GallDiet: Post-Op Privacy Policy

App: GallDiet: Post-Op
Developer: Caleb Oki
Effective Date: August 30, 2026
Last Updated: September 28, 2026

1. INTRODUCTION

GallDiet: Post-Op ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our mobile application and related services.

IMPORTANT: GallDiet: Post-Op is a health and wellness companion for people who have had their gallbladder removed. It helps you track meals, record how you feel, and follow a structured reintroduction of foods. It is not a medical device and does not provide medical advice. Always consult healthcare professionals for medical decisions.

2. INFORMATION WE COLLECT

2.1 Account Information

• Name: Your preferred name for personalization
• Email address: Required for account creation and authentication
• Password: Stored using industry-standard bcrypt hashing (we cannot read your password)
• Account creation date: For subscription and account management
• Age and sex: Asked when you create your account and editable in your profile. Used only in aggregate, to understand who uses the app and how. They do not change your meal estimates or guidance

2.2 Recovery Profile (Onboarding)

During onboarding, you provide:

• Surgery date: The date your gallbladder was removed, including how exact that date is (exact, month, approximate, or scheduled). This anchors the recovery timeline and dated guidance. A past date, an approximate date, a future date where surgery is planned, or none at all are all valid states
• Symptom experiences: Which post-surgery experiences you are dealing with most (for example urgency, bloating, pain, nausea, fat intolerance)
• Dietary preferences: Vegetarian, vegan, keto, or other dietary preferences
• Allergens: Food allergies that should be flagged regardless of a meal estimate
• Weight: Optional, for pattern context
• Disclaimer acceptance: A record of when you acknowledged the onboarding disclaimer

Purpose: This data enables dated, stage-relevant guidance and meal estimates that name the factors behind them.

2.3 Health Activity Information

Information generated through app usage:

• Meal scans: Photos of meals, barcode scans, and manual meal entries
• Estimates: Scores and the named factors behind them, with the perception version and scoring version recorded
• Urgency episodes: Timing, severity, and notes, linked to the preceding meal when applicable
• Symptom logs: Bloating, pain, nausea, or gas with severity
• No-symptom days: Quiet days you record so the record is not only difficult ones
• Reintroduction attempts: Foods you deliberately re-try and how they went
• Tolerance list: Foods classified from your attempts, each showing the recovery week it was tested in
• Pattern results: Timing and association findings derived from your records, shown with counts

Classification: This constitutes "health information" under applicable privacy regulations. We treat this data with enhanced security measures.

2.4 Photos and Media

• Meal photographs: Uploaded for AI ingredient analysis
• Camera access: Optional permission for real-time food photography
• Photo library access: Optional permission to select existing photos

Processing Note: Photos are transmitted to Anthropic Claude AI (primary), with OpenRouter and Google Gemini AI as fallbacks, for ingredient analysis. See Section 4.2 for AI processing details.

2.5 Payment Information

• Subscription status: Active, cancelled, or expired
• Payment processing: Handled by the Apple App Store or Google Play, with subscriptions managed via RevenueCat (we never receive or store your card details)
• Transaction history: Subscription dates, amounts, and payment confirmations
• Billing email: May differ from account email

2.6 Technical Information

• Device identifiers: Anonymous device IDs for push notifications
• App version and OS: For debugging and feature compatibility
• IP address: Temporarily logged for security and fraud prevention (retained 30 days)
• Crash logs: Voluntary error reports via Sentry (optional). Health data is scrubbed from these reports

2.7 We Do NOT Collect

• Precise location data: We do not track your physical location
• Address book/contacts: We do not access your phone's contact list or address book
• Microphone: No audio recording capabilities
• Health data from Apple Health/Google Fit: No integration with health platforms

3. HOW WE USE YOUR INFORMATION

3.1 AI-Powered Meal Analysis

When you estimate a meal photo:

1. The image is uploaded to our secure servers
2. The image is forwarded to Anthropic Claude AI for ingredient identification, with OpenRouter and Google Gemini AI as fallback providers
3. The detected ingredients are analyzed against nutritional reference data
4. The original photo and the analysis artifact are stored in your account

Data Retention: Photos and analysis artifacts are retained until you delete them or your account. See Section 6 for deletion procedures.

3.2 Pattern Detection and the Clinical Summary

We analyze your logged meals and episodes to describe what you have recorded:

• Timing between meals and episodes, with the number of records shown
• Observed associations between meal characteristics and episodes, reported as associations with counts visible — never as a cause, rule, or advice
• A summary you can take to a clinician, containing your records and marked as self-recorded on every page

This analysis is performed automatically, is personalized to your individual data, and can be disabled by discontinuing the related logging.

