Privacy Policy

Last Updated: 12 May 2026
Effective Date: 12 May 2026
Version: 2.1.0

1. Introduction & Data Controller

Welcome to ProTilo ("we," "our," "us," "ProTilo"). We are committed to protecting your privacy and ensuring the security of your personal and health data. This Privacy Policy explains how we collect, use, store, and protect your information when you use our mobile health-tracking application and related services (the "Service").

Data Controller for purposes of the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"):

Oleksandr Zayats — Empresário em Nome Individual (sole-proprietor business registered in Portugal)
NIF / Tax ID: 311513131
Place of business: Parede, Portugal
Email (general privacy enquiries): privacy@protilo.com
Email (data protection): dpo@protilo.com

Postal correspondence address is provided in §13 below. For all legal correspondence please use email; postal mail is monitored periodically.

2. Data We Collect

We organise the data we collect into the categories Apple recognises in its App Privacy framework, so you can correlate this section directly with the App Store privacy disclosure.

2.1 Contact Info

• First name and last name
• Email address
• Date of birth (used for age verification — see §9)

2.2 User Content

• Daily check-in entries you record in the journal (mood, sleep, activities, dietary notes, free-text reflections)
• Optional profile photo

2.3 Health & Fitness

• Self-reported metrics: weight, body measurements, blood pressure, any other metric you choose to track
• Apple HealthKit data (only if you grant permission in iOS Settings): sleep analysis, step count, heart rate, heart-rate variability (HRV). Read-only. ProTilo never writes to Apple Health.

Health and self-reported metric data are treated as Special Category Data under GDPR Article 9 and processed only on the legal basis described in §3.

2.4 Sensitive Info

All data described in §2.3, and any free-text content in journal entries that may reveal health, mental-health, or wellbeing status, is classified as sensitive information.

2.5 Identifiers

• User ID — an internal Firebase Authentication identifier assigned at signup
• Identifier for Vendor (IDFV) — an iOS-provided identifier scoped to this app
• Firebase Installation ID — for push-notification delivery
• Push notification token (APNs via Expo Push Service)

We do not collect IDFA (Identifier for Advertisers) and we do not display the App Tracking Transparency (ATT) prompt.

2.6 Usage Data

• App version, iOS version, device model, device language, timezone
• Authentication events (login, logout, password reset)
• Feature interaction events strictly necessary for the Service (e.g. "check-in saved at timestamp X") — no analytics or behavioural telemetry beyond what the Service itself requires

2.7 Diagnostics

• Crash logs, stack traces, performance metrics, error reports
• Sentry user identifier (a pseudonymous internal ID, not your email or name)

2.8 Payment Information

The current version of ProTilo is offered free of charge. We do not collect or process any payment information. If we introduce paid features in a future version, this Privacy Policy will be updated, and your explicit consent obtained where required by law.

2.9 What We Do Not Collect

To be unambiguous about the absence of common data-collection practices in this app:

• ❌ No advertising identifiers (no IDFA, no IDFA-replacement tokens)
• ❌ No location data (no GPS, no city-level geo, no IP-based geolocation for analytics)
• ❌ No contacts from your device address book
• ❌ No photos from your photo library beyond images you explicitly attach in-app
• ❌ No microphone or camera access
• ❌ No browsing or search history
• ❌ No third-party analytics SDKs (no Google Analytics, no Firebase Analytics, no Firebase Crashlytics, no Mixpanel, no Amplitude, no PostHog, no Segment, no advertising-network SDKs of any kind)

3. Legal Basis for Processing

4. How We Use Your Data

4.1 Primary Purposes

• Service delivery — store your check-ins; compute trends and personal averages; surface rule-based insights generated entirely on your device
• Personalisation — adapt charts, reminders, and content to your stated preferences
• Communication — send essential transactional emails (account confirmation, password reset, account-deletion notices, security alerts). We do not send marketing emails in the current version.
• Security & integrity — protect your account and our infrastructure
• Legal compliance — meet obligations under EU and Portuguese law

4.2 What We Do NOT Do

• ❌ We do not sell your personal data or health data to third parties
• ❌ We do not use your data for advertising or behavioural targeting
• ❌ We do not share your data with insurance companies, employers, or marketing networks
• ❌ We do not use your data to train artificial-intelligence models — neither our own nor any third party's

4.3 Automated Processing & Right to Explanation

The on-device insights ProTilo shows you (see §4.4 below) are produced by deterministic rules and do not produce legal effects or similarly significant effects within the meaning of GDPR Article 22(1). They are informational signals for your personal reflection.

Notwithstanding the above, in keeping with the transparency principles of GDPR Articles 13–15 and the EU AI Act, you may always request a plain-language explanation of any specific insight — see §7.7.

4.4 AI-Generated Content — How AI Is Used in ProTilo Today

ProTilo surfaces information at three levels. Please read this section carefully. Only the third level involves any AI provider, and only with your manual action.

L1 — On-device deterministic rules. Simple comparisons against your own history: "You slept less than your 30-day average." These run entirely on your device using fixed, auditable rules. No AI is involved. No data leaves your device.

L2 — On-device pattern matching. Correlation-style observations computed locally: "Your mood has trended downward over the last 3 days." Still deterministic, still local, still zero external transmission.

L3 — AI Analysis Export (user-initiated manual paste). An optional feature in which ProTilo generates a text prompt summarising selected entries from your journal, copies it to your device clipboard, and offers a deep-link to open a third-party AI app of your choice — Google Gemini, Anthropic Claude, or OpenAI ChatGPT. You then decide whether to paste the prompt into that third-party app.

First-time consent. The first time you trigger AI Analysis Export, ProTilo shows a consent modal that summarises the facts above and records your explicit acceptance. You may decline at any time without losing access to other app features — rules-based insights remain fully available.

Disclaimer for AI output. Any response you receive from a third-party AI service is for personal reflection only and must not be interpreted as medical advice, diagnosis, or treatment. AI responses may be inaccurate, incomplete, or out of date.

For complete transparency about how AI is used in ProTilo, see our separate AI Transparency document.

4.5 Looking Ahead — Future Server-Side AI Processing

In a future release of ProTilo we may introduce server-side AI-generated insights. In that future model, ProTilo's backend would send a structured prompt derived from your data to a third-party AI provider (for example, Anthropic Claude or OpenAI), receive a response, and store the resulting insight in your account.

If and when we introduce this feature:

• (a) Separate, explicit, granular consent. We will request your separate, explicit, granular consent before any of your data is sent to a third-party AI provider for this purpose. Existing users will be prompted in-app and presented with this updated Privacy Policy.
• (b) Zero Data Retention enrolment. We will engage AI providers under written Data Processing Agreements with Zero Data Retention enrolment, ensuring your data is not retained by the AI provider beyond the immediate response, is not used to train models, and is not accessible to humans at the provider.
• (c) Updated documentation. We will update this Privacy Policy with full details — the specific AI provider(s) used, the categories of data sent, and the safeguards in place — and notify you by email and in-app at least 30 days in advance.
• (d) No degradation of opt-out. Declining consent will not affect your access to any non-AI features of the Service.
• (e) Right to withdraw. You may withdraw consent for server-side AI processing at any time, after which we will cease sending data to AI providers for your account.

Server-side AI processing is not active in the current version. The current AI Analysis Export feature (§4.4) requires your manual action to copy and paste content into a third-party AI app.

5. Data Sharing and Disclosure

5.1 Processors — Service Providers Acting on Our Behalf

We engage the following providers to process personal data on our behalf, each under a written Data Processing Agreement satisfying GDPR Article 28:

5.2 Independent Controllers — Parties That Process Your Data on Their Own Account

Certain parties involved in delivering the Service to you process personal data as independent controllers, under their own privacy policies and on their own legal basis. We do not have a processor relationship with them, and they are not bound by our Data Processing Agreements.

5.3 Adding New Providers

If we add a new processor or independent controller, we will update this list and notify you by in-app notice and email at least 30 days before the change takes effect.

5.4 Legal Requirements

We may disclose your data only if strictly required by a binding court order from a competent EU authority, or to:

• protect the rights, property, or safety of ProTilo or our users
• prevent fraud or imminent security threats
• comply with mandatory tax, accounting, or regulatory obligations

We resist over-broad requests and notify affected users where lawfully permitted to do so.

5.5 Business Transfers

If ProTilo's business is acquired by, merged with, or transferred to another organisation, your data may be transferred to the new operator. In such an event we will:

• notify you by email and in-app at least 30 days in advance
• give you the option to delete your account and export your data before the transfer takes effect, without penalty
• ensure that the receiving organisation commits, in writing, to honour this Privacy Policy or an equivalent or stricter standard

6. Data Storage, Security & Retention

6.1 Where We Store Your Data

All personal data is stored on Google Cloud / Firebase servers in the European Union region europe-west1 (Saint-Ghislain, Belgium). Cloud Functions execute in the same region. Firebase has been explicitly configured so that primary data storage does not replicate to non-EU regions.

