Doctor PrimalBeta
Sign inGet started

Privacy Policy — Doctor Primal

Last updated: [DATE]

1. Who We Are

Doctor Primal is operated by [ENTITY NAME], [registered address]. For any privacy question, contact [PRIVACY EMAIL].

2. What We Collect

  • Account data: first name, last name, email address, and password (or, if you sign in with Google/Apple, the identifier and basic profile info they share with us).
  • Chat data: the questions you ask and the answers you receive, stored so your history is available across devices (paid tiers) or during your session (free tier).
  • Subscription and billing data: your selected plan and subscription status. Payment card details are collected and processed directly by Stripe — we receive only a token/reference and billing status, never your full card number.
  • Usage data: basic technical data such as login timestamps and daily question counts, used to enforce plan limits and improve the Service.

We do not knowingly collect special-category health data about you personally — the Service discusses general nutrition topics, not your individual medical records.

3. How We Use It

  • To provide the Service: generate answers, remember your conversation history, enforce plan limits.
  • To process payments and manage your subscription.
  • To maintain account security (e.g., checking new passwords against known data breaches).
  • To communicate with you about your account, billing, or material changes to the Service.
  • To improve the Service, including reviewing aggregated or anonymized usage patterns.
  • To comply with legal obligations.

4. Who We Share It With

We use the following third-party processors, each bound by their own data-processing terms:

  • Supabase — hosts our database and handles authentication.
  • Stripe — processes subscription payments. See Stripe's privacy policy at stripe.com/privacy.
  • Lovable (AI gateway) and the AI model providers it routes to (currently OpenAI) — generate chat responses, transcribe voice notes and read answers aloud; your questions (and, if you use them, your voice recordings and photos) are sent to these providers to produce an answer.
  • Cloudflare — hosts and serves the application.
  • NCBI / PubMed (E-utilities) — used only to look up public metadata (author, year, journal) for study links shown in answers; no personal data is sent.
  • Google / Apple — if you choose "Continue with Google/Apple" to sign in, they share the account information needed to authenticate you.

We do not sell your personal data.

5. Data Retention

  • Account and chat data is retained while your account is active.
  • If you delete your account (available in Account settings), your personal data and chat history are deleted [within X days], except where we're required to retain limited billing records for legal/tax purposes.
  • Free-tier chat history that is not saved (per current plan limits) is not retained beyond your session.

6. Your Rights

Depending on your location (this generally applies under EU/UK GDPR and the Swiss Federal Act on Data Protection), you have the right to:

  • Access the personal data we hold about you.
  • Correct inaccurate data.
  • Delete your account and data — available directly in Account settings, or by emailing [PRIVACY EMAIL].
  • Receive a copy of your data in a portable format.
  • Object to or restrict certain processing.
  • Withdraw consent at any time where processing is based on consent.
  • Lodge a complaint with your local data-protection supervisory authority.

7. Children

Doctor Primal is not directed at children. You must be 18 or older to create an account.

8. International Data Transfers

Some of our processors (including Stripe, Lovable and OpenAI) may process data outside your country of residence, including in the United States. Where this happens, we rely on appropriate safeguards (such as Standard Contractual Clauses) as required by applicable law. [Confirm specific mechanism per processor with a lawyer.]

9. Cookies and Local Storage

We use essential cookies/local storage to keep you signed in and remember basic preferences. We do not currently use third-party advertising trackers.

10. Security

We use industry-standard measures (encryption in transit, access controls, breached-password screening) to protect your data, but no system is 100% secure.

11. Changes to This Policy

We'll update the "last updated" date above and, for material changes, notify you by email or in-app notice.

12. Contact

[PRIVACY EMAIL] / [ENTITY NAME AND ADDRESS]