Privacy Policy

If you live in the United States, our Consumer Health Data Privacy Notice adds what state health-privacy laws require.

The data controller is DISTRIBEA OÜ (registry code 17264068), Sepapaja tn 6, Lasnamäe linnaosa, 15551 Tallinn, Harju maakond, Estonia.

Privacy contact: privacy@oolite.app. Representative under Article 27 GDPR: not required, the controller is established in the European Union.

a. What you give us

• Our e-mail list: your e-mail address, the answers you choose to give to a few short questions about your treatment (health data, kept only with your consent), and how you reached our site.
• What you record in the app: your treatment and its schedule, the doses you log, your weight, the effects you notice, your mood and appetite, your notes and, for a shot, your pen or vial and the injection sites. This is health data (section 4). It stays on your device: the app needs no account, and we do not ask for your name, e-mail, address or date of birth.
• Support and feedback: what you write to us, your app version and device model when you send feedback from the app, and your e-mail address only if you enter our monthly draw (see the Feedback Draw Official Rules).

b. What is collected automatically

• Technical data: device type, operating system, app version, language, approximate region derived from your IP address, crash reports and error logs.
• Usage measurement: pages or screens opened, features used, and the source that brought you to the site. We use this in aggregate to understand what works, not to profile you.
• Cookies and similar technologies on the website. See section 12.

c. What you connect, only if you choose to

• Data from a health platform on your device (for example weight from Apple Health), read only with your explicit permission and only for the purpose you enabled. You can withdraw that permission in your device settings at any time.

d. App usage, diagnostics, and anonymous treatment statistics

• Usage and diagnostics (on by default, one tap to turn off). To see how the app is used and fix what breaks, the app sends us the screens and features you use, crash and performance reports, how you found the app when Apple reports it to us (for example one of our Apple Search Ads campaigns), and a few general facts, such as some of your first-launch answers (where you are in your treatment, your main difficulty, your age range), the kind of entry you log and the scanner result shown. Never what you wrote, and never anything from Apple Health. It is tied to a random identifier created on your device, never to your name, your advertising identifier or your IP address. Turn it off in Settings › Privacy. We keep usage data for up to 24 months and diagnostics for up to 6 months, and we commit never to try to re-identify anyone from it.
• Anonymous treatment statistics (off unless you turn it on). If you choose to, the app also sends figures in ranges about how the treatment goes: your first-launch answers (such as your medicine and its form, your step, your goal, your body measures in ranges and your sex if you gave it), doses taken or missed and their time of day in ranges, effects and how strong they are, mood and appetite, weight progress rounded to the pound, and changes in your treatment (step, form, refill, appointment, stop). Never a note, your name, an exact weight or anything from Apple Health. Turn it on or off, or delete what you shared, in Settings › Privacy. We commit never to try to re-identify anyone, and we require the same in writing from anyone we share aggregate figures with. These figures are never sold, used for advertising or used to train a model.
• Advertising measurement. To know which of our ads work, the app includes tools from an advertising platform where our ads run and from our subscription manager. The advertising platform receives technical information about your device and a few app events: an app opening, the end of the first-run questions (never your answers) and a purchase with its price. The app never asks for Apple’s tracking permission and never reads your advertising identifier, so the platform cannot follow you across other apps. The platform uses these signals to measure our ads in aggregate and may use them to show our ads to people who are more likely to be interested in Oolite. Our subscription manager receives your App Store purchases to keep our records. Neither receives your journal, your treatment, your answers, your weight or anything from Apple Health.

e. The barcode scanner (United States)

The barcode scanner is available in the United States.

