Privacy Policy

Effective date: June 27, 2026 · Last updated: June 27, 2026

Pluma is an app that helps people on GLP-1 treatments organize their journey — injections, weight, nutrition, activity, and a supportive community. Because a lot of what you track is sensitive health information, we built Pluma to keep that data private by default. This policy explains, in plain English, what we collect, why, who we share it with, and the control you have over it.

1. Who we are

Pluma (“Pluma”, “we”, “us”, or “our”) provides the Pluma mobile application and the website at pluma-glp.web.app (together, the “Service”). For the purposes of the EU/UK General Data Protection Regulation (GDPR) and the Brazilian General Data Protection Law (LGPD), Scaleway Digital LLC is the data controller for personal data processed through the Service.

The Service is operated by Scaleway Digital LLC. You can reach us about anything in this policy at ola@pluma.app.

2. The data we collect

We only collect what we need to run the features you use. Most of it is information you choose to enter; some is collected automatically to keep the app working and secure.

Category	Examples	Why
Account	Email address and the authentication identifier created when you sign in.	To create and secure your account and sync your data across devices.
Health & treatment	Medication name and dose, injection dates, times and body sites, weight and goal weight, height, sex, date of birth, side effects and symptoms.	These are the core tracking features — the medication-level curve, weight trend, schedule, and reminders.
Nutrition & meal photos	Meals you log, estimated calories and macros, and photos you take with the AI food camera.	To estimate nutrition from a photo and show your daily nutrition rings. See section 4.
Activity (Apple Health / Health Connect)	Steps, active energy, and workouts — only if you grant permission.	To show your activity alongside your treatment. See section 3.
Community content	Posts, comments, likes, your chosen display name and optional profile photo.	To power the community feed. This content is visible to other signed-in users.
Device & notifications	Push notification token and basic device/platform info.	To send reminders and notifications you opt into.
Subscription	Subscription status and a customer identifier from our payments processor.	To unlock paid features and restore purchases. We never receive your full card number.
Diagnostics	Limited error and performance logs.	To find and fix crashes and keep the Service reliable.

We do not ask for your real name, and you never have to post anything to the community to use the tracking features.

3. Apple Health & Health Connect

With your explicit permission, Pluma can read certain data from Apple Health (iOS) or Health Connect (Android) — such as steps, active energy, and workouts — to display your activity within the app.

We use data obtained through Apple Health and Health Connect only to provide the features you see in the app. We do not use this health data for advertising or marketing, we do not sell it, and we do not share it with third parties for their own purposes. You can revoke this access at any time in your device’s Health settings.

4. AI food photo analysis

When you use the AI food camera, the photo and a request to estimate its nutrition are sent securely to our AI provider, OpenAI, which returns an estimate of the foods, calories and macros. We send these requests through our own server so that no API keys are exposed in the app.

Meal photos and the resulting estimates are stored in your account so the meal card and history work.
Nutrition estimates are approximate and provided for general informational purposes — they are not dietary or medical advice.
Our AI provider processes the image to generate your result and does not use data submitted through its API to train its models. We do not use your meal photos for advertising.

5. How we use your data

To provide, maintain and improve the Service and its features.
To sync your data across your devices and back it up.
To send reminders and notifications you have enabled.
To operate the community and apply our content rules (see our Terms).
To process subscriptions and restore purchases.
To keep the Service secure, prevent abuse, and debug problems.
To comply with legal obligations.

6. Who we share data with

We do not sell your personal data, and we do not share it for targeted advertising. Your health entries are never used to serve you ads.

We share data only with service providers who help us run the Service, under contracts that limit them to that purpose:

Google Firebase — authentication, database, file storage and cloud functions (your account and tracking data are hosted here).
OpenAI — AI analysis of the meal photos you submit (section 4).
RevenueCat — subscription management and entitlement validation.
Apple & Google — app distribution, in-app purchases, and push notification delivery.
Expo — delivery of push notifications you opt into.

We may also disclose data if required by law, to enforce our Terms, or to protect the rights, safety and security of our users or the public.

7. Legal bases (EEA, UK & similar regions)

Where the GDPR or similar laws apply, we rely on:

Consent — for health data, Apple Health / Health Connect access, and push notifications. You can withdraw consent at any time.
Performance of a contract — to provide the features and subscription you sign up for.
Legitimate interests — to keep the Service secure, prevent abuse, and improve it, balanced against your rights.
Legal obligation — where we are required to process data by law.

8. Storage, security & retention

Your data is stored on Google’s infrastructure and protected in transit and at rest. We restrict access to your data and design our database rules so that, by default, only you can read and write your own health information. No system is perfectly secure, but we work to protect your data using industry-standard safeguards.

We keep your data for as long as your account exists. When you delete your account, we delete it (see section 10). We may retain limited records where required for legal, security, or fraud-prevention reasons.

9. International data transfers

Our providers may process data in countries other than yours, including the United States. Where required, we rely on appropriate safeguards (such as the European Commission’s Standard Contractual Clauses) to protect your data when it is transferred internationally.

10. Your rights & controls

Depending on where you live, you may have the right to access, correct, export, restrict, or delete your personal data, and to object to certain processing. Pluma gives you direct control inside the app:

Export — you can export your data from the app at any time.
Delete your account — from Settings, you can permanently delete your account. This removes your profile, all your logs (injections, weight, meals, activity, symptoms), your statistics, your community posts and the comments and likes you left on others’ posts, your stored photos (profile and meal photos), and your authentication record. This action is irreversible.
Revoke permissions — Apple Health / Health Connect access and notifications can be turned off in your device settings at any time.

To exercise any right, or if you have a complaint, contact us at ola@pluma.app. You also have the right to lodge a complaint with your local data protection authority.

11. Children’s privacy

Pluma is intended for adults managing their own treatment. You must be at least 18 years old (or the age of majority where you live) to use the Service. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

12. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you in the app. Your continued use of the Service after a change means you accept the updated policy.

13. Contact us

Questions, requests, or concerns? Email ola@pluma.app and we’ll get back to you.

Pluma is a tracking and educational-support app. It does not provide medical advice, diagnosis, or treatment. Medication names are used only for compatibility and tracking — Pluma is not affiliated with, endorsed by, or sponsored by any pharmaceutical manufacturer. Always consult your healthcare provider before making any medical decision.