Join the waitlist

Privacy policy

Last updated: October 25, 2026

Your cycle and health data are personal, and we treat them that way. This policy explains, in plain words, what data Nourimi collects in the app and on this website, why, and how we protect it.

On this page

1. Who is responsible for your data

The controller responsible for your personal data is Pauline Gwet, Wexstr. 13, 10715 Berlin, Germany.

Nourimi Care UG (haftungsbeschränkt) is currently being founded and will take over Nourimi once it is registered. Before that happens, we will update this policy and let you know.

Contact for anything related to your data: hello@nourimi.app.

Data protection officer: [DPO NAME OR SERVICE], reachable at [DPO EMAIL].

2. What data we collect

We only collect what Nourimi needs to work.

Data you give us

  • Account details: your email address and first name.
  • Age and weight: your date of birth (used to adapt nutrient targets to your age and to confirm you are old enough to use Nourimi) and your weight (used to calculate your protein target).
  • Life stage and mode: whether you have a regular or irregular cycle, whether you use hormonal contraception, whether you are trying to conceive, pregnant (and your trimester), postpartum (your stage since birth and whether you are breastfeeding), in perimenopause or in menopause.
  • Cycle information: period and bleed start and end dates, typical cycle length, cycle regularity, whether your period has returned after birth, and the cycle day and phase we calculate from them.
  • Fertility observations (trying to conceive only): ovulation test results and mild pelvic pain, if you choose to log them.
  • Symptoms you log: for example cramps or pelvic pain, bleeding (including heavy bleeding and spotting), back pain, bloating, headaches, fatigue, mood changes and low mood, cravings and appetite changes, skin and hair changes, breast sensitivity, discharge changes, digestion changes, sleep, nausea, heartburn, constipation, swelling, food aversions, recovery discomfort, feeding discomfort, hot flushes, night sweats, brain fog, joint aches, vaginal dryness and bladder changes, as well as how much your symptoms affect you.
  • Goals and answers: what you want Nourimi to help with (for example support while trying to conceive, during pregnancy, postpartum recovery or menopause), your answers to onboarding questions such as whether you have felt your symptoms were dismissed, and your quiz answers.
  • Meal photos and food logs: the photos you take, the meals and drinks you log, portion sizes, and the nutrients, scores and daily totals calculated from them.
  • Planning and progress: your weekly meal plan, saved and created recipes, grocery lists and monthly progress insights.
  • Messages: anything you tell us when you contact support.
  • Settings: your language, units and notification preferences.
Your life stage, cycle and fertility information, symptoms, weight, and anything else that reveals information about your health are health data, a special category of personal data under Article 9 GDPR. We only process them with your explicit consent, which we ask for in the app before you enter them. Meal photos and food logs can also reveal health-related information, so we treat them with the same care. You never have to log symptoms or fertility observations: these are always optional.

Data collected automatically

  • Technical data: device type, operating system, app version, language and crash reports.
  • Usage data: which features you use and how the app performs. We only collect this if you agree to it, and we store it in pseudonymized form.

Subscriptions

Subscriptions are bought and managed through the Apple App Store or Google Play. We never receive your payment card details. We only receive the information we need to unlock your subscription, such as its status and renewal date.

3. Why we use your data and on what legal basis

We only use your data for the purposes below, each with its legal basis under the GDPR.

  • Providing Nourimi (priority nutrients, meal scores, insights, meal plans and grocery lists): your health data on the basis of your explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR); your account data because it is necessary to provide the service you signed up for (Art. 6(1)(b) GDPR).
  • Analyzing your meal photos to recognize foods and estimate nutrients: your explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR).
  • Managing your subscription: necessary to perform our contract with you (Art. 6(1)(b) GDPR).
  • Keeping the app stable and secure (crash reports, fixing bugs, preventing misuse): our legitimate interest in offering a reliable and secure app (Art. 6(1)(f) GDPR). These reports do not contain your health data.
  • Understanding how the app is used to improve it: your consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG). You can say no and still use every feature.
  • Answering your messages: our legitimate interest in helping you (Art. 6(1)(f) GDPR), or our contract with you when your question is about your account.
  • Keeping legally required records, for example for tax purposes: our legal obligations (Art. 6(1)(c) GDPR).

You need to give your consent to health data processing to use Nourimi’s personalized guidance, because the app cannot recommend nutrients without knowing your mode. Giving it is never a legal obligation, and you can withdraw it at any time.

What we never do

  • Sell your data.
  • Use your health data, meal photos or usage data for advertising.
  • Track you across other apps or websites.
  • Build marketing profiles about you.

We may promote Nourimi on social media, but these ads are never based on data from the app.

5. How meal photo analysis works

When you scan a meal, the photo is sent over an encrypted connection to our servers and analyzed by an AI model to recognize the foods and estimate their nutrients. This analysis is carried out by [AI PROVIDER] on our behalf, under a data processing agreement. It is not allowed to use your photos to train its own models. We keep your photos for [RETENTION, e.g. as long as the meal stays in your history].

Your meal score is calculated automatically. It is general wellbeing guidance only and has no legal or similarly significant effect on you, so it is not an automated decision within the meaning of Article 22 GDPR.

6. Who we share your data with

We do not sell your data. We only share it with service providers who help us run Nourimi, who act strictly on our instructions under data processing agreements (Article 28 GDPR):

  • Hosting and database: [e.g. Google Cloud / Firebase, region]
  • AI meal analysis: [AI PROVIDER]
  • Crash reporting: [PROVIDER]
  • Usage analytics (only with your consent): [PROVIDER]
  • Email and support: [PROVIDER]

Apple and Google process your purchase data as independent controllers under their own privacy policies.

Using Nourimi through your employer? Your employer never sees your personal or health data, your meals or your activity. We only ever share anonymous, aggregated figures with employers, such as the number of activated accounts.

We may disclose data if we are legally required to, for example by a court order.

7. International data transfers

We aim to store and process your data within the European Union. If a service provider processes data outside the EU or EEA, for example in the United States, we only allow this where the European Commission has recognized an adequate level of protection (such as the EU-US Data Privacy Framework), or under the Commission’s Standard Contractual Clauses with additional safeguards. You can ask us for a copy of these safeguards.

8. How long we keep your data

  • Account, cycle, meal and planning data: as long as your account exists. When you delete your account, we delete this data within [30 DAYS], including from backups within [90 DAYS].
  • Usage analytics: [e.g. 14 MONTHS], in pseudonymized form.
  • Crash reports: [e.g. 90 DAYS].
  • Support messages: up to [e.g. 2 YEARS] after your last message.
  • Records we must keep by law, such as invoices for business customers: up to 10 years, as required by German commercial and tax law.

9. Your rights

Under the GDPR you have the right to:

  • Access the data we hold about you and get a copy (Art. 15).
  • Correct inaccurate data (Art. 16).
  • Delete your data (Art. 17).
  • Restrict how we use it (Art. 18).
  • Receive your data in a portable format (Art. 20).
  • Object to processing based on our legitimate interests (Art. 21).
  • Withdraw your consent at any time (Art. 7(3)).

To use these rights, write to hello@nourimi.app or use the options in the app. We answer within one month. You can delete your account and all its data directly in the app at any time.

You also have the right to lodge a complaint with a data protection authority, in particular in the country where you live or work. Our lead authority is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit). In other countries, for example: the CNIL in France, the AEPD in Spain, the Garante per la protezione dei dati personali in Italy, or the ICO in the United Kingdom.

10. Children

Nourimi is not intended for anyone under 16. We do not knowingly collect data from children under 16. If you believe a child has given us their data, please contact us and we will delete it.

11. How we protect your data

We protect your data with appropriate technical and organizational measures, including encryption in transit and at rest, strict access controls and regular security reviews. Only the people who need it to run Nourimi can access personal data. No system is completely secure, but we take every reasonable step to keep your data safe, and we will inform you and the authorities of any breach as required by law.

12. This website

When you visit this website, our hosting provider Netlify, Inc. (San Francisco, USA) processes technical data such as your IP address, browser type and the pages you visit, in order to deliver and secure the site (Art. 6(1)(f) GDPR). These logs are deleted after [7 DAYS]. Netlify acts on our behalf under a data processing agreement, and transfers to the United States are protected as described in section 7.

We do not use advertising or tracking cookies on this website. Our fonts are hosted on our own servers, so no data is sent to third parties when the page loads.

Waiting list

If you join the waiting list, we store your email address so we can tell you when Nourimi launches. We only do this with your consent (Art. 6(1)(a) GDPR), which you give by ticking the box in the form. The form is processed by Netlify on our behalf.

We only use your email address for news about the Nourimi launch. You can unsubscribe at any time through the link in each email or by writing to us. We delete your address when you unsubscribe, and at the latest 12 months after launch.

13. If you live in the United States

Nourimi applies the same high standard of protection to everyone, wherever they live. If you live in the United States, this section adds information required by US federal and state laws.

Consumer health data

Information about your cycle, fertility, pregnancy, postpartum, menopause and meals is consumer health data under laws such as the Washington My Health My Data Act and similar laws in Nevada and Connecticut. Our separate Consumer Health Data Privacy Policy explains what we collect, where it comes from, who we share it with and how to exercise your rights.

What we never do

  • We do not sell your personal information or consumer health data.
  • We do not share it for targeted or cross-context behavioral advertising.
  • We do not use it for profiling that produces legal or similarly significant effects.
  • We do not use geofencing around health care facilities.

Your privacy rights

Depending on the state you live in (for example California, Colorado, Connecticut, Virginia, Texas or Oregon), you may have the right to know what personal information we collect, to access it and get a copy, to correct it, to delete it, and to opt out of the sale of your data, targeted advertising and profiling (we do none of these). We honor these requests for all US users, whether or not a particular state law applies to us.

To make a request, write to hello@nourimi.app or use the options in the app. We will verify your identity using your account details and respond within 45 days. You can also ask an authorized agent to make a request for you. We will never treat you differently for exercising your rights. If we decline your request, you can appeal by replying to our answer with the subject "Appeal". We will answer your appeal within 45 days, and if you disagree, you can contact your state attorney general.

Our website honors Global Privacy Control signals.

Data breaches

If a breach ever affects your health information, we will notify you without unreasonable delay and, where required, the Federal Trade Commission under its Health Breach Notification Rule and the relevant state authorities.

Children

Nourimi is not intended for anyone under 16. We do not knowingly collect personal information from children under 13, in line with the Children’s Online Privacy Protection Act (COPPA), or from anyone under 16.

Where your data is processed

Nourimi is operated from Germany. Your data is processed in the European Union and, where described in section 7, by service providers in other countries, including the United States.

14. Changes to this policy

We may update this policy when Nourimi changes or the law requires it. The date at the top always shows the latest version. If a change affects how we use your health data, we will tell you in the app and ask for your consent again where needed.

15. Contact

Pauline Gwet
Wexstr. 13, 10715 Berlin, Germany
Email: hello@nourimi.app
Data protection officer: [DPO EMAIL]