Privacy Policy

Last updated: September 16, 2026

Introduction

Welcome to Oria ("we", "our", "us"). Protecting your personal data is a priority for us. This Privacy Policy explains what data we collect, how we use it, who we share it with, and how we protect it when you use the Oria mobile app (the "App") and the oria-health.com website (the "Site").

Please read it carefully. By using the App, you accept this policy and our Terms of Service.

Information we collect

1. Account

You sign in with Apple. We receive:

• Apple identifier: a unique identifier specific to Oria
• Email address: your real address, or a private relay address if you choose "Hide My Email"

We do not store your name, and we never ask you for a password.

2. Profile

During onboarding, you tell us your:

• Body measurements: sex, age, height, current weight, goal weight
• Lifestyle: type of work, daily activity, exercise frequency, snacking, soda consumption
• History: previous weight-loss attempts and methods tried
• Preferences: language, weight unit, time zone

We use this data to calculate your personal plan.

3. Health and activity

• Weigh-ins: the weights you log
• Step count: read from Apple Health (HealthKit), with your explicit permission
• Plan: your calorie, macronutrient and step targets, and their history week after week

Important: Oria reads only your step count from Apple Health. Oria writes no data to Apple Health and does not access any other category of health data.

4. Food and nutrition

When you log a meal, we collect:

• Descriptions: the text you type or dictate
• Foods: the foods you choose, their portions and nutrition values
• Nutrition label photos: sent to be read by the AI, then not kept
• Barcodes: read by the camera on your device. Only the number is sent to Open Food Facts to find the product

5. Conversations with the coach

• Messages: your messages to the AI coach and its replies
• Dictation: speech recognition is done by Apple, through iOS. We receive only the text, never the audio

6. Notifications

• Push token: to send you your reminders
• Preferences: which reminders are on, and their times

We send no promotional notifications and no marketing emails.

7. Diagnostics

If the App crashes or hits an error, we receive a report that contains:

• Technical data: device model, iOS and App version, error trace
• User identifier: to group errors from the same account

These reports are filtered before they are sent: they contain no meals, weigh-ins, messages, searches or screenshots. We use no analytics or advertising tool in the App.

Our servers also record technical logs (IP address, date, request) for the security and operation of the service.

8. Subscription

Payments are processed by Apple through the App Store. We receive the status of your subscription (active, in trial, expired). We never have access to your payment details.

RevenueCat checks your purchases on our behalf. It receives your Oria user identifier and your purchase history, but not your email address.

How we collect your information

• Directly: the information you enter in the App or send us by email
• From Apple Health: only if you allow it in iOS
• Automatically: crash reports, technical logs and the push token

Where your information is stored

On our servers

Your account, profile, plan, meals, weigh-ins and conversations are stored in a database hosted by Supabase in the European Union (Frankfurt, Germany), so that they are available in the App.

On your device

A copy of your meals, weigh-ins and conversations is kept on your device so that the App opens quickly. It is erased when you delete the App.

All data transmission uses HTTPS encryption.

How we use your information

• Provide the service: calculate your plan, log your meals and weigh-ins, track your progress
• Personalize: adjust your plan every week based on your results
• Run the AI features: answer your messages, estimate your meals, read your labels, suggest meals
• Send reminders: meals, weigh-in and weekly check-in, if you turn them on
• Manage your subscription: check your access to features
• Fix bugs: analyze crash reports
• Reply to you: handle the requests you send by email

Restriction: we never use your health data for advertising or marketing.

The AI coach and artificial intelligence providers

The coach, meal estimates, label reading, meal suggestions and plan adjustments use artificial intelligence models from Google (Gemini) and OpenAI (GPT). These models run on Google (Vertex AI) and Microsoft (Azure), through the OpenRouter service.

To generate a response, we send them only what is needed:

• your message, the meal description or the label photo;
• the useful context: profile, goal, plan and a summary of your day.

We do not send them your name, your email address or your Apple identifier. Our AI providers do not keep your messages and do not use them for training.

AI responses can be inaccurate or incomplete. They are not medical advice. See our Terms of Service.

Third-party services

We work with the following service providers. They process your data only on our behalf and under our instructions.

We do not sell your information

We never sell, rent or trade your personal data. We do not share it with advertisers. We do not track you across other apps or websites.

When we share your information

• With our service providers: those listed above, to run the service
• At your direction: when you ask us to, or consent to it
• Legal obligation: when the law, a court order or a public authority requires it
• Business transfer: in a merger, acquisition or sale, your data can be transferred to the acquiring entity, which remains bound by this policy. We will tell you before this happens.

Apple Health data

Data read from Apple Health is used only to show and track your activity in Oria. It is never used for advertising or marketing, never sold, and never shared with third parties for those purposes.

Data retention

• Account, profile, tracking, meals and conversations: for as long as your account exists
• After account deletion: this data is erased immediately and permanently
• Label photos: not kept after they are read
• AI requests: not kept by our AI providers
• Server technical logs: 1 day
• Crash reports: 30 days
• Support emails: 3 years after our last exchange

Security

We use appropriate technical and organizational measures: encrypted traffic, access rules that limit each user to their own data, and restricted access to our systems. However, no system is perfectly secure.

Data breach

If a data breach creates a risk for you, we notify the CNIL within 72 hours and inform you without undue delay, as the GDPR requires. If you think your account is compromised, contact us immediately at hello@oria-health.com.

Your choices

Apple Health

• Open Settings > Health > Data Access & Devices
• Select Oria
• Turn access on or off

Notifications

• In the App: Settings > Notifications, to choose your reminders
• Or in iOS: Settings > Notifications > Oria

Delete your account

• In the App: Settings > Account > Delete account
• All your data is erased immediately and permanently
• Deleting your account does not cancel your Apple subscription: cancel it first in your iPhone settings

Your rights

Under the GDPR, you have the right to:

• Access: get a copy of your data
• Rectification: correct inaccurate data
• Erasure: have your data deleted
• Restriction: restrict some processing
• Portability: receive your data in a readable format
• Objection: object to processing based on our legitimate interest
• Withdraw consent: at any time, without affecting past processing
• Post-mortem instructions: decide what happens to your data after your death

To use your rights, write to hello@oria-health.com. We reply within one month. We can ask you to confirm your identity.

You can also lodge a complaint with the French data protection authority (CNIL): www.cnil.fr.

Legal bases

International transfers

Our servers are located in the European Union: the Supabase database is in Frankfurt (Germany), and Sentry crash reports stay in the European Union.

Some providers are US companies or process data in the United States: OpenRouter, Google, Microsoft, RevenueCat, Expo and Vercel. These transfers rely on the EU–US Data Privacy Framework when the provider is certified, or on the European Commission's Standard Contractual Clauses.

Children

Oria is for people aged 18 and over. We do not knowingly collect data from minors. If you believe a minor has given us personal data, contact us and we will delete it.

Website

The Site sets no cookies and uses no analytics or advertising tools. The Site's host, Vercel Inc., can keep technical logs (IP address, date, requested page) for the security of the service.

Changes to this policy

We can update this policy. We will tell you about changes by:

• posting the new version on this page;
• updating the date at the top of this page;
• for significant changes, showing a message in the App before they take effect.

Contact us

If you have questions about this policy or your data, contact us:

• Email: hello@oria-health.com
• Developer and data controller: Matthieu Roman

Summary

We never: sell your data · share your health data with advertisers · use advertising or tracking tools · access your payment details.