3.3 Safety Prompting

If a severe episode is recorded, or episode frequency rises over a sustained multi-week window, the app prompts you to contact a clinician. It does not characterise the cause.

4. THIRD-PARTY SERVICES

4.1 RevenueCat and App Store Billing (Payment Processing)

• Providers: RevenueCat, Inc. (subscription management); payments are processed by the Apple App Store or Google Play
• Data shared: Subscription status, purchase receipts, app user identifier
• Purpose: Subscription management and billing
• Privacy Policies: https://www.revenuecat.com/privacy, https://www.apple.com/legal/privacy/, https://policies.google.com/privacy
• Note: Card details are handled entirely by Apple or Google and never reach us or RevenueCat

4.2 Anthropic Claude AI (Primary Meal Analysis)

• Provider: Anthropic, PBC
• Data shared: Meal photographs, food-related text
• Purpose: Ingredient identification and meal analysis
• Privacy Policy: https://www.anthropic.com/privacy
• Data handling: Anthropic does not use API-submitted data to train models (per Anthropic API terms)

4.3 OpenRouter (Fallback Meal Analysis)

• Provider: OpenRouter (managed by OpenRouter Inc.)
• Data shared: Meal photographs and food-related text (only when the primary provider is unavailable)
• Purpose: Fallback ingredient identification and meal analysis
• Privacy Policy: https://openrouter.ai/privacy

4.4 Google Gemini AI (Fallback Meal Analysis)

• Provider: Google LLC
• Data shared: Meal photographs and food-related text (only when the primary provider is unavailable)
• Purpose: Fallback ingredient identification and meal analysis
• Privacy Policy: https://policies.google.com/privacy
• Data handling: Google states they do not use API-submitted data to train models (as of Gemini API terms, subject to change)

4.5 Open Food Facts and FoodData Central (Reference Data)

• Providers: Open Food Facts Association (non-profit); U.S. Department of Agriculture FoodData Central
• Data shared: Barcode numbers and normalized ingredient information only
• Purpose: Product and nutrition lookup for barcode scans
• Privacy Policies: https://world.openfoodfacts.org/legal, https://www.nal.usda.gov/

4.6 Resend (Email Delivery)

• Provider: Resend
• Data shared: Email addresses, email content
• Purpose: Transactional email delivery (verification, password resets, notifications)
• Privacy Policy: https://resend.com/legal/privacy

4.7 Sentry (Error Monitoring)

• Provider: Functional Software, Inc.
• Data shared: Crash logs, device type, app version (optional, anonymized where possible, health data scrubbed)
• Purpose: Bug detection and app stability improvement
• Privacy Policy: https://sentry.io/privacy/

4.8 Mixpanel (Analytics)

• Provider: Mixpanel, Inc.
• Data shared: Product events (for example onboarding started, first estimate completed) with recovery week and stage where relevant
• Purpose: Understanding how the product is used
• Privacy Policy: https://mixpanel.com/legal/privacy-overview/
• Note: Health data is excluded from analytics payloads by an allowlist

5. DATA STORAGE AND SECURITY

5.1 Storage Location

• Primary: PostgreSQL database hosted on Hetzner Cloud in Nuremberg, Germany
• Backups: Encrypted daily backups retained for 30 days
• File storage: Meal photos stored on encrypted server storage

5.2 Security Measures

• Encryption in transit: TLS 1.3 for all API communications
• Encryption at rest: AES-256 for database and file storage
• Authentication: Bearer tokens issued via Laravel Sanctum, securely stored
• Password hashing: bcrypt with appropriate work factor
• API security: Rate limiting, input validation, SQL injection protection

5.3 Access Controls

• Only the account holder can access their health data
• Our team can access data only for technical support purposes (with audit logging)
• We never sell or rent your personal data
• We do not share health data with advertisers

6. DATA RETENTION AND DELETION

6.1 Retention Periods

6.2 Account Deletion

You may delete your account at any time, reachable within two taps from Settings.

Process:

1. Navigate to Settings → Privacy → Delete Account
2. Confirm deletion
3. Your profile, meals, perception artifacts, estimates, urgency episodes, symptom logs, reintroduction attempts, tolerance classifications, and derived patterns are purged

During Processing: Your account and data are inaccessible while deletion is processed. You may cancel deletion by contacting support before it completes.

6.3 Data Export

You may request a complete export of your own data from Settings:

Process:

1. Navigate to Settings → Privacy → Export My Data
2. We generate a portable export containing your records
3. The export is delivered to your registered email address

7. YOUR RIGHTS

7.1 GDPR Rights (EU/EEA Users)

If you are in the European Union or European Economic Area, you have the right to:

1. Access: Request a copy of your personal data
2. Rectification: Correct inaccurate or incomplete data
3. Erasure ("Right to be Forgotten"): Request deletion of your data
4. Restrict Processing: Limit how we use your data
5. Data Portability: Receive your data in a structured, machine-readable format
6. Object: Object to certain types of processing
7. Withdraw Consent: Withdraw consent for optional data processing

To exercise these rights: Email support@galldiet.com with subject "GDPR Request". We respond within 30 days.

7.2 California Privacy Rights (CCPA/CPRA)

California residents have the right to:

1. Know: Request disclosure of personal information collected
2. Delete: Request deletion of personal information
3. Opt-out: Opt-out of "sale" of personal information (we do not sell data)
4. Non-discrimination: We do not discriminate for exercising privacy rights

To exercise these rights: Email support@galldiet.com with subject "California Privacy Request".

7.3 Canadian Rights (PIPEDA)

This app is operated from Ontario, Canada, and we honour your rights under the Personal Information Protection and Electronic Documents Act (PIPEDA): access, correction, and withdrawal of consent. To exercise these rights: Email support@galldiet.com with subject "PIPEDA Request".

7.4 Other Jurisdictions

Users in the UK and other jurisdictions have similar rights under applicable privacy laws. Contact us for jurisdiction-specific requests.

8. CHILDREN'S PRIVACY

GallDiet: Post-Op is not intended for children under 13 years of age (or 16 in the EU). We do not knowingly collect personal information from children. If you believe we have inadvertently collected data from a child, contact us immediately for deletion.

9. INTERNATIONAL DATA TRANSFERS

Your data may be processed in countries outside your jurisdiction:

• Germany: Primary server infrastructure (Hetzner Cloud, Nuremberg)
• United States: AI processing services (Anthropic, OpenRouter, Google)
• Global: AI processing services (global infrastructure)

We ensure appropriate safeguards are in place for international transfers, including:

• Standard Contractual Clauses (SCCs) for EU data transfers
• Adequacy decisions where applicable
• Data Processing Agreements with all subprocessors

10. COOKIES AND TRACKING

10.1 Mobile App

Our mobile app does not use traditional cookies. We use:

• Authentication tokens: Secure storage for session management
• Local storage: App preferences and cached data (stored on device only)

10.2 Website

If you visit postop.galldiet.com, the legal pages themselves set no cookies. Analytics on other pages on the domain follow the app's allowlist and exclude health data.

11. CHANGES TO THIS POLICY

We may update this Privacy Policy periodically. Changes will be:

• Posted on this page with an updated "Last Updated" date
• Notified via email for material changes
• Effective immediately upon posting for non-material changes

Material changes include:

• New categories of personal data collected
• New purposes for data use
• New third-party sharing
• Reduced security measures

12. CONTACT INFORMATION

Data Controller:
Caleb Oki
Toronto, Ontario, Canada
Email: support@galldiet.com

Data Protection Officer (DPO):
We are not required to appoint a DPO under GDPR Article 37, but you may contact support@galldiet.com for privacy concerns

Response Time: We aim to respond to all inquiries within 48 hours.

13. DISCLAIMERS

13.1 Not Medical Advice

GallDiet: Post-Op provides general wellness information and tracking tools. Meal estimates are based on general nutritional guidance and the food details you or the scan provide, and are not personalized medical advice.

Always consult:

• Your clinician before making dietary changes
• A nutrition professional for personalized eating plans
• Your clinician for severe or worsening symptoms

13.2 AI Limitations

Our ingredient analysis uses artificial intelligence which:

• May misidentify foods or ingredients
• Cannot detect hidden ingredients
• Does not account for individual medical conditions beyond what you explicitly record
• Should be verified by reading actual food labels where available

14. COMPLIANCE

• GDPR aligned (EU data protection)
• CCPA/CPRA ready (California privacy)
• PIPEDA aligned (Canadian privacy)
• App Store privacy requirements met
• Google Play Data Safety form requirements met

Document Version: 1.0
Next Review Date: October 30, 2026

APPENDIX A: DATA PROCESSING AGREEMENT (DPA)

For business customers or partners requiring a DPA under GDPR Article 28, contact support@galldiet.com to request our standard Data Processing Agreement.

APPENDIX B: SUBPROCESSOR LIST

Current subprocessors as of August 30, 2026:

We notify users of new subprocessors 30 days before they are engaged (where required by law).

This Privacy Policy was drafted specifically for GallDiet: Post-Op and covers the unique aspects of recovery tracking, AI-powered meal analysis, and subscription-based mobile application services.