Privacy Policy

Lysa Health (“Lysa”, “we”, “us”, “our”) is the data controller responsible for your personal data. We operate the Lysa mobile application and the website at lysahealth.app.

If you have any questions about this policy or how we handle your data, please contact us at: privacy@lysahealth.app

We collect the following categories of personal data:

2.1 Account data

• Email address (used for account creation and login)
• Your name, if you enter it or it is shared by Apple or Google when you use their sign-in
• Authentication tokens (managed by Supabase)

2.2 Profile data

• Starting weight and goal weight (optional)
• Age, sex and height (optional, used for targets and reports)
• Weight unit preference (kg or lbs)
• GLP-1 medication name (e.g., Ozempic, Wegovy, Mounjaro)
• Medication dose and concentration (for compounded medications)
• Preferred injection day of the week
• Dashboard and tracking preferences
• Account creation date

2.3 Health logs

• Weight logs: weight readings and date/time recorded
• Nutrition logs: meal descriptions, protein (g), calories (kcal), water intake, timestamp
• Injection logs: injection date, dose amount, injection site (abdomen/thigh/upper arm), side (left/right), optional notes
• Symptom logs: symptom name (selected from a list or free-text), severity rating (1–5), optional notes, date/time
• Therapies: therapies you add (for example a GLP-1 medication, peptide therapy, other medication, hormone or supplement), category, approval status (from our list, or marked user-entered for names you type), whether it is prescribed to you, route, start and end dates, the schedule days and time you enter, the dose and unit you enter, reminder settings and notes
• Administrations: date and time, route, amount you enter, injection area and side, notes, and scheduled days you mark as missed or skipped
• Wellness and body measurements: waist, body fat, lean mass, sleep, energy, appetite, recovery, hydration and steps, if you log them
• Lab results: test name, value, unit, date and notes you enter
• Timeline notes: free-text notes you add to your timeline
• AI-generated content (Pro): GP reports and daily tips created for you

Lysa records what you enter. It does not verify, prescribe or recommend any therapy or dose.

2.4 Photos (Pro subscribers only)

• Meal photos you choose to submit for AI nutritional analysis
• Photos are transmitted securely to our AI provider for analysis. If you save the meal, the photo is kept in private storage that only your account can access, shown in the app through short-lived links, and deleted when you delete the meal or your account.

2.5 Subscription data

• Subscription status (free or paid) — we do not store payment card details; these are handled by Apple or Google
• RevenueCat customer ID linked to your Lysa account

2.6 Technical data

• Device operating system and version (for debugging)
• App version
• Push notification token, if you allow notifications
• In-app usage events (for example screens viewed, onboarding steps, and that a meal, weight or symptom was logged), linked to your account ID. These events never include symptom names, free text or other health details.
• Error logs (anonymised where possible)

We do not use your health data for advertising, profiling, or marketing purposes. We do not sell your personal data to any third party.

Under the UK General Data Protection Regulation (UK GDPR), we rely on the following legal bases:

• Contract (Article 6(1)(b)): Processing necessary to provide the Lysa service you have signed up for — including storing your logs, displaying your progress, and calculating your targets.
• Consent (Article 6(1)(a) and Article 9(2)(a)): For processing special category health data (your weight, symptoms, therapies and administrations, nutrition, wellness measurements, lab results and notes) and for AI analysis of meal photos. You may withdraw consent at any time by deleting your account.
• Legitimate interests (Article 6(1)(f)): For improving the reliability and performance of our service using anonymised, aggregated data. We do not override your rights and freedoms.
• Legal obligation (Article 6(1)(c)): When required to comply with applicable law.

Because health data is a special category under UK GDPR (Article 9), we rely on your explicit consent for processing it. You grant this consent when you create an account and begin logging health information.

We share data with the following trusted third parties who provide services necessary to operate Lysa. We do not sell data to any party.

All providers acting as data processors are bound by data processing agreements and appropriate safeguards. Supabase offers EU and UK data residency options. Where data is transferred outside the UK, we ensure appropriate safeguards are in place (e.g., Standard Contractual Clauses).

Your health information is sensitive. We apply the following protections above and beyond standard data practices:

• Health data is stored encrypted at rest and in transit (TLS 1.2+).
• Health data is never used for advertising, marketing profiling, or sold to any party.
• Health data is never shared with insurers, employers, or government agencies except where required by law.
• Meal photos submitted for AI analysis are processed in memory and not stored by our AI provider beyond the duration of the request.
• Requests to our AI provider never include your name, email address or account ID.
• Therapy reminders are optional and never show the therapy name or dose on your lock screen.
• There is no public profile. Nothing you log is visible to other users.
• You can create a PDF summary of your records in the app, request a full export, or delete your data at any time (see Section 8).

Lysa is not a medical device. The information provided by the app, including AI-generated guidance and patterns in your logs, is for informational purposes only and does not constitute medical advice, diagnosis, or treatment. Lysa does not prescribe or recommend any therapy or dose.

Under UK GDPR you have the following rights. To exercise any of them, email us at privacy@lysahealth.app. We will respond within 30 days.

The Lysa app is intended for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a child has created an account, please contact us at privacy@lysahealth.app and we will delete the account promptly.

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by a prominent notice within the app at least 14 days before the change takes effect. The effective date at the top of this page will always reflect the current version. Continued use of Lysa after changes take effect constitutes your acceptance of the revised policy.

For any privacy questions, data requests, or concerns: