Privacy Policy
What data we collect, why, how long we keep it and what rights you have.
Version 1.0 · in force from 19/10/2026
Data controller
The MesogeaFit app and website (mesogeafit.com) are owned by Panagiotis Paterakis (sole proprietor), tax identification number (AFM) 140006769, Agios Nikolaos Tax Office, General Commercial Registry (GEMI) no. 196604041000, registered address Peristeras (outside the town plan), 722 00 Ierapetra, Crete, Greece, email info@mesogeafit.com, telephone +30 694 140 6341 (“we” or “us”).
For any matter concerning personal data, write to privacy@mesogeafit.com.
What applies today, before the app launches
The app has not launched yet. Today the website processes only two kinds of data:
- Notification list: your email address, your language and when you gave and confirmed your consent, if you sign up with the “Notify me” form. We use them only to tell you that the app has launched and for 1–2 updates a month. The legal basis is your consent (Art. 6(1)(a)). We keep them until you unsubscribe, with the link in every email or by writing to privacy@mesogeafit.com.
- Server logs: IP address, page requested, time and browser, for the security and proper operation of the website (Art. 6(1)(f)). They are deleted automatically after 14 days.
The website does not use cookies, analytics tools or third-party services that track you. Fonts are loaded from our own server. What follows about accounts, plans, health data, AI and payments applies from the launch of the app.
What we collect and why
| Category | Examples | Purpose | Legal basis (GDPR) | Retention period |
|---|---|---|---|---|
| Account | Email, name, sign-in with Apple or Google | Creating your account and keeping it secure | Art. 6(1)(b), contract | Until deletion or after 24 months of inactivity (with notice 30 days in advance), plus up to 30 days in backups |
| Age | Date of birth | Checking that you are 18 or over, and calculating calories | Art. 6(1)(b) | Until deletion |
| Body data and goals (health data) | Sex, height, weight, weigh-ins, activity, goal and, optionally, waist measurement and progress photos | Calculating and adjusting your plan | Art. 9(2)(a), explicit consent | Until deletion or withdrawal of consent |
| Health check answers | Medical conditions, medicines, questionnaire about your relationship with food | Keeping the plan safe | Art. 9(2)(a) | The answers stay only on your device. Only the indication “suitable plan yes/no” goes to the server. This indication is also health data and is kept until deletion or withdrawal of consent. The answers are not included in device backups |
| Food and preferences | Meals, allergies, vegan, favourites, your own recipes | Plan, warnings, shopping list | Art. 6(1)(b) and, for allergies, Art. 9(2)(a) | Until deletion |
| Conversations with the AI assistant | Messages, and voice messages that are converted to text on your device | Answering your questions | Art. 6(1)(b) and 9(2)(a) | 12 months, or earlier if you delete them. Voice is not stored. Parts of conversations with a safety flag or a report: up to 24 months, with restricted access |
| Scans and product photos | Barcode, scan history, photos of packaging | Scan results, product database | Art. 6(1)(b) | History until deletion. Product photos stay in the database. Their link to you is erased when your account is deleted |
| Purchases | Plan, dates, receipts. We do not see card details | Subscription, invoicing | Art. 6(1)(b) and (c) | For as long as tax law requires, as a rule 5 years |
| Duo and Household | Members’ names and email addresses, and whatever you choose to share | Shared subscription, shared list | Art. 6(1)(b) | For as long as you are a member |
| Technical data | Device, app version, IP address in logs, crash reports, notification token | Security, fixing bugs, notifications | Art. 6(1)(f), legitimate interest | 30 days |
| Records of consent | What you accepted and when | Accountability (Art. 7(1)) | Art. 6(1)(f), proving and defending claims | 5 years after the account ends |
| Customer support | Emails and messages to us, and the website form | Replying and resolving issues | Art. 6(1)(b) and (f) | 2 years |
| Newsletter emails | New recipes, offers, launch notification | Keeping you informed | Art. 6(1)(a), consent | Until you unsubscribe |
The weekly summary and the reminders are part of the service, and you set them up yourself in Settings.
