This policy explains what the Supply mobile app ("Supply", "we", "us") collects, why, who it is shared with, and the choices you have. It applies to the Supply app for iOS (the "App").
Contact for anything about privacy: vessa.care@outlook.com
The short version
- We collect what you give us to build and run your supplement routine, including health-related information.
- We don't sell your data, we don't show ads, and we don't track you across other apps or websites.
- AI features send the relevant data to our AI provider to produce your result.
- Lab report files are read once and never stored. The values you confirm are stored.
- You can delete your account and all your data in the App at any time: Settings → Delete account.
1. Information we collect
Information you give us
- Account: Email address, name, and password (stored only as a hash). With Sign in with Apple: your Apple user identifier and the email or private relay address Apple shares.
- Questionnaire answers: Goals and their details (sleep, energy, stress, training, digestion), age range, sex (optional), diet and eating habits, sun exposure, and preferences about your routine.
- Health-related information: Whether you are pregnant, breastfeeding or trying to conceive; medications, conditions, allergies and intolerances you choose to tell us about; supplements you already take.
- Lab results: Values, units, reference ranges, dates and lab names from reports you upload or enter, plus AI-written summaries and notes.
- Routine and tracking: Your routine, doses, times and days, which doses you marked as taken, routine history, your shelf (products you own and quantities left), and pillbox setup.
- Scans and photos: Photos of supplement products you scan, and the product details created from them.
- Assistant conversations: Messages you send to the AI assistant, its replies, and any attachments.
- Reminders and settings: Reminder times, notification preferences, and your time zone.
- Support: Anything you send us by email.
Information collected automatically
- Crash and performance reports: when the App crashes or runs into an error, details such as the error, app version, device model, iOS version and your account ID are sent to Sentry so we can fix it. They contain no questionnaire answers, lab results, photos or messages.
- Subscription status: plan, trial and renewal state, purchase dates and an anonymous app user ID. We never receive your card or payment details; Apple handles payment.
- Push token and device name and platform, so we can deliver notifications.
- Technical logs on our servers, such as request time, IP address and errors, used for security and debugging.
What we don't collect
No precise location, contacts, advertising identifier, or data from Apple Health. We don't use third-party advertising or analytics SDKs. We use Sentry only for crash and error reports (see section 5).
Device permissions
- Camera and Photos: only when you scan a product or upload a lab report.
- Notifications: reminders and refill alerts. Most reminders are scheduled locally on your device.
You can change these permissions in iOS Settings at any time.
2. How we use your information
- To create your account and sign you in.
- To build, update and explain your supplement routine and fit scores.
- To read and explain lab reports you upload and show trends over time.
- To recognise supplements you scan.
- To answer you in the AI assistant, using your profile, routine, shelf and lab results so that answers are about you.
- To send reminders, low-supply alerts and trial-ending notices.
- To manage subscriptions and unlock paid features.
- To keep the App secure, prevent abuse, enforce usage limits and fix problems.
- To respond to support requests and meet legal obligations.
We don't use your data for advertising, and we don't make decisions about you that have legal or similarly significant effects.
Fit scores are calculated on your device.
4. AI processing
We only send your information to our AI provider with your permission. Before any AI feature runs, the App shows what will be sent, who receives it and why, and asks you to allow it. If you choose "Not now", nothing is sent to the AI provider, and the AI features (building or rebuilding your routine, the assistant, product scans and lab report analysis) stay off. The rest of the App keeps working. You can change your choice at any time in Settings → AI features.
AI features are powered by OpenAI. When you use them, we send the data needed for that task:
- Routine generation and the assistant: your first name, date and time zone, plus what the AI looks up to answer you, which can include your questionnaire answers, routine, intake history, shelf, lab results and store products.
- Lab report analysis: the file you upload, your previous confirmed results and relevant profile information. The file is processed in memory and never stored by us. Only the extracted values you review and confirm are kept.
- Product scans: your photo, and a web search for public information about that product.
We ask OpenAI not to retain these requests beyond processing them, and data sent through its API is not used to train its models under its API terms. AI output may be inaccurate; see the Terms of Use.
OpenAI processes this information only on our behalf, to return a result, under a data processing agreement that requires it to protect your information with safeguards at least equal to those described in this policy.
6. Where your data is stored and international transfers
Your data is stored on our providers' servers, which may be located outside your country, including in the United Kingdom (our main database), the European Union and the United States. Where required, transfers rely on appropriate safeguards such as standard contractual clauses.
7. How long we keep it
- We keep your data for as long as your account exists.
- When you delete your account, your profile, answers, routine, tracking history, shelf, lab results, scanned products and photos, chat history and push tokens are permanently deleted. Residual copies in backups and logs expire within about 30 days.
- Uploaded lab files are never stored.
- We may keep limited records where the law requires it, for example transaction records, and Apple and RevenueCat keep purchase records under their own policies.
- Support emails are kept for as long as needed to handle your request.
8. Your choices and rights
In the App you can:
- view and edit your answers (Settings → preferences), name and notification settings;
- delete individual lab reports, chat conversations, shelf items and routine items;
- turn reminders off;
- delete your account and all data: Settings → Delete account. This is permanent. An active subscription must be cancelled separately in your Apple ID settings.
Depending on where you live (for example the EEA, UK, Ukraine, California and other U.S. states) you may have the right to access, correct, delete or export your data, to restrict or object to processing, to withdraw consent, and to complain to your local data protection authority. We don't discriminate against anyone for using these rights.
To make a request, or if you can't access the App, email vessa.care@outlook.com from the address on your account. We reply within 30 days.
Legal bases (EEA and UK): performing our contract with you (running the App), your consent (health-related information, notifications, camera and photos), our legitimate interests (security, preventing abuse, improving the App) and legal obligations.
9. Security
We use encryption in transit, row-level access rules so that each user can only reach their own records, unlisted, hard-to-guess links for photos of products you scan, server-side checks on paid features, and restricted access to production systems. No system is perfectly secure, and we can't guarantee absolute security. If a breach affects you, we'll notify you as the law requires.
10. Children
The App is for adults aged 18 and over. We don't knowingly collect data from anyone under 18. If you believe a minor has given us data, contact us and we'll delete it.
11. Changes to this policy
We may update this policy. We'll change the date above and, for significant changes, tell you in the App or by email.