Omnivity Privacy Policy

Version 1.0 · Last updated: 1 November 2026

This Privacy Policy explains how OmniGrowth OÜ ("we", "us") collects, uses, shares and protects personal data when you use the Omnivity app, the website getomnivity.com and related services (the "Services"), and the rights you have.

Key points

• We use your data to run Omnivity for you: logging, targets, training programs and coaching.
• Much of what you log is health-related. We process health data only with your explicit consent, which you can withdraw at any time.
• Some features use AI. For those features we send the necessary data to our AI provider, Anthropic, which processes it for us and does not use it to train its models. We do not use your data to train AI models either.
• We do not sell your personal data. We do not use your health data for advertising. We do not share data from Apple Health or Health Connect with anyone for marketing.
• You can see, correct, export and delete your data, and delete your account in the app at any time.

1. Who is responsible for your data

Controller: OmniGrowth OÜ, a private limited company registered in Estonia, registry code 17349965, Tornimäe tn 5, 10145 Tallinn, Estonia.

Privacy contact: privacy@getomnivity.com (we answer in English and Turkish).

Representative in Türkiye (KVKK): we will name our representative here before Omnivity is offered to users in Türkiye. See Section 14.

Lead supervisory authority in the EU: Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), www.aki.ee.

2. What this policy covers

This policy applies to personal data we process through the Services. It does not cover third-party services you choose to use with Omnivity (such as Apple Health, Health Connect, Google or Apple sign-in or the app stores), which have their own policies.

3. The data we collect

We collect only what we need for the purposes in Section 4. Fields marked optional are not required to use the app.

What you must provide. To create an account and receive targets and programs you need to provide an email address, a Google account or an Apple account, and your date of birth, sex, height and weight, and to give the health data consent in Section 4. Without them we cannot provide the Services. Everything else is optional; leaving it out may make some features less personal.

3.1 Account data. A user ID; your email address; if you sign in with Google, your Google account's name, email address and profile picture link; if you sign in with Apple, the email address Apple shares with us, which may be a private relay address that forwards to your inbox (we do not ask Apple for your name); your sign-in method; a password, which our authentication provider stores only as a one-way hash (we cannot read it). Before you create an account, the app uses a temporary guest identifier.

3.2 Profile and body data. Optional first name, sex, date of birth, height, weight and goal weight, optional body fat percentage if you enter it, goal and preferred pace, typical daily activity (step range), diet style and optional diet notes, measurement units, optional answer to "how did you hear about us?". Optional allergy, health condition and medication fields in your profile (we do not ask for them at sign-up); if you used an earlier version of the app, your focus and priority choices. If you use the body scan feature (18+ only, with your separate consent): your waist and hip measurements, the indicators calculated from them, Vita's note, your clothing setting, whether a photo exists for a scan, and, if you turn it on, your pregnancy setting; the body scan photos themselves stay only on your phone and are never sent to our servers or to our AI provider.

3.3 Training data. Experience level, training days, location, home equipment, gyms and machines you add, session length, other sports; injury or pain areas you select, how they affect you ("now and then, mild", "keeps coming back or ongoing", or "diagnosed by a doctor, or surgery") and an optional short note; pain reports; muscle-soreness check-ins; workouts you log (exercises, sets, repetitions, weights, effort ratings); your programs, routines and the changes made to them.

3.4 Nutrition data. Meals and foods you log, with the nutrient values copied at the time of logging; your food history, favourites, saved meals, recipes and custom serving units; foods you create; product and restaurant entries you add to the shared database and the entries you confirm; corrections you make to nutrition values; barcodes you scan; water intake; weight entries; the history of your calorie target. When you search for food, your search words are used to show results and are not stored with your account; your last 10 searches are kept only on your phone.

3.5 Photos and descriptions for AI estimates. When you photograph a meal or a nutrition label, or describe a meal in words, we send the photo or text, together with the meal type, any options you selected and your optional note, to our AI provider to produce an estimate. We do not store the photo on our servers: it is processed in memory and discarded after the estimate is returned. The app keeps a small preview of the photo on your phone for up to 30 days so you can see what you logged. Your description, note and selected options are kept in your account with the logging job, and the resulting estimate is saved as a food that only you can see.

3.6 Data from Apple Health or Health Connect (only if you connect them). Depending on your phone and the permissions you grant, we read: steps, distance, active and total energy burned, resting heart rate, heart rate variability, sleep (including sleep stages), weight, body fat percentage, height, date of birth, sex and workouts. We store daily summaries (for example your step total, sleep duration and resting heart rate for a day) and the workouts you import, not every raw sample. Workouts you import and your recent daily summaries also go into your weekly review and into the context Vita uses to answer you. If you ask us to import your nutrition history, we also read the daily nutrition totals (energy, protein, carbohydrates and fat) that other apps wrote to Apple Health or Health Connect, once, and keep them as daily totals without food names; you can delete the imported history in Settings. With your permission we also write your logged meals (energy and nutrients) and workouts to Apple Health; writing to Health Connect is not yet available.

3.7 Conversations with Vita (when this feature is available to you). Your messages to Vita, Vita's replies, and short summaries of past conversations that help Vita remember your context. Anything you tell Vita about your health is health data.

3.8 Device and technical data. Your country or region setting (taken from your phone's region and changeable in Settings) and language; time zone; app version; device model and operating system; a push-notification token; when you last opened the app and when we last sent you a notification (so we do not send too many); Firebase installation identifiers; crash reports (stack traces, device state and app log lines); usage events (see Section 9); IP address, which our servers process to deliver the Services and which our authentication provider keeps in logs for a short time.

3.9 Purchases and free Premium time. Your subscription status, trial dates and, when you buy, purchase confirmations from Apple or Google; any free Premium time we give you (for example for testing the app before release, for an invitation, for completing a challenge or for answering an in-app survey) and its end date; your invitation code and whether it has been used. We never receive your card details. We manage subscriptions and free Premium time with RevenueCat (Section 6.1), which receives only your user ID, your subscription and free-time status and the store's purchase records.

3.10 Communications and reports. Messages you send to support and our replies; reports you submit about content, such as entries in the shared food database, or about AI responses (including the reported response).

3.10a Beta testing. If you test a pre-release version through Apple TestFlight, Apple shares with us the name and email address you were invited with, your device model and operating system, the app version, crash reports and the feedback and screenshots you choose to send. Apple's own processing is described in Apple's TestFlight privacy notice. If you take part in our friends-and-family test, we also process the notes, weekly answers and interview notes you choose to give us in the test group, the feedback sheet or a call. Please don't put health details (such as your weight, goals or conditions) in them; we don't record those.

3.10b Waitlist. If you join the waitlist on getomnivity.com: your email address, language and country, the time and text version of your consent, and whether you opened our emails and clicked their links.

3.11 Consent and legal records. Which versions of our documents you accepted, which consents you gave or withdrew, when, and your region at that time.

3.12 What we do not collect. We do not collect precise location, contacts, advertising identifiers (IDFA or Android advertising ID), or biometric identifiers such as face or fingerprint data. We do not buy personal data from data brokers.

Sources. We get this data from you, from your device and the health platforms you connect, from Google or Apple if you sign in with them, from Apple or Google about your purchases (and, where the law requires, an age range), from Apple if you join a TestFlight beta, and from our AI provider (the estimates and replies it generates for you).

4. Why we use your data and our legal bases

Automated calculations. Your targets and programs are produced automatically, by published formulas and rules and, for programs, with the help of AI. They are suggestions you can change at any time; they do not produce legal effects or similarly significant effects on you. You can ask us how they were produced.

Training of AI models. We do not use your personal data to train large language models or other AI models, and our AI provider is contractually prohibited from training its models on the data we send it.

No selling, no ad targeting. We do not sell personal data, do not share it for cross-context behavioural advertising, and do not use your health data for advertising or marketing. We do not currently use advertising or ad-measurement software in the app. If we ever add it, we will update this policy first, name the partners, never send them health data, and ask for your permission where the law requires it (and always on iOS).

De-identified data. We may create statistics that are aggregated or de-identified so that they cannot reasonably be linked to you (for example, average logging activity across users). We keep and use such data only in that form, do not attempt to re-identify it, and require anyone we share it with to do the same. We never include data from Apple Health or Health Connect in data we share, even in de-identified form.

5. How AI features handle your data

• Provider. Our AI features use models from Anthropic (Anthropic Ireland, Limited and its affiliate Anthropic, PBC in the United States). Anthropic processes the data on our behalf under a data processing agreement.

• What is sent. Only what each feature needs:

  • meal estimates: the photo or your description, the meal type, any options you selected, your optional note, and your recent nutrition corrections (so estimates match how you correct them);
  • label reading: the label photos and your language;
  • training programs: your age, sex, height, weight, body fat percentage (if you entered it), daily activity level, goal and pace, diet style and notes, calorie and macro targets, training preferences, the injury or pain areas and notes you entered, muscle-soreness check-ins and relevant recent training data;
  • Vita: your messages and the profile and log information Vita needs to answer, including recent daily summaries and workouts imported from a health platform you connected (Section 3.6).

  We never send your email address. We send your first name only if you have chosen to give it to us, so that the AI can address you by name.

• Retention at Anthropic. Anthropic deletes inputs and outputs within 30 days, except content flagged for a possible violation of its usage policy, which it may keep for up to 2 years (and safety scores for up to 7 years).

• No training. Anthropic may not train its models on the data we send.

• Disclosure. We always label AI-generated estimates and programs, and Vita always identifies itself as an AI.

6. Who we share data with

We share personal data only as described here.

6.1 Service providers (processors). They process data only on our instructions and under contracts that require confidentiality and security:

6.2 Other users. Product entries you add to the shared database are visible to other users without your name or account information. Nothing else you log is visible to other users.

6.3 Apple and Google as app stores, sign-in services and health platforms. If you sign in with Apple or Google, they confirm your identity under their own privacy policies and share with us only what Section 3.1 lists; when you delete your account, we also revoke Omnivity's access to your Apple sign-in. On iPhone, notifications reach you through Apple's push notification service. When you buy a subscription, Apple or Google processes the payment as an independent controller; Apple does the same for TestFlight beta testing. When you connect Apple Health or Health Connect, data you choose to write is stored there under your control.

6.4 Professional advisers. Our lawyers, accountants and auditors, where necessary and under a duty of confidentiality.

6.5 Legal reasons. We may disclose data if required by law, court order or a valid request from a public authority, or where necessary to protect the rights, safety or property of users, the public or OmniGrowth. We review requests and disclose only what is required.

6.6 Business transfers. If OmniGrowth is involved in a merger, acquisition, financing or sale of assets, personal data may be transferred to the new owner, who must continue to protect it as described here. If your health data would pass to another company in a sale of the app or its assets, we will ask for your consent first; without it, your health data will not be transferred. A change in who owns OmniGrowth's shares does not transfer your data; OmniGrowth remains responsible for it. We will tell you before your data becomes subject to a different policy.

6.7 With your consent. In any other case, only with your consent.

7. International transfers

We are based in the EU, and much of our infrastructure is in the EU. Some providers process data in the United States or elsewhere (Section 6.1). When personal data from the EEA, UK or Switzerland is transferred to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (and the UK and Swiss equivalents) and, where the recipient is certified, the EU-US Data Privacy Framework and its UK and Swiss extensions. For users in Türkiye, transfers by us to our service providers outside Türkiye are made under Article 9 of Law No. 6698 using the standard contracts published by the Personal Data Protection Board, which are notified to the Authority as required. You can ask us for a copy of the relevant safeguards at privacy@getomnivity.com.

8. How long we keep data

9. Usage statistics, crash reports and cookies

In the app. We use Google Analytics for Firebase to count a small set of events about how the app is used (for example which onboarding step was reached, whether sign-up was completed, the first logged meal, a program becoming ready). These events contain no health or body data and are not linked to your user ID; Google may derive an approximate location (such as country or city) from your IP address for these statistics. We use Firebase Crashlytics to receive crash reports, which are linked to your user ID so we can fix problems in your account. Both are off until you allow them, except in the United States, Switzerland, Australia and New Zealand, where the law allows them to be on by default. You can switch them off or on at any time in Settings → Privacy. These tools use identifiers stored on your device (for example a Firebase installation ID); they do not use advertising identifiers.

On our website. getomnivity.com uses no cookies, analytics or advertising tools and loads nothing from other sites. Our hosting provider (Google, Firebase Hosting) processes your IP address and the technical details of each request to deliver the pages and protect the service.

Do Not Track and Global Privacy Control. We do not sell or share personal data for targeted advertising, so there is nothing to opt out of today. If that changes, we will treat a Global Privacy Control signal as a valid opt-out request.

10. Security

We use measures appropriate to the sensitivity of health data, including encryption in transit, encryption at rest provided by our hosting providers, access rules that let each account access only its own data, server-side handling of AI requests and secret keys, limited administrative access protected by two-step verification, and a separate, restricted service account for account deletion. No system is perfectly secure; if a breach affects your data, we will notify you and the authorities as the law requires.

11. Your choices and rights

Everyone can:

• See and download a copy of your data — email privacy@getomnivity.com (an in-app export is planned);
• Correct your data — most of it directly in the app;
• Delete your account and data — Settings → Account → Delete account, or by email;
• Withdraw consent at any time — Settings → Privacy, or by email. Withdrawal does not affect processing before it. Because Omnivity cannot work without processing health data, withdrawing your health data consent means we will stop processing that data and close your account;
• Turn off usage statistics, crash reports, notifications and health-platform access in Settings or in your phone's settings;
• Opt out of marketing emails using the link in any such email.

We respond within the time the law sets: one month under EU and UK law, 30 days under Turkish law, and 45 days under most US state laws. Where the law allows, we may extend this period and will tell you why. We may need to verify your identity, usually by asking you to write from the email linked to your account. Requests are free of charge; we charge a fee only where the law allows it (for example for manifestly unfounded or excessive requests, or, in Türkiye, where answering involves an additional cost under the Board's fee schedule).

11.1 EEA, UK and Switzerland. You also have the rights to restrict processing, to object to processing based on legitimate interests, and to data portability. You can complain to the Estonian Data Protection Inspectorate, to the authority where you live or work, or (in the UK) to the Information Commissioner's Office.

11.2 United States. Depending on your state, you have the right to know what personal data we hold and how we use and disclose it (including the categories of third parties we disclose it to), to access and obtain a portable copy, to correct, to delete, to opt out of the sale of personal data, targeted advertising and profiling with legal or similarly significant effects (we do none of these), and not to be discriminated against for exercising your rights. You may use an authorized agent; we may ask for proof of the agent's authority and verify your identity. Appeals: if we decline your request, you can appeal by replying to our decision with the word "Appeal". We will respond within the time required by your state's law (generally 45 or 60 days) and, if we deny the appeal, tell you how to contact your state Attorney General. See also the table in Section 13.

11.3 Washington, Nevada and Connecticut consumer health data. Our Consumer Health Data Privacy Policy describes your additional rights.

11.4 Türkiye. See Section 14.

12. Children and teens

The Services are not for children under 13, or under the minimum age in their country (14 in Türkiye; 13 to 16 in EU countries; 16 in countries not otherwise listed in our Terms). If we learn that we hold data of a child below the minimum age, we delete it. Where the law of the user's country requires it, users under 18 need a parent's or guardian's consent, which the app asks for at sign-up; in some US states we rely on the age and parental consent information provided by the app store. For users we know are under 18, we do not use personal data for targeted advertising, do not sell it, do not use engagement features designed to extend their use of the app, and do not send them re-engagement or promotional notifications. We follow the Children's Online Privacy Protection Act (COPPA) and the child-safety requirements of our AI provider. Parents and guardians can contact privacy@getomnivity.com to review or delete their child's data.

13. Additional information for US residents

The table below describes, for the past 12 months, the categories of personal information we collect (as defined in the California Consumer Privacy Act) and how we disclose them. We collect them from the sources in Section 3, for the purposes in Section 4, and keep them as described in Section 8.

We use sensitive personal information only to provide the Services you request and for other purposes permitted by law, so the right to limit its use does not apply. We do not offer financial incentives for personal data. We do not disclose personal information to third parties for their own direct-marketing purposes ("Shine the Light").

14. Information for users in Türkiye (KVKK)

OmniGrowth OÜ is the data controller (veri sorumlusu) under Law No. 6698 on the Protection of Personal Data ("KVKK"). Our KVKK Information Notice (Aydınlatma Metni) sets out the purposes, legal grounds, recipients, method of collection and your rights under Article 11 of KVKK. Health data is processed on the basis of your explicit consent (Açık Rıza Metni). You can apply to us in writing, via registered electronic mail (KEP), with a secure electronic or mobile signature, or from the email address registered in your Omnivity account, to privacy@getomnivity.com or to our representative in Türkiye (Section 1). We respond within 30 days, free of charge unless answering involves an additional cost under the Board's fee schedule. You may complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) as provided in KVKK.

15. Changes to this policy

We will update this policy when our practices change. If the changes are material, we will tell you in the app or by email before they take effect, and ask for your consent again where the law requires it. The date at the top shows the latest version; earlier versions are available on request.

16. Contact

privacy@getomnivity.com · OmniGrowth OÜ, Tornimäe tn 5, 10145 Tallinn, Estonia.