Skip to content
NurtureTech

Legal

Privacy Policy

Last updated 16 September 2026 · v3.7

This policy explains how NurtureTech ApS (under stiftelse) processes personal data in Ketora, Kcalra and on nurturetech.dk, in line with the GDPR, including Article 13 and Article 9 (health data). The Danish version of this policy is the official and legally binding text. Translations into other languages are provided for convenience only.

1. Controller (identity)

2. Local-first: what stays on your device

Ketora and Kcalra are native Android apps (APK / Google Play). All user data, app state and your Gemini key (`user_gemini_api_key`) are stored locally in the Android sandbox via Capacitor Preferences. The apps do not use cookies, PWA sessions or web tracking. Meals, photos, goals, weight, settings and app lock (`app_lock_record`) do not leave the device unless you trigger an AI request or attach them to a support email. NurtureTech operates no cloud servers with user accounts. We do not sell personal data.

AI calls travel TLS-encrypted through an uncached, memory-only proxy to Google Gemini. No prompts, images or API keys are logged or retained by NurtureTech. Local deletion: Me → Delete all data and reset app, Android app data, or uninstall.

3. Actual processing and legal bases (GDPR Arts. 6 and 9)

The processing that actually occurs, with legal basis:

  • AI / Google Gemini API (Art. 6(1)(a) and Art. 9(2)(a)). When you trigger a photo scan, text or voice log, that specific input is sent encrypted via NurtureTech’s stateless serverless API proxy to the Google Gemini API for computation, using your own API key (BYOK). This may include health and nutrition data (special categories, Art. 9). Processing takes place only with your explicit consent on a separate in-app screen (not the same control as the Terms). AI meal analysis is the core feature of the application. Consent for AI processing is voluntary, but required to use photo scanning, text, and voice logging. If consent is not given or is withdrawn, AI functionality will be unavailable, and the app will be limited to viewing and reusing saved meals previously generated via the AI features. Withdraw consent under Me → Preferences by turning AI analysis off, removing your API key and/or deleting local data. NurtureTech does not store these transmissions and has no user-account database of your meals. AI features require you to enter your own Google Gemini API key (BYOK). NurtureTech does not provide an API key and has no Google account or bill for your calls. The proxy is 100% memory-only and does not persist health data, prompts or API keys. NurtureTech is the controller for app design, prompt structure and initiating the transfer. The transfer to Google (USA) is based on your explicit Art. 9 consent, the key type you choose with Google (free Developer API vs Paid/Workspace API — training terms follow Google’s terms for that key) and use of the stateless proxy. Google processes the request under Google's Gemini API Terms of Service and the Google Privacy Policy.
  • Google Health Connect / Apple Health (Art. 6(1)(a) and Art. 9(2)(a)). Activity data (e.g. steps and energy expenditure) is read strictly locally after your Health Connect authorisation. It is not transferred to NurtureTech, not stored on our servers and not sold. It is shown in the app on-device. If you use the AI coach, you may with Art. 9 consent include selected context in that single memory-only Gemini request; turn this off under Me → Preferences or in system settings. Health Connect is not used for advertising.
  • App lock / PIN (Art. 6(1)(f)). An optional PIN (`app_lock_record`) is stored as a one-way hash in the Android sandbox. The PIN is never sent to us. Support cannot recover a forgotten PIN; reset requires clearing app data or reinstalling.
  • Licence checks and hosting (Art. 6(1)(f); for purchases also Art. 6(1)(b)). Anonymised or pseudonymised tokens and device IDs may be processed via our hosting (Vercel) for licence, trial and start-up validation. We do not build a health profile on our side.
  • Support and company mail (Art. 6(1)(b) and (f)). We receive enquiries at contact@nurturetech.dk on Google Workspace. NurtureTech is the controller. Google is a processor under the Cloud Data Processing Addendum. Mail is used for support and company operations. We process your email address, app version and any details you send solely to answer the request and run the company. Ketora and Kcalra meal logs stay on your device and are not sent to us unless you attach them. This is not a medical record system. Support information is stored only as long as needed to close the request, then routinely deleted. Reply drafts may be prepared with an AI assistant at Cursor/xAI in the United States; we approve before anything is sent. Meal logs are not sent to the assistant.
  • Consent record (Art. 6(1)(c) and (a)). A timestamp of the accepted policy version may be stored so we can document Art. 7.
  • Supplements, not prescription medication. The app supports logging of dietary supplements only (e.g. creatine, magnesium, vitamins). Prescription medication is not supported, is not analysed medically, and is ignored by the AI coach.

4. Website (nurturetech.dk)

nurturetech.dk is hosted by Vercel. Technical logs and IP addresses may be processed briefly to deliver and secure the site (GDPR Art. 6(1)(f) — legitimate interest in running a secure website).

This section applies only to nurturetech.dk in a browser. The native apps do not set cookies and do not use browser localStorage for app data. On the site, language preference is stored in localStorage (`nt.legal-locale`). We use no ad networks and no non-essential tracking. Therefore no cookie banner is shown.

Typefaces (Fraunces and Source Sans 3) are hosted 100% locally on our own servers at Vercel. There is no external IP transmission to Google or other CDNs for fonts.

Enquiries via contact@nurturetech.dk are processed in Google Workspace as described in sections 3 and 5. Meal logs are not uploaded to the site.

5. Recipients, processors and third countries

Google (Gemini API) receives data when you use AI features. NurtureTech is the controller for initiating the transfer via the stateless serverless proxy. Google may process data in the US and EU. Transfers to the US rely on your Art. 9 consent and Google’s terms for the chosen key type, including the safeguards Google provides (SCC and — where certified — the EU–US Data Privacy Framework). See EU Standard Contractual Clauses (SCC) and EU–US Data Privacy Framework.

Vercel hosts the websites and the licence/start-up API. Apple and Google are independent data controllers for purchases and subscriptions made via the Apple App Store and Google Play Store as Merchant of Record.

Google Workspace hosts the company inbox contact@nurturetech.dk. NurtureTech is the controller; Google is a processor under the Cloud Data Processing Addendum. Without a Data Region setting, Google may process data in countries where Google and its subprocessors operate, with transfers covered by the CDPA (including DPF/SCC).

Cursor / xAI (Grok Bot). Internal AI assistant for drafts. Processing takes place in the United States. NurtureTech is the controller. No mail is sent until a human approves. Ketora and Kcalra meal logs are not sent to the assistant.

We do not sell your data or share it with advertising third parties.

6. Your rights

You have the GDPR rights of access, rectification, erasure, restriction, portability (where technically meaningful via in-app export), objection, and withdrawal of consent without affecting the lawfulness of processing before withdrawal.

  • Erasure: Directly in the app (Me → Delete all data and reset app), by clearing app data, or by uninstalling — the effective way to exercise erasure for local-first data.
  • Consent for AI/health data: Withdraw by stopping AI calls, removing your API key and/or deleting local data.
  • Complaint: You may lodge a complaint with Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, Denmark.
  • Rights requests: contact@nurturetech.dk. We can only provide what we actually hold (typically support correspondence) — not your local meal history, which we do not have.

7. Children

The Services are not directed at children under 16. We do not knowingly collect children’s health data. If you are under 16, use the app only with parent or guardian consent where required.

8. Security and app lock

Security of local-first data depends primarily on your device lock, biometrics and encryption. Network traffic (AI calls and licence checks) uses HTTPS/TLS.

App-lock PINs and biometrics are processed only locally. A forgotten PIN cannot be reset by NurtureTech; see the terms on local responsibility.

9. Retention

Local app data is kept until you delete it or uninstall. Support emails in Google Workspace are kept only as long as needed to close the request, then routinely deleted. Licence tokens are kept only as long as needed for validation. Workspace is a company inbox — not a medical record system.

10. Changes

Material changes (for example optional cloud sync) will be updated here and shown in the app. Where the law requires a new explicit consent — especially Art. 9 — we will obtain it before the new processing starts.

Back to home