Privacy Policy

This Privacy Policy explains what personal information Loma collects, how we use and share it, and the choices and rights available to you. It applies to the Loma mobile application, our website at lomadynamics.com, beta waitlist signup, and any related services we operate (collectively, the "Services").

This Policy is separate from but complements our Terms of Service, which govern your use of the Services and limitations of liability.

Loma is a consumer wellness and health-literacy tool. We are not a HIPAA-covered entity, health care provider, or insurer. Information you provide is handled under applicable consumer privacy laws, not as protected health information under HIPAA, unless we tell you otherwise in a separate agreement.

01Scope and Roles

Data controller. For the Services, Loma Dynamics, Inc. is the data controller (or "business" under U.S. state privacy laws) that determines how your personal information is processed.

What this Policy covers.

• The Loma iOS and Android mobile applications
• The marketing website and beta enrollment form
• Cloud infrastructure, AI coaching, wearable integrations, and account services that support the above

What this Policy does not cover.

• Third-party wearables, nutrition apps, health platforms, or app stores you connect or purchase through. Those services have their own privacy policies.
• Websites or services that link to us but that we do not operate.

02Information We Collect

We collect information in four ways: from you directly, from integrations you authorize, from your device, and by generating insights from the data above.

Information you provide directly

• Account details — Email address, sign-in method (such as Apple Sign In), preferred name, date of birth, biological sex, country
• Health profile — Height, weight, VO₂ max, max heart rate, dietary pattern, allergies, intolerances, religious dietary rules, preferred and disliked sports, equipment access, stated goals
• Logged entries — Meals, exercise, hydration, sleep notes, free-text descriptions, voice transcripts you choose to submit, photographs of food or menus you submit through Loma Lens or similar capture features
• Preferences — Language, response density, persona tier, archetype labels, notification settings, appearance settings, product-analytics preference, grocery banners and delivery apps you choose, nearby store names you star
• Chat and coaching — Messages you send to Loma's coaching surfaces, check-ins, and the responses generated for you
• Consent records — Privacy acknowledgments, disclaimer acceptances, location-sharing choices, consumer health data consent where required

Information from connected integrations

When you authorize a third-party service in the App's Settings, we read the data that service makes available. Integrations may include, now or in the future:

• Wearables and devices: Apple Watch (via Apple Health), Garmin, Fitbit, Whoop, Oura Ring, Eight Sleep, and similar devices
• Health platforms: Apple Health, Google Fit, Samsung Health
• Nutrition and fitness apps: MyFitnessPal, MacroFactor, MyMacros+, MyCal, Strava, Peloton, Nike Run Club, and similar services

Depending on what you connect, this may include recovery scores, HRV, resting heart rate, sleep stages and duration, strain, workouts, steps, active energy, dietary energy, dietary macros, body composition, respiratory rate, skin temperature deviation, and related metrics.

We read integration data only after you authorize the connection. We do not write data back to a third-party account unless you explicitly direct us to and the integration supports it.

Shopping list and grocery apps. Preferred grocers and delivery apps are stored on your device (and may sync with your Loma account as preferences). Copy list for Uber Eats / DoorDash copies text to your clipboard on this device. If you paste that list into Uber, DoorDash, Instacart, or another app, or open those apps from Loma, those companies receive whatever you submit under their own privacy policies. Loma does not create an account for you there or send your list to them unless a future “Send to …” feature you tap does so, in which case we will say so in the App.

Information from your device

• Device identifier (such as identifierForVendor), device model, operating system version, and app version
• Approximate location (city, region, or country) when you enable location sharing for seasonal or time-of-day coaching context. If you tap Find stores near me on the shopping list, the app uses When In Use location and Apple Maps (MapKit) on your device to shortlist nearby grocers. Loma’s servers do not receive your GPS coordinates. Apple may process the map search (including an approximate location and the search query) under Apple’s privacy policy. We store only store names and banners you star, not coordinates. You can turn location off anytime.
• Crash logs, performance telemetry, and diagnostic events (for example through Sentry), configured to minimize personal data collection
• Push notification token, if you enable notifications
• Product usage events (see below) when Share usage analytics is on

Voice input. Speech recognition may occur on your device. When you submit a voice log, dictate a goal, or speak in chat, the resulting text transcript and coaching context may be sent to our servers and AI providers to generate a response. Audio recordings are not retained unless a feature explicitly tells you otherwise.

Product usage analytics (feature metrics)

When Share usage analytics is enabled in the App (it is on by default; you can turn it off anytime in Settings → Privacy), we collect account-linked product interaction events so we can understand which features people use and how often. Examples:

• App opens and session boundaries
• Which main tabs you open (Home, Log, Chat, Guide, Plan)
• Whether you open Loma Log or Loma Lens, which Lens mode (food, menu, pantry), and whether a parse succeeded or failed
• Insight refreshes and which insight panel you open
• High-level chat send counts (not message content)
• Integration connect/sync outcomes at a high level (provider name and success/failure class)

Each event stores an event name, timestamp, optional session identifier, app and OS version, and a small set of non-sensitive properties (for example `scan_type=menu`, `tab=log`, `latency_ms`, `error_class`). Events are tied to your account ID for product and operations analysis.

