PRIVACY POLICY

This Privacy Policy explains what Alure (“Alure,” “we,” “us”) collects when you use the Alure mobile app or website, how we use it, and the choices you have. If anything here is unclear, email support@alure.health.

The short version

• We collect what you put in: profile details, meal photos and their nutrition, symptom journal entries, cycle logs, and optional health data from Apple Health or Health Connect.
• Google Gemini processes meal photos and descriptions, typed activity descriptions, and summaries used to create personal insights. Those summaries can include profile answers and connected health data.
• Connected health data is used solely to power what you see inside the app. It is never used for advertising, never sold, never shared with data brokers, and never used for research.
• We measure app use with PostHog. Events are linked to your account identifier after sign-in. We describe the event details below. Session recording is off.
• You can delete your account inside the app or request deletion by email. See account deletion for what is removed and how provider cleanup is handled.
• We don’t sell your personal information.

What we collect

Waitlist (website, pre-launch)

If you joined the waitlist on our website before Alure launched, we collected the email address you submitted and the date you joined. We use it only to email you about Alure, and we store it with our database provider, Supabase. We never sell it and never use it for advertising. Email support@alure.health to be removed at any time.

Account information

When you sign in with Apple or Google, we receive an email address and a stable user identifier. We do not receive your social contacts, calendar, or other data from those providers.

Profile you create

Name, age, height, weight, PMOS type, and goals you provide. This information stays tied to your account and is used to personalize your experience inside the app.

Shipping details

You can save your shipping address and phone number in your profile or provide them at checkout. We use your address to localize the app (for example, regional grocery prices in the savings calculator and seasonal food suggestions) and to prefill checkout in the PMOS Labs store if you ever choose to order there. While you type your street address, the text in that field is sent to the Photon geocoding service to offer completions (see providers below). You can edit or remove your shipping details at any time in Profile → Shipping details, and they are deleted with your account.

Meal logs

Photos you select or capture, and meal descriptions you type, are stored with your account and used to generate nutrition estimates (calories, macros, micronutrients, and a meal score). The photo, description, and any note you add are sent to Google’s Gemini API to identify the foods and portions and estimate their nutrition. The analysis response is stored against the meal record. No user identifier is sent to Google with the photo.

AI insights and activity logging

When AI features are enabled, we use Google Gemini to interpret activity descriptions and create personal insights. Insight requests include summaries of recent meals, symptoms, goals, profile answers, and medication or supplement logs. If you connect Apple Health or Health Connect, daily summaries can include steps, active calories, sleep duration, resting heart rate, and heart rate variability. These are processed by our Supabase service and Google Gemini to produce your insight cards. You can pause AI features in Profile.

Symptom journal

Symptoms you log (category, severity, time of day) are stored with your account. We use these entries to generate your personal insights and to surface patterns alongside your meal data.

Cycle tracking

Period and cycle entries you log (flow, dates, and optional body signs) are stored with your account and used to show your cycle view and connect cycle phase to your other patterns. If you connect Apple Health or Health Connect, cycle data can sync in both directions as described below.

Other logs

Water, supplement, and saved-meal entries you create are stored with your account and shown back to you in the app.

Messages, attachments, and sharing

Alure Care stores messages, photos, PDFs, screening answers, and any health summary you choose to share for a GLP-1 request, its review, and follow-up. Staff with access to your conversation can read that content. If you use Partner, the person you invite can see the cycle and symptom details you choose to share. You can pause sharing or end the link. Feature board posts and comments, including your chosen display name, are visible to other members. A profile photo you upload is stored at a public image URL and can appear beside your feature board posts and comments.

Purchases

Google Play or Apple processes in-app purchases. RevenueCat receives your app account identifier, purchase history, and subscription status so we can provide paid access and restore purchases. For store orders placed through the app, we collect your contact and shipping details and order history. Stripe processes card payment details in its payment form. Our app uses the resulting payment identifiers and status to complete your order. PMOS Labs fulfills store orders.

Nearby and location

Nearby asks for foreground location permission to center the map and find places near you. Your device can provide precise coordinates if you allow them. Maps are provided by Google on Android and Apple on iPhone. Map requests include the area you view. You can also search for a city or place without sharing your device location. On Android, when location permission is off, the place name you submit is sent to the Photon geocoding service to find it on the map. We do not send your name, email, account identifier, or device coordinates with that search. Recent searches stay on your device; we do not include their text or coordinates in Alure analytics. If you submit a missing restaurant, we save its name, town, your note, and the map coordinates rounded to two decimal places with your account. We do not request background location. You can change location permission in your device settings.

Apple Health and Health Connect (optional)

If you grant permission, Alure reads the following from Apple HealthKit on iPhone or Health Connect on Android to power what you see in the app:

• Body mass (weight)
• Step count
• Active energy burned
• Workouts
• Sleep analysis
• Heart rate and resting heart rate
• Heart rate variability
• Blood glucose (if you use a connected meter or CGM)
• Cycle data: menstrual flow, basal body temperature, ovulation test results, and cervical mucus quality

You choose which of these to grant, and the app works without any of them. When you log a weight inside Alure, we write a body mass sample back to Apple Health or Health Connect. When you log a period or cervical mucus entry in the cycle tracker, we write those back too, so the Health app’s history stays complete. You can revoke any of these permissions at any time in Apple Settings or Health Connect settings.

Health Connect history permission lets Alure show older cycle and weight entries and longer trends. Connected daily health summaries can also be sent to our service and Google Gemini for the personal insights described above. Deleting your Alure account does not delete records already saved in Apple Health or Health Connect; manage those records in the health app.

