Back to Home

Privacy Policy

Last updated: April 13, 2026

🔒 Your health data is sensitive. We treat it that way. We never sell your personal information.

1. Overview

DuoBean AI ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and website.

We are committed to protecting your privacy in accordance with applicable data protection laws, including the Protection of Personal Information Act (POPIA) in South Africa. We are working towards full compliance with international privacy standards including GDPR.

2. Information We Collect

2.1 Information You Provide

  • Account information: Name, email address, profile photo (optional)
  • Health data: condition stage and care notes (if you choose to provide them), daily targets you've set
  • Food logs: Meal photos, food descriptions, portion sizes
  • Lab results: Blood test values (eGFR, creatinine, potassium, etc.)
  • Wellness data: Sleep quality, energy levels, mood, cramp occurrences
  • Fluid intake: Amounts and times of liquid consumption
  • Voice recordings: When using voice input, it is processed in real-time using your browser's built-in speech recognition. Voice audio is never sent to our servers or stored

2.2 Automatically Collected Information

  • Device information (type, operating system, browser)
  • Usage data (features used, frequency, session duration)
  • IP address and approximate location (country/region only)
  • Crash reports and performance data

3. How We Use Your Information

  • To provide personalized nutrition and wellness tracking
  • To generate AI-powered meal analysis and lab explanations
  • Health data is sent to AI processing services (OpenRouter) with all personally identifiable information removed. Only food photos, nutrition values, and lab numbers are sent — never your name, email, or ID.
  • To create reports for you to share with your healthcare provider
  • To improve our AI models and app features
  • To send important notifications (custom reminders, safety alerts you've set up)
  • To respond to customer support requests
  • To comply with legal obligations
  • Email: to authenticate your account, send critical safety alerts, and recover your account if needed. We will never email you marketing or promotional content unless you explicitly opt in.
  • Name: shown on weekly reports you generate for your doctor, so they know whose data they're reviewing. If you'd rather keep this empty or use a nickname, that's fine — the app works without it.
  • We use PostHog (EU-hosted) to track anonymous usage events such as which features are clicked, page navigation, and how users complete onboarding. This helps us improve the app. PostHog records events only — no session recordings, no health data, no input field contents. All inputs and sensitive content are excluded from analytics.
  • To measure how well our ads perform, we use advertising tools from Meta (Facebook and Instagram). These record only general marketing events like visiting our landing page or beginning sign-up. We never share your health data, food logs, lab values, or wellness entries for advertising.

4. How We Protect Your Data

We implement multiple layers of security:

  • Encryption: All data encrypted in transit (TLS/SSL) and at rest (AES-256)
  • Access controls: Strict authentication for all data access
  • Data minimization: We only collect what we need to provide our service
  • Regular audits: We review our security practices regularly
  • No third-party sharing: We never sell your personal or health data

✅ Lab Report Privacy: When you upload a PDF lab report, we extract the values andimmediately delete the original file. We do not store your full lab reports.

5. Third-Party Services We Use

We rely on trusted third-party services to power DuoBean AI:

Clerk

Authentication and user management. Clerk Privacy Policy

Supabase

Database and file storage (encrypted). Supabase Privacy Policy

OpenRouter.ai

AI processing for food and lab analysis. No personal identifiers sent.OpenRouter AI Privacy Policy

Vercel

Hosting and deployment. Vercel Privacy Policy

PostHog

PostHog Anonymous usage analytics (EU-hosted). No session recording. No health data sent. PostHog Privacy Policy

Meta (Facebook & Instagram)

Advertising measurement. If you reach our site from one of our ads, Meta's tools may record limited events such as visiting our landing page or starting sign-up, so we can measure ad performance. We never send Meta any health data. Meta Privacy Policy

These services have their own privacy policies. We encourage you to review them.

6. Advertising, Analytics & Cookies

We advertise DuoBean AI online so people who could benefit from it can find it. To understand whether our ads are working, we use a small number of measurement tools. This section explains what they do and how you can limit them.

6.1 Advertising measurement (Meta)

When you reach our website from one of our adverts on Facebook or Instagram, Meta's advertising tools may record a limited number of general events, such as arriving on our landing page or beginning the sign-up process. This helps us see how many people our ads reach and whether they lead to sign-ups. These tools use cookies and similar technologies stored on your device.

6.2 Product analytics (PostHog)

As noted in Section 5, we use PostHog (EU-hosted) to understand how the app is used, for example which features are opened and how onboarding is completed. PostHog records events only. It does not record your screen, your health data, or the contents of any input field.

✅ We never use your health data for advertising. Advertising tools only ever see general marketing actions like a page visit or the start of sign-up. Your meals, lab values, wellness entries, and anything you log inside the app are never shared with advertising or analytics partners.

6.3 Your choices

  • You can decline non-essential cookies using the cookie notice on our site.
  • You can control ad personalisation in your Meta ad settings.
  • You can block or clear cookies in your browser settings at any time.

If you are in the EU or UK, advertising and non-essential cookies are only set after you give consent.

7. Your Rights & Choices

Depending on your location, you may have the following rights:

  • Access: Request a copy of your personal data
  • Correction: Update or correct inaccurate information
  • Deletion: Request deletion of your account and data
  • Export: Download your data in a portable format
  • Opt-out: Disable non-essential data collection

To exercise these rights, email privacy@duobeanai.com.

8. Data Retention

We retain your data as long as your account is active. If you delete your account:

  • You can request immediate deletion of all your data
  • Otherwise, data is deleted within 30 days of account deletion
  • Anonymized, aggregated data may be retained for research purposes

9. Children's Privacy

DuoBean AI is not intended for children under 18. We do not knowingly collect information from children. If you believe a child has provided us with personal information, please contact us.

10. International Data Transfers

DuoBean AI uses globally distributed cloud infrastructure. Your data is encrypted in transit and at rest.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via:

  • Email (if you have provided one)
  • In-app notification
  • Updated "Last updated" date at the top of this page

12. Contact Us

For privacy-related questions or concerns: