Privacy Policy

1. Controller

The controller for your personal data is Ingrid Health UG (haftungsbeschränkt), Fidicinstraße 36, 10965 Berlin, Germany. You can reach us at privacy@ingrid.health.

This Privacy Policy applies to the Ingrid app for iOS and the associated support and expert features. A separate privacy notice applies to our website.

2. At a glance

• For the health features, we process your health data on the basis of your explicit consent. You can withdraw it at any time.
• We do not sell your personal data and do not use your health data for advertising.
• We do not use your personal data to train AI models.
• Product analytics and the storage of excerpts from AI conversations for error analysis take place only if you give separate consent to “Analytics and AI quality”.
• You decide whether to connect Apple Health, whether to invite an Expert and which data they may see.
• You can request a copy of your data by email, have your health data deleted by withdrawing your consent, and delete your account in the app.

3. Data we process

Health and lifestyle data, Apple Health data, medical documents, meal photos, parts of AI chats and, where applicable, Expert-service data may contain health data and therefore special categories of personal data under Article 9 GDPR.

4. Purposes and legal bases

5. Health data and consent

5.1 Before Ingrid processes health data for personalised health or AI features, we ask for your explicit consent when you start using the app. Without this consent you cannot use the app, because its features rely on health data; there is no limited mode.

5.2 The consent covers only the purposes described in the app. For Apple Health, you additionally decide in your device settings, on a data-type-by-data-type basis, what Ingrid may access.

5.3 You can withdraw consent at any time with effect for the future in the app under Profile → Consents (turn off “Health data and AI”) or by emailing privacy@ingrid.health. Processing before withdrawal remains lawful.

5.4 After withdrawal, we immediately block access to the health features and then delete all health data in your account: your answers, the health information in your profile, your plan with tasks, progress, XP and streaks, your chats including summaries and AI memory, measurements and lab values, documents and uploaded files, symptoms, family history, questions for your doctor, connections to Experts including their notes and recommendations, and AI logs at Langfuse. Your account (email address, name, language, push identifier) and the consent log (section 5.8) remain. Data that we must keep under statutory duties or need to establish, exercise or defend legal claims is deleted once the periods in section 12 expire. You can consent again later and then start over.

5.5 We need sign-in data for your account, and purchase and subscription data for your paid access. Health information, documents, connected data sources, notifications, consent to “Analytics and AI quality” and sharing with Experts are optional. Without consent to the processing of health data, the app is not available (section 5.1). Consent to “Analytics and AI quality” is not a condition of using the app or of your subscription.

5.6 Withdrawing a consent ends neither the contract nor billing by Apple. You cancel your subscription separately under section 6.4 of the Terms.

5.7 When you start using the app, you also confirm that you have taken note of Ingrid’s intended purpose: Ingrid is not a medical device, does not diagnose or treat, AI can make mistakes, and in an emergency you call 112. This confirmation is not a consent under data protection law; we store it as a record in the consent log (section 5.8).

5.8 We record every consent and confirmation (health data and AI, intended purpose, Terms, age confirmation, Analytics and AI quality) in a consent log to which entries are only added and never changed: type, granted or withdrawn, text version, language, time, place in the app and app version. The log remains when you withdraw consent or delete your account and is deleted 3 years after your account is deleted (section 12).

6. AI features, Google Vertex AI and Mistral AI

6.1 Ingrid generates chat replies, plans, home-screen notes, task guides, the onboarding interview, the reading of documents and lab reports, calorie estimates from meal photos and checks of AI replies with Gemini models that Ingrid uses through Google Vertex AI. Mistral AI handles further features (section 6.7).

6.2 For a response, Gemini receives your message and the context data the feature needs. Processing takes place in the EU: Ingrid uses the Vertex AI endpoint in the EU multi-region and, for text embeddings (gemini-embedding-001), the europe-west1 region (Belgium). Google’s in-memory caching of inputs is disabled for Ingrid. To detect abuse, Google may store inputs for up to 90 days.

6.3 Google processes this data for Ingrid as a processor. Under the terms applicable to the Google Cloud service we use, Google may not use Ingrid Customer Data to train or fine-tune general Google AI/ML models without our permission or instruction. Ingrid does not give such permission for personal user data.

6.4 We do not use your personal data to train or fine-tune our own or third-party AI models.

6.5 For the technical operation of the AI features, we log technical metadata at Langfuse, such as latency, model identifier, token counts and error code, under a pseudonymised user ID, without inputs, replies, tool parameters, error texts or health data. Only if you consent to “Analytics and AI quality” do we also store excerpts from inputs, replies and the context used for them at Langfuse, so that authorised staff can identify and correct errors and safety issues. This data may contain health data. The legal bases are Art. 6(1)(a) and Art. 9(2)(a) GDPR. You can withdraw your consent at any time under Profile → Consents → “Analytics and AI quality”; the AI features remain available.

6.6 Ingrid tailors content to your information. This may constitute profiling under Article 4(4) GDPR. Ingrid does not, however, make solely automated decisions under Article 22 GDPR that produce legal or similarly significant effects.

6.7 Ingrid uses Mistral AI SAS, Paris, France, as a second AI provider. Mistral generates the texts of push notifications, sample questions for the chat, conversation summaries and conversation titles, and receives chat transcripts for this. If Gemini is unavailable, Mistral takes over chat replies, plans, home-screen notes, task guides and the preparation for a doctor’s appointment as a fallback. Mistral processes this data for Ingrid as a processor in the EU does not use it for training and deletes it after one day.

7. Apple Health

7.1 Ingrid reads Apple Health data (iOS) only after you authorise the relevant data types on your device. You can change permissions at any time in your device settings.

