Privacy Policy

Last updated: April 9, 2026

Prime Club ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and share your personal information when you use the Prime Club iOS application (the "App") and related services available at primeclub.lat (collectively, the "Service").

Prime Club is operated by Rafael Castro, based in Mexico City, Mexico. By using the Service, you agree to the collection and use of information in accordance with this policy.

---

1. Information We Collect

1.1 Account Information

We collect your email address for authentication purposes. We use a passwordless magic link system to sign you in securely.

1.2 Nutrition Data

You may log meals via photo, text, or voice input. This data is processed by AI to extract nutritional information, including:

• Calories
• Protein
• Carbohydrates
• Fat

1.3 Wearable Data

If you choose to connect third-party wearable services, we collect data from those services with your explicit consent:

• WHOOP: Recovery score, strain, sleep data, heart rate, and workout data
• Oura Ring: Sleep stages, HRV (heart rate variability), readiness score, SpO2, heart rate, and stress data
• Apple Health: Activity, sleep, and heart rate data synced on-device with your permission

1.4 AI Coach Conversation History

We store your interactions with our AI coaching feature to provide personalized and contextual recommendations over time.

1.5 Device Information and Usage Analytics

We may collect basic device information and usage analytics to improve the Service, including device type, operating system version, and general usage patterns.

---

2. How We Use Your Data

We use the information we collect to:

• Generate personalized nutrition insights by correlating your meal data with your wearable metrics
• Provide AI-powered coaching recommendations tailored to your health data
• Display trends and progress over time through dashboards and summaries
• Improve our AI models and overall service quality
• Communicate important updates about the Service

---

3. Third-Party Services (incl. AI)

To deliver the Service, we rely on the following third-party providers:

• Supabase — Database hosting (PostgreSQL) and user authentication
• OpenAI — Meal photo/text analysis and AI coaching functionality
• WHOOP API — Wearable data retrieval, accessed with your OAuth consent
• Oura API — Wearable data retrieval, accessed with your OAuth consent
• Apple HealthKit — On-device health data access, with your explicit permission

Each third-party service operates under its own privacy policy and terms of service.

---

4. Data Sharing

• We do NOT sell your personal data to any third party.
• We do NOT share your data with advertisers.
• Your data is shared only with the third-party services listed in Section 3, strictly as needed to provide the Service.
• Meal photos and text sent to OpenAI for analysis are processed via their API and are not stored by OpenAI in accordance with their API data usage policy.

---

5. Data Storage and Security

• Your data is stored on Supabase (PostgreSQL) with encryption at rest.
• All API communications are transmitted over HTTPS/TLS.
• Authentication is handled via Supabase Auth using secure JWT tokens.
• Wearable integration tokens (OAuth) are stored in encrypted form.

While we implement industry-standard security measures, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

---

6. Your Rights

You have the right to:

• Access your personal data at any time
• Correct inaccurate or incomplete data
• Delete your data and your account entirely
• Disconnect any wearable integration at any time
• Request a full data export of all information associated with your account

To exercise any of these rights, please contact us at rafael@primeclub.lat.

---

7. Data Retention

We retain your personal data for as long as your account remains active. If you request account deletion, all associated data will be permanently deleted within 30 days of the request.

---

8. Children's Privacy

The Service is not intended for users under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected data from a child under 13, we will take steps to delete that information promptly.

---

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you via the email address associated with your account. Your continued use of the Service after such changes constitutes your acceptance of the updated policy.

---

10. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

Prime Club
Operated by Rafael Castro
Mexico City, Mexico
Email: rafael@primeclub.lat
Website: primeclub.lat