Inaya: AI Health Coach — Privacy Policy

This policy covers the Inaya: AI Health Coach mobile app for Android and iOS — the app you use to plan meals, follow workouts, log food (by text, photo, or voice), upload lab reports, and chat with your AI coach. Inaya is an AI wellness coach for general health; it is not a medical device or a healthcare provider and does not provide medical advice, diagnosis, or treatment.

If anything here is unclear, email support@simpleapps.world and we'll fix it.

1. Who we are

Inaya ("we", "us", "our") is operated by Simple Apps. Contact us at support@simpleapps.world.

2. What we collect

• Phone number — used to create your account and sign you in (Firebase phone OTP).
• Profile basics — first name, date of birth, gender, height, weight, activity level, dietary preference, preferred language, and primary goal. You enter these during setup and can edit them on the Me → Your profile screen.
• Health & fitness profile — likes, dislikes, allergies, medical conditions, medications, cooking context, goals, and freeform notes. Added by you, or proposed by the AI coach during chat (you tap Apply to save).
• Meal logs — meals you record by typing, by photo, or by voice: name, time, estimated macros, and an optional photo.
• Habit & vitals logs — water, weight readings, activity, mood, flare/symptom entries, and fasts.
• Health Connect data (Android — optional) — if you connect Health Connect, we read your steps, active calories, total calories, sleep, heart rate, and weight to show your activity and progress. Read-only, limited to those types, and only after you grant it. See section 2b.
• Lab reports — when you upload a PDF or photo of a lab report, we extract the markers (HbA1c, lipids, thyroid, vitamins, etc.) and your name as printed on it. The original file is processed transiently and not retained.
• Voice input (transient) — when you answer by voice or use the voice coach, your speech is transcribed to text on your device and we receive only that text. We do not record, upload, or store the raw audio. See section 2c.
• AI coach conversations — your messages and the coach's replies, so the conversation has memory across turns, plus a small daily usage counter for fair-use limits.
• AI-generated plans — the meal and workout plans the coach builds, saved so the app can show and reference them.
• Reminders you ask the coach to set (medicine, meals, check-ins).
• Purchase records — if you subscribe, a Google Play purchase token and your subscription status (to unlock Premium). We never receive your card or bank details.
• Device basics — app version, OS version, language, and a push-notification token (only if you enable notifications).

We do not collect: contacts, precise or background location, SMS, calendar, your full photo library, biometric identifiers (fingerprint / face), or anything for advertising. We do not store raw microphone audio — voice is transcribed to text on your device (section 2c). Health & fitness readings are only accessed via Health Connect, with your explicit consent (section 2b).

2a. Device permissions we ask for

• Camera — only when you tap "take a photo" to log a meal or upload a lab report. The image is sent to our servers for processing (meal recognition or lab-marker extraction) and not retained beyond extraction.
• Photos — only when you pick an existing photo of a meal to log. We access just the image you choose, not your library.
• Microphone & speech recognition — only when you tap the mic to answer by voice or talk to the voice coach. Used to capture your words and convert them to text; see section 2c.
• Notifications — only if you accept the prompt. Used for reminders you set and occasional coach nudges. Revoke any time in system Settings.
• Biometric / device unlock — used by the OS to encrypt your sign-in token in the device keychain. We never see your fingerprint or face data; the OS handles it locally.

We do not request: location, contacts, SMS, calendar, or background activity.

2b. Health Connect (Android health & fitness data)

Inaya can connect to Health Connect on Android to read your health and fitness data. This is entirely optional — the app works without it, and we only read data after you explicitly grant permission in the Health Connect permission sheet.

• What we read (read-only): Steps, Active Calories Burned, Total Calories Burned, Sleep, Heart Rate, and Weight. We request read access only — the app never writes, edits, or deletes data in Health Connect.
• Why: to show your daily activity, sleep, and weight trends alongside your meals and goals, and to help the AI coach give context-aware suggestions. We only use it to power features you see in the app.
• How it's stored: a daily summary (e.g. total steps, sleep minutes, resting heart rate, latest weight) is saved to your account under the same encryption and access controls as the rest of your data. We do not store raw, per-sample records.
• Sharing: we do not sell or share Health Connect data with third parties, use it for advertising, or transfer it to data brokers.
• Revoking access: disconnect any time in Android Settings → Health Connect → App permissions. Once revoked, we stop reading new data immediately. To delete summaries we've stored, delete your account (Me → Delete account) or email support@simpleapps.world.

Our use of information received from Health Connect adheres to the Google Play Health Connect Permissions policy, including the Limited Use requirements.

2c. Voice & speech

Inaya lets you answer questions and talk to your coach by voice instead of typing. When you do:

• Speech-to-text happens through your device's built-in speech recognition — Apple's Speech framework on iOS and the system speech recognizer (Google) on Android — governed by Apple's or Google's privacy policy.
• We receive only the resulting text, handled exactly like a typed message or meal log. We do not record, upload, or store the raw audio on our servers.
• The coach's spoken replies use on-device text-to-speech — no audio leaves your phone for that.

3. How we use it

• Build and adapt your meal plans, workouts, and coach replies.
• Show you trends, adherence, and patterns across your logs and lab reports.
• Remember your preferences so you don't have to repeat yourself.
• Operate the service (sign-in, hosting, billing, and fixing bugs we find in logs).

We do not sell your data, share it for advertising, or allow our AI providers to use your inputs to train their models.

4. Who we share with

We share your data only with the service providers needed to run the app, or where required by law:

• Google (Firebase Auth, Firestore, App Hosting) — authentication, database, and hosting on Google Cloud. Data is encrypted at rest.
• Google (Gemini API) and Anthropic (Claude API) — our AI providers, used for coach replies, meal parsing, plan generation, and lab-report extraction. Your inputs are not used to train their models, per the Gemini API terms and Anthropic's commercial terms. Processing may occur on their infrastructure outside your country (typically the United States).
• Google Play Billing — only if you subscribe to Premium. Google handles the payment; we receive only a purchase token and subscription status, never your card details.
• Your device's speech-recognition service (Apple / Google) — only when you use voice, to convert speech to text (section 2c).

5. Where it's stored

Securely on Google Firebase (Google Cloud). Data in transit uses TLS 1.2+; data at rest is encrypted by Google. Access is restricted, and your personal data is private to your account.

6. How long we keep it

As long as your account is active. If you delete your account (see below), all of your personal data is removed within 30 days; most of it is removed immediately. We keep a minimal audit log of the deletion itself for 6 months in case of disputes.

7a. Legal bases & your regional rights

Where data-protection law applies, we process your personal data to perform our contract with you (running the Service), on your consent (for health data and optional permissions like Health Connect, camera, or notifications), and for our legitimate interests in operating, securing, and improving the Service. We process health and other sensitive data only with your explicit consent, which you give when you sign up and provide it, and which you can withdraw any time by deleting the data or your account.

• EU / UK (GDPR): access, rectification, erasure, restriction, portability, objection, withdrawing consent, and lodging a complaint with your data-protection authority. International transfers (e.g. to our AI providers in the US) rely on appropriate safeguards such as Standard Contractual Clauses.
• India (DPDP Act, 2023): access, correction, erasure, grievance redressal, and nomination. Contact our Grievance Officer (section 11).
• California (CCPA/CPRA): know, delete, correct, and opt out of "sale"/"sharing" — we do not sell or share your personal information, and we do not use sensitive data to infer characteristics about you.

To exercise any of these, email support@simpleapps.world.

8. Children

Inaya is not intended for users under 18. If you believe a minor has signed up, email us and we'll delete the account.

9. Health & safety

Inaya is for general wellness only. Always consult a qualified healthcare professional before changing your diet, exercise, supplements, medication, or treatment, and for anything related to a medical condition.

10. Updates to this policy

If we change anything material, we'll notify you in-app before the change takes effect. The "Last updated" date at the top reflects the current version.

11. Contact

Questions, complaints, or requests: support@simpleapps.world.

Grievance Officer (India, DPDP Act 2023): Simple Apps, support@simpleapps.world. We aim to acknowledge grievances within 24 hours and resolve them within the timelines required by law.