What product analytics does not include. We intentionally do not put the following into product usage events:

• What you type in logs, chat, goals, or dictation transcripts
• Photos or images you capture in Loma Lens
• Health numbers (macros, calories, HRV, sleep stages, weight, and similar values)
• Precise location
• HealthKit sample payloads

You can stop collection of future product usage events by turning off Share usage analytics. Turning the toggle off does not delete events already stored; you may request deletion of your account or data as described in Your Privacy Rights. We purge raw product usage events after 90 days and retain only aggregated counts (for example daily feature counts) for longer-term product analysis.

Information generated by Loma

• Daily and rolling aggregates (for example acute and chronic strain ratios, fuel–activity balance reads)
• Personalized insights, recommendations, panel copy, and action cards
• Feedback signals (likes, dislikes, dwell time, dismissals)
• Safety, citation, and voice-validation logs that record whether generated content passed automated checks (these logs are designed to minimize storage of raw message content)
• OAuth tokens and sync metadata for integrations you connect (stored in encrypted form)
• AI token usage and estimated cost per account (for rate limits, abuse prevention, and service operations — see AI and Automated Processing)

Website and beta waitlist

If you request a beta invite on our website, we collect:

• Email address
• Signup timestamp
• Technical metadata routinely logged by our hosting provider (for example IP address, browser type, and request time) for security and abuse prevention

We store beta signups in Vercel KV and may add your email to a Resend audience list so we can contact you about the beta. We do not sell beta waitlist emails.

Sensitive and consumer health data

Much of the information above is sensitive under U.S. state laws and special category data under the GDPR, including health, fitness, and wellness data; dietary restrictions; precise identifiers combined with health inferences; and, where applicable, information about mental wellness or eating behaviors surfaced in coaching interactions.

We collect this data only to provide the Services you request, to keep you safe through automated guardrails, and as otherwise described in this Policy. Where required by law, we obtain separate consent before collecting consumer health data.

03How We Use Your Information

• Provide the Services — Display health summaries, balance reads, goal-aware coaching, chat, food logging, shopping lists, wearable sync, and account management
• Personalize your experience — Tailor voice density, recommendations, and insights to your goals, constraints, persona tier, and recent activity
• Operate Loma Lens — Process photographs you submit (for example plates, menus, pantry) and related day-context fields — including dietary pattern, allergies, intolerances, and diet notes — to estimate nutrition, rank menu options, and draft order-instruction language for you to review with food-service staff
• Operate AI coaching — Send prompts and relevant context to AI providers to generate responses, subject to safety and citation checks
• Keep you safe — Detect crisis language, eating-disorder risk signals, allergen conflicts, and unsafe recommendations through automated systems; route crisis topics to fixed resource messages without LLM generation where designed to do so
• Improve quality — Use product usage events and aggregated metrics to improve feature design, validators, prompts, content library retrieval, and product reliability
• Operate and protect the Services — Enforce AI daily caps, monitor abuse, diagnose failures, and understand infrastructure cost
• Communicate with you — Account notices, security alerts, beta invitations, and product updates you opt into
• Comply with law — Respond to lawful requests, enforce our terms, prevent fraud, and protect rights and safety
• Business operations — Billing support through app stores, website analytics, internal product metrics, and AI cost reporting

What we do not do.

• We do not sell your personal information.
• We do not share your personal information for cross-context behavioral advertising.
• We do not use your personal health data to train third-party foundation models.
• We do not use Apple HealthKit, Google Fit, or Samsung Health data for advertising, marketing, or sale, or for any purpose other than providing the Services and as permitted by those platforms' terms.

04Legal Bases for Processing (EEA, UK, and Switzerland)

If you are in the European Economic Area, the United Kingdom, or Switzerland, we process personal data only where we have a legal basis:

• Contract — Providing the App, account, sync, coaching, and support
• Consent — Optional location sharing, marketing email, certain integrations, and consumer health data where consent is required
• Legitimate interests — Security, fraud prevention, product improvement (including first-party feature usage analytics with opt-out), AI cost and capacity planning, and communicating about the Services — balanced against your rights
• Legal obligation — Compliance with law, regulatory requests, and recordkeeping
• Vital interests — Protecting life or physical safety in rare emergency scenarios

You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal. Where we rely on legitimate interests, you may object as described in Section 10.

05AI and Automated Processing

Loma uses large-language models and other automated systems to summarize data, generate coaching copy, retrieve curated library content, and rank recommendations. This involves:

• Sending chat messages and contextual summaries (recent logs, goals, constraints, biometrics you store, and persona settings) to xAI (Grok) to generate responses
• Using Voyage AI and Cohere to embed and retrieve curated health-literacy library passages for grounded answers
• Occasionally routing to Anthropic (Claude) as a backup model when primary systems are unavailable
• Logging token usage, estimated cost, model, provider, and call kind per authenticated account to enforce daily caps, prevent abuse, and operate the service
• Logging validator outcomes and safety events to monitor quality (designed to minimize raw message content)

AI cost and usage logs are operational records needed to run the App safely and affordably. They continue even if you turn off Share usage analytics, because they are required to enforce rate limits and operate AI features you request. They do not store your free-text prompts or health content in the usage ledger; they store accounting fields (for example tokens and call kind).

Important limitations.

• Automated output is informational, not medical advice. See our Terms of Service.
• We configure AI providers for minimal retention where available and contractually prohibit them from using your data to train their public foundation models.
• Some safety checks (for example crisis keyword detection) run without calling an LLM.
• You are not subject to a decision based solely on automated processing that produces legal or similarly significant effects. Loma does not make employment, credit, insurance, or housing decisions about you.

06Who We Share Information With

We share personal information only as described below.

Service providers (processors)

• Supabase — Database, authentication, storage, edge functions, and row-level security
• xAI — Primary large-language-model inference for coaching and content generation
• Anthropic — Backup large-language-model inference
• Voyage AI / Cohere — Embeddings and retrieval for curated content library
• Sentry — Crash and performance diagnostics
• Apple / Google — Sign-in, app distribution, and (if you use Find stores near me) Apple Maps search
• Vercel — Website hosting, serverless functions, and KV storage for beta signups
• Resend — Transactional email and beta audience management
• Plausible Analytics — Privacy-oriented, cookie-light website analytics

These providers may access personal information only to perform services for us under contractual confidentiality, security, and data-processing terms.

Integrations you authorize

When you connect a wearable, health platform, or fitness app, we exchange data with that provider as you direct. Disconnecting in Loma or in the third party's settings stops future sync, but data already received may remain in your Loma account until you delete it.

Legal, safety, and business transfers

We may disclose information if required by law, court order, or governmental request; to protect the rights, safety, and security of Loma, users, or others; or in connection with a merger, acquisition, financing, or sale of assets, with notice where required by law. We do not treat beta waitlist emails as part of the App's health dataset for advertising purposes in any transfer.

07International Data Transfers

Loma's primary systems are hosted in the United States. If you access the Services from outside the United States, your information will be transferred to, stored in, and processed in the United States and may be accessible to U.S. law enforcement under U.S. law.

Where required, we rely on appropriate safeguards such as Standard Contractual Clauses, the UK International Data Transfer Addendum, and supplementary measures. Contact us for a copy of relevant transfer mechanisms.

08Retention

• Account and profile — While your account is active
• Raw daily health metrics — Up to 90 days, then rolled into monthly aggregates
• Chat messages — Newest 1,000 messages or 90 days, whichever is greater, unless you delete sooner
• Product usage events (raw) — Up to 90 days, then deleted
• Product usage aggregates — Daily feature-count rollups retained while useful for product analysis (or until account deletion)
• AI usage and cost logs — Operational retention for caps, abuse prevention, and cost analysis; daily rollups may be retained longer. Deleted with your account subject to the deleted-accounts row below
• Beta waitlist email — Until you unsubscribe, we remove you, or the beta program ends
• Security and audit logs — Up to 13 months for operational logs; longer where law requires
• Deleted accounts — Identifiable data deleted or anonymized within 30 days of confirmed deletion request, except minimal records kept for fraud prevention, security, or legal compliance

Data already held by a third-party integration you authorized remains subject to that provider's retention practices.

09Security

We use administrative, technical, and organizational measures designed to protect personal information, including:

• Encryption in transit (TLS)
• Encryption at rest for databases
• Encrypted storage for third-party OAuth tokens
• Row-level security and role-based access controls
• Audit logging for sensitive health-table writes
• Vendor security review and least-privilege access

No method of transmission or storage is completely secure. You use the Services at your own risk. Report suspected vulnerabilities to hello@lomadynamics.com.

If we discover a breach that materially affects your personal information, we will notify you and regulators as required by applicable law, including state breach-notification statutes and, where relevant, the FTC Health Breach Notification Rule.

10Your Privacy Rights

Your rights depend on where you live. We honor applicable rights regardless of where you submit a request, and we will not discriminate against you for exercising them.

How to exercise rights. Use in-app Settings (export or delete account) or email hello@lomadynamics.com with "Privacy Request" in the subject line. We may verify your identity before responding. Authorized agents may submit requests where permitted by law.

Rights available broadly

• Access — know what personal information we hold about you
• Correction — fix inaccurate information
• Deletion — delete personal information we collected from you
• Portability — receive a machine-readable copy of information you provided
• Restriction / objection — limit or object to certain processing
• Withdraw consent — where processing is consent-based
• Opt out of marketing email — unsubscribe links or email us
• Opt out of product usage analytics — Settings → Privacy → Share usage analytics (off stops future product usage events; AI operational cost logging for caps continues as described above)

United States — California (CCPA / CPRA)

California residents have the right to know, access, correct, delete, and port personal information; to limit use of sensitive personal information to what is necessary to provide the Services; and to opt out of sale or sharing. We do not sell or share personal information for cross-context behavioral advertising.

Sensitive personal information. We use health and wellness data only to provide the Services, for safety, and as permitted by CPRA. We do not use or disclose sensitive personal information for inferring characteristics for unrelated advertising.

Shine the Light. We do not disclose personal information to third parties for their direct marketing purposes.

United States — comprehensive state privacy laws

Residents of Colorado, Connecticut, Virginia, Utah, Oregon, Texas, Montana, Indiana, Iowa, Delaware, New Jersey, New Hampshire, Nebraska, Tennessee, Minnesota, Maryland, and other states with consumer privacy laws may have rights to access, correct, delete, port, and opt out of targeted advertising, sale, and certain profiling. We do not sell personal data or engage in targeted advertising based on App health data.

Appeals: if we deny your request, email us to appeal. You may also contact your state attorney general.

United States — Washington My Health My Data Act and similar laws

Washington residents (and residents of other states with consumer health-data laws, including Nevada and Connecticut health-data provisions) may have rights to confirm collection, access, delete, and withdraw consent for consumer health data. We collect consumer health data only to provide the Services you request and with consent where required. You may withdraw consent by disconnecting integrations, adjusting settings, or deleting your account.

We do not sell consumer health data.

European Economic Area and United Kingdom (GDPR / UK GDPR)

You have the rights listed in Section 10.1, plus the right to lodge a complaint with your local supervisory authority. Our lawful bases are in Section 4.

EU representative. If and when required, we will appoint an EU representative and update this Policy with contact details.

Canada (PIPEDA and provincial laws)

Canadian residents may access, correct, and challenge our handling of personal information, and may complain to the Office of the Privacy Commissioner of Canada or applicable provincial authority.

Brazil (LGPD)

Brazilian data subjects may confirm processing, access, correct, anonymize, block, delete, port, and revoke consent, and may file a complaint with the ANPD.

Australia

Australian users may access and correct personal information and complain to the Office of the Australian Information Commissioner.

Other regions

If your local law grants additional rights, contact us and we will respond consistent with that law.

11Children's Privacy

The Services are not directed to children under 16, and we do not knowingly collect personal information from anyone under 16. If you believe a child under 16 has provided information to Loma, contact hello@lomadynamics.com and we will delete it.

If you are 16 or 17, you may use the Services only with permission of a parent or legal guardian who agrees to these terms on your behalf.

12Cookies and Similar Technologies

Mobile App. The App does not use browser cookies. Product usage analytics, when enabled, uses first-party events sent to our backend with your account session — not third-party advertising SDKs and not the App Tracking Transparency advertising identifier.

Website. Our marketing site uses Plausible Analytics, a privacy-oriented analytics tool that does not use third-party advertising cookies and does not track you across other sites. Plausible may use a first-party connection to count page views in aggregate. Because we do not operate cross-site advertising or sell personal data, we do not display a cookie consent banner in jurisdictions where analytics of this kind do not require one; if your jurisdiction requires opt-in consent for analytics, contact us and we will honor your choice.

Essential hosting and security logs are processed by Vercel as part of operating the site.

13Third-Party Links and App Stores

The Services may link to third-party sites (for example integration partners or support resources). Their privacy practices are their own. Purchases through the Apple App Store or Google Play are also subject to those platforms' privacy policies.

14Important Reminder About App Output

For Loma Lens menu features, we may use dietary pattern, allergies, intolerances, and related notes you provide to filter suggestions and draft language you can use with restaurant staff. We do not control food preparation or service. Confirming allergens, restrictions, and how a dish is made is your responsibility when ordering. See our Terms of Service for the full wellness disclaimer, Loma Lens food-order terms, and limitation of liability.

15Changes to This Policy

We may update this Policy from time to time. When we make material changes, we will notify you in the App with a prompt that asks you to review and agree before you continue. We may also email beta waitlist subscribers where appropriate, or post an updated Policy on our website with a revised "Last updated" date. Continued use after you agree (or, where permitted by law and we have given notice, after the effective date) constitutes acceptance. If you do not agree, sign out and delete your account.

16Contact Us

Privacy questions, data-rights requests, and security reports: