Privacy policy

1. Who we are

AllerPrism ("AllerPrism", "we", "us") is a wellness application that helps you log meals and symptoms and spot patterns in your own data. This policy explains what we collect, why, who we share it with, and the rights you have over it. It applies to the AllerPrism mobile apps, the web app at app.allerprism.com, and this website.

AllerPrism is not a medical device and does not provide medical advice, diagnosis or treatment. For anything health related, talk to your doctor.

2. Data we collect

We collect only what the product needs to work:

• Account data. Email address, display name, and authentication identifiers. If you sign in with Apple or Google, we receive the identifier and email those providers share.
• Health-adjacent log data you create. Meal photos, detected and corrected food entries, portion notes, symptom check-ins (bloating, pain, stool form, mood, sleep, stress), diet phase, and onboarding answers such as the conditions you say you manage. This is sensitive data and we treat it that way.
• Payment data. Subscriptions are processed by Apple, Google, Stripe and RevenueCat. We receive subscription status, plan and renewal dates. We never see or store your full card number.
• Usage and device data. App interactions, feature usage, approximate region, device type and crash reports, collected through PostHog and error tooling to keep the product working and improve it.

3. How we use your data

• To run the core loop: analyse meal photos, compute FODMAP and fiber estimates, and correlate your meals with your symptoms to surface your personal trigger candidates.
• To generate reports you explicitly request, such as the doctor-ready PDF.
• To operate your account, subscription, trial and billing.
• To send service messages and, if you enable them, reminders and notifications. You can turn these off at any time.
• To understand aggregate product usage and improve features.
• To meet legal obligations and enforce our terms.

4. AI processing of meal photos

When you photograph a meal, the photo is sent from our backend to a third-party AI model provider to identify the foods on the plate. The photo is used to produce the food list you see and is not used by us to train AI models. Nutritional values (FODMAP and fiber) come from our curated dataset, not from the AI model.

Insights are framed as observations from your own data. They are statistical patterns, not clinical conclusions.

5. Legal bases (EEA and UK)

• Contract: providing the service you signed up for.
• Consent: processing your health-adjacent logs, marketing emails, and optional notifications. You can withdraw consent at any time by deleting data or your account.
• Legitimate interests: product analytics, security and fraud prevention, balanced against your rights.
• Legal obligation: tax, accounting and lawful requests.

6. Who we share data with

We never sell your data. We share it only with processors that run the service:

• Supabase: database, authentication and file storage.
• Railway and Vercel: application hosting.
• AI model providers: meal photo recognition, as described above.
• Stripe, RevenueCat, Apple, Google: payments and subscriptions.
• PostHog: product analytics.

Each processor is bound by a data processing agreement. We may also disclose data if the law requires it, or as part of a merger or acquisition, in which case this policy continues to apply to your data.

7. International transfers

Our processors operate primarily in the United States and the European Union. Where data leaves the EEA or UK, transfers rely on adequacy decisions or standard contractual clauses.

8. Retention

• Your logs and photos are kept while your account is active so your history and insights keep working.
• If you delete individual entries, they are removed from the live product immediately and from backups within 30 days.
• If you delete your account, all personal data is deleted within 30 days, except records we must keep for tax or legal reasons.
• Inactive free accounts may be deleted after 24 months following advance notice by email.

9. Security

Data is encrypted in transit (TLS) and at rest. Database access is protected with row-level security so your records are readable by your account only. Photos and reports live in private storage buckets scoped to your user. Secrets and AI keys stay on our servers, never in the apps. No system is perfectly secure, but if a breach affects your data we will notify you and the relevant authority as the law requires.

10. Your rights

Wherever you live, we honor these for everyone: access, export, correction, deletion, restriction, objection, and portability. In the EEA and UK you can also complain to your data protection authority; in California you have equivalent rights under the CCPA/CPRA, and we do not "sell" or "share" personal information as defined there.

Export and deletion are self-serve inside the app (Profile, then Data). Anything else, email privacy@allerprism.com and we will respond within 30 days.

11. Children

AllerPrism is not for children. You must be at least 16 years old (or the age of digital consent where you live) to create an account. We do not knowingly collect data from children; if you believe a child has an account, contact us and we will delete it.

12. Cookies and analytics on this website

This marketing site uses PostHog to measure pages visited and general usage. The embedded demo video is served by YouTube in privacy-enhanced mode, which sets no advertising cookies until you play it. The interactive product demo on the homepage runs entirely in your browser and stores nothing.

13. Changes to this policy

We will update this policy as the product evolves. Material changes are announced in the app or by email at least 14 days before they take effect. The date below always reflects the current version.

14. Contact

Privacy questions and requests: privacy@allerprism.com. General support: support@allerprism.com.