for information needed to verify your identity. EU users may also complain to a supervisory authority, including the Spanish Data Protection Agency (AEPD) or the authority where they live or work.

9. Children's Privacy

KidneyMate is intended for adults aged 18 or older and is not intended for children. Please do not create an account or submit personal information if you are under 18.

If you believe someone under 18 has provided personal information, contact support@kidneymate.app so we can review the situation and arrange appropriate deletion.

10. International Data Processing

The operator is established in Spain, while our production Supabase project is hosted in the United States. OpenAI processing uses a Global-residency project, not an EU-only processing arrangement. Other providers may process information in other countries.

Using these features can involve transfers outside your country, including outside the European Economic Area. Such transfers are subject to applicable data-protection requirements, and data-protection laws may differ between countries. Contact support@kidneymate.app for information about the transfer arrangements applicable to your data.

11. Health Information

Targets, food and fluid history, retained health preferences and nutritional analyses can reveal health-related information. Such information may receive additional protection under applicable law, including the EU General Data Protection Regulation (GDPR).

For health-related processing covered by your consent, we rely on consent under Article 6(1)(a) and, where the information is health data protected as a special category, explicit consent under Article 9(2)(a). This covers providing the personalized tracking, nutrition, recipe, meal-planning, grocery and related features you request. Necessary account and other service operations have the separate bases described in Section 2. We do not use health-related information for behavioral advertising.

12. Changes to This Privacy Policy

We may update this Privacy Policy when KidneyMate's features, providers, legal requirements, or data practices change.

The effective date at the top of this page will be updated when appropriate.

13. Contact

For privacy questions, requests, or concerns, contact: