Last updated: 8 October 2026
Sanoria (“the app”, “we”) is a wellbeing app that helps you track your nutrition, exercise and wellbeing day to day. This page explains which data the app processes, how, and what your rights are — in plain words, not jargon.
1. Who is responsible
The data controller is Chloé De Azevedo Mendes, 80 rue de Meyrin, 01210 Ferney-Voltaire, France. For any question or to exercise your rights: [email protected].
The terms of use are on a separate page: sanoria.app/en/terms.
2. Which data, and why
| Data | Why | Where |
|---|---|---|
| First name | Personalise the app | Your device only |
| Email and password | Protect access to the app | Your device only — no authentication server |
| Food diary, exercise, water, sleep, mood | Calculate your score and tips | Your device only |
| Health profile (goals, conditions) | Adapt the score and targets | Your device only |
| Questions to your coach | Answer you about your day | Your device — answers are computed by the app, nothing is sent |
| Meals and recipes you share with a friend | Deliver them, when you ask | Encrypted on your iPhone; they pass through a relay (Cloudflare, database in Western Europe) that cannot read them, and are deleted once received, after 30 days at most |
We do not collect your precise location, your contacts or any advertising identifier. Sanoria shows no third-party advertising and sells no data.
3. Health data
The information you enter (food, activity, sleep, health conditions) is sensitive. It is used only to make the app work for you (score, tips). It is not sold, not shared for advertising and not used to train models.
Your coach answers from within the app itself, based on what you logged during the day. Neither your question nor your data is sent to an artificial intelligence service or to any server.
Apple Health (HealthKit)
If you choose to connect Apple Health, Sanoria reads, only after your explicit permission in iOS, your steps, active energy, exercise minutes for the day and your latest weigh-in. If you turn them on separately, it also reads your workouts for the week (Sport card) and your last night's sleep (Sleep card).
With a diabetes profile, and only if you turn it on, Sanoria also reads your latest blood glucose reading to display it as is, and never writes any: no interpretation, no alert, no calculation. Sanoria never calculates an insulin dose.
If you also allow it, Sanoria writes to Apple Health the weigh-ins you log yourself and, if you turn it on, your water, the daily totals of the meals you log (energy, protein, carbohydrates, fat, saturated fat, sugars, fibre, sodium) and your breathing sessions. Sanoria only changes data it has written itself. Each type of writing is optional: you can refuse it and keep reading.
This Health data stays on your device: it is never sent to a server, never sold, never shared for advertising and never used to train models. You can withdraw reading and writing at any time in Settings → Health → Data Access & Devices → Sanoria, or disconnect Apple Health from your Sanoria profile.
4. Third-party services
- Open Food Facts, Open Beauty Facts and Open Products Facts — queried when you scan a barcode, for food as well as household and cosmetic products. Only the reference of the scanned product is sent: not your first name, your profile or your diary.
- Cloudflare Pages (Cloudflare, Inc.) — hosts this site, this page and the terms of use. Like any website, it sees your browser's IP address when you visit it; the app sends nothing to it.
- Cloudflare, Inc. (United States, database in Western Europe) — runs the relay for sharing with friends. It only receives content encrypted on your iPhone, unreadable to it and to us, with random identifiers. See 4b.
- Apple App Store — distributes the app and collects the Sanoria Premium subscription. We never see your bank details.
- Apple Push Notification service (Apple) — if you turn on friend notifications, delivers to your iPhone the note that a friend sent you something. It receives no shared content and not the friend's name.
- RappelConso (data.economie.gouv.fr, French Ministry of the Economy) — every day, Sanoria downloads the public list of product recalls to warn you if a product you scanned or logged is recalled. It is a plain download, the same for everyone: no barcode and nothing from your log or profile is sent; the comparison happens on your device. Like any website, this service sees your device's IP address. You can turn these alerts off in Profile › Notifications.
- RevenueCat, Inc. (United States) — checks that your subscription is valid. It receives your purchase history (plan, dates, status) and an anonymous identifier it generates itself: we give it neither your name, nor your email, nor any health data, and it cannot know who you are. It is contacted each time the app opens, subscribed or not, to check your status and display prices: it then receives that anonymous identifier and technical information (app and iOS version, App Store storefront). Its policy: revenuecat.com/privacy.
- YouTube (Google) — in Sport, exercise video thumbnails are loaded from YouTube, which therefore receives your device's IP address, as with any online image. No profile data is sent; the video itself opens on youtube.com.
There is no other third-party service: no authentication server, no online database for your diary or your profile (the relay only holds encrypted shares until they are received), no artificial intelligence service, no analytics tool, no ad network, no advertising identifier.
4a. Your subscription
Sanoria Premium is sold only through the App Store. The app contains no payment form and never sees your bank details: Apple collects the payment, and you cancel in your App Store account settings.
To know whether your subscription is active, the app asks RevenueCat. This provider receives your purchase history (plan, dates, status) linked to an anonymous identifier it creates itself. It receives neither your name, nor your email, nor any health data, and has no way to re-identify you. This data is processed in the United States, on the basis of performing the subscription contract (GDPR art. 6(1)(b)); transfers rely on the European Commission's standard contractual clauses.
If you don't subscribe, nothing is transmitted: none of this information leaves your device.
4b. Sharing with friends (optional)
When you share a meal or a recipe with a friend, the content is encrypted on your iPhone and can only be opened on your friend's. It goes through a relay hosted by Cloudflare, with its database in Western Europe. The relay sees only random identifiers, not linked to your name or email, and unreadable content, deleted as soon as your friend has received it, and after 30 days at most. It keeps no list of friends. We cannot read what you share.
Your first name and your coach travel encrypted with the share. Only the invitation link you send yourself (by Messages, WhatsApp…) contains your first name in plain text, like any message you write. To limit abuse, the relay counts the day's sends using a fingerprint of the IP address, never the address itself, deleted after 2 days. Nothing is sent unless you share, and you can remove a friend at any time.
Friend notifications (optional). If you turn on “Notify me when a friend sends me something”, the relay also keeps your iPhone's notification address (provided by Apple), so that Apple can let you know when a share arrives. The notification contains nothing of what is shared, nor the friend's name. This address is deleted when you turn the option off, when Apple reports it as expired, and at the latest after 60 days without using the app.
5. Camera, microphone, photos and notifications
Camera: used to scan a barcode and, if you choose, to take a photo of a meal, a restaurant menu, a food label or the ingredient list of a household product. Scanning stores no image. A meal photo is analysed on your iPhone, never sent, and deleted after 60 days, like the diary. A photo of a menu, a label or a household product is read on your iPhone, never sent and never kept: only the text you checked (name, ingredients, nutrition values) stays on your iPhone.
Microphone: only if you dictate a meal. Your voice is understood on your iPhone (on-device speech recognition); nothing is recorded or sent, neither to us nor to Apple.
Live Activities: a fast, a breathing session or a rest period in progress can be shown on the Lock Screen. They are created on your iPhone, without sending anything, and only show a title and times, with no detailed health data.
Notifications: reminders you can turn off in your phone's settings, and, if you turn it on, a note that a friend sent you something (see 4b).
6. Retention
Your data stays on your phone as long as the app is installed. Uninstalling the app deletes it. You can also delete your account and all associated data at any time from the app's settings. Since nothing is copied to a server, this deletion is final: we have no copy to erase on our side, and no way to give it back to you. Only shares waiting on the relay and the friends' notification address follow their own periods (30 and 60 days at most, see 4b).
Copy of your data: from the app, you can make a copy of your data in a .sanoria file encrypted with a password (recommended), or unencrypted in JSON format. You choose where to keep it (Files, an email to yourself, a computer): nothing is copied to iCloud or to us. Shares waiting on the relay are deleted once received, and after 30 days at most.
7. Your rights
Depending on your law (GDPR in Europe, FADP in Switzerland) you can request access, rectification, export or deletion of your data, and withdraw your consent at any time. Two of these rights are exercised directly in the app, without writing to us: Profile → Legal & privacy → “Export my data (JSON)” and “Delete my account and my data”. For anything else: [email protected] — answer within 30 days.
Health data is sensitive data. In Sanoria it does not leave your device, except what you choose to share with a friend: encrypted on your iPhone, that content can only be read on theirs. Supervisory authority: the CNIL in France, the FDPIC in Switzerland.
8. Children
Sanoria is not intended for children under 16 and does not knowingly collect their data.
9. Health disclaimer
Sanoria is an educational wellbeing app. It is not a medical device, neither under Regulation (EU) 2017/745 nor under the Swiss MedDO (SR 812.213). It does not replace medical advice and makes no diagnosis. See a health professional for any medical question.
10. Changes
If anything changes, this page will be updated and the date at the top changed.