Privacy Policy — Healthy Bears

Effective date: 8 July 2026 Last updated: 8 July 2026

Healthy Bears ("Healthy Bears", "we", "us", "our") operates the Healthy Bears mobile application and the services available at https://healthybears.ai (the "Service"). This Privacy Policy describes what personal information we collect when you use Healthy Bears, how we use it, with whom we share it, and the choices you have. We take your privacy seriously; reading this document in full takes about five minutes.

1. Who we are and how to contact us

• Company: Healthy Bears
• Location: Dubai, United Arab Emirates
• Email for privacy questions, access requests, and complaints: healthbears.ai@gmail.com

If you would prefer to reach us about a specific privacy concern, use the email above with the word "PRIVACY" in the subject line — we route those separately.

2. Information we collect

2.1 Information you provide directly

When you create an account and use Healthy Bears, you give us:

• Account identifiers. Your name (first and last), email address, and the authentication credentials associated with your Google account or Apple ID if you sign in with one of those providers. If you choose Apple's "Hide My Email", we receive only the relayed email address Apple generates for you and never see your real one.
• Profile and health data. Date of birth, biological sex, height, current weight, goal weight, activity level, dietary preferences, food allergies and restrictions, and any weight log entries you add over time. This data is needed to generate your nutrition plan and weekly reports.
• Food logs. Every meal you record — whether typed, photographed, or scanned via barcode — including the macro and calorie values we compute for it and any notes you attach.
• Photos. When you use the camera-based meal logger we upload your photo to our servers so it can be analysed.
• Subscription data. Your purchase token from Google Play (Android) or the original transaction identifier and signed renewal info from the Apple App Store (iOS). We never see, store, or process your card details — Google and Apple do all payment handling. We also keep the SKU you purchased and the subscription status derived from the store's server-to-server notifications.
• Support correspondence. If you email us or respond to an in-app prompt, we keep the text of that message.

2.2 Information we collect automatically

• Device and app telemetry. App version, OS version, device model, approximate region (derived from IP, not precise location), crash reports, performance traces, and aggregate feature-usage metrics. Collected via Firebase Analytics and Firebase Crashlytics.
• Session and authentication data. Secure tokens that keep you signed in and that protect your account from unauthorised access.

2.3 Information we do not collect

• We do not access your precise GPS location.
• We do not read your contacts, SMS messages, or other apps' data.
• We do not record audio. The microphone permission is not requested.
• We do not collect camera data in the background; only when you actively use the camera-based meal logger.
• We do not serve or display advertising of any kind inside the app, and no ad network delivers content to you through Healthy Bears.
• Separately from displaying ads: we use Meta's SDK for ad measurement (see section 2.4) to measure the performance of our own advertisements for the app. This is on by default for adult accounts, you can turn it off at any time in Settings, and it never shares your food, weight, or health data.

2.4 Advertising measurement (Meta and Google)

We advertise Healthy Bears on Meta platforms (such as Instagram and Facebook) and may advertise on Google platforms. To measure whether those ads work, the app includes Meta's Core SDK, and the same setting controls Google's advertising-consent signals ("Consent Mode") in the Firebase analytics we already use — subject to all of the following:

• On by default for adult accounts; you can turn it off. Ad measurement is enabled once you are signed in and your profile confirms you are 18 or older. You can switch it off at any time in Settings → Ad measurement. It never runs for signed-out users, and entering a birth date under 18 turns it off automatically.
• What Meta receives: a signal that the app was installed and opened, standard app-session lifecycle signals, and device identifiers used for ad matching — on Android the Google Advertising ID; on iOS we do not request tracking permission and do not collect the IDFA (measurement runs in Apple's aggregate/privacy-preserving mode).
• What changes for Google: Google's advertising-consent signals (ad storage and ad-user-data) are enabled in our Firebase analytics so Google can measure our own ads. If you switch ad measurement off, those signals are denied. Ad personalization is never enabled either way.
• What Meta never receives: your food logs, meal photos, calories, macros, weight, height, birth date, health goals, or any other profile or health information.
• Turning it off: flip the Settings toggle at any time. Your denial takes effect immediately for future launches; signals from the current app session may complete, and sharing stops fully from the next time you open the app. Data already sent to Meta cannot be retracted by us — Meta's own retention and processing terms govern it (see https://www.facebook.com/privacy/policy).
• Your choice is remembered: if you switch ad measurement off, we store that on your device and it stays off for that account — including after updates to this policy.
• Questions or complaints: contact us via section 11.

