Privacy Policy

This Privacy Policy explains what personal information Loma collects, how we use and share it, and the choices and rights available to you. It applies to the Loma mobile application, our website at lomadynamics.com, beta waitlist signup, and any related services we operate (collectively, the "Services").

This Policy is separate from but complements our Terms of Service, which govern your use of the Services and limitations of liability.

Loma is a consumer wellness and health-literacy tool. We are not a HIPAA-covered entity, health care provider, or insurer. Information you provide is handled under applicable consumer privacy laws, not as protected health information under HIPAA, unless we tell you otherwise in a separate agreement.

01Scope and Roles

Data controller. For the Services, Loma Dynamics, Inc. is the data controller (or "business" under U.S. state privacy laws) that determines how your personal information is processed.

What this Policy covers.

• The Loma iOS and Android mobile applications
• The marketing website and beta enrollment form
• Cloud infrastructure, AI coaching, wearable integrations, and account services that support the above

What this Policy does not cover.

• Third-party wearables, nutrition apps, health platforms, or app stores you connect or purchase through. Those services have their own privacy policies.
• Websites or services that link to us but that we do not operate.

02Information We Collect

We collect information in four ways: from you directly, from integrations you authorize, from your device, and by generating insights from the data above.

Information you provide directly

• Account details — Email address, sign-in method (such as Apple Sign In), preferred name, date of birth, biological sex, country
• Health profile — Height, weight, VO₂ max, max heart rate, dietary pattern, allergies, intolerances, religious dietary rules, preferred and disliked sports, equipment access, stated goals
• Logged entries — Meals, exercise, hydration, sleep notes, free-text descriptions, voice transcripts you choose to submit, photographs of food or menus you submit through Loma Lens or similar capture features
• Preferences — Language, response density, persona tier, archetype labels, notification settings, appearance settings
• Chat and coaching — Messages you send to Loma's coaching surfaces, check-ins, and the responses generated for you
• Consent records — Privacy acknowledgments, disclaimer acceptances, location-sharing choices

Information from connected integrations

When you authorize a third-party service in the App's Settings, we read the data that service makes available. Integrations may include, now or in the future:

• Wearables and devices: Apple Watch (via Apple Health), Garmin, Fitbit, Whoop, Oura Ring, Eight Sleep, and similar devices
• Health platforms: Apple Health, Google Fit, Samsung Health
• Nutrition and fitness apps: MyFitnessPal, MacroFactor, MyMacros+, MyCal, Strava, Peloton, Nike Run Club, and similar services

Depending on what you connect, this may include recovery scores, HRV, resting heart rate, sleep stages and duration, strain, workouts, steps, active energy, dietary energy, dietary macros, body composition, respiratory rate, skin temperature deviation, and related metrics.

We read integration data only after you authorize the connection. We do not write data back to a third-party account unless you explicitly direct us to and the integration supports it.

Information from your device

• Device identifier (such as identifierForVendor), device model, operating system version, and app version
• Approximate location (city, region, or country) when you enable location sharing for seasonal or time-of-day coaching context; we do not collect precise GPS coordinates unless a feature you enable specifically requires it and you grant permission
• Crash logs, performance telemetry, and diagnostic events (for example through Sentry), configured to minimize personal data collection
• Push notification token, if you enable notifications

Voice input. Speech recognition may occur on your device. When you submit a voice log, dictate a goal, or speak in chat, the resulting text transcript and coaching context may be sent to our servers and AI providers to generate a response. Audio recordings are not retained unless a feature explicitly tells you otherwise.

Information generated by Loma

• Daily and rolling aggregates (for example acute and chronic strain ratios, fuel–activity balance reads)
• Personalized insights, recommendations, panel copy, and action cards
• Feedback signals (likes, dislikes, dwell time, dismissals)
• Safety, citation, and voice-validation logs that record whether generated content passed automated checks (these logs are designed to minimize storage of raw message content)
• OAuth tokens and sync metadata for integrations you connect (stored in encrypted form)

Website and beta waitlist

If you request a beta invite on our website, we collect:

• Email address
• Signup timestamp
• Technical metadata routinely logged by our hosting provider (for example IP address, browser type, and request time) for security and abuse prevention

We store beta signups in Vercel KV and may add your email to a Resend audience list so we can contact you about the beta. We do not sell beta waitlist emails.

Sensitive and consumer health data

Much of the information above is sensitive under U.S. state laws and special category data under the GDPR, including health, fitness, and wellness data; dietary restrictions; precise identifiers combined with health inferences; and, where applicable, information about mental wellness or eating behaviors surfaced in coaching interactions.

We collect this data only to provide the Services you request, to keep you safe through automated guardrails, and as otherwise described in this Policy. Where required by law, we obtain separate consent before collecting consumer health data.

03How We Use Your Information

• Provide the Services — Display health summaries, balance reads, goal-aware coaching, chat, food logging, wearable sync, and account management
• Personalize your experience — Tailor voice density, recommendations, and insights to your goals, constraints, persona tier, and recent activity
• Operate AI coaching — Send prompts and relevant context to AI providers to generate responses, subject to safety and citation checks
• Keep you safe — Detect crisis language, eating-disorder risk signals, allergen conflicts, and unsafe recommendations through automated systems; route crisis topics to fixed resource messages without LLM generation where designed to do so
• Improve quality — Use aggregated and de-identified telemetry to improve validators, prompts, content library retrieval, and product reliability
• Communicate with you — Account notices, security alerts, beta invitations, and product updates you opt into
• Comply with law — Respond to lawful requests, enforce our terms, prevent fraud, and protect rights and safety
• Business operations — Billing support through app stores, analytics on the marketing site, and internal reporting in de-identified form

What we do not do.

• We do not sell your personal information.
• We do not share your personal information for cross-context behavioral advertising.
• We do not use your personal health data to train third-party foundation models.
• We do not use Apple HealthKit, Google Fit, or Samsung Health data for advertising, marketing, or sale, or for any purpose other than providing the Services and as permitted by those platforms' terms.

04Legal Bases for Processing (EEA, UK, and Switzerland)

If you are in the European Economic Area, the United Kingdom, or Switzerland, we process personal data only where we have a legal basis:

• Contract — Providing the App, account, sync, coaching, and support
• Consent — Optional location sharing, marketing email, certain integrations, and consumer health data where consent is required
• Legitimate interests — Security, fraud prevention, product improvement using de-identified data, and communicating about the Services — balanced against your rights
• Legal obligation — Compliance with law, regulatory requests, and recordkeeping
• Vital interests — Protecting life or physical safety in rare emergency scenarios

You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal. Where we rely on legitimate interests, you may object as described in Section 10.

05AI and Automated Processing

Loma uses large-language models and other automated systems to summarize data, generate coaching copy, retrieve curated library content, and rank recommendations. This involves:

• Sending chat messages and contextual summaries (recent logs, goals, constraints, biometrics you store, and persona settings) to xAI (Grok) to generate responses
• Using Voyage AI and Cohere to embed and retrieve curated health-literacy library passages for grounded answers
• Occasionally routing to Anthropic (Claude) as a backup model when primary systems are unavailable
• Logging token usage, validator outcomes, and safety events to monitor quality and cost

Important limitations.

• Automated output is informational, not medical advice. See our Terms of Service.
• We configure AI providers for minimal retention where available and contractually prohibit them from using your data to train their public foundation models.
• Some safety checks (for example crisis keyword detection) run without calling an LLM.
• You are not subject to a decision based solely on automated processing that produces legal or similarly significant effects. Loma does not make employment, credit, insurance, or housing decisions about you.

06Who We Share Information With

We share personal information only as described below.

Service providers (processors)

• Supabase — Database, authentication, storage, edge functions, and row-level security
• xAI — Primary large-language-model inference for coaching and content generation
• Anthropic — Backup large-language-model inference
• Voyage AI / Cohere — Embeddings and retrieval for curated content library
• Sentry — Crash and performance diagnostics
• Apple / Google — Sign-in and app distribution
• Vercel — Website hosting, serverless functions, and KV storage for beta signups
• Resend — Transactional email and beta audience management
• Plausible Analytics — Privacy-oriented, cookie-light website analytics

These providers may access personal information only to perform services for us under contractual confidentiality, security, and data-processing terms.

Integrations you authorize

When you connect a wearable, health platform, or fitness app, we exchange data with that provider as you direct. Disconnecting in Loma or in the third party's settings stops future sync, but data already received may remain in your Loma account until you delete it.

Legal, safety, and business transfers

We may disclose information if required by law, court order, or governmental request; to protect the rights, safety, and security of Loma, users, or others; or in connection with a merger, acquisition, financing, or sale of assets, with notice where required by law. We do not treat beta waitlist emails as part of the App's health dataset for advertising purposes in any transfer.

07International Data Transfers

Loma's primary systems are hosted in the United States. If you access the Services from outside the United States, your information will be transferred to, stored in, and processed in the United States and may be accessible to U.S. law enforcement under U.S. law.

Where required, we rely on appropriate safeguards such as Standard Contractual Clauses, the UK International Data Transfer Addendum, and supplementary measures. Contact us for a copy of relevant transfer mechanisms.

08Retention

• Account and profile — While your account is active
• Raw daily health metrics — Up to 90 days, then rolled into monthly aggregates
• Chat messages — Newest 1,000 messages or 90 days, whichever is greater, unless you delete sooner
• Beta waitlist email — Until you unsubscribe, we remove you, or the beta program ends
• Security and audit logs — Up to 13 months for operational logs; longer where law requires
• Deleted accounts — Identifiable data deleted or anonymized within 30 days of confirmed deletion request, except minimal records kept for fraud prevention, security, or legal compliance

Data already held by a third-party integration you authorized remains subject to that provider's retention practices.

09Security

We use administrative, technical, and organizational measures designed to protect personal information, including:

• Encryption in transit (TLS)
• Encryption at rest for databases
• Encrypted storage for third-party OAuth tokens
• Row-level security and role-based access controls
• Audit logging for sensitive health-table writes
• Vendor security review and least-privilege access

No method of transmission or storage is completely secure. You use the Services at your own risk. Report suspected vulnerabilities to hello@lomadynamics.com.

If we discover a breach that materially affects your personal information, we will notify you and regulators as required by applicable law, including state breach-notification statutes and, where relevant, the FTC Health Breach Notification Rule.

10Your Privacy Rights

Your rights depend on where you live. We honor applicable rights regardless of where you submit a request, and we will not discriminate against you for exercising them.

How to exercise rights. Use in-app Settings (export or delete account) or email hello@lomadynamics.com with "Privacy Request" in the subject line. We may verify your identity before responding. Authorized agents may submit requests where permitted by law.

Rights available broadly

• Access — know what personal information we hold about you
• Correction — fix inaccurate information
• Deletion — delete personal information we collected from you
• Portability — receive a machine-readable copy of information you provided
• Restriction / objection — limit or object to certain processing
• Withdraw consent — where processing is consent-based
• Opt out of marketing email — unsubscribe links or email us

United States — California (CCPA / CPRA)

California residents have the right to know, access, correct, delete, and port personal information; to limit use of sensitive personal information to what is necessary to provide the Services; and to opt out of sale or sharing. We do not sell or share personal information for cross-context behavioral advertising.

Sensitive personal information. We use health and wellness data only to provide the Services, for safety, and as permitted by CPRA. We do not use or disclose sensitive personal information for inferring characteristics for unrelated advertising.

Shine the Light. We do not disclose personal information to third parties for their direct marketing purposes.

United States — comprehensive state privacy laws

Residents of Colorado, Connecticut, Virginia, Utah, Oregon, Texas, Montana, Indiana, Iowa, Delaware, New Jersey, New Hampshire, Nebraska, Tennessee, Minnesota, Maryland, and other states with consumer privacy laws may have rights to access, correct, delete, port, and opt out of targeted advertising, sale, and certain profiling. We do not sell personal data or engage in targeted advertising based on App health data.

Appeals: if we deny your request, email us to appeal. You may also contact your state attorney general.

United States — Washington My Health My Data Act and similar laws

Washington residents (and residents of other states with consumer health-data laws, including Nevada and Connecticut health-data provisions) may have rights to confirm collection, access, delete, and withdraw consent for consumer health data. We collect consumer health data only to provide the Services you request and with consent where required. You may withdraw consent by disconnecting integrations, adjusting settings, or deleting your account.

We do not sell consumer health data.

European Economic Area and United Kingdom (GDPR / UK GDPR)

You have the rights listed in Section 10.1, plus the right to lodge a complaint with your local supervisory authority. Our lawful bases are in Section 4.

EU representative. If and when required, we will appoint an EU representative and update this Policy with contact details.

Canada (PIPEDA and provincial laws)

Canadian residents may access, correct, and challenge our handling of personal information, and may complain to the Office of the Privacy Commissioner of Canada or applicable provincial authority.

Brazil (LGPD)

Brazilian data subjects may confirm processing, access, correct, anonymize, block, delete, port, and revoke consent, and may file a complaint with the ANPD.

Australia

Australian users may access and correct personal information and complain to the Office of the Australian Information Commissioner.

Other regions

If your local law grants additional rights, contact us and we will respond consistent with that law.

11Children's Privacy

The Services are not directed to children under 16, and we do not knowingly collect personal information from anyone under 16. If you believe a child under 16 has provided information to Loma, contact hello@lomadynamics.com and we will delete it.

If you are 16 or 17, you may use the Services only with permission of a parent or legal guardian who agrees to these terms on your behalf.

12Cookies and Similar Technologies

Mobile App. The App does not use browser cookies.

Website. Our marketing site uses Plausible Analytics, a privacy-oriented analytics tool that does not use third-party advertising cookies and does not track you across other sites. Plausible may use a first-party connection to count page views in aggregate. Because we do not operate cross-site advertising or sell personal data, we do not display a cookie consent banner in jurisdictions where analytics of this kind do not require one; if your jurisdiction requires opt-in consent for analytics, contact us and we will honor your choice.

Essential hosting and security logs are processed by Vercel as part of operating the site.

13Third-Party Links and App Stores

The Services may link to third-party sites (for example integration partners or support resources). Their privacy practices are their own. Purchases through the Apple App Store or Google Play are also subject to those platforms' privacy policies.

14Important Reminder About App Output

15Changes to This Policy

We may update this Policy from time to time. When we make material changes, we will notify you in the App, by email for beta waitlist subscribers where appropriate, or by posting an updated Policy on our website with a revised "Last updated" date. Continued use after the effective date constitutes acceptance where permitted by law.

16Contact Us

Privacy questions, data-rights requests, and security reports: