Doctor Primal

Privacy Policy — Doctor Primal

Last updated: 18 September 2026

1. Who We Are

Doctor Primal is operated by Tomas Brencic, sole proprietor (Einzelunternehmen), Dietlikon, Switzerland, who is the controller responsible for your personal data. For any privacy question or request, contact support@doctorprimal.com.

This policy is written to comply with the Swiss Federal Act on Data Protection (FADP) and, for users in the EU/EEA and UK, the GDPR / UK GDPR.

2. What We Collect

  • Account data: first name, last name, email address, and password (or, if you sign in with Google/Apple, the identifier and basic profile info they share with us).
  • Chat data: the questions you ask and the answers you receive, stored so your history is available across devices (paid tiers) or during your session (free tier). If you use voice input or photo upload, the recording or image is sent to the AI provider to produce the answer and is not stored by us afterwards.
  • Subscription and billing data: your selected plan, subscription status, billing currency and the Stripe customer and subscription references. Payment card details are collected and processed directly by Stripe — we receive only a token/reference and billing status, never your full card number.
  • Usage data: basic technical data such as login timestamps, daily question counts and AI token usage per request, used to enforce plan limits, calculate our costs and improve the Service.
  • Consent records: the version and time of the withdrawal-right waiver you give before a paid checkout.

We do not ask for and do not knowingly collect special-category health data about you personally — the Service discusses general nutrition topics, not your individual medical records. Please avoid entering personal medical details in your questions; anything you do enter is processed like any other chat message.

3. How and Why We Use It

  • To provide the Service: generate answers, remember your conversation history, enforce plan limits (performance of our contract with you).
  • To process payments and manage your subscription (performance of contract; legal obligations).
  • To maintain account security, e.g. checking new passwords against known data breaches (legitimate interest in security).
  • To communicate with you about your account, billing, or material changes to the Service (contract; legitimate interest).
  • To improve the Service by reviewing aggregated or anonymised usage patterns (legitimate interest).
  • To comply with legal obligations, such as accounting and tax record-keeping.

We do not use your data for advertising, and we do not sell personal data.

4. Who We Share It With

We use the following processors, each bound by a data-processing agreement:

  • Supabase — hosts our database and handles authentication.
  • Stripe — processes subscription payments and issues invoices. See stripe.com/privacy.
  • Lovable (AI gateway) and the AI model providers it routes to (currently OpenAI) — generate chat responses, transcribe voice notes and read answers aloud; your questions (and, if you use them, your voice recordings and photos) are sent to these providers to produce an answer.
  • Cloudflare — hosts and serves the application and protects it against abuse.
  • NCBI / PubMed (E-utilities) — used only to look up public metadata (author, year, journal) for study links shown in answers; no personal data is sent.
  • Google / Apple — if you choose "Continue with Google/Apple" to sign in, they share the account information needed to authenticate you.

We may also disclose data where required by law or to protect our rights.

5. Data Retention

  • Account and chat data is retained while your account is active.
  • When you delete your account (Account settings → Delete account), your profile, conversations, messages, preferences and usage counters are deleted immediately and any active subscription is cancelled. AI usage records are anonymised so they no longer reference you.
  • Invoices and payment records are kept by Stripe and by us for 10 years as required by Swiss accounting law (Art. 958f Swiss Code of Obligations).
  • Free-tier chat history that is not saved (per current plan limits) is not retained beyond your session.

6. Your Rights

Under the Swiss FADP and, where applicable, the GDPR you have the right to:

  • Access the personal data we hold about you.
  • Correct inaccurate data.
  • Delete your account and data — available directly in Account settings, or by emailing support@doctorprimal.com.
  • Receive a copy of your data in a portable format.
  • Object to or restrict certain processing.
  • Withdraw consent at any time where processing is based on consent.
  • Lodge a complaint with a supervisory authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch); in the EU/EEA or UK your local data-protection authority.

To exercise a right, email support@doctorprimal.com from the address linked to your account. We answer within 30 days.

7. Children

Doctor Primal is not directed at children. You must be 18 or older to create an account. If you believe a minor has created an account, contact us and we will delete it.

8. International Data Transfers

Some of our processors (including Stripe, Cloudflare, Lovable and OpenAI) process data outside Switzerland and the EU/EEA, including in the United States. Where this happens we rely on the Swiss–U.S. and EU–U.S. Data Privacy Framework for certified providers, and otherwise on the standard contractual clauses recognised by the FDPIC and the European Commission.

9. Cookies and Local Storage

We use essential cookies and local storage to keep you signed in and to remember basic preferences such as your chosen currency and cookie choices. We do not use third-party advertising or tracking cookies. You can review your choices at any time via "Privacy preferences" in the footer.

10. Security

We use industry-standard measures (encryption in transit, access controls, row-level database permissions, breached-password screening) to protect your data, but no system is 100% secure. If we become aware of a breach affecting your data we will inform you and the competent authority as required by law.

11. Changes to This Policy

We'll update the "last updated" date above and, for material changes, notify you by email or in-app notice.

12. Contact

Tomas Brencic, Dietlikon, Switzerland
support@doctorprimal.com