7.2 This data is used only for the health and wellbeing features you request. It is not used for advertising or sold.

7.3 You cannot connect other wearables or third-party apps directly at launch.

7.4 Once you withdraw the permission, Ingrid stops retrieving new data. Previously imported data remains until you delete it or your account, unless another retention obligation applies.

8. Uploaded documents

8.1 Uploaded documents may be analysed automatically using text recognition and AI (Gemini, section 6) to extract information such as lab values.

8.2 Do not upload other people's health data. The names or professional contact details of your treating professionals may be part of your record; we process them only as part of your document. The legal basis is Art. 6(1)(f) GDPR, our interest in providing the document feature you requested.

8.3 You can delete uploaded documents and extracted values in the app unless mandatory retention applies.

8.4 We send photos of meals that you take or select for a calorie estimate to Gemini for analysis (section 6). We do not store these photos.

9. Human Experts

9.1 You can invite an Expert of your choice, such as a coach or a nutrition expert, by email. There is no booking, payment or matching through Ingrid. In the invitation, you choose which data categories the Expert may see: plan, measurements, lab values, documents, family history, symptoms and questions for your doctor. Art. 6(1)(b) GDPR applies to the invitation and the technical provision; we share health data only with your explicit consent under Art. 9(2)(a) GDPR.

9.2 Experts do not receive general access to your Ingrid account. In a separate expert area, they see only the categories you share. You can change the categories or end the connection at any time. If you withdraw your consent to the processing of health data, the Expert loses access immediately. When the Expert views a document, we log this.

9.3 The Expert can send you recommendations and plan suggestions through Ingrid, which you accept or decline. The Expert can also keep private working notes in Ingrid that are not shown to you. We delete these notes when the connection ends or you withdraw your consent.

9.4 For the invitation, the expert area, recommendations and notes, Ingrid processes the data required in its role as platform provider.

9.5 Where an Expert records information outside Ingrid in their own advice or treatment records, they are responsible for it themselves; their own privacy notice applies. Withdrawing consent at Ingrid ends their access but does not erase records they have already lawfully created outside Ingrid. You exercise your rights concerning those records with the Expert.

10. Recipients and service providers

We have data-processing agreements under Art. 28 GDPR with our processors.

11. International transfers

11.1 We store application and health data in the EU (currently in Germany). Firebase Authentication, Resend and RevenueCat process data in the United States, Firebase Cloud Messaging worldwide. Vertex AI processes data in the EU (EU multi-region, embeddings in Belgium), Mistral AI in the EU. PostHog, Sentry and Langfuse store data in the EU; access from the United States is possible.

11.2 We base transfers to the United States and other third countries on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR) and, where the recipient is certified for it, on the EU-US Data Privacy Framework. Certified under the EU-US Data Privacy Framework are Google LLC (Firebase, Google Workspace), PostHog, Inc., Functional Software, Inc. (Sentry), Plus Five Five, Inc. (Resend) and ClickHouse, Inc. (parent company of Langfuse); for RevenueCat, Inc. we use the Standard Contractual Clauses.

11.3 You can request a copy of the relevant safeguards at privacy@ingrid.health.

12. Retention

The following periods apply to each data category.

13. Security

We protect your data with technical and organisational measures in accordance with Art. 32 GDPR.

14. Device access, push and analytics

14.1 Ingrid stores technically necessary information on your device, such as login status and settings. Where German law applies, this is based on section 25(2) TDDDG; corresponding national rules apply in Austria.

14.2 Ingrid requests device permissions for notifications, Apple Health, camera, photos or files only when a feature needs them. You can revoke them at any time in your device settings. We ask for push permission only after you have agreed in the app to receive reminders. You receive push notifications only if you allow them; they may contain task reminders and notes from your coach, but no measured values or lab results.

14.3 Only with your consent to “Analytics and AI quality”, which we ask for once on your third day of use, do we use PostHog for product analytics, for example on app opens and feature calls under a pseudonymous user ID. Without consent, PostHog is not started. The legal basis is Art. 6(1)(a) GDPR and, in Germany, section 25(1) TDDDG. We transmit no health information, chat text or documents. The same consent covers storing conversation excerpts at Langfuse (section 6.5). You can withdraw your consent at any time under Profile → Consents → “Analytics and AI quality”; your paid features are not affected.

14.4 For error analysis, Sentry receives, under a pseudonymised user ID, technical details such as app version, operating system and error code, but no health data. The legal basis is Art. 6(1)(f) GDPR, our interest in a secure and stable service.

14.5 To understand where people drop out when starting the app, we anonymously count how many people reach each onboarding step. We store no user or device identifier and no IP address. The legal basis is Art. 6(1)(f) GDPR, our interest in an easy-to-follow start in the app.

15. Your rights

• Access to your personal data and a copy (Art. 15 GDPR)
• Correction of inaccurate data (Art. 16 GDPR)
• Erasure where the requirements are met (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interests on grounds relating to your particular situation (Art. 21 GDPR)
• Withdrawal of consent at any time with effect for the future (Art. 7(3) GDPR)

You manage your consents in the app under Profile → Consents. You request a copy of your data by email to privacy@ingrid.health. You delete your account under Profile → “Delete Account”. For other requests, contact privacy@ingrid.health.

You also have the right to complain to a data protection supervisory authority. Ingrid’s lead authority is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit, BlnBDI), Alt-Moabit 59–61, 10555 Berlin. In Austria, you may contact the Datenschutzbehörde.

16. Minors

Ingrid is intended only for adults aged 18 or older. When registering, you confirm that you are at least 18 years old; a date of birth under 18 is not accepted. We do not knowingly process data of minors. If we learn that a minor has registered, we delete the account.

17. Changes to this Privacy Policy

We update this Privacy Policy when the Service, our service providers or applicable law changes. We will notify you of material changes in the app or by email.