Privacy Policy

dietfam is operated by Hypercube Ventures Pty Ltd (the "Company", "we", "us"), a company registered in Australia. For any privacy enquiry, email support@dietfam.app or use the WhatsApp chat if you're an active user. For UK and EU users we process data in line with UK GDPR and EU GDPR respectively.

What personal data dietfam collects, why we collect it, how long we keep it, who we share it with, your rights, how we handle special-category health data, how we make automated decisions, and how to contact us with concerns.

Data you provide directly

• WhatsApp phone number — your unique identifier on our service
• Voice notes you send to the dietfam WhatsApp number
• Text messages you send (questions, corrections, replies)
• Onboarding answers — name (optional), age, height, weight (optional), goal, your onboarding self-declaration, dietary preferences
• Subscription information — billing email, payment method (handled by Stripe)
• Web dashboard interactions — when you log into the dashboard

Data we derive

• Transcripts of your voice notes (produced by our speech-to-text provider)
• Structured food and exercise logs — items, quantities, calories, macros (produced by our AI language-model provider)
• Daily and rolling summaries of your eating and exercise patterns
• Diet-quality estimates, including the gut health score — computed from your logged food (fibre, plant variety, fermented foods, processed share); an estimate, not a medical or microbiome measurement
• Safety classifications — flags applied by the model when your message contains certain patterns (e.g. medication mentions, distress signals)
• How you found us — if you arrived from a link we advertised on, we record the campaign tags on that link (which platform, which campaign, which advert) and the website that referred you, as part of your account record. We store the referring site's domain only, never the full address it came from. This tells us which adverts are worth paying for; it is not used to profile you, is never sold, and you can see and delete it with the rest of your data.

Almost everything you share with dietfam is "special category data" under UK GDPR Article 9 — it relates to your physical and mental health. Our lawful basis for processing is your explicit consent, given through the consent step at onboarding. You can withdraw consent at any time by deleting your account from the dashboard (Subscription → Your data) — or ask in the WhatsApp chat and you'll be pointed there.

• Operate the coaching service (transcribe, estimate, reply)
• Maintain your account, subscription, and billing
• Reply to each entry with a running tally, send one short message when your day closes at midnight, a weekly report each Sunday, day/week/month picture-card reports when you ask for them, and an evening reminder if you haven't logged
• Show your progress in the web dashboard
• Detect and respond to safety-relevant patterns
• Comply with legal obligations (e.g. responding to lawful regulator requests)

We do not sell or rent your data, build advertising profiles, or train any AI model on your data (our providers contractually do not train on our data).

When you delete your account (dashboard → Subscription → Your data), all data tied to it is hard-deleted within 30 days, except billing records (legally required to keep). Safety-event log entries become anonymised but remain for audit.

dietfam uses AI throughout. You have a right to know this.

• Speech-to-text: a third-party AI model transcribes your voice notes. It receives the audio and nothing that identifies you.
• Calorie and macro estimates, running tally, reports: a third-party large language model estimates each entry, classifies it on safety axes, and writes the report narratives.
• What the AI providers receive: the text of your entry, the day's items, your calorie and protein targets, your goal, your activity level, and rounded body measurements (weight to the nearest kilogram, height to 5 cm, age to a 5-year step) together with your region. They do not receive your name, phone number, email address, account identifier, or the time of day. We keep the record that links an entry to you in our own database only.
• Safety classification: when the model detects eating-disorder language, distress, medication mentions, or partner-coercion in dyad mode, the system modulates the reply, inserts a fixed deferral line, or replaces the reply with a locale-routed safety template containing helpline numbers.
• Onboarding declaration: a short self-declaration during signup that dietfam is a suitable tool for you, with specialist resources and helplines shown alongside. It is not a clinical screen and no automated decision is made from it.
• Coercion detection in dyad mode: not used per ADR 0005 — dietfam relays reactions between paired users as a pure conduit; we do not moderate the content of those relays.

You have the right to (a) be informed of any automated decision that significantly affects you, (b) request human review, and (c) contest the decision. Email support@dietfam.app or use your WhatsApp chat. We aim to respond within 30 days.

dietfam is a wellness/coaching service and is not a medical device. Calorie estimates have a typical accuracy band of ±15%.

We use a small set of service providers, by category:

• Cloud hosting, storage and email — EU (Ireland) region
• Messaging — the WhatsApp Business platform
• AI processing — a speech-to-text provider (United States) and a large-language-model provider (China); both receive de-identified data only, as described in section 7
• Payments — a PCI-compliant subscription billing provider (we never see your card number)
• Dashboard sign-in — a web authentication provider (US, under SCCs)
• Product analytics — US-hosted (under SCCs), cookieless: it stores nothing on your device and cannot follow you between visits. Counts page views and signup steps only; never receives message content.

Our hosting, messaging, payment, sign-in and analytics providers are bound by data-processing agreements with EU Standard Contractual Clauses (SCCs) and the UK Addendum where applicable. Our AI providers receive de-identified data only: your name, phone number, email address and account identifiers are removed before anything is sent, and body measurements are rounded, so what they hold cannot be tied back to you. AI observability is handled in-house — no third-party observability vendor. A detailed provider list is available on request via support@dietfam.app, and active users are notified 30 days before we add or change a provider.

UK and EU users. When data leaves the UK/EU — to our authentication, payment and product-analytics providers in the United States, and to our AI providers in the United States and China — we rely on Standard Contractual Clauses and the UK Addendum, and the AI providers receive de-identified data only (section 7).

Australian users (Australian Privacy Principle 8). We disclose de-identified entries — with your name, phone number, email address and account identifiers removed and body measurements rounded — to AI providers located in the United States and China, and identifying account details to our payment and sign-in providers in the United States. We take reasonable steps so that overseas recipients handle your information in line with the Australian Privacy Principles, and we remain accountable to you for it.

• Access & portability: download everything we hold about you as machine-readable JSON from your dashboard (Subscription → Your data)
• Rectify: correct your profile in the dashboard settings, or with the update command in WhatsApp
• Delete: delete your account from the dashboard (Subscription → Your data) — 30-day hard delete
• Withdraw consent at any time (deleting your account withdraws it entirely)
• Complain to the ICO at ico.org.uk, or your local supervisory authority (EU)

Asking for any of these in the WhatsApp chat points you to the right place; emailing support@dietfam.app works too.

dietfam is for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If we identify that a user is under 18, we delete their account and all associated data.

When the system detects acute crisis (suicidal ideation, acute eating disorder, acute medical emergency, partner violence), we replace the normal coach reply with a supportive message containing crisis helpline numbers routed to your country, and log the event in our internal audit log. Your service continues as normal — logging and summaries carry on, and we never lock you out or pause your account.

We do not notify next of kin, emergency services, or any third party unless required by a lawful court order.

• All data encrypted in transit (TLS 1.3) and at rest (AES-256 with cloud-managed keys)
• Voice notes and transcripts stored in our cloud provider's EU (Ireland) region
• Access restricted to authorised staff; access logged and reviewed monthly
• We do not extract voiceprints from your audio

We commit to publishing a post-mortem within 30 days of any breach that affects user data.

We will notify you of material changes via WhatsApp message at least 30 days before they take effect.

For privacy enquiries: email support@dietfam.app or use your WhatsApp chat if you're an active user. For Data Subject Access Requests: the dashboard export (Subscription → Your data), or support@dietfam.app. ICO complaints: ico.org.uk/make-a-complaint.