Privacy Policy

Draft – pending legal review

Last updated: 25 October 2026

The German version is the legally binding one: Datenschutzerklärung

1. Controller

No data protection officer has been appointed because there is no legal obligation to do so.

2. Summary

• The website uses no cookies and no analytics or tracking tools.
• The app stores your entries only locally on your device. There is no account, and we have no access to your diary.
• Data only leaves your device if you use a feature that needs it: the optional photo analysis, the barcode scan or a subscription (payment via Apple, subscription management via RevenueCat).
• For the waitlist we only process your email address and, optionally, your first name (Brevo, double opt-in).
• We do not sell data and do not show ads.

Part A – Website fermohealth.de

3. Hosting (Cloudflare)

This website is hosted on Cloudflare Pages; DNS and CDN delivery are also provided by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. When you visit, Cloudflare processes technically necessary data sent by your browser (IP address, date and time, requested file, amount of data, status code, browser, operating system, referrer) to deliver the site and keep it secure. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure and reliable delivery). Cloudflare acts as our processor under a data processing agreement (Art. 28 GDPR). Data may be transferred to the USA; Cloudflare is certified under the EU-US Data Privacy Framework (adequacy decision, Art. 45 GDPR). We do not analyse these logs. More: cloudflare.com/privacypolicy.

4. Cookies, tracking and external content

We use no cookies or similar technologies, no web analytics, no tracking pixels and no external fonts, videos or social plugins. Links to sources in our guides lead to third-party websites with their own privacy policies.

5. Contacting us by email

If you email us, we process your address, name (if given) and message to answer you (Art. 6(1)(b) or (f) GDPR). Emails to [email protected] are forwarded via Cloudflare Email Routing (Cloudflare, Inc., USA) to a Gmail mailbox (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Transfers to the USA are based on the EU-US Data Privacy Framework (Art. 45 GDPR). We delete requests once they are resolved unless statutory retention applies. Please do not send us health data.

6. Waitlist and newsletter (Brevo)

You can join the waitlist with your email address and, optionally, your first name. The data is sent directly to Brevo GmbH, Köpenicker Straße 126, 10179 Berlin, Germany, our processor under Art. 28 GDPR; according to Brevo, data is stored on servers in the EU. You will receive a confirmation email (double opt-in); time of sign-up and confirmation and technical data (e.g. IP address) are logged as proof of consent. A later newsletter also runs via Brevo and only with your consent. Legal basis: consent, Art. 6(1)(a) GDPR, which you can withdraw at any time via the unsubscribe link or by email. No health data is collected. More: brevo.com/legal/privacypolicy.

Part B – The “Fermo” app (iOS)

Fermo is a diary for people on GLP-1 therapy. It does not suggest doses and does not diagnose. This part applies once the app is available in the App Store.

7. Your entries stay on your device

• Local storage: Everything you enter (e.g. doses taken, well-being, symptoms, weight, meals and protein, water, costs, notes, reminder times) is stored in a local database (SQLite) on your device. It is not sent to us. We cannot view or restore it.
• No account: No sign-up is needed.
• No analytics or advertising SDKs.
• Reminders are scheduled locally; no push token is sent to us.
• Camera and photos are only accessed when you start a barcode scan or photo analysis and allow it in iOS.
• Device backup: Depending on your iPhone settings, app data may be included in your device backup (e.g. iCloud Backup), which you manage with Apple.
• Export and deletion: You can export entries as JSON or CSV and create a PDF summary for your doctor. Files are created on your device; you decide where they go. Settings → Data → “Delete all data” or deleting the app removes all entries from the device.

If we later offer optional storage or backup on a server in the EU, this will only happen with your explicit consent (Art. 9(2)(a) GDPR), and this policy will be updated first.

8. Optional photo analysis (Fermo Plus)

• What is sent: the photo you take or select for analysis (resized JPEG) and a random device ID generated by the app, not linked to your name, Apple Account or diary entries. Your IP address is processed for technical reasons.
• How: encrypted (HTTPS) to our server endpoint on Cloudflare Workers, which forwards the photo to an AI service that estimates foods and protein. The result returns to the app; you review it before anything is saved, and it is saved only on your device.
• Storage on our side: we do not store the photo; it is held in memory only for the request and not logged. For the daily usage limit we count requests per device ID; this counter is deleted after at most two days.
• AI service: TODO: provider, location, data processing agreement, third-country transfer safeguards and retention at the provider
• Legal basis: because meal photos may allow conclusions about your health, we ask for your explicit consent before first use (Art. 6(1)(a) and Art. 9(2)(a) GDPR). You can withdraw it at any time by no longer using or switching off the feature. TODO: implement in-app consent dialog and align wording

9. Barcode scan (Open Food Facts)

When you scan a barcode, the app sends only the barcode number to the open food database Open Food Facts (non-profit association, France) to retrieve nutrition values; your IP address is processed for technical reasons. Legal basis: Art. 6(1)(b) GDPR. Privacy: world.openfoodfacts.org/privacy. TODO: verify legal basis and provider details

10. Fermo Plus: payment via Apple, subscription management via RevenueCat

Payment (Apple): Purchases run through the App Store. Apple processes your payment and account data under its own responsibility. We receive no payment data, name or email address. Apple privacy: apple.com/legal/privacy.

Subscription management (RevenueCat): To know whether Fermo Plus is active and to restore purchases, we use RevenueCat, Inc., USA. Processed data: an anonymous app user ID generated by RevenueCat; purchase history (product, purchase and expiry date, price and currency, store transaction IDs, trial status); technical device and app information (e.g. OS and app version, store country) and IP address. No health data or diary entries are sent to RevenueCat. Legal basis: Art. 6(1)(b) GDPR. RevenueCat is our processor under a data processing agreement (revenuecat.com/dpa). Processing takes place in the USA based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). Retention: as long as needed to manage your subscription, subject to statutory retention. TODO: confirm DPA with RevenueCat, add retention period RevenueCat privacy: revenuecat.com/privacy.

11. App Store and crash reports

Apple processes data under its own responsibility when you download and update the app. If you agreed in iOS to share analytics with app developers, we receive aggregated usage statistics and anonymised crash reports via App Store Connect, which cannot be linked to you.

Part C – Website and app

12. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), withdrawal of consent (Art. 7(3)) and the right to object to processing based on Art. 6(1)(f) GDPR (Art. 21). Data that exists only on your device can be exported and deleted by you; we have no access to it. To exercise your rights, email [email protected].

13. Right to lodge a complaint

You may complain to a supervisory authority (Art. 77 GDPR). Ours is: Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany, www.lfd.niedersachsen.de.

14. Security and changes

Website and app connections use encrypted transfer only (HTTPS/TLS). We update this policy when the website, app or our processing changes.

Last updated: 25 October 2026 · Draft – pending legal review