Privacy Policy
Last updated:
Who we are
Holimo is an all-in-one health companion app for iPhone and Android. It is published by To fill in company legal name, a company registered in India (CIN To fill in CIN), with its registered office at To fill in registered address. In this policy, “Holimo”, “we” and “us” mean that company.
We are the controller of the personal data described here. That means we decide why and how it is used, and we are responsible for protecting it.
Questions about privacy go to privacy@getholimo.com. Our representatives in the EU and UK, and our Grievance Officer for India, are listed in Your rights and India below.
This policy covers the Holimo app and the getholimo.com website. US residents should also read our Consumer Health Data Privacy Policy.
What data the app handles
Holimo only collects what it needs to work. Much of it is optional: you choose which health areas to use, and you can leave fields blank. Everything you enter is stored on your phone first, then synced to our servers so it is safe if you change phones.
| Category | What it includes | Notes |
|---|---|---|
| Account | An anonymous account ID created when you first open the app. If you choose to link an account: your email address, or your Sign in with Apple or Google identity. | You can use Holimo without giving us your name or email. If you use Sign in with Apple, you can hide your real email. |
| Profile and goals | Date of birth (for the age gate and energy formula), sex for the energy formula (optional; “prefer not to say” is allowed), height, weight, goal weight, activity level, goals, diets, allergies, dislikes, equipment, units, country, language, time zone, app theme and coach tone. An optional display name. | Used to calculate your targets and personalise plans. |
| Food and meal planning | Food logs with the nutrients of each entry, meal plans, grocery and pantry lists, and recipes you save or add. | |
| Body | Weight logs and body measurements. Progress photos, if you add them. | Progress photos are uploaded to private storage only if you turn on photo backup. |
| Medication and GLP-1 | Medication names, doses exactly as you enter them from your prescription, schedules, dose logs, injection sites, side effects, appetite and fullness ratings, and your supply of pens or tablets. | Holimo records what you enter. It never suggests doses. |
| Fitness | Workouts, sets, reps and weights, personal records, program enrolments, and your answers to the readiness check. | |
| Wellness | Water and caffeine logs, sleep logs and sleep goal, focus sessions, breathing sessions, mood check-ins and mood tags. | |
| Journal | The text of your journal entries. | Encrypted on your phone before it syncs. Never sent to the AI. |
| Habits | The habits you create and when you complete them. | |
| Cycle | Period dates, flow, symptoms, cycle length, predictions, and whether you have marked yourself pregnant or breastfeeding. | Optional. Encrypted on your phone before it syncs. You can keep it on your phone only. |
| Reminders | Your reminder settings and the times the app learns from your routine (for example, when you usually log lunch). | Synced so a new phone keeps your routine. |
| Streaks and badges | Your streaks, badges and challenge entries. | |
| Subscription | Whether you have Pro, which plan, the store you bought it in, renewal and expiry dates, and a store transaction reference, received from RevenueCat. | We never see or store your card or bank details. Apple and Google handle payment. |
| Family plan | Which household you belong to and your role (owner or member). | Members do not see each other’s health logs. |
| Shop-button clicks | When you tap an optional shop button: which product, which placement (for example, a recipe’s “Tools you’ll need”), your country and the time. | No health data is attached. |
| AI | Pro only: how many AI requests you make each month and their cost, and your AI coach conversations. | Coach messages are deleted after 90 days. |
| Consent records | Each consent you give or withdraw, with its version and time. | We keep these to show we asked properly. |
| Device | Platform (iOS or Android), app version, time zone, a notification token if you allow notifications, and when the device last synced. | Used to keep sync and reminders working. |
| Usage statistics (optional) | Small events such as “a meal was logged” or “onboarding finished”, with app version, platform, country and plan type. | Never health values, food details or journal text. Off unless you agree in the EU and UK. |
| Apple Health and Health Connect | Steps, active energy, workouts, sleep, weight and menstrual data, read only for the types you allow, and written back only where you choose. | Only with your permission. See below. |
Apple Health and Health Connect
- Holimo reads from or writes to Apple Health or Health Connect only for the data types you allow in your phone’s permission screen. You can change this at any time in your phone’s settings.
- Data from Apple Health and Health Connect is never used for advertising, marketing or affiliate targeting, and never sold.
- Holimo never stores Apple Health data in iCloud.
- Data we read is used only to show your progress and to make your plans and insights more accurate.
What we do not collect
- No precise location. We use your phone’s region and time zone only.
- No advertising identifiers, and no advertising or tracking software in the app.
- No access to your contacts or microphone. Holimo only reads a photo when you choose one to add.
- No card or bank details.
Why we use your data, and our legal basis
Data protection law in the EU and UK (the GDPR and UK GDPR) requires a legal basis for each use of personal data. Health data is a “special category” and needs your explicit consent under Article 9(2)(a) GDPR. We ask for each kind of health processing separately during setup, and you can change your mind later.
| What we do | Data used | Legal basis |
|---|---|---|
| Create and run your account, sync your data across phones, provide the features you ask for | Account, profile, device, reminders, streaks | Contract: we need it to provide the service (Article 6(1)(b)) |
| Store and use your health logs (food, body, workouts, sleep, water, mood, journal, habits) to show progress and plan your week | Health logs | Your explicit consent (Article 9(2)(a)), plus contract |
| GLP-1 mode and medication tracking, dose reminders and the doctor-visit report | Medication and GLP-1 data | Your separate explicit consent (Article 9(2)(a)) |
| Cycle tracking and predictions | Cycle data | Your separate explicit consent (Article 9(2)(a)) |
| Pro AI features, including the AI coach | A minimal summary of your numbers, targets and plan (see AI) | Your separate explicit consent (Article 9(2)(a)), plus contract |
| Manage your subscription and family plan | Subscription and household data | Contract |
| Understand which features are used, so we can improve Holimo | Optional usage statistics | Your consent (Article 6(1)(a)) |
| Keep Holimo secure, prevent abuse, enforce AI fair-use limits and fix errors | Account, device, AI usage counts | Our legitimate interests in running a safe and reliable service (Article 6(1)(f)) |
| Record consents, handle deletion requests, keep purchase records and respond to authorities | Consent records, subscription data | Legal obligations (Article 6(1)(c)) |
| Count shop-button clicks so we can be paid by affiliate partners | Shop-button clicks (no health data) | Our legitimate interests; you can hide shop buttons at any time |
You can withdraw consent at any time in the app’s Settings, or by contacting us. Withdrawing consent does not affect processing that happened before. If you withdraw consent for a health area, that feature stops working for you; the rest of Holimo keeps working.
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Your calorie targets and meal plans are calculated by fixed rules you can see and change.
Where your data lives and how we protect it
Your data lives on your phone and in our database, which is hosted by Supabase in the EU (Frankfurt, Germany).
On-device encryption for journal and cycle data
Journal text and all cycle fields are encrypted on your phone with AES-256-GCM before they sync. Our database only ever holds the encrypted version.
To let you read your journal and cycle history on a new phone, a backup copy of your personal encryption key is held in Supabase Vault. It is released only to you, after you sign in to your account.
To be clear about what this means: this protects your journal and cycle data if our database were ever leaked or copied, because the data there is unreadable without the key. It is not “zero-knowledge” encryption, because a backup of the key exists on our servers so you can recover your data.
If you turn on “Keep cycle data on this phone only”, your cycle data does not sync at all. It will be lost if you lose or reset your phone.
Everything else
- All data travels between your phone and our servers over encrypted connections (TLS).
- Every table in our database uses row-level security, so one user’s account cannot read another user’s rows. Automated tests check this for every table.
- Secret keys stay on our servers and are never shipped inside the app.
- Our database is backed up daily. We have a written plan for responding to a data breach, including notifying authorities and affected users when the law requires it (within 72 hours where the GDPR applies).
More detail is on our Security and Privacy by design pages.
Who we share data with
We do not sell your personal data. We do not show ads, ever. We never use health data for advertising or affiliate targeting.
We use a small number of service providers (“sub-processors”) to run Holimo, such as our database host, Google for Pro AI features, and RevenueCat for subscriptions. They may only use your data to provide their service to us, under written contracts. The full, current list is on our Sub-processors page.