Usage, device information, and notifications

PostHog receives screen names, app lifecycle events, feature use, experiment assignments, purchase events, and device and app details. Events can include meal calories and scores, water amounts, supplement and exercise categories, symptom entry counts, and partner sharing settings. They use an anonymous identifier before sign-in and your app account identifier after sign-in. We do not send your name, email, meal photos, or message text to PostHog. Session recording and automatic touch capture are off.

On the Path website, PostHog receives the quiz step shown, when you start and finish, and a random journey identifier stored in your browser for up to 30 days. This helps us see where people leave the quiz. We do not link this identifier to your account or send your answers, results, name, email, payment details, or page addresses. Session recording and automatic form capture are off. Path analytics respects Do Not Track and Global Privacy Control. Like other online services, PostHog receives network information when your browser connects. These events are not sent to Meta.

When you allow push notifications, we store a device push token with your account. Expo and Apple or Google deliver notifications such as message, order, and feature board updates. Daily reminders are scheduled on your device. Maps and payment providers also receive device, network, and diagnostic information as part of operating their services.

In builds with Meta campaign measurement enabled, Meta receives app install and session events, completion of registration, and purchase amounts and currencies. We use these events to measure our app promotion campaigns. The app does not enable advertising ID collection or send health log contents in these events.

For website ads, we save a campaign code, ad code, source (Facebook or Instagram), and click date in your browser for up to 30 days. When you start checkout, we keep those codes with your enrollment in Supabase to count paid trials by ad. This website measurement does not send your purchase, contact details, or quiz answers to Meta.

How we use your information

• Provide and improve the Alure experience.
• Generate personal insights using the summaries and profile context described above.
• Understand which features are used through product analytics so we can improve them.
• Schedule local meal reminders if you turn them on.
• Respond when you contact support.
• Detect and prevent abuse (e.g., rate limits on meal scans).
• Localize the app to your region, for example grocery prices in the savings calculator and seasonal food suggestions.
• Sign you into the PMOS Labs store and prefill checkout when you choose to open it from the app.

How we share your information

We do not sell or rent personal information. The following providers process data for the features described in this policy:

• Supabase, Inc.: managed PostgreSQL, authentication, and Edge Functions hosting (US East).
• PowerSync, Inc.: sync engine between the device and our database.
• Apple Inc.: Sign in with Apple, App Store distribution, and HealthKit on iPhone.
• PostHog, Inc.: product analytics and feature experiments, including the identifiers and event details described above.
• Google LLC: Gemini analysis, Google sign-in, Google Play purchases and distribution, Maps, Firebase Cloud Messaging, and Health Connect on Android.
• RevenueCat: in-app purchase history, account identifiers, subscriptions, and paid access.
• Stripe: payment processing and fraud prevention for store and website checkout.
• Expo: app updates and push notification delivery, including device push tokens.
• Meta: app campaign measurement in builds where it is enabled, using the events described above.
• Komoot Photon (OpenStreetMap): address autocomplete and manual place search. As you type in the street address field, that text is sent to Photon to suggest completions. On Android, if location permission is off, a place name is sent when you submit a Nearby search. No name, email, or account identifier is attached to these requests. Like other online services, Photon receives network information, including your IP address.
• PMOS Labs (pmoslabs.com): our companion store, available through the app. When you open a store link from the app, a signed one time link can pass your email, name, and saved shipping details to sign you in and prefill checkout. When you place an order in the app, your contact, shipping and order details are sent to the store for fulfillment. Your health logs are not included in these store transfers.

Data you choose to post on the feature board or share through Partner is also shown to the recipients described above. We may disclose information if required by law.

Where data is stored

Account and profile data, meals, symptom logs, cycle logs, and weights are stored in encrypted PostgreSQL databases operated by Supabase in AWS US East. On your device, session tokens are stored in the iOS Keychain or Android Keystore. Recent data is cached in a local SQLite database for offline use.

Retention

We retain your data for as long as your account is active. When you delete your account, we delete your profile, meal records and photos, symptom logs, cycle logs, weights, saved plans, and Care messages and attachments from our active app systems. We delete your feature board comments and clear the text, display name, and profile photo from feature requests you created. Other members’ replies can remain. We also remove your restaurant suggestions and shared menu submissions.

Account deletion automatically records a request to review records held by our payment, analytics, and PMOS Labs store providers. Provider cleanup remains pending review and completion; recording the request does not mean the providers have erased their data. No second email is needed to initiate that review.

We retain limited payment, order, and subscription references to handle provider cleanup and unresolved billing. Some financial records may need to be kept for accounting, refunds, disputes, or legal obligations. We keep a hashed email value to prevent deleted store data from being imported into analytics again. This hash is personal data. These records remain subject to review of provider cleanup and retention requirements. Backup copies are subject to our hosting providers’ retention settings.

See account deletion for details and subscription controls. You can contact support@alure.health to ask about your request’s status or records that remain.

Your rights

• Access & correction: view and edit your profile from the Profile tab.
• Deletion: use Profile → Delete Account or the instructions on our account deletion page.
• Health data control: revoke read or write permissions at any time in Apple Settings or Health Connect settings.
• Notifications: turn meal reminders on or off in Profile → Settings.

Depending on your jurisdiction (e.g., California, EEA, UK) you may have additional rights to access, correct, port, or restrict processing of your data. Email support@alure.health to exercise those rights.

Children

Alure is not directed to children under 13. We do not knowingly collect personal information from children under 13. If we learn we have, we will delete it.

Security

We use TLS for data in transit and encryption at rest with our database provider. No system is perfectly secure, but we take reasonable steps to protect your information.

Changes

If we materially change this Policy, we will update the effective date and, where appropriate, notify you in the app. Continued use after changes means you accept them.

Contact

17258526 Canada Ltd. Questions, requests, or complaints: support@alure.health.