Privacy Policy – Anovi App

Looking for the website's privacy policy? Privacy Policy (Website) →

Last updated: May 2026

At a glance

• Who we are. Anovi is a wellness and meal-planning app for adults aged 18 and over. The controller is Pragathi Jayaram, doing business as Anovi Wellness, in Germany.
• What we process. We process your account details, dietary and health-related entries, such as food allergies, body metrics, meal logs and wellness logs, and the content you record in the App. Some of this information is health data under Art. 9 GDPR and is processed on the basis of your explicit consent.
• AI for meal logging. When you describe a meal, AI helps structure it into ingredients so we can estimate nutrition. More details are in Section 6.
• Who helps us run Anovi. Selected service providers help us operate the App, including database, hosting, error monitoring, support email, transactional email, app infrastructure, AI providers, and in-app purchase and subscription management. Our current list of sub-processors is available on our website.
• Your control. You can access, correct, export, or delete your data, and you can withdraw consent where we rely on consent. Account deletion removes your data from our active database, subject to short recovery backups and legal retention exceptions.
• What we do not do. We do not sell your personal data. We do not show advertising in the App or use advertising identifiers. We do not currently send marketing communications. We do not make automated decisions with legal or similarly significant effects. Anovi is not a medical device and does not provide medical advice, diagnosis, or treatment.

1. About this Privacy Policy

This Privacy Policy applies to the Anovi mobile app for iOS and Android (the "App"). It describes which personal data we process when you use the App, for which purposes, and on which legal basis. For information about processing on our website, see the separate Privacy Policy for the website.

Last updated: May 2026. The current version of this Privacy Policy is always available on our website. It begins with a short overview followed by 16 detailed sections.

Sub-processors that help us provide the App are listed in our separate list of sub-processors.

The German version is authoritative. An English version is also available; in case of any inconsistency, the German version prevails.

2. Who is responsible

The controller responsible for processing your personal data in the App is:

Pragathi Jayaram, doing business as Anovi Wellness
Karlsruher Straße 32
70771 Leinfelden-Echterdingen
Germany

Email: hello@anoviwellness.com

We have not designated a Data Protection Officer because the legal requirements (Art. 37 GDPR; § 38 BDSG) are not met.

If you have any questions about data protection, you can contact us at any time at the email address above. For more information about the provider, see our Impressum.

3. Who this Privacy Policy applies to

The Anovi App is intended exclusively for adults aged 18 and over. Because we process health-related data, we deliberately require adult capacity to consent.

We check age eligibility in two steps. At signup, you confirm with a checkbox that you are at least 18 years old. During onboarding, you also enter your age, and we validate this entry server-side. You cannot complete onboarding unless both steps confirm that you are at least 18.

We do not collect your exact date of birth. We only process the information needed to confirm that you are at least 18, in line with data minimisation under Art. 5(1)(c) GDPR. We do not use external identity verification and rely on the information you provide.

If we learn that a minor has created an account or stored data in the App, we will delete the relevant account and data promptly.

4. What data we collect and why

We process your data in six areas. For each area, we tell you what we collect, why, and on which legal basis.

4.1 Account and sign-in

When you register and sign in, we process:

• Identifiers and contact data: email address, display name, a technical user ID
• Credentials: password (stored hashed) and session tokens
• Basic profile: age, household size, language, time zone, country, currency
• Security indicators: failed sign-in attempts and an automatic 15-minute lockout after repeated failed attempts

We process this data to provide your account, sign you in, and protect against brute-force attempts. Legal basis: Art. 6(1)(b) GDPR (performance of contract) for account creation, sign-in, session management, and profile management; Art. 6(1)(f) GDPR (legitimate interests) for security indicators and protection against misuse, including failed sign-in attempts and temporary lockouts.

4.2 Health and profile information

So we can recommend meals safely, we ask for two required entries when you set up your profile: food allergies and dietary practice (e.g., vegan, vegetarian, omnivore; "no allergies" and "no restrictions" are valid answers).

Optionally, you can also provide:

• Wellness goals
• Body metrics (e.g., gender, weight, height, activity level, weight goal, weekly rate goal)
• Taste preferences (preferred cuisines, foods you dislike)

You can reset optional entries at any time at the field level (see Section 5).

Legal basis: For required entries, we rely on Art. 6(1)(b) GDPR (performance of contract), as they are needed for safe and personalised meal recommendations. For optional entries, we rely on Art. 6(1)(a) GDPR (consent). Where the information is health-related (especially food allergies, body metrics, wellness goals, and weight goals), we additionally rely on Art. 9(2)(a) GDPR (explicit consent). The wording of the consent and the withdrawal mechanism are in Section 5.

4.3 What you record in the App

When you use the App, we process the content you enter:

• Meal logs (consumption data, nutrient snapshots, personal recipes)
• Pantry and shopping lists (stock, quantities, expiry dates, store name)
• Recipe ratings, favorites, meal plans
• Wellness logs (e.g., mood, energy, sleep, hydration, activity) and weight records

We process this data to provide you with personalised meal planning, nutrient analysis, and self-reflection on your wellbeing.

Legal basis: Art. 6(1)(a) GDPR (consent) for data you voluntarily record in the App: meal logs, pantry items, shopping lists, wellness logs, and weight records. Art. 6(1)(b) GDPR (performance of contract) for processing necessary to display your content, calculate your nutrient targets, show recipes, generate meal plans, and provide the App features you use. Where the content is health-related (especially meal consumption, wellness, body, and weight data), we additionally rely on Art. 9(2)(a) GDPR (explicit consent). A description of our rule-based personalisation algorithms and our determination on Art. 22 GDPR is in Section 7.

4.4 AI-assisted meal logging

When you log a meal via the AI path, we send to our AI providers:

• the meal title and portion count
• your free-text notes on this meal
• your food allergies (automatically appended)

We do not send identifiers (such as your email address, user ID, or IP address) to the AI providers. They receive only the content needed to structure the logged meal and estimate its nutrient values. You then review and confirm the AI estimate before we save it.

We also record technical call data on AI usage (model name, provider, token count, success status, without any content data) for cost management and quota enforcement.

Legal basis: Art. 6(1)(a) GDPR (consent) for transmitting your inputs to the AI providers; Art. 9(2)(a) GDPR (explicit consent) for the allergies and health-related free-text content transmitted in that process; Art. 6(1)(f) GDPR (legitimate interests) for the technical call data. Before any data is sent to the AI providers for the first time, we obtain your explicit consent in the App. You may decline and continue logging meals manually, by barcode scan, or from the catalogue; you may withdraw your consent at any time, with effect for the future, in the App's settings (Art. 7(3) GDPR). More on AI providers and safeguards in Section 6 and on third-country transfers in Section 9.

4.5 Stability, security, and communication

So that the App runs reliably and you can reach us, we process:

• Error logs and performance data via Sentry (technical metadata and a pseudonymous identifier; health and nutrition data are removed before transmission)
• Security and misuse-prevention records (request-rate counters and access audit logs used to enforce technical limits, detect misuse, and protect App security; these records contain technical metadata only and do not include the substantive content of your meal logs, recipes, wellness entries, or other personal content)
• Transactional emails (welcome email, password reset, account deletion confirmation)
• Support requests (name, email, app version, your message; you decide what you write)
• Consent records and requests for access, rectification, or erasure

Legal basis: Art. 6(1)(f) GDPR (legitimate interests) for error logs, security and misuse-prevention records, and support triage; Art. 6(1)(b) GDPR (performance of contract) for transactional emails; Art. 6(1)(c) GDPR (legal obligation) for consent records and data subject requests. Retention periods are in Section 10.

4.6 Subscription and in-app purchases

When you subscribe to Anovi Pro, we process data relating to your subscription:

• Subscription status (for example active, trial, cancelled, expired, billing-retry, or grace period) and the renewal or expiry date
• Purchase metadata: the product purchased, transaction identifiers, purchase date, price, and currency

To manage subscriptions and activate Pro features, we use RevenueCat as our in-app purchase and subscription-management provider. We send RevenueCat a pseudonymous app user identifier and the purchase receipt or token issued by the Apple App Store or Google Play. We do not send your name, email address, or any health or app-content data to RevenueCat.

Payment is handled by the Apple App Store or Google Play as the seller of the subscription. Your payment-card details are processed by Apple or Google and do not reach Anovi or RevenueCat.

Legal basis: Art. 6(1)(b) GDPR (performance of contract) for providing and managing your Anovi Pro subscription, activating Pro features, and synchronising your subscription status across your devices. We do not process special categories of personal data for this purpose. More on RevenueCat as a service provider is in Section 8; more on transfers to the United States is in Section 9.

4.7 What we do NOT process

For clarity on what does not happen:

• We do not sell your data. No sale, no exchange, no rental to third parties.
• We do not use advertising identifiers. No advertising IDs (IDFA, IDFV, Google Advertising ID), no tracking pixels, no cookie-based profiling.
• We do not currently send marketing emails. Should you ever receive promotional content by email in future, we will ask you first explicitly.
• We do not process data from people under 18 (see Section 3).
• We do not make automated decisions with legal or similarly significant effects on you (Art. 22 GDPR not engaged; see Section 7).
• We do not provide medical advice, diagnosis, or treatment. Anovi provides nutrition and wellness information for self-reflection and meal planning, but it is not a medical device (see Section 14).

5. Special categories of personal data: health data

Some of the information you provide qualifies as a special category of personal data under Art. 9 GDPR (in particular health-related information such as food allergies, body metrics, and wellbeing entries). For processing such data we rely on your explicit consent under Art. 9(2)(a) GDPR.

Your consent

When you register, you confirm that you are at least 18 years old and give Anovi your explicit consent to process the health-related data you provide (in particular food allergies, body metrics, and meal and wellness entries) to provide personalised meal planning, nutrition analysis, and self-reflection on your wellbeing, as described in this Privacy Policy. This is your explicit consent under Art. 9(2)(a) GDPR. We document your consent with a timestamp and the version of this Privacy Policy.

Required entries (Tier A)

So we can recommend meals safely, we ask for two required entries when you set up your profile:

• Food allergies: based on the 14 allergen categories in Regulation (EU) 1169/2011 Annex II; "no allergies" is a valid answer
• Dietary practice: vegan, vegetarian, pescatarian, or omnivore; "no restrictions" is a valid answer

You can change these entries at any time in your profile. The answer "none" is fully operational; the App works in either case.

Optional entries (Tier B)

You can also provide the following information, which is not required to use the App:

• Wellness goals (up to 3 of 13 goals, e.g., more energy, better sleep, bone health)
• Body metrics (e.g., gender, weight, height, activity level, weight goal, weekly rate goal)
• Taste preferences (preferred cuisines, foods you dislike)

You can reset optional entries at any time at the field level; the reset action is as simple as adding the entry (Art. 7(3) sentence 4 GDPR "as easy to withdraw as to give").

How to withdraw your consent

You can withdraw your consent at any time:

• Field level: via the "Reset" element in your profile or settings (for Tier B entries)
• Change required entries (Tier A): adjust your answer at any time, including changing to "none"
• AI transmission separately: you can withdraw your consent to transmitting your inputs to the AI providers (Section 4.4) independently, in the App's settings, without deleting your account. AI-assisted meal logging then stops; the App's other features remain available.
• Full withdrawal: the App's core features depend on your health-related entries; full withdrawal of your consent therefore takes the form of account deletion via Settings → Delete account. This stops future processing and deletes your account data; retention periods after deletion are in Section 10 and more on your rights is in Section 11.

Withdrawal does not affect the lawfulness of processing carried out before the withdrawal (Art. 7(3) sentence 2 GDPR).

Where we use your health data is shown in Section 4 by area. More on safeguards for AI-assisted meal logging in Section 6, and on your rights in Section 11.

6. How we use AI

Anovi uses AI in one place only: when you log a meal by describing what you ate (e.g., "chicken curry with rice and vegetables"), the AI converts your description into a structured list of ingredients. On that screen you are interacting with an AI system (per Art. 50(1) Regulation (EU) 2024/1689). The AI output is an estimate and should not be considered medical or nutritional advice.

How nutrient values are determined

For each ingredient on the list, we first look up nutrient values in Anovi's curated database. Database values are used wherever available. AI-estimated values are used only when an ingredient or nutrient value is not available in our database; these values are flagged as "AI-estimated" in your meal log.

Your control

Before we save anything, you review and confirm what the AI suggested:

• You can change quantities, add or remove ingredients, adjust portions, meal type, or notes
• When you edit an ingredient, we run a fresh database lookup; AI estimates are often replaced by database values
• You can skip the AI path entirely and log meals directly from our database, by barcode scan, or as a copy of a previous meal

The AI path is optional and runs only with your consent. The first time you use it, we ask for your explicit permission before anything is sent to the AI providers. You can withdraw this consent at any time, with effect for the future, in the App's settings; the other logging methods remain available to you.

Third-country transfer and safeguards

We use an EU-hosted primary AI path and a United States-based fallback AI provider, used only when the primary path is unavailable. To the AI providers we send only the content needed to structure the meal log and, where necessary, estimate missing ingredients or nutrient values (no email address, no user ID, no IP address). For transfers to the United States we rely on Standard Contractual Clauses and supplementary measures (details are in Section 9); the individual AI providers with their privacy notices are listed in our list of sub-processors.

More on the data we send is in Section 4.4; on our determination on Art. 22 GDPR in Section 7; on retention in Section 10; on disclaimers (no medical advice etc.) in Section 14.

7. Profiling and automated decisions

Anovi personalises several parts of the App through recommendations, calculations, summaries, and suggestions based on your own inputs and records. These features suggest, rank, summarise, and remind. They do not make decisions that produce legal or similarly significant effects on you. For this reason, Art. 22(1) GDPR is not engaged.

Where we personalise

A. Personalised recipes. We rank recipes for you based on your wellness goals, dietary preferences, food allergies, and your marked favorites and dislikes. The ranking is rule-based.

B. Personal nutrient targets. From your body metrics and activity level, we calculate your daily calorie need and nutrient targets using the Mifflin-St Jeor formula and EFSA reference values. The result is an estimate for orientation, not a medical prescription. If you have set a weight goal, we also suggest several safe weekly rates for you to choose from; the suggestions are derived from your body metrics and activity level. You select from the suggested options; you cannot enter custom values.

C. Weekly wellness summaries. From your own wellness entries, we generate weekly overviews (e.g., "you met your hydration goal on 5 of 7 days"). This is a summary of your own records, not an external assessment.

D. Pantry, shopping, and quick-add suggestions. We learn from your shopping and consumption behaviour to help you keep track of your pantry. Specifically: we flag low stock and expiring items, point out conflicts between your shopping list and pantry, suggest replenishment based on your typical rhythm, and order frequently-used ingredients in your quick-add list. We also compute shopping analytics on read (e.g., most-frequent store, spend trends) from your completed shopping trips; these are not persistently stored.

E. Nutrient-gap food recommendations. When your daily nutrient intake falls short of your targets, we suggest foods that could fill those gaps. We remember which suggestions you saved or dismissed, so we don't repeat them.

Why these are not automated decisions

The personalisation features above are rule-based and deterministic. They may involve profiling in the GDPR sense; we use your own inputs and records to personalise recipes, targets, summaries, and suggestions. However, they are not automated decisions within the meaning of Art. 22(1) GDPR, because they do not produce legal or similarly significant effects on you. The only place we use AI is meal logging by description (see Section 6). The outputs are advisory (rankings, suggestions, estimates, summaries), and you retain full discretion over whether, how, and to what extent you follow these suggestions.

Your control

You can reduce or fully turn off personalisation at the field level by resetting the optional entries (Tier B) in your profile (see Section 5). Without wellness goals, recipe ranking is based only on your allergies and dietary preferences; without body metrics, the calorie target is not calculated; without wellness logs, no weekly summaries are generated. More on your rights and full deletion in Section 11.

8. Who helps us process your data

To operate the App, we engage carefully selected service providers. Where they act as processors for us, they process your personal data on our documented instructions and under a data processing agreement within the meaning of Art. 28 GDPR. We currently use the following service providers:

• Supabase, Inc. (database, authentication, file storage), Frankfurt, EU
• Functional Software, Inc. (Sentry) (error monitoring and performance), Frankfurt, EU
• Railway Corporation (backend hosting), Amsterdam, EU
• Zoho Corporation GMBH (support mailbox), Amsterdam, EU; contracting entity: Essen, Germany
• Resend, Inc. (transactional email), Ireland, EU
• Google LLC (Vertex AI) (AI for meal logging, primary path), inference region Frankfurt
• Anthropic, PBC (AI for meal logging, fallback path; used only when the primary path is unavailable), United States
• 650 Industries, Inc. (Expo) (build and update infrastructure, no nutrition or wellness data), AWS us-west-2 and global CDN
• RevenueCat, Inc. (in-app purchase and subscription management), United States

We may update this list. The current version with role, region, and the privacy notice for each provider is available in our list of sub-processors. We communicate material changes per Section 15. More on transfers outside the EU is in Section 9; on AI-assisted meal logging in Section 6.

9. Transfers outside the EU

Some of our service providers are based outside the European Union, belong to groups headquartered outside the EU, or may involve limited access from outside the EU in support, security, or maintenance cases.

Where personal data is transferred to a country outside the EU/EEA, we rely on appropriate transfer mechanisms under GDPR. These include an adequacy decision such as the EU-U.S. Data Privacy Framework, where the relevant recipient is certified, or the European Commission's Standard Contractual Clauses. Where required, we also assess the transfer and apply supplementary technical and organisational measures.

For AI-assisted meal logging, our primary AI processing path is configured for the Frankfurt region. The fallback provider, Anthropic, is used only if the primary path fails. In normal operation, the fallback prompt payload does not include your email address, direct user ID, or device IP address.

For in-app purchase and subscription management, we use RevenueCat in the United States. The data transferred is limited to a pseudonymous app user identifier and purchase and subscription metadata; it does not include your health data or the content you record in the App. For this transfer we rely on Standard Contractual Clauses together with supplementary measures.

Despite these safeguards, we cannot fully exclude that public authorities in third countries may access personal data, or that you may not have the same legal remedies as within the EU/EEA.

You can request further information about the transfer safeguards we use, including a copy of the relevant Standard Contractual Clauses, by contacting us at hello@anoviwellness.com. We may redact confidential or security-sensitive information where necessary.

The processors we use are listed in Section 8. More information about AI-assisted meal logging is provided in Section 6.

10. Retention

We keep your account data while your account is active and delete it when you delete your account. Our database provider keeps recovery backups for up to 7 days after deletion; access to those backups is contractually limited to recovery emergencies.

Service-provider records. Some of our service providers keep limited technical or operational records for short, provider-set windows. Error monitoring and transactional email logs are typically kept for up to 30 days; the AI fallback provider may retain prompt content for up to 30 days; the support inbox retains your correspondence for as long as needed to handle your request and is reviewed on our internal cadence.

Records we may keep longer. Where the law requires us to retain specific records (for example, evidence of consent for the period during which a claim could be made, or business records under tax or commercial law that exist outside the App), we keep those records for the period required by the applicable law.

App removal and account deletion. Removing the App from your device does not delete your account. Cancelling a Pro subscription also does not delete your account; cancellation ends your access to Pro features at the end of the paid subscription period, while your account remains active and your data is retained as described above. To delete your data, use Settings → Delete account in the App, or contact us at hello@anoviwellness.com. When you delete your account, the deletion also removes the subscription data held by our in-app purchase and subscription-management provider.

Your right to erasure and other data-subject rights are described in Section 11.

11. Your rights and how to exercise them

Under the GDPR, you have the following rights regarding your personal data. The table below summarises each right and how to exercise it in Anovi. These rights may be subject to legal conditions and exceptions.

How to contact us about your rights. Email hello@anoviwellness.com. We may ask you to verify your identity, in particular for access and portability requests, to make sure we send your data only to you.

Response time. We respond within one month of receiving your request. Where the request is complex or where we receive a high volume of requests, we may extend that period by up to two further months and will let you know in advance.

Right to lodge a complaint. If you believe that our processing of your personal data infringes the GDPR, you may lodge a complaint with a supervisory authority. The competent authority for Anovi is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (LfDI BW), Heilbronner Straße 35, 70191 Stuttgart, Germany (baden-wuerttemberg.datenschutz.de). You may also lodge a complaint with another competent supervisory authority.

12. Storage on your device

The Anovi App stores some information on your device to deliver the service you requested and to support core app features. Where storage on your device is strictly necessary for the service you have requested, no consent is required under § 25 of the German Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz (TDDDG). Where storage or access is not strictly necessary, we will ask for consent where required under § 25 TDDDG and rely on the relevant lawful basis under the GDPR for any related processing of personal data.

Strictly necessary storage. We store the following on your device so the App works:

• Authentication tokens in your device's secure storage (iOS Keychain or Android EncryptedSharedPreferences) so you remain signed in
• App state and preferences (for example your language, time zone, and onboarding progress), and a temporary performance cache of content you have already viewed
• A per-installation identifier used by our app-update and build-infrastructure provider to deliver app updates

Storage for error monitoring. To keep the App secure and stable, our error-monitoring SDK uses a per-installation pseudonymous identifier to correlate technical errors and stability issues within a single installation. We treat this storage as strictly necessary for providing a secure and reliable App under § 25(2) no. 2 TDDDG. The related processing of personal data is based on our legitimate interest in maintaining the security and stability of the App (Art. 6(1)(f) GDPR; the balancing assessment is available on request). You may object to this processing at any time; see Section 11.

What we do not store on your device. We do not use advertising identifiers (Apple IDFA, Google Advertising ID), analytics cookies, web tracking pixels, session-replay recordings, or cross-app tracking identifiers. We also do not access Apple IDFV.

13. No marketing

Anovi does not currently send you marketing communications. We do not show advertising inside the App, use advertising identifiers, or use your App data to target advertising on third-party platforms.

The emails we send are operational. We send a welcome email when you sign up, a password-reset email when you request one, and a confirmation when you delete your account. We also respond when you contact us, for example to ask a question, get help, or exercise your rights.

If we add features in the future that involve marketing communications, such as promotional emails, newsletters, referral campaigns, or promotional push notifications, we will not send you marketing without your separate consent where required, and we will update this Privacy Policy in line with Section 15.

14. Important disclaimers

Anovi is a wellness and meal-planning app. It is not a medical device and does not provide medical advice, diagnosis, or treatment. Information shown in the App is for general nutrition and wellness orientation, not a substitute for advice from a qualified healthcare professional.

Nutrition values shown in the App are estimates based on our curated database, third-party food data, and AI estimates where database values are not available. Actual values can vary by brand, batch, and preparation. Always check product labels.

Allergen flags and filters rely on the data we have for each ingredient and on your stated allergies. They do not replace reading product labels. For serious allergies, always check the actual packaging.

Where AI is used to structure your meal entries or estimate nutrition (see Section 6), the output is an estimate. Verify it before relying on it.

Anovi is not intended to support extreme dieting or disordered eating. If you have a medical condition, are pregnant or breastfeeding, or follow a specific dietary regimen prescribed by a healthcare professional, please consult a qualified professional before acting on information shown in the App.

15. Changes to this policy

We may update this Privacy Policy from time to time, for example to reflect changes in our App, our service providers, or applicable law. The effective date is shown at the top of this policy.

Where we make material changes (for example a new processing purpose, a change in the lawful basis, a new sub-processor, or a change to your rights), we will notify you in an appropriate way, such as by email, an in-app notice, or another prominent notice in the App. If a material change affects processing for which we rely on your consent, we will ask for your renewed consent where required.

The most recent version of this Privacy Policy is always available on our website.

16. Contact

If you have any questions about this Privacy Policy or about how we process your personal data, you can contact us:

• Email: hello@anoviwellness.com
• Postal address: Pragathi Jayaram, Anovi Wellness, Karlsruher Straße 32, 70771 Leinfelden-Echterdingen, Germany

For more details about who is responsible for processing your data, see Section 2. For your data-subject rights and the right to lodge a complaint with a supervisory authority, see Section 11.