Home

Privacy Policy

Last Updated: September 11, 2026 · HealthGuard AI / Fabeco Kft.

HealthGuard AI ("we", "our", "the Service") is operated by Fabeco Kft. (H-6000 Kecskemét, Katona József utca 3. fszt. 1., Hungary). We are committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and all other applicable data protection laws.

This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and what rights you have. Please read it carefully — especially Section 1.3 about the camera and photos.

1. Data We Collect

1.1 Account Data

  • Name and email address (provided at registration or via Google OAuth)
  • Encrypted password hash (we never store your plaintext password)
  • Your language and app settings
  • Date of account creation and last login timestamp

1.2 Health and wellbeing data you enter

HealthGuard AI has five areas. Depending on which ones you use, you may enter:

  • Fitness & Recovery: fitness goals and level, any limitations or injuries you choose to share, workout history, form scores and repetition counts, pain scores, range-of-motion and body measurements
  • Meals: allergies, intolerances and dietary preferences, calorie and nutrition goals, your meal log and shopping lists
  • Mind: mood check-ins on a 0–10 scale, optional tags and notes, and your conversations with the AI companion
  • Skin: the skin spots you track, the photos you take of them, and their analysis history

This is data concerning health (GDPR Art. 9). We process it only with your explicit consent. It is never sold and never used for advertising.

1.3 Camera and photos — Important

Several features use your device camera. What happens to the images depends on the feature:

  • Movement analysis (Fitness, Recovery): the live camera detects your body position entirely on your device. The live camera feed is never recorded, stored or uploaded.
  • AI form check (Fitness): if you request one, the single photo you take is sent to our AI provider (Google Gemini) for that analysis. The photo is not stored; only the numerical result is saved.
  • Meal and fridge photos (Meals): sent to Google Gemini to recognise foods and ingredients. The photo is not stored; only the text result is saved.
  • Skin photos (Skin): sent to Google Gemini for analysis and saved to your account so you can follow changes over time. You can delete any photo at any time.
  • The camera is never used for facial recognition or to identify you. You can revoke camera access at any time in your device settings.

Legal basis: your explicit consent (GDPR Art. 6(1)(a) and Art. 9(2)(a)), given when you allow camera access and use a camera feature. You can withdraw it at any time.

1.4 Medical reports (optional)

If you upload a lab result or another medical report, it is sent to Google Gemini to produce a plain-language, educational summary — never a diagnosis. Neither the file nor the summary is stored on our servers.

1.5 Technical data

  • Device type and operating system version, for compatibility
  • Error and performance information, so we can fix problems
  • IP address, for security and abuse prevention — not stored long-term
  • The app contains no analytics, advertising or tracking SDKs

2. Legal Basis for Processing (GDPR)

Data TypeLegal Basis
Account dataPerformance of our contract with you (Art. 6(1)(b))
Health and wellbeing data, photos, medical reportsYour explicit consent (Art. 6(1)(a) and Art. 9(2)(a))
Technical dataOur legitimate interest in a secure, working service (Art. 6(1)(f))
Essential emails (confirmation, password reset)Performance of our contract with you (Art. 6(1)(b))

3. How We Use Your Data

  • Providing the features of the areas you use
  • Producing the AI analyses you request from your photos, reports and text
  • Showing your history, trends and progress
  • Managing your account and sending essential emails, such as email confirmation and password reset
  • Keeping the service secure and preventing abuse
  • We never use your data for advertising and never sell it

4. Data Sharing & Third Parties

We never sell your personal data. We share it only with service providers that process it on our behalf, under data processing agreements:

Technology service providerDevelops and operates the app's servers and database on our behalf
Google GeminiAI analysis of the text, photos and reports you submit — only for the analysis you request
ElevenLabsOptional spoken guidance — only the text to be read aloud is sent
Google Sign-InOptional sign-in — we receive only your name and email address
Email service providerSending essential emails, such as email confirmation and password reset
Vercel and NeonApp hosting and the encrypted database
Google MediaPipeRuns on your device for movement analysis — no data is sent

5. Data Retention

Account data: kept while your account exists.

Health and wellbeing data: kept while your account exists; you can delete individual entries at any time.

Skin photos: kept until you delete them or your account.

Meal, fridge and form-check photos and uploaded reports: not stored.

Account deletion: when you delete your account, your personal data is permanently deleted within 30 days.

6. Your Rights (GDPR / CCPA)

You have the following rights regarding your personal data:

Right of Access

Request a copy of all data we hold about you

Right to Rectification

Correct inaccurate or incomplete personal data

Right to Erasure

Request permanent deletion of your account and all data

Right to Portability

Export your data in a structured, machine-readable format

Right to Restrict Processing

Limit how we process your data in certain circumstances

Right to Object

Object to processing based on legitimate interests

Right to Withdraw Consent

Withdraw consent at any time — delete your entries or photos, revoke camera access in your device settings, or delete your account

Right to Lodge a Complaint

File a complaint with your national data protection authority

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days (GDPR Art. 12).

7. Cookies & Tracking

The app uses a single, strictly necessary cookie to keep you signed in. It uses no analytics, advertising or tracking cookies, so it does not ask for cookie consent.

SessionKeeps you signed in and protects your account. Strictly necessary; cannot be disabled.

8. Data Security

We implement appropriate technical and organizational measures to protect your data:

  • All data transmitted over encrypted TLS/HTTPS connections
  • Passwords stored as bcrypt hashes — never in plaintext
  • Database encryption at rest
  • Health data, photos and conversations are encrypted in transit and at rest, never sold, and disclosed only to the providers listed in Section 4
  • Access to personal data restricted to authorized personnel only
  • Regular security reviews

9. International Data Transfers

Our servers are primarily located in the EU and USA. For transfers from the EU/EEA to the USA we use the European Commission's Standard Contractual Clauses (SCCs) with our providers, together with the technical safeguards described in Section 8.

10. Children's Privacy

HealthGuard AI is not directed at children under 16 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data without parental consent, please contact us at [email protected] and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you via email or a prominent notice in the app at least 30 days before the changes take effect. Continued use of the Service after the effective date constitutes acceptance of the updated policy.

12. Contact & Data Protection

Data Controller: Fabeco Kft.

Fabeco Kft.

H-6000 Kecskemét, Katona József utca 3. fszt. 1., Hungary

Company registration no.: 03-09-116583

Tax number: 14426005-2-03

EU VAT number: HU14426005

EU residents may also contact their national Data Protection Authority (DPA). Hungary: NAIH (naih.hu). Germany: BfDI. Austria: DSB.

Last Updated: June 20, 2026

HealthGuard AI — Part of the HealthGuardAI ecosystem