Privacy policy

Who is responsible

Nubi Oy is the controller of your personal data when you use the nubi app, nubi.health website, or beta waitlist. For privacy questions or requests, email hello@nubi.health.

Data the app uses

• Account details, such as your name, email address, sign-in identifier, language, and time zone.
• Information you provide about yourself, such as age, body measurements, activity, dietary preferences, allergies, goals, and other health information you choose to share.
• Your meals, food photos, nutrition plans, progress, chat messages, and the suggestions and summaries nubi creates for you.
• If you connect Apple Health, Health Connect, or a supported wearable service, the data you allow it to share. This can include activity, workouts, sleep, heart rate, recovery, and body measurements, together with their source and recording time.
• Your consent choices and technical records needed to operate the app, investigate errors, and protect accounts.

Connected health is optional. You choose the available data types in your device or provider settings. Disconnecting stops new imports but keeps previously imported information. Deleting connected-health data removes those imports and their derived health summaries from nubi. It does not delete your chats, information you entered yourself, or records held by the original health service.

Purposes and legal bases

We use account details to provide your account and respond to service requests, based on performance of our agreement with you under GDPR Article 6(1)(b).

With your explicit consent, we use your health, nutrition, and activity information to personalise meal guidance, goals, progress summaries, and AI coaching. This includes the health information you enter and any connected-health data you choose to share. The legal bases are consent under Article 6(1)(a) and explicit consent for health data under Article 9(2)(a). We record when you consent and which notice you agreed to.

We use limited technical records to keep the service secure and reliable, based on our legitimate interests under Article 6(1)(f). Where a law requires records or disclosure, we rely on Article 6(1)(c). We do not sell your personal data or use your health information for advertising.

AI coaching

OpenAI processes information for nubi's AI features. Depending on the feature, this includes your messages and food photos, relevant profile and nutrition information, goals, and summaries of connected-health data. AI can infer information about your health from this material. Avoid including information about other people in messages or photos.

OpenAI's published API policy says customer content is not used to train its models by default. Its standard service can retain content for safety monitoring for up to 30 days, or longer when legally required. Stored AI conversation responses are retained for at least 30 days. Images flagged by safety checks may be retained for review. Deleting your nubi account does not immediately remove these copies. OpenAI's data controls explain these retention rules.

nubi uses automated calculations and AI to suggest meals and goals and to summarise progress. These suggestions are for you to review. We do not use them to make decisions about you with legal or similarly significant effects, such as insurance or employment decisions.

Service providers and international transfers

Service providers help us deliver sign-in, hosting, storage, security, email, and AI features. Kinde handles account authentication. OpenAI provides AI processing. Health services you choose to connect also process data under their own privacy notices. Access within nubi is limited to people who need it to operate the service or respond to your request.

Personal data may be processed outside the European Economic Area, including in the United States. OpenAI processing is not limited to the EU. Its data processing addendum provides for transfers using European Commission standard contractual clauses or an applicable adequacy decision. These safeguards address protection of data transferred abroad. Contact us to request information about the safeguards applicable to your data or a copy of them.

Retention and account deletion

We keep your profile, saved content, and health history while your account is active so you can use them and review progress. You can delete your account in the app settings. Once the request is accepted, access ends and we remove your account data from our active database. Deletion of stored photos and records with our service providers can take longer and is retried if a service is unavailable.

Backup copies can remain until the relevant backup expires. They are retained for recovery, rather than ordinary use. Limited records may be kept where needed to complete deletion, prevent access using an old sign-in session, meet legal duties, or handle a legal claim. OpenAI retention is described above. For the status of a deletion request, contact us.

Website and waitlist

The waitlist collects your email, selected mobile platform, signup source, and submission time. We use your consent to send beta invitations and related launch updates. You can withdraw it by contacting us. We keep these details while handling your signup and the related beta or launch communications, and remove them when you withdraw or they are no longer needed.

Hosting and security providers process technical request data to deliver and protect the website. Cloudflare Turnstile checks for automated abuse, and Google supplies the website's fonts. This processing serves our legitimate interests in a working, secure website. See our cookie policy for details. Please do not send health information through the waitlist form.

Your choices and rights

You can withdraw health-data consent at any time by choosing Delete account in Settings. This closes your account and removes your health history and other personal data as described above. You can also contact us to request withdrawal and deletion. Withdrawal does not affect processing that was lawful before you withdrew. Health personalisation needs your consent; connecting a health service is always optional, and you can manage connections or delete connected-health imports separately.

You may request access, correction, deletion, restriction, or a portable copy of your personal data. You may object to processing based on legitimate interests. Contact hello@nubi.health to exercise these rights. We may need to verify your identity. We normally respond within one month and will explain any permitted extension or limitation.

You can complain to Finland's Office of the Data Protection Ombudsman or your local data protection authority.

Children

The beta is intended for adults. Contact us if a child has provided personal data.

Changes to this policy

We may update this policy to reflect changes to our services, how we use personal data, or legal requirements. We will publish the updated policy here and update the date above.

Before changing how we process your personal data, we will explain the changes and when they take effect. For material changes, we will email affected account holders and waitlist members in advance, giving you reasonable time to understand the changes and exercise your rights. For website visitors whose email address we do not hold, we will provide a prominent notice on the website before the changed processing begins.

Where a change requires fresh consent, we will ask for it before using your data in that way. Continuing to use nubi does not count as that consent. You can withdraw consent at any time as described above. Wording corrections that do not change how we process your data or affect your rights may take effect when published.