What we never do
- We do not sell or rent out data. We have no advertising and we do not build advertising profiles.
- We do not allow the AI provider to train models on your data.
- We do not send the AI provider your name, your email or your health check answers.
- In the first version, we do not connect to Apple Health or Health Connect, and we do not store health data in iCloud.
Automated decisions
Your plan, and whether a weight-loss plan is suitable for you, are worked out automatically by the Scientific Lead’s protocol, on the basis of your explicit consent (Art. 22(2)(c) and 22(4) GDPR). You have the right to ask for human review, to express your point of view and to contest the result, by writing to privacy@mesogeafit.com. The human review is carried out by the Scientific Lead. Because your answers stay on your device, you send them to him yourself, if you choose to. AI plays no part in this assessment.
Who receives data
| Recipient | Role | What they receive | Where |
|---|---|---|---|
| Hetzner Online GmbH (hosting of the website, server and database) | Processor | The data stored on the server, such as the notification list and the server logs | Germany (EU) |
| Anthropic (Claude models) | Processor | Conversation text, the plan and health details that are needed (for example weight, allergies) and photos of nutrition tables or recipes to be read, without your name or email | USA, with Standard Contractual Clauses |
| Microsoft (Azure AI Speech) | Processor | Only the text of the answer you ask to hear, without any of your details. Microsoft does not store it | EU |
| Papaki (email) | Processor | Emails we exchange with you, confirmation emails and summaries | EU |
| Apple and Google | Independent controllers | Purchases, sign-in, notifications | Under their own policies |
| Viva | Independent controller (payment service provider) | Payments on the website | EU |
| Oxygen and our accountant | Processor, and tax obligations | Receipt details | Greece |
| Scientific Lead (dietitian) | Processor for quality control and recipe approval, under an Art. 28 contract | Only pseudonymised samples of plans, and the recipes you send for approval | Greece |
| Open Food Facts | Independent controller | Only the details and photos of the products you add, without any of your details | France |
| Public authorities | Only when the law requires it | Whatever is lawfully requested | Greece |
Before the app launches, we will also add the crash reporting provider here, within the EU. Voice-to-text conversion takes place on your device. This table is the complete list of processors, and we update it before any change.
Appointments with the dietitian take place directly with him, outside MesogeaFit. For these appointments, he is an independent controller, and we do not send him any of your details.
Inviting friends: we record which code was used and whether the new account became active, so that rewards can be given and abuse prevented (legitimate interest, Art. 6(1)(f) GDPR). To check the device, we use Apple’s and Google’s integrity tools, without advertising identifiers. The person who invited you sees only that the invitation was completed. These details are kept for up to 12 months after the last reward.
Transfers outside the EU
When data leaves the EU, the European Commission’s Standard Contractual Clauses or an adequacy decision apply. We send only what is needed, and without identity details. You can ask for a copy of the safeguards at privacy@mesogeafit.com.
Security
- Encryption in transit and at rest.
- The health check takes place on your device.
- Access only where it is needed, with two-factor authentication and a log of every access.
- If there is a data breach, we notify the Hellenic Data Protection Authority within 72 hours, and we tell you without delay where there is a high risk.
Your rights
- Access, rectification, erasure, restriction, objection and portability. You can export all your data from “Me › My data”.
- You can withdraw your consent at any time. Without consent for health data we cannot create a plan for you, but the Scan and Product Opinion service remains available.
- For requests, write to privacy@mesogeafit.com. We reply within one month.
- You can lodge a complaint with the Hellenic Data Protection Authority (1-3 Kifisias Avenue, 115 23 Athens, dpa.gr).
Age
MesogeaFit is not intended for people under 18. If we find that an account was created by a minor, we delete the data.
Cookies on the website
Today mesogeafit.com uses no cookies at all. If we add any in the future (for example to sign in to your account), we will first list them here, and analytics tools will be switched on only if you accept them. For details, see the Cookies page.
Changes
We tell you about material changes by notification and email before they take effect. If a change needs new consent, we ask you for it again.