Privacy Policy

Who is responsible for your data

Saura Health Oy ("Saura", "we", "us") is the controller of personal data described in this policy. Contact our privacy team at privacy@saura.health.

This policy applies to Saura's consumer app, website, store, customer support, and any optional laboratory services you choose. Our Consumer Health Data Privacy Policy gives U.S. consumers additional information and rights.

Personal data we process

• Account and contact data: user ID, email, display name, authentication records, and contact details you provide to the store or support.
• Nutrition and health-related data: age, sex, height, weight, activity level, goals, dietary preferences, restrictions, allergies, meal photos and descriptions, meal times, ingredients, nutrition estimates, corrections, targets, scores, trends, and recommendations.
• Purchases: subscription product, status, trial, renewal, transaction, and entitlement information. We do not receive your full App Store payment-card number.
• Device, usage, and attribution data: device and app identifiers, platform, app version, language, screens and features used, lifecycle and conversion events, and Apple advertising attribution information.
• Diagnostics and communications: crash and performance information, support requests, feedback, and messages you send us.
• Optional laboratory-service data: order and delivery details, identity-verification information, and test results when you separately purchase or activate a laboratory service.

Where the data comes from

We receive data from you; from your device and use of Saura; from Apple, RevenueCat, and other providers supporting your purchase or request; and, for optional laboratory services, from the laboratory provider. We also calculate or infer nutrition estimates, targets, trends, and recommendations from information you submit.

Age eligibility and children

The Saura app and consumer account are intended for people aged 13 or older. We do not knowingly permit children under 13 to create or use a Saura account, and we do not offer a guardian-consent flow for them. Personalised nutrition targets are additionally limited to users aged 16 or older. If you believe a child under 13 has provided personal data to Saura, email privacy@saura.health so we can investigate and delete it where appropriate.

Why we process data

We process personal data to:

• create and secure your account and provide the meal-analysis, tracking, personalization, synchronization, subscription, and support features you request;
• analyze meals and generate nutrition estimates, recommendations, and related AI-assisted outputs;
• operate purchases, trials, entitlements, accounting, and fraud prevention;
• understand product use, measure acquisition, diagnose errors, and improve Saura; and
• comply with law, enforce our terms, and protect Saura, our users, and others.

Depending on the activity and your location, our legal basis is performance of a contract or steps you request, your consent, compliance with law, or our legitimate interests in operating, securing, and improving Saura. Where we rely on consent, you may withdraw it at any time without affecting earlier processing.

Service providers and other recipients

We disclose only the data reasonably needed for the relevant service to providers acting for us, including:

• Supabase for authentication, database, and file storage;
• Google Cloud and Vertex AI, Anthropic, and OpenAI for cloud, AI, and embedding processing used by requested features;
• Turbopuffer for per-user vector storage and retrieval used to personalize meal analysis and app memory;
• Apple and RevenueCat for App Store purchases, subscriptions, and entitlements; and
• PostHog for product analytics, Google/Firebase for consented analytics and advertising measurement, and Sentry for crash and reliability monitoring.

Product analytics may include your Saura user ID, email, product goal, total meals logged, and app-interaction data. We do not send meal photos or descriptions, nutrition values, body measurements, allergy or restriction values, or laboratory results to advertising networks for personalized advertising.

We may also disclose data to professional advisers, regulators, courts, law enforcement, or a successor in a corporate transaction when permitted or required by law. We do not sell personal data or consumer health data.

Advertising, analytics, and your choices

Product analytics is enabled by default and can be disabled in the app under Settings → Privacy. On iOS, you control permission for advertising measurement through Apple's App Tracking Transparency setting. Where required on Android or the website, we ask for consent before using optional analytics or advertising identifiers. You can review all available controls on our Privacy Choices page.

International transfers

Saura is based in Finland and uses providers that may process data in the European Economic Area, the United States, and other countries. Where required, we use recognized transfer safeguards such as adequacy decisions or standard contractual clauses. Provider locations can vary by service and configuration.

Retention and deletion

We retain account and service data while your account is active and as needed to provide Saura. When you delete your account or make a valid deletion request, we delete or deidentify data unless retention is required for security, disputes, accounting, or law. Copies in backups may remain isolated until overwritten in the ordinary backup cycle; consumer health data subject to Washington law will be removed from archived or backup systems within six months where that law requires it.

Your rights

Depending on where you live, you may have rights to access, correct, export, delete, restrict or object to processing, and withdraw consent. You may also complain to your local data protection authority. U.S. consumer-health requests and appeals are described in the supplemental policy.

Use the in-app account controls or visit Privacy Choices. You can also email privacy@saura.health. We may verify your identity before completing a request.

Security

We use administrative, technical, and organizational safeguards designed to protect personal data, including access controls, encryption in transit, and restricted processor access. No system can guarantee absolute security.

Changes and contact

We will post material changes before they take effect and seek consent where required. Questions or requests may be sent to:

Saura Health Oy
Privacy contact: Tatu Koivisto
Email: privacy@saura.health