6.2 Security Measures

• Encryption in transit — TLS 1.3 for all client-server communication
• Encryption at rest — AES-256 (Google Cloud default)
• Access controls — least-privilege Firestore Security Rules; production credentials are limited to the data controller and are protected by hardware-backed two-factor authentication
• Application-layer authentication — Firebase Authentication; tokens stored on-device in the iOS Keychain (Secure Enclave-backed where supported)
• Audit logging — server-side audit logs for sensitive operations (data exports, account deletions, administrative actions)
• Automated backups — daily backups, retained 30 days, then automatically and irreversibly deleted
• Vulnerability management — automated dependency scanning in CI; runtime monitoring via Sentry
• Personal-data breach response — documented runbook (see §11)

6.3 Data Retention

7. Your Rights Under GDPR

7.1 Right of Access (Art. 15)

You can request a copy of all personal data we hold about you.
How: Settings → Safety → Request Data Export, or email privacy@protilo.com.

7.2 Right to Rectification (Art. 16)

You can correct inaccurate or incomplete data directly in the app (Profile screen; journal entries), or by writing to privacy@protilo.com.

7.3 Right to Erasure / "Right to Be Forgotten" (Art. 17)

You can request deletion of your account and all associated personal data at any time.
How: Settings → Safety → Delete Account. You will be asked to type DELETE and re-enter your password. The account is queued for deletion and irreversibly removed within 7 days; you can sign in during that 7-day window to cancel.
What is removed: all profile data, all health data, all check-ins, all derived insights, push tokens, Sentry pseudonymous identifier.
What is retained: server-side audit logs (24 months) and minimum tax records, as required by legal obligation.

7.4 Right to Restrict Processing (Art. 18)

You can ask us to suspend processing while a dispute about accuracy or lawful basis is resolved. Email privacy@protilo.com.

7.5 Right to Data Portability (Art. 20)

You can receive your data in a structured, commonly-used, machine-readable format (JSON).
How: Settings → Safety → Request Data Export. We acknowledge the request immediately and deliver a downloadable archive within 30 days, normally faster.

7.6 Right to Withdraw Consent (Art. 7(3))

You can withdraw consent for the processing of health data, AI Analysis Export, and diagnostic data at any time in Settings → Privacy & Data → Manage Consents. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal. Withdrawing health-data consent will require us to delete the associated health data and will substantially limit Service functionality, because health data is the core of the Service.

7.7 Right to an Explanation of Insights

Although our insights are not automated decisions within the meaning of GDPR Article 22, we voluntarily offer a right to explanation as a transparency commitment, in keeping with GDPR Articles 13–15 and the EU AI Act. You may request a plain-language explanation of:

• How a specific insight shown in the app was generated — which deterministic rule produced it, or which prompt template was used in an AI Analysis Export
• What inputs (which journal fields, which time windows) contributed to it
• Why a given pattern was surfaced

Email privacy@protilo.com with the date and title of the insight. We respond within 30 days (GDPR Art. 12(3)).

7.8 Right to Lodge a Complaint (Art. 77)

If you believe we have processed your data in breach of GDPR, you may lodge a complaint with your national data-protection authority. ProTilo's lead supervisory authority is:

Comissão Nacional de Proteção de Dados (CNPD) — Portugal
Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, Portugal
www.cnpd.pt · geral@cnpd.pt

If you reside in another EU/EEA Member State, you may also complain to your local authority. A directory of European data-protection authorities is available at edpb.europa.eu/about-edpb/about-edpb/members.

7.9 No Fee, No Discrimination

Exercising any of these rights is free of charge and will not result in any degradation of the Service you receive (other than the natural consequences of the right itself — for example, deleting your account ends your access to it).

8. Tracking Technologies & Mobile Identifiers

ProTilo is a native iOS application and does not use web cookies, web beacons, pixel tags, or any browser-based tracking technology. We use a small number of mobile identifiers strictly necessary to operate the app (IDFV, Firebase Installation ID, push token).

We do not perform cross-app or cross-site tracking, we do not display the App Tracking Transparency (ATT) prompt, and we do not collect IDFA. Full detail is available in our separate Mobile Tracking Policy.

9. Children's Privacy & Age Verification

ProTilo is intended exclusively for users aged 18 or older.

We take active measures to prevent the creation of accounts by users under 18:

• Age gate at sign-up. Users must provide their date of birth before account creation. The app calculates the user's age and rejects creation if the user is under 18.
• Confirmation step. Users are asked to affirm that they are aged 18 or older as a condition of using the Service.
• App Store age rating. ProTilo carries an App Store age rating consistent with this restriction.
• Removal on discovery. If we become aware that a person under 18 has created an account — whether through their own disclosure, a report from a parent or guardian, or any other means — we suspend the account immediately and irreversibly delete all associated data without undue delay.

If you are a parent or guardian and believe a minor has provided us with personal data, please contact us immediately at privacy@protilo.com. We will treat your request as a priority.

We do not market the Service to persons under 18. Our 18+ policy is a more conservative threshold than the GDPR digital-service consent age (16, or lower as set by Member States), and reflects our commitment to keeping wellness-tracking with sensitive personal content out of the hands of minors.

10. International Data Transfers

The primary storage location for your personal data is the European Union (Belgium). Some processors and independent controllers we work with — namely Expo, Apple, and (if you choose to use them) Google, Anthropic, and OpenAI — are based in the United States or operate global infrastructure that may involve transfers outside the EU/EEA.

Where such transfers occur, they are governed by appropriate safeguards under GDPR Chapter V:

• EU-US Data Privacy Framework certifications, where the receiving party is certified
• Standard Contractual Clauses adopted by the European Commission (Commission Implementing Decision (EU) 2021/914), as a baseline for all non-EU processors
• Supplementary measures where required — including encryption in transit and at rest, and contractual restrictions on government-access disclosure

We maintain documentation of these safeguards and make a summary available on request to dpo@protilo.com.

11. Personal-Data Breach Notification

In the event of a personal-data breach likely to result in a risk to your rights and freedoms, we will:

• notify the CNPD (or another lead supervisory authority, where applicable) within 72 hours of becoming aware of the breach, as required by GDPR Article 33
• notify affected users without undue delay where the breach is likely to result in a high risk to their rights and freedoms, as required by GDPR Article 34
• describe in our notice the nature of the breach, the categories of data affected, likely consequences, and the measures we have taken or will take to mitigate the breach

To report a suspected security issue, email security@protilo.com. We treat coordinated disclosure of security issues with appreciation and will not pursue good-faith security researchers.

12. Changes to This Policy

We may update this Privacy Policy to reflect changes in the Service, in applicable law, or in our data-processing practices. When we make material changes we will:

• update the "Last Updated" date and version number at the top of this document
• notify you by email and in-app notice at least 30 days in advance
• where the change introduces new processing that requires consent, ask you to consent again before that processing begins

Continued use of the Service after the effective date of an update constitutes acceptance of the updated Privacy Policy for processing not requiring consent. For processing that requires consent, your previous consent does not carry over — affirmative re-consent is required.

Historical versions of this Privacy Policy are available on request to privacy@protilo.com.

13. Contact Us

General privacy enquiries: privacy@protilo.com

Data protection & rights requests: dpo@protilo.com

Security & vulnerability reports: security@protilo.com

Legal & contractual matters: legal@protilo.com

General support: support@protilo.com

Postal correspondence:

Oleksandr Zayats — ENI
Parede, Portugal
NIF 311513131

For all legal and time-sensitive matters please use email; postal mail is monitored periodically.

Response time: We respond to all rights requests within 30 days, as required by GDPR Art. 12(3). Where a request is complex or where we receive a high volume of requests, we may extend the response period by up to an additional 60 days and will inform you of the extension and the reason for it within the initial 30-day period.

14. Definitions

• "Service" — the ProTilo mobile application and supporting backend infrastructure
• "User" — any natural person aged 18 or older who creates an account in the Service
• "Personal data" — any information relating to an identified or identifiable natural person (GDPR Art. 4(1))
• "Health data" — personal data related to the physical or mental health of a natural person (GDPR Art. 4(15)); treated as a Special Category under Art. 9
• "Controller" — Oleksandr Zayats (ENI), as defined in §1
• "Processor" — a service provider that processes personal data on behalf of the controller (see §5.1)
• "Independent controller" — a third party that processes data on its own account under its own privacy policy (see §5.2)
• "GDPR" — Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data
• "EU AI Act" — Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence

This Privacy Policy is governed by Portuguese law and the GDPR. By using the ProTilo Service, you acknowledge that you have read and understood this Privacy Policy.