Your health data deserves careful handling.

This Privacy Policy applies when you use Shellel’s mobile apps, website, AI nutrition coaching, and related support services (together, the “Services”). In this policy, “Shellel”, “we”, “us”, and “our” refer to the operator of the Services.

The information we collect depends on the features you use and the choices you make.

• Account information: your name, email address, profile photo, and sign-in identifier when you continue with Google or Apple. Email sign-in is also available. A client who joins a nutritionist’s invitation is matched to the email address on that invitation.
• Profile and wellness information: details you choose to provide, such as age, sex, height, weight, activity level, dietary preferences, allergies, goals, and timezone.
• Nutrition and activity information: meal entries, food searches, meal descriptions and captions, nutrition estimates, water, weight and other measurements, activity entries, progress, and coaching history. A meal photo is sent for an estimate, but the image itself is not saved to your diary or our application database.
• Health records: documents you upload, such as laboratory reports, prescriptions, and doctor’s notes, together with text and health-marker values extracted from them.
• Conversations and feedback: messages you send to the AI coach or support team, feedback, and other content you choose to share.
• Device and usage information: app version, device and operating-system details, language, IP address, push-notification token, timestamps, diagnostic events, and feature interactions.
• Purchase information: subscription status, product, renewal, and transaction references supplied by the app store. We do not receive your full payment-card details.

• Provide and personalise the Services, including nutrition estimates, progress views, reminders, and AI-generated coaching.
• Authenticate your account, keep your information synchronised, and manage subscriptions and entitlements.
• Operate, troubleshoot, secure, and improve the Services, including preventing misuse and understanding aggregate product performance.
• Respond to support requests and send transactional service emails, including email sign-in links or codes.
• Comply with applicable law, enforce our terms, and establish or defend legal claims.

Where applicable law requires a legal basis, we process information to provide the service you request, with your consent, for legitimate uses such as security and service improvement, and to comply with legal obligations. You may withdraw consent for future processing where consent is the basis, but that does not affect processing already completed.

When a nutritionist or dietitian asks for a demo on our nutritionists page, we collect their name and phone number, and optionally their city and number of active clients. We use these details only to contact them about the demo and about Shellel for Nutritionists. The request is emailed to our team and also saved as a sales lead for our team to follow up. We delete the stored request one year after the last request; a lead that does not go ahead is deleted a year after we close it, and if the nutritionist becomes a customer the details become part of their account record. We do not share these details or use them for other marketing. You can ask us to delete them at any time by emailing [email protected].

We use OpenAI for AI features. Meal parsing sends the meal description; a photo estimate sends the image and any caption to OpenAI, then saves the validated estimate and caption or label, not the image. Coach sends the conversation and relevant profile, meal, activity, and saved coaching context needed for a reply. These features can be used by people with or without a linked nutritionist. OpenAI receives the submitted feature input, not access to your account or files. Responses and estimates can be incomplete or inaccurate, so review them before relying on them.

Shellel Intelligence creates meal-plan drafts and food swaps for a nutritionist to review. The request contains the plan details and relevant nutrition targets and dietary constraints; a linked-client draft may also include a short list of common food names from that client’s shared meal history. It does not include the client’s identity, practice-recorded condition, or private messages. A draft is not approved until the nutritionist reviews it.

If you join a nutritionist’s invitation, the practice can see your meals, water, activity, weight, reports, and other linked progress available from the link’s history start date. Intake answers and health records have separate sharing controls. The invitation is bound to the email address entered by the practice. People without an active link use Shellel without a linked practice receiving these client records.

• You can end the relationship from the app; the practice can also end it, and an invitation seat can end on its configured end date.
• When the link ends, the practice loses access, the message thread closes, scheduled calls and appointments are stopped, and link-specific assignments and derived workspace data are removed. Intake answers, ended-link metadata, and other records marked for link retention are deleted after up to 730 days.
• Messages you and the practice sent are stored in the account until account deletion. Closing the link prevents further practice access; it does not erase the client’s message history immediately.
• You can switch off health-record sharing separately. Practice-uploaded health-record files are scheduled for deletion 30 days after sharing is switched off or the link ends; switching sharing back on before the purge cancels that schedule. Health records that you uploaded remain in your own account.
• Consult calls carry audio over WebRTC, directly between participants where possible or through a TURN relay. Calls are not recorded. Call history stores metadata such as participants, status, and timestamps for 730 days; it does not store audio or call signalling.

Health-record files are held in a private S3 bucket in AWS Mumbai (ap-south-1), encrypted at rest, and opened with signed links that expire after five minutes. Amazon Textract reads the document in ap-south-1. Only text from unmatched test rows is sent to OpenAI for mapping; the document itself is not sent to OpenAI. Practice-uploaded files are removed 30 days after sharing ends.

We use PostHog’s EU service for product analytics. PostHog discards IP addresses, the app does not use session replay, and you can turn analytics off with “Share usage analytics” in Profile. Sentry receives crash and error reports; our analytics events use an approved event and property list and do not include health values.

• Google and Apple, for sign-in and app distribution;
• MongoDB and hosting providers, for application data and infrastructure;
• OpenAI, for AI-generated coaching responses;
• Firebase Cloud Messaging for push delivery;
• Amazon SES is planned for transactional email delivery, including email sign-in and account or service messages; we do not use it for promotional email;
• PostHog EU for usage analytics and Sentry EU for crash and error reporting;
• Amazon Textract in AWS Mumbai to read health-record documents;
• Google Play and Apple App Store, for subscriptions, billing status, and purchase management;
• professional advisers, regulators, courts, or law-enforcement authorities when disclosure is legally required or necessary to protect rights and safety.

We do not sell or rent personal data, and we do not share it for cross-context behavioural advertising. If ownership of the Services changes, information may transfer as part of that transaction subject to applicable law and this policy.

Our AWS application infrastructure and health-record storage are in Mumbai, India (ap-south-1). PostHog and Sentry process their respective analytics and crash reports in the EU. OpenAI processes the content you submit for an AI feature; its processing location is not determined by the application code. Email delivery uses the configured transactional email provider. These providers may process information outside India. We apply safeguards and follow transfer restrictions where required by law.

If you end a nutritionist link, its metadata is retained for up to 730 days, and practice-uploaded health-record files are deleted after 30 days. In-app messages remain in your account until account deletion. Calls are not recorded; call metadata is retained for 730 days. If you request account deletion in Profile, you may restore the account by signing in during the 30-day grace period; after that, the account and associated records are scheduled for deletion. Some backup copies may remain temporarily under our backup cycle.

Some limited records may be retained longer when required for tax, accounting, fraud prevention, security, dispute resolution, or other legal obligations. De-identified or aggregated information that can no longer reasonably identify you may be retained for analytics and service improvement.

You can request access to, correction of, or erasure of your personal data and raise a grievance by contacting us below. The Digital Personal Data Protection Act, 2023 provides rights that take effect on the commencement schedule set by the Government of India; we will handle requests under the provisions applicable at the time. You can export your data from Profile and request account deletion in the app. You may withdraw an optional sharing or analytics choice in the app.

• Account deletion: follow the public deletion instructions or email [email protected].
• Profile changes: update available details in the app or contact support if a field cannot be changed there.
• Notifications: change push permissions in your device settings. Essential account or policy emails may still be sent.

We may need to verify your identity before fulfilling a request. We will respond within the period required by applicable law and explain if a request cannot be completed.

We use administrative, technical, and organisational safeguards designed to protect personal data, including access controls and encryption in transit. No system is completely secure, so please protect your sign-in account and tell us promptly if you suspect unauthorised access.

The Services are for people aged 18 and above. We do not knowingly offer accounts to children. If you believe a child has provided personal data, contact us so we can investigate and take appropriate action.

We may update this policy as the Services or legal requirements change. We will post the revised version here and update the date above. If a change materially affects your rights or how we use personal data, we will provide additional notice or request consent when required.

For privacy questions, access, correction or erasure requests, or grievances, contact Shellel’s privacy grievance officer at [email protected]. Include enough detail for us to understand the request, but do not send passwords, payment-card details, or unnecessary health information by email.