Privacy Policy

NOTICE FOR USERS IN THE USA AND EUROPE

This Privacy Policy is designed to comply with the requirements of the Apple App Store, Google Play, EU GDPR / UK GDPR, California CCPA/CPRA, the EU AI Act transparency obligations, and other applicable data protection laws. It explains what personal and health data we collect, how we use it (including for AI-powered personalized recommendations), with whom we share it, and what rights you have. Health data is treated as a special category and processed only with your explicit consent.

1. INTRODUCTION

This Privacy Policy describes how PHA Personal Health Assistant. Developed by ZORPH SRL ("we", "us", "our", the "Company"), the developer and operator of the PHA Personal Health Assistant mobile application ("App", "Service"), collects, uses, discloses, and protects your personal information when you use the App. The App is a personal wellness tracking and AI-powered suggestion tool that helps users input health and lifestyle data and receive personalized general wellness recommendations generated by artificial intelligence.

By using the App, you consent to the collection and processing of your information as described in this Policy. If you do not agree, please do not use the App.

2. INFORMATION WE COLLECT

2.1 Information You Provide Directly

• Account and Profile Data: Name, email address, age range, gender (optional), country/region, password (hashed).
• Health and Wellness Data (Special Category / Sensitive Data): Data you voluntarily input such as weight, height, blood pressure, heart rate, blood glucose, sleep patterns, physical activity logs, symptoms, goals, dietary preferences, medication/supplement logs, mood, and other wellness-related information you choose to enter.
• Connected Health Data (with your explicit permission): If you choose to connect Apple HealthKit, Google Health Connect, or similar services, we may read and/or write specific data categories (e.g., steps, workouts, sleep, heart rate, blood pressure) to provide better personalization. You control permissions via your device settings.
• AI Interaction Data: The questions, inputs, and context you provide to the AI assistant, and the responses generated, to maintain conversation history and improve personalization within your account. 2.2 Information Collected Automatically

• Device and Technical Data: Device type, operating system, app version, unique device identifiers (IDFA/GAID only if you opt-in), IP address, language, time zone, crash logs and diagnostic data.
• Usage and Analytics Data: How you interact with the App (screens viewed, features used, session duration, AI recommendation acceptance rates) to improve the Service. We use aggregated analytics where possible. 2.3 Information from Third Parties We may receive limited information from Apple, Google, or other sign-in providers if you use "Sign in with Apple" or Google Sign-In. We do not receive your password from these providers.

3. HOW WE USE YOUR INFORMATION

We use the information we collect for the following purposes (legal bases indicated where relevant under GDPR):

• Provide and Personalize the Service (Contract + Consent): Generate AI-powered wellness recommendations, insights, and suggestions tailored to the data you provide and (with permission) data from connected health platforms.

• Improve AI Models and Service Quality (Legitimate Interest + Consent for health data): Train and refine our AI systems using aggregated, anonymized, or pseudonymized data. Health data used for model improvement is minimized and protected.
• Account Management and Security (Contract + Legitimate Interest): Create and secure your account, prevent fraud and abuse, respond to your requests and support inquiries.
• Analytics and Product Development (Legitimate Interest): Understand usage patterns, fix bugs, and develop new features.
• Legal Compliance and Safety (Legal Obligation): Comply with applicable laws, respond to lawful requests, enforce our Terms of Service.
• Communications: Send important service updates, security alerts, and (only with your consent) occasional newsletters or feature announcements (you can opt out anytime).

4. LEGAL BASIS FOR PROCESSING (GDPR / UK GDPR)

For users in the EU/EEA/UK: We process personal data on the following legal bases under the GDPR:

• Explicit Consent (Art. 6(1)(a) and Art. 9(2)(a)): For processing of special-category health data and for AI-powered personalization features. You can withdraw consent at any time via App settings or by contacting us.
• Performance of Contract (Art. 6(1)(b)): To deliver the Service you requested (account creation, AI recommendations based on your inputs).
• Legitimate Interests (Art. 6(1)(f)): To improve the App, ensure security, prevent fraud, and conduct aggregated analytics (balanced against your rights).
• Legal Obligation (Art. 6(1)(c)): To comply with laws and respond to valid legal requests.

5. SHARING AND DISCLOSURE OF YOUR INFORMATION

We do not sell your personal data. We share information only in the following limited circumstances:

• AI and Cloud Service Providers (Data Processors): We use reputable third-party AI model providers (e.g., xAI / Grok API, and potentially specialized health AI services such as NVIDIA Clara or similar) and cloud hosting providers. These providers process data only on our instructions under strict Data Processing Agreements (DPAs) that include confidentiality, security, and (for EU data) Standard Contractual Clauses. They do not use your data to train their own models unless you explicitly opt in to anonymized improvement programs.
• Analytics and Infrastructure Providers: Aggregated or pseudonymized usage data may be shared with analytics tools (e.g., Firebase, Mixpanel, or similar) to help us understand how the App is used.
• Legal and Safety: We may disclose information if required by law, regulation, court order, or to protect the rights, safety, or property of users, the Company, or the public.
• Business Transfers: In the unlikely event of a merger, acquisition, or sale of assets, your information may be transferred as part of the transaction, subject to appropriate safeguards.
• Aggregated / Anonymized Data: We may share fully aggregated and anonymized statistics that cannot be used to identify you for research, marketing, or improvement purposes.

6. INTERNATIONAL DATA TRANSFERS

Your data may be processed in countries outside your country of residence, including the United States or other jurisdictions where our service providers are located. For users in the EU/EEA/UK/Switzerland:

• We rely on European Commission-approved Standard Contractual Clauses (SCCs) and, where applicable, additional safeguards (supplementary measures) to protect your data when it is transferred outside the EEA/UK.
• You can request a copy of the relevant SCCs by contacting us.

7. DATA RETENTION

We retain your personal data only for as long as necessary to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements:

• Account and Health Data: Retained while your account is active. You can delete your account and all associated data at any time via App settings or by contacting us. After deletion, data is removed from active systems within 30 days (backups may persist up to 90 days for disaster recovery).
• AI Conversation History: Retained for the duration of your active use to maintain context; you can clear individual conversations or request full deletion.
• Analytics / Usage Data: Aggregated or pseudonymized data may be retained longer for product improvement.
• Legal Requirements: Some data may be retained longer if required by law (e.g., tax, accounting, or fraud prevention records).

8. YOUR RIGHTS (GDPR, CCPA/CPRA, AND OTHER LAWS)

Depending on your location, you have the following rights. We will respond to verified requests within the timeframes required by law (usually 30 days, extendable in complex cases).

For EU/EEA/UK/Swiss Users (GDPR / UK GDPR):

• Right of access, rectification, erasure ("right to be forgotten"), restriction of processing, data portability, and objection to processing.
• Right to withdraw consent at any time (this will not affect processing that occurred before withdrawal).
• Right to lodge a complaint with your local Data Protection Authority (DPA).
• Right to object to automated decision-making / profiling and request human review (where applicable to AI recommendations). For California and Other U.S. Users (CCPA/CPRA and state laws):

• Right to know what personal information we collect, use, disclose, and sell/share.
• Right to delete personal information we hold about you.
• Right to opt-out of the "sale" or sharing of personal information (we do not sell personal data).
• Right to non-discrimination for exercising your CCPA rights.
• Right to correct inaccurate personal information. How to Exercise Your Rights: Use the in-app settings (Account → Privacy / Data Settings) or email us at the contact address below. We will verify your identity before fulfilling requests that require it. For EU users, you may also contact your local DPA.

9. SECURITY OF YOUR INFORMATION

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These include:

• Encryption of data in transit (TLS 1.2+) and at rest.
• Strict access controls and role-based permissions.
• Regular security assessments and vulnerability management.
• Secure cloud infrastructure with reputable providers.
• Privacy by design and by default principles. No method of transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. In the event of a data breach that poses a high risk to your rights, we will notify you and the relevant authorities as required by law.

10. CHILDREN'S PRIVACY

The App is not intended for children under 18 years of age. We do not knowingly collect personal information from children under 18. If you believe we have collected such information, please contact us immediately so we can delete it. If you are a parent or guardian and believe your child has used the App without your consent, please contact us.

11. THIRD-PARTY SERVICES, SDKs, AND LINKS

The App may integrate third-party services and SDKs (e.g., analytics, crash reporting, sign-in providers, AI model APIs, Apple HealthKit / Google Health Connect). These third parties have their own privacy policies. We encourage you to review them. We are not responsible for the privacy practices of third parties.

Current key third-party categories (subject to change; full list available upon request):

• AI model / inference providers (under strict DPAs)
• Cloud hosting and database providers
• Analytics and performance monitoring tools (aggregated/pseudonymized data)
• Apple HealthKit / Google Health Connect (only with your explicit device permission)

12. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. We will notify you of material changes by posting the new Policy in the App, sending an in-app notification, or via email (where appropriate). The "Last Updated" date at the top indicates when the latest changes were made. Your continued use of the App after changes become effective constitutes acceptance of the updated Policy.

13. CONTACT US

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, or wish to exercise your rights, please contact us:

PHA Personal Health Assistant. Developed by ZORPH SRL Email: support@pha-app.net (or the in-app support channel)

For EU/EEA users: You may also contact your local Data Protection Authority.

ACKNOWLEDGMENT

By using the PHA Personal Health Assistant App, you acknowledge that you have read and understood this Privacy Policy, including how we collect, use, and protect your health and personal data, how AI processes your inputs, and the rights available to you under GDPR, CCPA, and other applicable laws. You consent to the processing described herein, including the processing of special-category health data with your explicit consent for personalized AI wellness features.

© 2026 PHA Personal Health Assistant. Developed by ZORPH SRL. All rights reserved. This Privacy Policy is provided to ensure transparency and compliance for users in the United States, European Union, United Kingdom, and other jurisdictions.