We may also share data:
- With members of your family plan: they can see that you are in the household, and anything you choose to share with them. Your health logs are never shared with them.
- If the law requires it, for example a valid court order. We will tell you unless the law forbids it.
- To protect someone’s safety, or our rights, where the law allows.
- If our company is reorganised, merged or sold. The new owner would have to keep the promises in this policy, and we would tell you first.
Shop buttons open Amazon or Myprotein outside Holimo. We do not send them any data about you; once you are on their site or app, their privacy policies apply. See our Affiliate Disclosure.
How long we keep data
- We keep your data for as long as your account exists, so you can see your history.
- When you delete your account, we erase your rows, stored files and the escrowed encryption key within 30 days.
- AI coach messages are deleted automatically after 90 days.
- Database backups roll off after To fill in backup retention days, per the Supabase plan. Deleted data may remain in a backup until it rolls off, and is never restored into the live service.
- If you sign in to an existing account from a new anonymous account, your data moves into the existing account and the anonymous account is deleted.
- Consent records and purchase records may be kept longer where the law requires us to prove consent or keep tax records. Apple, Google and RevenueCat keep their own purchase records.
- Usage statistics are kept for To fill in founder decision — analytics event retention period.
See Delete your account for the steps.
International transfers
Your data is stored in the EU. Some people and providers who help run Holimo are outside the EU and UK:
- Our company and team are in India, and may access data from India to support you and maintain the service.
- Some sub-processors are based in the United States (for example Google and RevenueCat).
Where data leaves the EU or UK, we use legal safeguards: the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum or Agreement, or the EU-US Data Privacy Framework (and its UK extension) where a provider is certified under it. To fill in counsel to confirm the transfer mechanism for each transfer, including EU to India
You can ask us for a copy of the safeguards by emailing privacy@getholimo.com.
Your rights
Wherever you live, you can see, export, correct and delete your data. If the GDPR or UK GDPR applies to you, you have the right to:
- Access your data and get a copy.
- Correct data that is wrong.
- Delete your data (“right to be forgotten”).
- Restrict how we use it in some cases.
- Data portability: receive your data in a machine-readable format.
- Object to processing based on our legitimate interests.
- Withdraw consent at any time, without affecting earlier processing.
- Complain to a data protection supervisory authority, usually in the country where you live or work.
How to use your rights
- Export: Settings → Your data → “Export everything (JSON)” or “Export logs (CSV)”.
- Correct: edit any entry, or your profile and goals, in the app.
- Delete: Settings → Account → “Delete account”. See Delete your account.
- Withdraw consent: use the switches in Settings → Privacy, or turn off the health area.
- Anything else: email privacy@getholimo.com. We will reply within one month, and may need to confirm the request comes from you.
Our representatives
Because our company is outside the EU and UK, we have appointed representatives under Article 27 of the GDPR and UK GDPR. You can contact them instead of us.
- EU representative: To fill in EU Article 27 representative name, address and email
- UK representative: To fill in UK Article 27 representative name, address and email
India: Digital Personal Data Protection Act, 2023
This section applies to users in India and adds to the rest of this policy. Under the Digital Personal Data Protection Act, 2023 (DPDP Act), we are the Data Fiduciary for your personal data.
Notice and consent
We process your personal data on the basis of your consent, which we ask for in the app before you use each feature that needs it, and for the purposes described in this policy. Our consent notice is available in English To fill in counsel to confirm whether notices in Indian languages listed in the Eighth Schedule are needed at launch.
You can withdraw consent at any time, as easily as you gave it, in Settings → Privacy or by emailing us. After you withdraw, we stop processing that data and delete it unless the law requires us to keep it.
Your rights
- Access: a summary of the personal data we process and what we do with it, and who we have shared it with.
- Correction and completion of inaccurate or incomplete data.
- Erasure of data that is no longer needed, or when you withdraw consent.
- Grievance redressal: a quick and fair response to complaints.
- Nomination: you can name another person to exercise your rights if you die or become unable to do so. Email us to set this up.
Grievance Officer
Grievance Officer: To fill in name, email, address of the Grievance Officer
We will respond to grievances within To fill in counsel to confirm the response period set by the DPDP Rules. If you are not satisfied with our response, you can complain to the Data Protection Board of India.
Children
Holimo is only for adults aged 18 and over, so we do not process the personal data of children under the DPDP Act. See Children.
United States: California privacy notice
This section applies to California residents, to the extent the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA), applies to us. It describes the previous 12 months and our current practices.
| CCPA category | Examples in Holimo | Collected? |
|---|---|---|
| Identifiers | Anonymous account ID, email address (if you link one), Apple or Google sign-in identity, device notification token | Yes |
| Personal records (Cal. Civ. Code 1798.80(e)) | Email address; no financial or insurance information | Yes, email only |
| Characteristics of protected classifications | Age (from date of birth), sex (optional) | Yes |
| Commercial information | Subscription plan, status and renewal dates | Yes |
| Biometric information | No | |
| Internet or other electronic network activity | Optional usage statistics, shop-button clicks, sync activity | Yes |
| Geolocation data | Country and time zone only. We do not collect precise geolocation. | Coarse only |
| Audio, electronic, visual or similar information | Progress photos, only if you add them | Only if you choose |
| Professional or employment information | No | |
| Education information | No | |
| Inferences | Calorie and nutrient targets, sleep score, cycle predictions, calculated from what you enter, used only to provide the features | Yes |
| Sensitive personal information | Health information (food, body, medication, workouts, sleep, mood, journal, cycle); account log-in through Apple, Google or an email code | Yes |
Sources: you (what you enter in the app), your phone (Apple Health or Health Connect, with your permission), Apple, Google and RevenueCat (subscription status), and the app itself (device and usage information).
Purposes: the purposes in Why we use your data. Retention: see How long we keep data.
Disclosure for a business purpose: we disclose the categories above to our service providers listed on the Sub-processors page, only to run Holimo.
We do not sell or share your personal information, as “sell” and “share” are defined in the CCPA, and we have not done so in the past 12 months. We do not knowingly sell or share the personal information of anyone under 16. We use sensitive personal information only for the purposes the CCPA permits, such as providing the services you ask for, so we do not offer a “limit” link.
Your California rights
- Know and access: the categories and specific pieces of personal information we hold, its sources, purposes and who we disclose it to.
- Delete personal information we collected from you.
- Correct inaccurate personal information.
- Opt out of sale or sharing: not needed, because we do not sell or share personal information.
- Limit use of sensitive personal information: not needed, because we use it only for permitted purposes.
- Non-discrimination: we will not deny you service, charge you a different price or give you a lower quality of service for using your rights.
To use these rights, use the export and delete tools in the app, or email privacy@getholimo.com. We will verify your request by confirming it comes from the email address or sign-in linked to your account. You can use an authorised agent; we will ask for proof of their authority and may ask you to confirm your identity directly.
If you live in Washington, Nevada, Connecticut or another state with a consumer health data law, please also read our Consumer Health Data Privacy Policy.
Children
Holimo is for adults aged 18 and over only. The app asks for your date of birth during setup and does not let anyone under 18 continue.
If we learn that we hold data about someone under 18, we will delete it. If you think a child is using Holimo, please email privacy@getholimo.com.
This website
- getholimo.com is a static website. It sets no cookies and uses no analytics, ads or tracking pixels.
- Fonts are hosted on our own site, so your browser does not contact a font service.
- If you use the light or dark theme switch, your choice is saved in your browser’s local storage so the page remembers it. It never leaves your browser. See our Cookie Policy.
- If you join the waitlist, your email address, the page you signed up on, the version of the notice you saw and the time are sent through our website’s server function to our waitlist provider To fill in name the waitlist provider once chosen. We use them only to tell you when Holimo launches, then stop. Our function doesn’t store them. You can ask us to remove your address at any time.
- Our website is hosted by Vercel, which keeps standard request logs, such as IP addresses and the pages requested, for security and abuse prevention. To fill in confirm Vercel’s log retention period for our plan
Changes to this policy
If we change this policy, we will update the date at the top. If a change is important, for example a new use of health data, we will tell you in the app before it takes effect and ask for your consent where the law requires it.
Contact us
Email privacy@getholimo.com, or write to To fill in company legal name and registered address.