3. How we use your information

We use what we collect to:

• Build and maintain your personalised nutrition plan.
• Analyse the meals you log and return calorie and macro estimates.
• Generate your daily summary and weekly reports.
• Process and verify your subscription.
• Send you essential service communications (e.g. account security, subscription renewals, major policy changes).
• Investigate crashes and fix bugs.
• Improve the product in aggregate — always using de-identified or aggregated data when improving models or measuring usage patterns.

We do not sell your personal information to anyone. We do not use your food logs, photos, or profile data to train public AI models.

4. Who we share your information with

Healthy Bears relies on a small number of specialist vendors to deliver the service. We share the minimum data each of them needs to do their job.

We do not share your data with any party beyond the list above except: (a) when you explicitly instruct us to; (b) when legally compelled (subpoena, court order, equivalent); or (c) during a corporate transition (merger, acquisition, asset sale), in which case the acquiring entity will honour this policy or give you an opportunity to delete your data first.

5. International data transfers

Healthy Bears operates globally. Your data may be stored or processed in the United States, the European Union, the United Arab Emirates, or India depending on where our vendors run. Where required by law (e.g. GDPR in the EU), we rely on Standard Contractual Clauses or equivalent safeguards with our processors.

6. How long we keep your data

You can request deletion at any time; see Section 8.

7. Security

We protect your data with:

• HTTPS for all network traffic between the app and our servers.
• Encrypted storage of authentication tokens on your device (Android EncryptedSharedPreferences / iOS Keychain).
• Principle-of-least-privilege access controls on the backend; only a small engineering team reaches production data, and access is logged.
• Google Play App Signing for release integrity.

No internet service is perfectly secure. In the unlikely event of a data breach that materially affects you, we will notify you by email within 72 hours of confirming the breach.

8. Your rights

Depending on where you live you have some or all of the following rights. We honour all of them for every user worldwide, regardless of local law.

• Access — request a copy of the personal data we hold about you.
• Correction — ask us to fix inaccurate data.
• Deletion — ask us to delete your account and all associated data. You can trigger this from inside the app (Settings → Delete account) or by emailing healthbears.ai@gmail.com.
• Portability — request your data in a structured, machine-readable format (JSON).
• Withdraw consent — where we rely on consent (e.g. optional analytics), you can withdraw it at any time in Settings.
• Complain — you can complain to your local data protection authority. In the UAE this is the UAE Data Office; in the EU it is your national supervisory authority; in India it is the Data Protection Board of India under the DPDP Act.

We respond to rights requests within 30 days. We do not charge a fee except for manifestly unfounded or repeated requests.

9. Age requirement

Healthy Bears is designed for adults and is not intended for use by anyone under 18 years old. Calorie and weight tracking is not appropriate for minors, and the app's sign-up flow requires a birth date confirming you are 18 or older. We do not knowingly collect personal data from anyone under 18 — and never from children under 13. If you believe a minor has given us personal data, email healthbears.ai@gmail.com and we will delete it promptly.

The optional advertising-measurement feature (section 2.4) is additionally restricted: it cannot be enabled unless your profile confirms you are 18 or older, and we never send birth dates or ages to Meta.

10. Changes to this policy

We update this policy when our practices change. Material changes will be announced in-app and by email at least 30 days before they take effect. The "Last updated" date at the top of this page always reflects the most recent version.

11. How to contact us

• Privacy email: healthbears.ai@gmail.com
• General support: healthbears.ai@gmail.com

Jurisdiction-specific supplements

11.1 European Economic Area and United Kingdom (GDPR / UK GDPR)

• Legal bases we rely on: performance of a contract (delivering the service you paid for), legitimate interests (security, product improvement), your consent (optional analytics), and legal obligations (accounting, lawful-request responses).

11.2 California (CCPA / CPRA)

• Categories of personal information collected: identifiers (name, email), account info, internet activity (app usage), geolocation (approximate only), and health/fitness data.
• "Sale" of personal information: we do not sell. We do not disclose your information for third parties to advertise their own products to you. While ad measurement is on (section 2.4), device identifiers and app-install/session signals are disclosed to Meta solely to measure our own advertising; to the extent California law treats that as "sharing," you can opt out at any time via the Settings toggle, and it never occurs while you are signed out or under 18.
• Right to limit use of sensitive personal information: California residents can request that we limit use of sensitive data (e.g. precise weight history) to the minimum necessary to deliver the service. Email us to invoke.

11.3 India (DPDP Act 2023)

• Consent Manager: Healthy Bears acts directly; we do not route consent through a third-party Consent Manager at this time.
• Grievance Officer: reachable at healthbears.ai@gmail.com.

11.4 United Arab Emirates (PDPL)

• Healthy Bears complies with UAE Federal Decree-Law No. 45 of 2021 (PDPL). UAE users can contact the UAE Data Office for regulatory complaints.

End of policy.