Privacy Policy

Controller / Administrator: WebWiseAI Tomasz Ścierski
NIP: 6463009555 · REGON: 527437312
Registered address: ul. Brzoskwiniowa 67/8, 43-100 Tychy, Poland
Contact: support@trymealo.com (subject: "Privacy")

WebWiseAI Tomasz Ścierski ("Mealo", "we", "us", "our") operates the Mealo website and mobile apps.

This policy applies to information we collect through trymealo.com, our mobile apps, our email communications, and related services (the "Services"). It does not apply to third‑party sites or services that we do not operate.

We collect the following categories of information:

• Account information — name, email, password, and profile photo if you upload one.
• Health, fitness, and lifestyle inputs — age, sex, height, weight, goals, allergies and intolerances, dietary preferences, activity level, medications you choose to share, and periodic measurements. This information may be treated as "sensitive personal information" under California and other state privacy laws.
• Meal photos and fridge photos — images you submit for AI recognition and recipe suggestions.
• Usage data — the food you log, water intake, workouts, chat messages with your team, and interactions with the app.
• Device integration data — with your permission, data from Apple Health, Google Health Connect, Fitbit, and similar services.
• Payment metadata — plan, amount, and last four digits of the card. Full card details are handled by our PCI‑compliant payment processor and are not stored on our servers.
• Device and log data — IP address, device model, operating system, app version, and diagnostic logs.
• Cookies and similar technologies — see Section 12.

We use your information to:

• create your account and deliver the Services;
• generate and personalize your meal and workout plan;
• allow your Registered Dietitian and trainer to review and adjust your plan;
• power AI features such as meal photo recognition and fridge scanning;
• process payments and prevent fraud;
• send transactional messages from notifications@trymealo.com;
• improve product quality, safety, and security;
• comply with law and enforce our Terms.

Where required, we rely on your consent (for example, to process sensitive health inputs and to connect Apple Health or Google Health Connect), on the performance of our contract with you (to deliver the Services you purchased), on our legitimate interests (to secure and improve the Services), and on legal obligations.

To power meal recognition, fridge scanning, and the AI chat assistant, we process photos and message text with machine learning models we operate or license. We do not sell your health data. We do not use your identifiable health data to train third‑party foundation models. When we use third‑party AI providers, we bind them by contract to use your data only to provide the service to us and to delete it after processing where feasible.

We share information only with the following categories of recipients:

• Your care team — the Registered Dietitian and personal trainer assigned to your plan, so they can build and adjust it.
• Service providers (subprocessors) — cloud hosting, database, analytics, error monitoring, email delivery, customer support tools, and AI model providers, all bound by data‑processing terms. A current subprocessor list is available on request.
• Payment processor — to charge your card and prevent fraud.
• Third‑party integrations you enable — such as Apple Health, Google Health Connect, Instacart, Amazon Fresh, Walmart, Kroger, and Whole Foods.
• Legal and safety — to comply with law, respond to lawful requests, protect our rights, or address safety issues.
• Business transfers — in connection with a merger, acquisition, or asset sale, subject to this policy.

We do not sell your personal information for money. We do not use your health information for cross‑context behavioral advertising.

Mealo is a consumer wellness service and, in most cases, is not a "covered entity" or "business associate" under HIPAA. That means HIPAA generally does not apply to the health information you share with us — but we still treat that information as sensitive and protect it under this policy and applicable state laws. Information you share with a healthcare provider outside Mealo remains subject to that provider's HIPAA obligations.

We keep your information for as long as your account is active and for a limited period afterward to comply with legal obligations, resolve disputes, and enforce our agreements. You can request deletion at any time (see Section 11). Some information may remain in backups for a short retention window before it is overwritten.

We use administrative, technical, and physical safeguards designed to protect your information — including encryption in transit and at rest, access controls, audit logging, and vendor reviews. No system is perfectly secure; we cannot guarantee absolute security.

Depending on where you live, you may have the right to know what personal information we hold about you, to receive a copy, to correct inaccuracies, to delete your information, to limit the use of your sensitive personal information, to opt out of the "sale" or "sharing" of personal information, and to appeal a denial. To exercise any of these rights, email us at support@trymealo.com with the subject "Privacy request", or use the in‑app privacy controls.

Under GDPR/RODO (if you are in the European Economic Area, United Kingdom, or Switzerland) you have the right to access your data, to rectify or erase it, to restrict or object to processing, to data portability, to withdraw consent at any time (without affecting the lawfulness of prior processing), and to lodge a complaint with a supervisory authority — in Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa).

Under U.S. state privacy laws — including the California Consumer Privacy Act as amended by the CPRA (California), and comparable laws in Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Delaware, Iowa, Indiana, Montana, New Hampshire, New Jersey, and others as they take effect — you may have similar rights. We will not discriminate against you for exercising them. If we deny your request, you may appeal by replying to our decision email.

"Do Not Sell or Share My Personal Information." We do not sell your personal information for money. If you would like to opt out of any "sharing" for cross‑context behavioral advertising, email us at support@trymealo.com with the subject "Do Not Share" and we will process your request.

We use essential cookies to keep you signed in and to remember preferences, and we use privacy‑respecting analytics to understand how the Services are used and to improve them. You can control cookies through your browser settings. Where required, we will ask for your consent before setting non‑essential cookies.

Mealo is intended for adults 18 and over and is not directed to children. We do not knowingly collect personal information from anyone under 13 (or under 16 where applicable). If you believe a child has provided us information, please contact us and we will delete it.

The controller is established in Poland (EU) and personal data are processed primarily within the European Economic Area. Where we use service providers located outside the EEA (for example, U.S. cloud or AI providers), we rely on appropriate safeguards under the GDPR, such as the European Commission's Standard Contractual Clauses, and — where applicable — the EU‑U.S. Data Privacy Framework.

We may update this Privacy Policy from time to time. We will update the "Effective date" above and, for material changes, notify you by email or in‑app notice before the changes take effect.

Controller / Administrator: WebWiseAI Tomasz Ścierski
NIP: 6463009555 · REGON: 527437312
Registered address: ul. Brzoskwiniowa 67/8, 43-100 Tychy, Poland
Privacy contact: support@trymealo.com (subject: "Privacy")
System notifications are sent from notifications@trymealo.com.