• Looking up a product. The barcode is read and looked up on your phone, in a product base built from public sources, such as the USDA’s FoodData Central, and from products checked by Oolite. The barcodes you scan are never linked to you or your phone.
• Protecting the base. The base on your phone is encrypted. To unlock and update it, the app proves to our server, through Apple, that it is a genuine copy of Oolite. We keep brief technical records of these requests and of products added, with no name and no barcode, only to stop bulk copying and abuse.
• Scan counts. Only while “Help us improve Oolite” is on, the app sends the barcodes scanned and their results, with nothing that identifies you or your phone. We keep only totals per product and per day.
• Photos of a pack. When you choose to send photos of a pack, to add a missing product, report a problem or get a one-time reading, the app sends them only after you agree, and removes location and camera details first. An outside AI service reads the label for us, under contract: it deletes the photos within 30 days unless the law requires longer, and never uses them to train its models. The result is always computed by Oolite’s own rules. When we keep photos, it is privately, as the source of a product record: they are never shown to other users, published, sold or licensed, and only the product facts (name, brand, category, nutrition values) join the base. To make sure two different people agree before a product changes, we briefly keep an unreadable, one-way form of the IP address the photos came from, and erase it once the product is checked.
• Please photograph only the pack. If a photo shows a person or another personal detail, we delete it when we find it or when you ask (section 11).

We do not buy personal data from data brokers, and we do not collect precise location.

Information about a treatment, a symptom or a body measurement is a special category of personal data under the GDPR and consumer health data under several US state laws. We process it only with your explicit consent, given when you enable the relevant feature in the app, and only for the purposes described in section 5.

You can withdraw that consent at any time, from the app or by writing to us. Withdrawing it stops any further processing for that purpose and, if you ask, we delete the data. That also means the Service can no longer show you your history.

We are not a HIPAA covered entity or a business associate: HIPAA protects data held by healthcare providers and insurers, not data you record yourself in a consumer app. Your data is protected by this policy and by the laws referred to in sections 10 and 11.

• To provide the Service: store your entries, send the reminders you set, draw your charts, build an export you asked for. Basis: performance of our contract with you, and your explicit consent for health data.
• To keep it working and secure: diagnose crashes, prevent abuse and fraud. Basis: our legitimate interest in a safe, functioning service, and our legal obligations.
• To improve the product: aggregated, de-identified usage measurement. Basis: legitimate interest, or consent where the law requires it. We do not use the content of your health entries for this.
• To run the barcode scanner and build its product base: read the photos you choose to send, check them against other contributions, keep them as the source of product records, share checked product facts with every user, count scans anonymously, and protect the base from copying and abuse. Basis: our contract with you (Terms of Use, section 9) and our legitimate interest in an accurate and protected product base.
• To communicate with you: service messages, replies to your questions, and waitlist or marketing e-mails you asked for and can leave at any time. Basis: contract, legitimate interest, or consent.
• To comply with the law: accounting, and answering a lawful, binding request from an authority. Basis: legal obligation.

We do not make decisions about you by automated means that produce legal or similarly significant effects.

• We do not sell your personal data, and we do not share it for cross-context behavioural advertising.
• We do not use health data for advertising or to build advertising audiences, on our site or anywhere else.
• We do not use your health data to train artificial intelligence models, and we do not give it to a third party to do so.
• We do not send your data to an employer, an insurer, a pharmaceutical company or a data broker.
• We do not name a medicine in a notification, an e-mail subject line or anywhere else it could be read over your shoulder.
• We do not publish, sell or license the photos you send with the barcode scanner, and we do not use the scanner to learn what a particular person eats.

Your entries are visible to you. Beyond that, we share personal data only in these situations:

• Service providers working for us: hosting and servers, database and storage, e-mail delivery, domain and bot protection, our internal team messaging, subscription records, and the AI service that reads pack photos. Most are in the United States. They act only on our instructions, under a written contract, may not use the data for their own purposes, and must protect it at least as well as this policy does. None of them receives your journal or your Health data. You can ask us for the current list.
• Everyone who uses Oolite: the checked facts of a product added with photos (name, brand, category, nutrition values). Never the photos, and nothing about who sent them.
• The advertising platform where our ads run: unless you opt out, our website tells it when you visit and when you join our e-mail list (with browser identifiers and, on sign-up, your e-mail address in hashed form), and the app sends it the events described in section 3.d. Never your answers or anything you record. The platform uses these signals to measure our ads and may use them to show our ads to people who are more likely to be interested, as an independent controller. To opt out, see section 12 and our Do Not Sell or Share page.
• People you choose: if you generate an export and send it to your doctor or anyone else, that copy leaves our control and is governed by whatever the recipient does with it.
• Authorities: where we are legally required to, after checking that the request is valid and limited, and, where we are permitted to, after telling you.
• A successor: if the business is transferred, your data may transfer with it. It stays subject to this policy or to a policy at least as protective, and we tell you before anything changes for you.

We are established in Estonia and use providers located in the European Economic Area and in the United States. Where personal data is transferred outside the EEA or the UK, we rely on an adequacy decision or on the European Commission’s standard contractual clauses, together with additional technical measures such as encryption. You can ask us for a copy of the safeguards we use.

We keep data only as long as we need it for the reason we collected it, then delete it or make it anonymous.

• Your entries: on your device, for as long as you keep them. Delete one and it goes; Settings › Delete everything removes them all.
• Usage data: up to 24 months. Diagnostics: up to 6 months.
• Our e-mail list: until you unsubscribe or ask, and at most three years after our last contact.
• Pack photos we keep: for as long as we operate the product base, as the source of each product record.
• Technical records that protect the scanner and prevent abuse: only as long as that purpose requires, usually from one day to 30 days.
• Logs and security records: up to 12 months. Accounting records: as long as the law requires.

After deletion, data leaves our live systems promptly and our backups within 90 days.

We protect your data with encryption in transit and at rest, access limited to the few people who need it, providers chosen for their security and bound by contract, and a procedure for incidents that includes telling you and the authorities where the law requires it.

No service can promise perfect security, and we do not. We design for the smallest possible amount of data, and we will tell you honestly if something goes wrong.

Wherever you live, you can ask us to: give you a copy of your data; correct it; delete it; export it in a portable format; restrict or object to a particular use; or withdraw a consent you have given. Exercising a right never costs you anything and never means worse treatment.

Write to privacy@oolite.app. We reply within 30 days, or tell you why we need longer. We may need to check that the request really comes from you, using the e-mail address you write from. We will not ask you for extra identity documents unless we have no other way.

Pack photos are stored without your name, so we usually cannot tell which are yours. Write to privacy@oolite.app with the product’s barcode and the day you sent it, and we will delete the photos we can match; product facts already checked stay in the base.

If you are in the EEA or the UK, you may also complain to your data protection authority; in Estonia, the Data Protection Inspectorate (Andmekaitse Inspektsioon). If you are in the United States, see the state-specific rights in our Consumer Health Data Privacy Notice, including the right to appeal a refusal.

The website uses cookies it needs to work, a visit counter that sets no cookie and identifies no one, a bot check on the sign-up form, and an advertising pixel, which sets cookies to measure our ads. Where the law requires consent, non-essential cookies are set only after you give it. We never pass what you record to an analytics or advertising provider.

We honour the Global Privacy Control signal: when your browser sends it, the advertising pixel is not loaded. Most browsers also let you refuse or delete cookies, and the site stays usable. The app uses no cookies and never asks for tracking permission (section 3.d). California residents can also use our Do Not Sell or Share My Personal Information page.

The Service is for adults. We do not knowingly collect data from anyone under 18. If you believe a child has given us data, write to privacy@oolite.app and we will delete it.

We update this policy when the Service or the law changes. The effective date at the top always tells you which version is in force. If a change materially affects how we use your data, we tell you before it takes effect and, where the law requires it, ask for your consent again.

Privacy questions and requests: privacy@oolite.app, or by post at Sepapaja tn 6, Lasnamäe linnaosa, 15551 Tallinn, Harju maakond, Estonia.