This document is a template. It must be reviewed by qualified legal counsel before launch. TODO: replace with the reviewed policy, the real company entity and contact details.
GI Buddy is operated by DSHG Sonic. This policy explains what we collect when you use the GI Buddy app, why we collect it, who processes it on our behalf, and the choices you have.
1. Introduction and scope
This policy covers the GI Buddy mobile and web apps, this website, and our support channels. It does not cover third-party services you choose to connect, or the practices of your clinic or care provider.
2. Information we collect
We collect only what the product needs to work:
- Account information — name, email address and authentication details.
- Diet profile — your conditions and diseases, diet type, dietary preference and allergies. This is health information and is treated as such.
- Food photos and voice recordings — images of dishes and nutrition labels, and audio you record when asking by voice.
- Barcode scans — the product codes you scan and the products they resolve to.
- Chat messages — what you send to the GI Buddy AI Assistant and the replies it returns.
- Colonoscopy prep details — procedure date and time, prep medication, prep type and prep status.
- Usage data — device type, app version, feature usage and diagnostic logs.
- Payment data — handled by Stripe. We receive subscription status and the last four digits of your card; we never store full card numbers.
3. How we use it
To check foods against your profile, generate meal plans, grocery lists, recipes and daily suggestions, run the AI Assistant, keep your recommendation history searchable, send prep reminders, provide support, manage your subscription, and keep the service secure and reliable. We do not sell your data and do not use your health information for advertising.
4. AI processing
To generate recommendations, relevant content — your diet profile attributes, the food you ask about, photos, transcribed voice input and chat messages — is sent to third-party AI providers acting as our processors. Output is AI-generated and may be incomplete or wrong; it is general dietary information, not medical advice.
5. Legal basis and consent
Where required, we process health information on the basis of your explicit consent, which you give when you create your diet profile and can withdraw at any time. We also rely on performance of our contract with you, our legitimate interests in operating and securing the service, and legal obligations.
6. Sharing and third-party processors
We share data only with processors that help us run GI Buddy: our AI provider (recommendation generation), Stripe (payments and subscriptions), our hosting and infrastructure provider, and our transactional email provider. Each is bound by contract to process data only on our instructions. We may also disclose data where legally required.
7. Data retention
We keep your account and diet profile while your account is active. Recommendation history, photos and voice recordings are retained so you can revisit past checks, and can be deleted individually. When you delete your account, we delete or anonymise your data within a reasonable period, except where we must retain records for legal or billing reasons.
8. Security measures
Data is encrypted in transit and at rest using 256-bit encryption. Access is role-based, limited to staff who need it, logged and reviewed. We operate HIPAA-aligned handling practices and SOC 2 controls. No system is perfectly secure, so we also ask you to protect your own credentials.
9. Your rights
Depending on where you live, you may access your data, correct it, export it, delete it, restrict or object to certain processing, and withdraw consent. You can do most of this in the app; otherwise contact us using the details below and we will respond within the period required by law.
10. Children's privacy
GI Buddy is intended for people aged 18 and over, or for minors with the consent and supervision of a parent or guardian. We do not knowingly collect data from children without that consent; if we learn we have, we delete it.
11. International transfers
Our processors may store or process data in countries other than yours. Where that happens, we rely on appropriate safeguards such as standard contractual clauses.
12. Cookies and local storage
We use cookies and local storage to keep you signed in, remember preferences and understand how the product is used. You can clear them in your browser or device settings; some features will stop working if you do.
13. Changes to this policy
If we make material changes we will update the date at the top of this page and notify you in the app or by email before the changes take effect.
14. Contact us
TODO: replace with the real contact details.
See also the Terms & Conditions.