Privacy Policy

What we collect

• Email address;
• Display name (where provided by an identity provider, such as Apple or Google when you sign in using your account with those providers);
• Persistent user identifier;
• Authentication and consent records (e.g., the time and date of your consent, and relevant identifiers such as IP address and user agent);
• Push notification tokens; and
• Basic session and feature-usage events.

Why

To create and manage your account, authenticate you, record consent, and deliver the Services, maintain security, and provide account-related communications.

Legal basis

Art. 6(1)(b) GDPR (contract)

This data includes special category data under Art. 9 GDPR, specifically data related to your health. We only process this data with your explicit consent.

What we collect

• Logged and self-reported data:
  • Meals (photos, voice, text, barcodes), nutrition estimates
  • Caffeine, hydration, supplements
  • Workouts and activity
  • Daily check-ins (energy, mood, stress, sleep quality)
  • Menstrual-cycle events and reproductive-health context
  • Free-text reflections and coach interactions
• Wearables / device data:
  • Sleep, activity, heart rate, HRV, recovery/strain scores, body metrics
  • Data synced via connected wearables and health platforms through our aggregator partner
• User-uploaded files:
  • Lab reports, biomarker results, medical records, PDFs, images
  • Meal photos and other files you attach in the app
• Voice and audio:
  • Voice input streamed to an AI provider for transcription and interpretation
  • Transcripts are stored as messages; raw audio is not retained
• Derived and inferred data:
  • Scores, trends, modelled curves (e.g., caffeine or hydration estimates)
  • AI generated explanations, summaries, plans, recommendations, recipes, workouts, and guided audio sessions
• Long-term AI memory:
  • Profile memory: structured facts and preferences
  • Episodic memory: short summaries of past interactions
  • Used to personalize future AI interactions and outputs

Derived data and AI-generated content inherit the sensitivity of the underlying inputs.

Cycle data

If you connect Apple Health, Outcurve reads your menstrual-flow records to anchor cycle-aware coaching and — if you enable it — writes the period days you log in Outcurve back to Health. We store period dates, flow days, and derived cycle statistics only; we never collect sexual-activity data, fertility intentions, or free-text cycle notes. Cycle data is never used for advertising, sold, or shared with third parties for their own purposes; like the rest of your Program Data, it is processed by the sub-processors listed in Annex A, including the AI providers that generate your coaching. Cycle predictions are informational and are not a form of contraception.

Why

To provide the Services, including to:

• Deliver and personalise AI-driven coaching content, plans, insights, and recommendations;
• Display lab and wearable trends; generate scores, trends, insights, and adaptive daily plans; and
• Maintain continuity and personalisation across interactions

With your consent, we also use pseudonymized Program Data, including health-related data, for product improvement and safety.

Legal basis

• Art. 6(1)(b) GDPR (contract) to provide the base service.
• Art. 6(1)(f) GDPR (legitimate interests) for personalisation, including long-term personalisation through AI memory.
• Arts. 6(1)(a) GDPR (consent) and 9(2)(a) GDPR (explicit consent) for the processing of health-related data, including for product improvement and safety purposes.

What we collect

• Transaction and subscription-status information provided by app stores

What we do not collect

• Payment card data or billing details

Why

• To manage subscriptions and grant access to paid features

Legal basis

Art. 6(1)(b) GDPR (contract)

What we collect

• App version, device and OS type
• Time zone and coarse locale
• Crash reports and performance diagnostics
• Minimal, non-content product analytics

Why

• To ensure the security, reliability, and technical performance of the Services;
• To prevent abuse;
• To understand how the Services are used and improve app functionality, where permitted by law and your choices; and
• To comply with consent rules for analytics, diagnostics or similar technologies where applicable, including under §25 TDDDG.

Legal basis

• Art. 6(1)(a) GDPR (consent) to the extent that this data is not strictly necessary to provide a service you have requested (e.g., for analytics and performance diagnostics)
• Art. 6(1)(b) GDPR (contract) to the extent that it is necessary to provide the Services (e.g., to ensure the app displays properly on your device).

What we collect

• Emails or messages sent to customer support
• Feedback, surveys, or interviews (recorded only with consent)

Why

• To respond to inquiries and improve the Services

Legal basis

• Art. 6(1)(b), where processing is necessary to respond to your request or provide support related to the Services;
• Art. 6(1)(f) GDPR, where processing is necessary for our legitimate interests in responding to user inquiries, improving the Services, managing support operations.

What we collect

• Precise location (GPS) and related motion and sensor data while you record a run or bike activity in the app, including — where you have granted the relevant device permission — in the background while a tracked activity is in progress
• Routes, distance, pace, elevation and similar activity metrics derived from that location data

Background location is collected only while a run or bike activity you have started is being tracked, and stops when you end or discard the activity. You can withdraw location permissions at any time in your device settings; if you do, activity tracking features may be limited or unavailable.

Why

• To record and display your run and bike activities, including routes, distance, pace and elevation; and
• To generate activity metrics, trends, training insights and personalised coaching based on those activities.

Legal basis

• Art. 6(1)(b) GDPR (contract), where processing is necessary to provide an activity-tracking feature you have requested;
• Art. 6(1)(a) GDPR (consent), given through your device’s location permission, which you can withdraw at any time in your device settings; and
• Art. 9(2)(a) GDPR (explicit consent), to the extent workout location data reveals health-related information. Location data collected as part of your activities is treated as Program Data.

• Cloud infrastructure & hosting
• Authentication & notifications
• Wearable aggregation
• AI processing
• Analytics & diagnostics

• App stores (e.g., Apple, Google): distribution, platform permissions, in-app purchase processing and subscription management.
• User-directed sharing (optional): You may share selected data with a Data Recipient (e.g., your physician, trainer, employer). We’ll show what, who, and for how long before you consent; you can revoke in-app. The recipient becomes an independent controller for their copy.

• Legal: We disclose when required by law or to protect rights/safety.
• Business transfers: As part of due diligence or a transaction, with appropriate safeguards