🇫🇷 Version française | 🇺🇸 English (this page)
Privacy Policy
Last updated: July 9, 2026
In short: Anawiri processes health data only with your explicit consent. Some AI features (blood-test photo analysis, AI-assisted food journal, image generation) send data to providers located outside the European Union (United States). We never sell your data. You can delete your account and all your data at any time. Anawiri is not medical advice — see Section 8 for details.
1. Data controller
The controller responsible for your personal data is:
- Company: Le Bien Neuf, a French simplified joint-stock company (SAS), registered with the Paris Trade and Companies Register under no. 941 030 009
- Address: 12 avenue Philippe-Auguste, 75011 Paris, France
- Contact / to exercise your rights: contact@anawiri.com
- Data Protection Officer: no DPO has been appointed to date; for any question about how we protect your data, write to contact@anawiri.com.
2. Data we collect
We follow a data minimization principle: we only collect what the service needs to function.
2.1 Account and profile data
- Email address, login identifier (and Apple/Google identifier if you use SSO sign-in)
- First name (optional)
- Dietary preferences (diet type, allergies, intolerances, liked/disliked foods)
- Nutrition goal (weight loss, muscle gain, maintenance, etc.)
- Food journal (logged meals, portions), shopping lists, saved recipes
2.2 Health data
The following data receives enhanced protection and is only processed with your explicit consent:
- Biometric data: weight, height, age, sex, and weight history
- Blood test results / biomarkers: lab values (vitamin D, iron, ferritin, B12, magnesium, etc.), improvement plans
- Food journal (may reveal health-related habits)
- Menstrual cycle: phases, dates, predictions
- Physical activity data from Apple Health / Google Health Connect (steps, calories, heart rate, sleep) — see Section 9 on Apple HealthKit for special rules that apply to this data
Important, for transparency: this health data does not stay only on your device. It can be synced to our servers (Supabase, hosted in the European Union) to provide the service, and some AI features send data to providers outside the EU (see Sections 5 and 6). You stay in control: consent is required, and you can withdraw it and delete your data at any time.
2.3 Technical data
- Device type, OS version, and app version
- Technical identifiers and logs needed for security and operation
- Subscription status (via RevenueCat / app stores)
2.4 Data we do not collect
- Bank details (handled exclusively by Apple / Google)
- Precise GPS location
- Social security numbers, phone contacts
3. Legal basis for processing
- Explicit consent: for all health data (biometrics, blood tests, menstrual cycle, Health app data) and for the cross-border transfers linked to AI features.
- Performance of a contract: for creating your account and providing core features (journal, recipes, shopping lists).
- Consent: for push notifications and non-transactional emails.
- Legitimate interest: for security, fraud prevention, and service improvement.
- Legal obligation: for keeping billing records.
4. Purposes of processing
- Provide personalized nutrition tracking and calculate your needs (BMR, TDEE)
- Analyze your blood test results to suggest ways to address nutrient gaps
- Generate recipe recommendations, meal plans, and shopping lists
- Analyze a blood-test photo (OCR) to automatically extract values
- Assist food journal entry (text recognition / AI-powered lists)
- Generate recipe illustrations
- Show your progress and stats; keep the service secure
5. Recipients and processors
We never sell your data and never share it for advertising purposes. The following processors may handle certain data on our behalf:
| Provider | Purpose | Data involved | Location | Safeguards |
|---|---|---|---|---|
| Supabase | PostgreSQL database hosting, authentication, storage | Account and profile data, journal data, and synced health data | European Union, region eu-north-1 (Stockholm, Sweden) | Processed within the EU; data processing agreement in place |
| OpenAI | OCR of blood-test photos; AI food-journal assistance; list generation | Blood-test image (health data), food-journal text | United States (outside the EU) | Standard Contractual Clauses (SCCs) / DPA in place. See Section 6. |
| Google (Gemini / Generative AI) | Recipe image generation | Text prompts (recipe names, ingredients), no identifiable health data | United States (outside the EU) | SCCs / DPA in place. See Section 6. |
| Anthropic (Claude) | Generation of the personalized weekly narrative report | Aggregated health and lifestyle data (scores, average sleep, steps, alcohol units, cigarettes, nutrition progress), no name or email | United States (outside the EU) | SCCs / DPA in place. See Section 6. |
| Open Food Facts | Identifying scanned food products (name, brand, nutrition facts) | Barcode of the scanned product, or search terms you enter, no account data | France / European Union (nonprofit association) | Open, collaborative database; no formal DPA (only non-identifying data is sent) |
| Open Beauty Facts | Identifying scanned cosmetic products (name, brand, ingredient list) | Barcode of the scanned product, or search terms you enter, no account data | France / European Union (nonprofit association) | Open, collaborative database; no formal DPA (only non-identifying data is sent) |
| UPCItemDB | Product identification as a last resort, when Open Food Facts / Open Beauty Facts return no result | Product barcode only, no account data | United States (outside the EU) | Only non-identifying data is sent. See Section 6. |
| RevenueCat | In-app subscription management | Anonymized user identifier, subscription status | United States | SCCs / DPA in place |
| Apple / Google (app stores) | In-app payment, distribution | Purchase data (managed by the platform) | United States | Platform-specific transfer agreements |
Technical architecture: calls to OpenAI and Google are relayed through a secure server-side function (Supabase edge function, EU); no third-party API key is stored in the app. This does not change the fact that the content sent (blood-test image, text) is ultimately processed in the United States by the provider in question.
6. International data transfers
Anawiri's database is hosted in the European Union (Sweden). If you are located in the United States, using the app means your account and health data are stored and processed on servers in the EU — this is itself an international transfer of your data. In addition, some features send data further, to providers in the United States:
- OpenAI (USA): when you use automatic analysis of a blood-test photo (OCR) or AI food-journal assistance, the image or text involved is sent to OpenAI in the United States. Since this may involve health data, this transfer relies on your explicit consent and, where applicable, is governed by Standard Contractual Clauses.
- Google / Gemini (USA): recipe image generation sends text prompts to Google in the United States (no identifiable health data).
- Anthropic / Claude (USA): generating the weekly narrative report sends aggregated health and lifestyle data (scores, average sleep and activity, self-reported alcohol/tobacco use, nutrition progress) to Anthropic in the United States. Since this is health data, this transfer relies on your explicit consent and is governed by Standard Contractual Clauses.
- UPCItemDB (USA): when a scanned product is not found in Open Food Facts / Open Beauty Facts, the barcode is sent to UPCItemDB (United States) as a last resort to try to identify the product. Only non-identifying data (the product barcode) is sent, with no account identifier or other personal data attached.
These transfers are governed by Standard Contractual Clauses (SCCs) approved by the European Commission and/or by your consent. You can request a copy of these safeguards by writing to contact@anawiri.com.
Optional features: AI analysis (blood-test OCR, journal assistance, images) is optional. If you don't want a cross-border transfer of this kind, you can enter your data manually and skip these features.
7. Data retention
- Account and health data: kept for as long as your account is active, then deleted.
- After account deletion: all data is erased within 30 days (technical delay to purge backups).
- Data sent to OpenAI / Google: subject to those providers' own retention policies (see their respective DPAs). We do not store it ourselves beyond the result returned.
- Billing records: kept as required by applicable legal obligations.
8. Not medical advice
Anawiri is not a medical device and does not provide medical advice, diagnosis, or treatment. Scores, biomarker analyses, nutrition recommendations, and educational content are informational and wellness-oriented only. Always talk to a doctor or qualified healthcare professional before changing your diet, physical activity, or supplements, and before acting on anything you read in the app — especially if you are pregnant or breastfeeding, have a medical condition, or take medication. Never stop or change a medical treatment based on information from the app.
9. Apple HealthKit
If you connect Apple Health, Anawiri reads data such as steps, calories, heart rate, and sleep to power your activity and recovery tracking. In line with Apple's requirements:
- HealthKit data is never used for advertising or marketing purposes.
- HealthKit data is never sold to data brokers or any third party.
- HealthKit data is never shared with third parties for purposes unrelated to providing you the health and fitness features of the app, except as described in Sections 5 and 6 (service providers who help us run the app) or where you have separately consented.
- You control this access at any time from your device's Settings app (Privacy & Security → Health) or from Anawiri's own settings, and you can revoke it at any time.
10. Your rights
You have the following rights over your personal data:
- Right of access: obtain a copy of your data
- Right of rectification: correct your information (directly in the app)
- Right of erasure: delete your account via Settings > Delete my account, or via the public web page: https://anawiri.com/supprimer-compte
- Right to data portability: export your data in a structured format (JSON)
- Right to object and to restrict processing
- Right to withdraw consent at any time, in particular for health data and AI features (with no effect on processing already carried out)
To exercise your rights: contact@anawiri.com. Response time: within 1 month.
See Sections 11 and 12 below for rights specific to California, Washington, and Nevada residents.
11. Your California Privacy Rights (CCPA/CPRA)
If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the CPRA, gives you the following rights regarding your personal information:
- Right to know / access: ask us what personal information we have collected about you, and get a copy of it.
- Right to delete: ask us to delete your personal information (see Section 10 for how).
- Right to correct: ask us to correct inaccurate personal information.
- Right to opt out of sale or sharing: Anawiri does not sell or share your personal information (as those terms are defined under the CCPA), so there is nothing to opt out of. We do not use cross-context behavioral advertising.
- Right to limit use of sensitive personal information: your health data, precise location (not collected), and similar sensitive information are only used to provide the app's features, not for advertising. You can ask us to further limit any secondary use.
- Right to non-discrimination: we will not deny you service, charge you a different price, or provide a lower quality of service for exercising any of these rights.
To exercise any of these rights, contact us at contact@anawiri.com. We may need to verify your identity before completing your request. You may also designate an authorized agent to make a request on your behalf.
12. Consumer Health Data (Washington My Health My Data Act, Nevada SB 370)
Washington's My Health My Data Act and Nevada SB 370 give residents of those states specific rights over "consumer health data" — information that identifies your health status or health-related activity.
What consumer health data we collect
- Biometric data (weight, height, weight history)
- Blood-test results and biomarkers
- Menstrual cycle data
- Food journal entries and nutrition-related data
- Activity, sleep, and heart-rate data synced from Apple Health / Google Health Connect
Why we collect it
Solely to provide the app's core features to you: personalized nutrition and biomarker recommendations, cycle-aware tracking, and activity/recovery insights. We do not use this data for advertising.
Who we share it with
As described in Section 5: our hosting provider Supabase (EU-based database), and, only for the specific AI features you choose to use, the anonymized-where-possible AI providers OpenAI, Google, and Anthropic (see Sections 5 and 6 for exactly which data goes to which provider). We do not sell consumer health data, and we do not share it with data brokers or advertisers.
How to withdraw consent and delete this data
You can withdraw your consent to health-data processing and delete this data at any time via Settings > Delete my account in the app, or via anawiri.com/supprimer-compte. Withdrawing consent does not affect processing that already happened before your request. See Section 7 for our data-retention timelines.
Questions about your consumer health data rights: contact@anawiri.com.
13. Security
- Encryption in transit: all network communication uses TLS/HTTPS.
- Encryption at rest, server-side: the Supabase database is encrypted at rest by the hosting provider.
- Access control: secure authentication and Row Level Security (RLS). Each user can only access their own data. No password is stored in plain text.
- Local storage: some health data (e.g., blood-test results) is also stored in a local database on your device. As of today, this local database is not encrypted at rest; local encryption is planned for a future version. Access to this data remains protected by your device's operating-system security.
14. Minors
Anawiri is intended for people age 15 and older (the digital-consent threshold under French law, which applies to our EU-based data processing). We do not knowingly collect data from anyone under 13. If you believe a child has provided us with data, contact us at contact@anawiri.com.
15. Cookies and trackers
Mobile app: no advertising cookies or third-party trackers. Only strictly necessary technical tokens (authentication session, local preferences) are used.
anawiri.com website: when you arrive, a banner lets you accept or refuse, with equal ease, two categories of trackers. None are set before your choice, and refusing has no effect on your ability to use the site.
- Audience measurement (Google Analytics 4): pages viewed and traffic source, with IP anonymization and Google's advertising signals turned off. Purpose: understand what visitors find useful.
- Advertising (Meta pixel, TikTok pixel, and their server-side conversion APIs): measure which ads lead to sign-ups. These tools receive your IP address, browser, ad-click identifier, and the page you viewed. Recipients: Meta Platforms Ireland Ltd and TikTok Technology Ltd, which may transfer this data outside the European Union under the EU-US Data Privacy Framework and Standard Contractual Clauses.
Special safeguard for health-topic pages. Pages about a medical topic (for example, reading a blood test or iron deficiency) are excluded from advertising tools: neither the Meta pixel nor the TikTok pixel loads there, and no URL for those pages is sent to them server-side. No information about your health, inferred or stated, is therefore shared with an advertiser. Only audience measurement, if you accepted it, applies there.
Your choice is stored on your device for six months. You can change it at any time via the Cookies link at the bottom of each page.
16. Changes
Any material change to this policy will be announced in the app. Continued use after notice means you've been informed; processing based on consent will require a new consent where applicable.
17. Contact
For any question about your personal data: