This policy explains what data the Ketia Habits app (the “App”) processes, why, who it is shared with, and what you can do about it.
2.1 Account data. Email address and name (on sign-up or Google sign-in), profile picture if your Google account has one, and an internal user identifier.
2.2 Body and habit data — the data you choose to enter:
2.3 Your conversations with the coach. The messages you write and any images you choose to attach (for example, a photo of a meal or a food label).
2.4 Technical data. A notification token if you enable reminders, basic operational and error information, and preferences stored on your own device.
2.5 Waiting list — only if you signed up from the website, before having an account. In that case we process only: your email address, your name if you type it, the goal you pick in the form, the date you signed up and the browser you used (to detect automated sign-ups). Nothing else: we do not ask for health data, payment details or your phone number. Joining the list does not create an account and does not commit you to anything.
Ketia Habits does not collect diagnoses, illnesses, medication or lab results. This is not merely an intention: the Ketia Habits database is built to reject that information. If a lab result were ever written, the write is refused; and if you mention a medical condition or a medication in conversation, that information is not recorded in your profile and is not used to adapt your plan.
That is why the coach refers you rather than opining on any medical topic: it does not interpret lab work, does not assess symptoms, and does not adjust your plan because of an illness or a medication. That is your doctor's job.
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and managing your account and giving you access. | Performance of a contract (Art. 6(1)(b)). |
| Generating your meal and habit plan and showing your progress. | Explicit consent for health data (Arts. 6(1)(a) and 9(2)(a)). |
| Letting the AI coach answer with your context. | Explicit consent (Arts. 6(1)(a) and 9(2)(a)). |
| Sending reminders and notices. | Consent (Art. 6(1)(a)). You can turn them off. |
| Security, abuse prevention and service operation. | Legitimate interest (Art. 6(1)(f)). |
| Keeping proof of consent and, where applicable, billing records. | Legal obligation (Art. 6(1)(c)). |
| Waiting list: letting you know when Ketia Habits launches and on what terms, and gauging how many people are interested. | Consent (Art. 6(1)(a)), given by ticking the box on the form. You can withdraw it with one click in any of those emails. |
You may withdraw your consent at any time (section 8); this does not affect the lawfulness of processing carried out beforehand.
We do not sell your data and we do not share it for advertising. We use the following providers as data processors, acting only on our instructions:
| Provider | Purpose | Where processed |
|---|---|---|
| Supabase | Authentication and database. | EU — Stockholm (Sweden) |
| Microsoft Azure | App server. | EU — Ireland |
| Microsoft Azure AI Foundry | The AI model behind your plan and the coach. | EU — Sweden |
| Google sign-in. | USA (with safeguards, see below) | |
| Expo | App updates and notification delivery. | USA (with safeguards, see below) |
| Sentry | Technical errors, without conversation content or health data. | USA (with safeguards, see below) |
| What | How long |
|---|---|
| Your profile, measurements and plans | While your account is active |
| Your conversations with the coach | 12 months from the last message in that conversation |
| The sign-up and renewal conversations | 30 days |
| Technical operation records | 12 months |
| Consent records | The period required by law — survives account deletion, because it is the proof that you gave us permission |
| Billing data (once payments are live) | The tax and accounting period required by law |
| Waiting list | Until you unsubscribe or withdraw your consent and, at most, 24 months from sign-up if the service has not launched by then |
An automated job deletes anything past its period every week. And if you delete your account you don't wait for any period: deletion is immediate (section 9). Deleted data disappears from backups within 30 days at most.
You may exercise, free of charge and at any time, your rights of access, rectification, erasure, restriction, objection and portability, and withdraw your consent. Write to ketia.admin@gmail.com and we will reply within one month.
You may also lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
In the App: Account → Delete my account and data. Deletion is immediate and irreversible: your profile, plans, metrics, workouts and coach conversations are removed. You can also request it at ketia.admin@gmail.com with the subject “Delete my account”.
Ketia Habits is for adults over 18 only. We check this at sign-up and the App does not create a profile for anyone who states they are a minor. We do not knowingly collect data from minors; if you believe this has happened, contact us and we will delete it.
Your data travels encrypted and is stored encrypted by our providers. Internal access is limited to what is strictly needed to operate the service. No system is infallible, but we work to reduce the risk and, in the event of a breach affecting you, we would notify you as the GDPR requires.
We may update it. The current version will always be published on this page with its date, and we will tell you if a change is substantial.