Privacy Policy

The data controller is Thesos Innovations d.o.o., a company registered in the Republic of Serbia. Contact: support@thesos.app.

For questions about your data, including data-protection requests, write to the same address.

Website quiz: your answers about symptoms, history, diet and lifestyle, plus your first name and email if you give them.

Account data: your email address and name from Google, Apple or email sign-in.

Health data you log in the app: meals, bowel movements, symptoms, sleep, stress, weight, exercise, hydration, alcohol, supplements and medications, plus profile and onboarding answers and test results.

Usage data: which screens and pages are opened, how long the Service is used, steps reached in the quiz, device type and approximate region. This never includes the content of your health entries.

Health information is "special category" data under the GDPR and UK GDPR, and we treat it with extra care.

Providing the Service (saving logs, calendars, scores, trends, likely triggers and personalised content): performance of our contract with you. For health data, your explicit consent, which you give when you press "Agree & start".

Linking your quiz to your app profile using the same email: your explicit consent.

Improving and securing the Service using usage data and error logs: our legitimate interests.

Service emails such as account and security messages: performance of our contract.

Legal obligations, for example answering lawful requests: legal obligation.

We do not sell your data, share it with advertisers, or use it for advertising profiles. We do not make decisions about you that have legal or similarly significant effects based solely on automated processing.

Some insights and summaries are generated by AI models (for example from OpenAI). We send only the minimum data needed for each request. Our providers act as processors under contract, and your data is not used to train their models or ours.

AI output can be wrong and is never medical advice.

We use trusted service providers ("processors") who may only act on our instructions:

• Cloud hosting and database (servers in the EU)
• Google and Apple, for sign-in
• PostHog (EU servers), for app usage analytics without health content
• OpenAI, for AI features
• Email delivery providers
• Apple App Store and Google Play, if you buy a subscription in the future

We may also disclose data when the law requires it or to protect the safety of users.

Your data is stored on servers in the European Union. If a provider processes data outside the EU/EEA or UK, we rely on safeguards such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum. Data is encrypted in transit, and access rules let only you read your own records.

We keep your data while your account exists. When you delete your account, your account, logs, photos, profile and quiz answers are permanently deleted straight away, in the app and on our website systems.

We keep only what the law requires, such as purchase and tax records if you ever buy a subscription, plus fully anonymous statistics that can't identify you. Backups are overwritten within 30 days.

If you want a copy first, use Settings → Export data.

Under the GDPR, UK GDPR and the Serbian Law on Personal Data Protection you have the right to access, correct, export (portability), delete and restrict your data, to object to processing, and to withdraw consent at any time. Withdrawing consent does not affect processing that happened before.

In the app: Settings → Export data, and Settings → Delete account. Anything else: email support@thesos.app. We reply within one month.

You can also complain to a data-protection authority: the authority in your EU country, the UK Information Commissioner's Office (ico.org.uk), or the Serbian Commissioner for Information of Public Importance and Personal Data Protection (poverenik.rs).

We use only the cookies and local storage needed to keep you signed in and to make the Service work. We measure usage without advertising trackers. On the website, any non-essential analytics follows the cookie choices shown there.

Thesos is for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If you think a minor has given us data, contact us and we will delete it.

We use encryption in transit, strict access controls and regular reviews. No system is completely secure. If a breach affects your rights, we will notify you and the authorities as the law requires.

If we change this policy in a meaningful way, we will tell you in the app or by email before the change takes effect.

Thesos Innovations d.o.o., Republic of Serbia. Email: support@thesos.app.