Privacy Policy

Last updated: September 23, 2026

1. Introduction

Welcome to KYMBA ("we," "our," or "us"). We are committed to protecting your privacy and personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and related services.

2. Information We Collect

We collect information you provide directly to us, including:

• Account information (name, email address)
• Health and fitness data (meals, nutrition information, activity, sleep, heart rate, and recovery metrics)
• Device information and usage data
• Photos you choose to upload for meal analysis
• The text of what you say when you speak to log a meal or to talk to the coach. Apple's speech recognition turns it into text on your device or on Apple's servers; we receive only the text, never the recording
• Subscription status and purchase history (we never receive or store your card details)
• Your conversations with the Kymba coach: what you write or say to it, its replies, and a short summary it keeps of past conversations so it can pick up where you left off
• Location: the GPS route of each walk you record, which is saved to your account, and your location when you ask for local weather or nearby parks

3. Apple Health and Connected Devices

With your permission, we access and sync data from Apple Health, including activity, nutrition, sleep, and other health metrics. You can also connect an Oura account, in which case we receive the data that provider shares, such as sleep stages, heart rate, heart-rate variability, and readiness or recovery scores. This data is used solely to personalize your plans, readiness, and recommendations. We never write to Apple Health without your explicit action, we never use this data for advertising, and you can disconnect any provider at any time in Settings, which stops further syncing and revokes our access token.

4. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our services
• Analyze your meals and provide nutritional insights
• Generate personalized recommendations and meal plans
• Send you updates and notifications about your progress
• Respond to your comments, questions, and support requests

5. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. Information you send to us travels over encrypted connections (TLS), and our databases and file storage are encrypted at rest by our hosting providers. On your own device, app data is protected by the device’s own file-system encryption and your passcode rather than by a separate app-level encryption layer, so keeping your device locked and up to date matters. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

6. Data Retention

We retain your personal information for as long as your account is active. You can delete your account and its associated data at any time from Settings, under Delete Account, which removes it immediately rather than after a delay; you can also write to privacy@heirclark.com. Security and audit records - which log events such as sign-ins and administrative access, and do not contain your name or email address - are kept for up to 400 days so that we can investigate security incidents, and are deleted afterwards. We may retain limited records for longer where the law requires it.

Your conversations with the coach are kept on our servers for 90 days, so the coach can continue a conversation and the same history appears on each of your devices; anything older is deleted automatically every day. The short summary the coach keeps of past conversations stays until you clear that conversation or delete your account. You can clear a conversation at any time from the coach chat, which deletes it and its summary from our servers straight away. A copy of recent messages is also kept on your device so the chat opens without a connection; it is removed when you clear the conversation or sign out.

7. Your Rights

Depending on your location, you may have certain rights regarding your personal information, including:

• Access to your personal data
• Correction of inaccurate data
• Deletion of your data
• Data portability
• Objection to certain processing, or withdrawal of consent - email privacy@heirclark.com, or disconnect Apple Health and any wearable at any time in Settings

8. Third-Party Services

To power the app we share the minimum necessary information with third-party processors, each under contract and none of whom may sell your data or use it to train models for advertising:

AI and content generation - OpenAI, Anthropic, and Perplexity receive meal descriptions and photos, goals, and activity context to generate your plans, analysis, and coaching. Your messages to the coach and the coaching context are processed by OpenAI (or by Anthropic if OpenAI is unavailable). In what we send for coaching, the name on your profile is replaced with a placeholder; anything you write yourself is sent as you wrote it. Replicate generates imagery used in the app.

Live video coach - LiveAvatar (HeyGen) and ElevenLabs receive the text of the coach's replies, which can include your first name, and turn it into speech and video. They do not receive your messages, your voice, or your camera. The video is streamed to you, not stored by us.

Grocery ordering - Instacart receives your shopping list, and only when you choose to place an order.

Infrastructure and operations - Amazon Web Services (storage), Sentry (crash diagnostics), PostHog (product analytics), and RevenueCat (subscription status). Sign in with Apple handles authentication; Apple does not share your real email address unless you choose to.

Reference data - USDA, ExerciseDB, OpenWeatherMap, OpenStreetMap, and Google Places supply nutrition, exercise, weather, and location reference information. For local weather, OpenWeatherMap receives your location; to find nearby parks, OpenStreetMap receives an approximate location (rounded to about 110 meters) and Google Places receives an approximate location or an address you type.

Each service has its own privacy policy, which we encourage you to review.

9. Children's Privacy

Our services are not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date.

11. Contact Us

If you have any questions about this Privacy Policy, please contact us at: