Prime Club ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and share your personal information when you use the Prime Club iOS application (the "App") and related services available at primeclub.lat (collectively, the "Service").
Prime Club is operated by Rafael Castro, based in Mexico City, Mexico. By using the Service, you agree to the collection and use of information in accordance with this policy.
1. Information We Collect
1.1 Account Information
We collect your email address for authentication purposes. We use a passwordless magic link system to sign you in securely.
1.2 Nutrition Data
You may log meals via photo, text, or voice input. This data is processed by AI to extract nutritional information, including:
Calories
Protein
Carbohydrates
Fat
1.3 Wearable Data
If you choose to connect third-party wearable services, we collect data from those services with your explicit consent:
WHOOP: Recovery score, strain, sleep data, heart rate, and workout data
Oura Ring: Sleep stages, HRV (heart rate variability), readiness score, SpO2, heart rate, and stress data
Apple Health: Activity, sleep, and heart rate data synced on-device with your permission
Fitbit / Pixel Watch (Google Health API): Sleep sessions and stages, daily resting heart rate, daily heart rate variability (HRV), steps, total calories, and exercise sessions. Read-only access, granted through Google's consent screen
We only request read-only access to the data listed above, and we use it only to provide user-facing features in Prime Club: your daily nutrition plan, your day score, your trends, and your AI coach.
We do not use Google Health data for advertising, we do not sell it, and we do not use it to determine credit-worthiness or for lending purposes.
We do not use Google Health data to develop, improve, or train generalized AI or machine learning models.
To generate your own coach responses, relevant metrics (for example last night's sleep or today's HRV) are sent to our AI provider (OpenAI) through its API, which does not use API data to train its models. No other transfer happens, except as required by law.
Our staff does not read this data, except with your explicit consent for support, when needed for security or to comply with the law.
You can disconnect Fitbit at any time in Profile → Connections. This revokes our access in Google. You can also revoke it at myaccount.google.com/permissions and ask us to delete the data already stored by writing to rafael@primeclub.lat.
1.4 AI Coach Conversation History
We store your interactions with our AI coaching feature to provide personalized and contextual recommendations over time.
1.5 Device Information and Usage Analytics
We may collect basic device information and usage analytics to improve the Service, including device type, operating system version, and general usage patterns.
2. How We Use Your Data
We use the information we collect to:
Generate personalized nutrition insights by correlating your meal data with your wearable metrics
Provide AI-powered coaching recommendations tailored to your health data
Display trends and progress over time through dashboards and summaries
Improve overall service quality (Google Health API data is excluded from this, see 1.3.1)
Communicate important updates about the Service
3. Third-Party Services (incl. AI)
To deliver the Service, we rely on the following third-party providers:
Supabase — Database hosting (PostgreSQL) and user authentication
OpenAI — Meal photo/text analysis and AI coaching functionality
WHOOP API — Wearable data retrieval, accessed with your OAuth consent
Oura API — Wearable data retrieval, accessed with your OAuth consent
Google Health API — Fitbit and Pixel Watch data retrieval, accessed with your OAuth consent (see 1.3.1)
Apple HealthKit — On-device health data access, with your explicit permission
Each third-party service operates under its own privacy policy and terms of service.
4. Data Sharing
We do NOT sell your personal data to any third party.
We do NOT share your data with advertisers.
Your data is shared only with the third-party services listed in Section 3, strictly as needed to provide the Service.
Meal photos and text sent to OpenAI for analysis are processed via their API and are not stored by OpenAI in accordance with their API data usage policy.
Your nutritionist, only if you choose to. If you enter your nutritionist's code in the app (Profile → Nutritionist) and accept, she can see in the Prime Club professional portal: your meals (time, calories, macronutrients and micronutrients), your weight, the exercise, sleep and recovery data from your connected wearable, your glucose and blood pressure readings if you record them, and the alerts the app generates (for example, allergies). She can see your records from the last 30 days, including those before linking. You can stop sharing at any time from the same screen; from that moment she can no longer see any data from the app, and she keeps only the notes of the consultations you had together. Your nutritionist may set your goals, meal plan and coach instructions in the app.
5. Data Storage and Security
Your data is stored on Supabase (PostgreSQL) with encryption at rest.
All API communications are transmitted over HTTPS/TLS.
Authentication is handled via Supabase Auth using secure JWT tokens.
Wearable integration tokens (OAuth) are stored in encrypted form.
While we implement industry-standard security measures, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.
6. Your Rights
You have the right to:
Access your personal data at any time
Correct inaccurate or incomplete data
Delete your data and your account entirely
Disconnect any wearable integration at any time
Request a full data export of all information associated with your account
We retain your personal data for as long as your account remains active. If you request account deletion, all associated data will be permanently deleted within 30 days of the request.
8. Children's Privacy
The Service is not intended for users under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected data from a child under 13, we will take steps to delete that information promptly.
9. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you via the email address associated with your account. Your continued use of the Service after such changes constitutes your acceptance of the updated policy.
10. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us: