Privacy
PrivyHealth is a photo calorie tracker and training log. This page explains, in plain language, what we collect, what gets shared, how long we keep it, and the controls you have — all in one place.
Last updated 2 August 2026 · applies to everyone with a PrivyHealth account
PrivyHealth is operated by Kevin Robert Lake, trading as PrivyHealth, who is the data controller for the personal data described on this page.
When you use PrivyHealth, you choose to log things like meals (often from a photo), workouts, weight, and — if you connect it — your Whoop recovery and sleep. We also keep the basics needed to run your account: your email and the sign-in method you used.
We never read your contacts, track your location, or pull anything from your phone's other apps beyond what you explicitly connect.
Your plan changes what leaves your account. On Premium, nothing you log is shared with anyone. On Free, some of your logs may be bundled and shared with research partners and advertisers so we can keep PrivyHealth free — but never your name, photos, or notes.
Your name & email
Meal & calorie logs
Workout & training history
Whoop recovery, sleep & strain
Weight & body measurements
Food photos & meal notes
Coach chat messages
Tied to your identity
Free data is labelled with an anonymous ID, never your name
may be shared · kept private
Upgrading to Premium stops any further sharing right away. See plans.
Anonymised records (no name, photos, or notes) may be kept for up to two years for research and advertising, then they're deleted. If you upgrade, no new records are shared.
Everything stays private to your account. Delete your account and every trace of your data is removed with it — nothing is held back or archived.
No matter your plan, your data belongs to you. Here's what you can do at any time:
See your data
Open your profile to view everything you've logged — meals, workouts, weight, and Whoop metrics.
Export it
Download a machine-readable copy of everything we hold from your profile page — no request form, no waiting.
Delete it
Delete your account and all your logs are permanently removed. There's no archive, no soft delete.
Stop sharing
Turn on 'Do not sell or share my personal information' in your profile, upgrade to Premium, or close your account.
If you live in California, Colorado, Connecticut, Virginia, Texas or another US state with a privacy law, you can tell us to stop selling or sharing your personal information — and you can do it yourself, in one tap, without leaving the app.
Do not sell or share my personal informationThese are the categories of third party that can receive data, and exactly what they get. Everyone in this list is bound by contract to use it only for the stated purpose.
Cloud hosting & database provider
Runs the app, stores your account and logs, handles sign-in
Gets: Everything you log, plus your email and sign-in method
Paddle (Merchant of Record)
Takes payment, issues receipts, handles tax and refunds
Gets: Your email, plan, transaction amounts. Never your health logs
AI model providers
Estimates nutrition from your meal photo and powers the coach
Gets: The photo or message you submit, sent for analysis and not used to train models
Whoop
Only if you connect it — syncs your recovery, sleep and strain
Gets: Read-only access to your Whoop metrics, revocable any time
Research partners & advertisers
Free onlyBuy aggregated wellness trend data so Free stays free
Gets: Anonymised meal, training and recovery figures under a random ID — never your name, photos or notes
We never hand over your identified health logs to advertisers, insurers, or employers — on any plan. Cookies and similar storage are covered in our cookie notice.
Under UK/EU data protection law every use of your data needs a legal basis. Here is ours, activity by activity. Health data is special-category data, so where consent is the basis it is explicit and you can withdraw it at any time.
Running your account and showing your logs
ContractWe can't provide the app you signed up for without it.
Taking payment for Premium and credit packs
Contract & legal obligationNeeded to bill you and to keep tax records.
Analysing your meal photos with AI
ConsentIt only happens when you choose to upload a photo.
Syncing Whoop data
ConsentOnly after you authorise the connection; disconnect any time.
Packaging anonymised Free-tier data
ConsentDisclosed at sign-up, opt out any time with the Do Not Sell or Share control, or by going Premium.
Keeping the service secure and preventing abuse
Legitimate interestsLimited to security logs and fraud checks on payments.
Connecting Whoop
Linking Whoop is optional and read-only. We request your recovery, sleep, strain and calorie data, store it in your account to power your dashboard and coach, and keep your access tokens server-side only. Disconnect in your profile and syncing stops immediately.
Where your data is handled
Our hosting, payment and AI providers may process data outside the UK/EU. Those transfers rely on standard contractual clauses and equivalent safeguards. Children under 16 may not hold an account; if we learn of one we delete it.
Keeping your data secure is a shared effort between PrivyHealth and the platform that hosts it:
What PrivyHealth does
Your logs are locked to your account — only you can read them. We don't add moderator or admin views over your data, and third-party sharing happens only through anonymised, service-level export views that strip your identity.
What the hosting platform does
PrivyHealth runs on a managed cloud platform that handles encrypted storage, authentication, and database hosting. These are platform capabilities — not a certification or audit by PrivyHealth.
Want to export your data, delete something, or ask what we hold? Email us and we'll respond.
privacy@myprivyhealth.comWe answer access, deletion and opt-out requests within 45 days. Reporting a security vulnerability instead? See security & disclosure.
This page is maintained by the PrivyHealth team to answer common privacy questions about PrivyHealth. It describes the controls and practices PrivyHealth has enabled today; it is not an independent certification or a legal warranty. If something here ever changes, we'll update this page.