Privacy Policy

Summary: Your health data is stored on your device and your iCloud account. We do not have servers or databases. The only external services Cora uses are Google Gemini AI (for food photo analysis, with your consent) and Open Food Facts (for barcode lookups).

1. Data We Collect

Cora collects only the data you provide directly within the app to enable its health tracking features:

• Profile Information: Name, age, gender, height, and profile photo (optional). Used to personalize your experience.
• Nutrition Data: Food entries (name, calories, protein, carbs, fat), meal photos, meal times, and portion sizes.
• Hydration Data: Water intake amounts, container types, and timestamps.
• Weight Data: Weight entries with dates and units (kg/lbs).
• Medication Data: Medication names, dosages, frequencies, schedule times, and adherence logs.
• Cycle Data: Period start/end dates, flow levels, symptoms, mood, and energy levels.
• Chat Messages: Conversations with Cora AI coach (stored on-device only).
• Food Photos: Photos taken or selected for AI nutrition analysis.

Cora does not collect your email address, phone number, precise location, contacts, browsing history, or any data beyond what you explicitly enter.

2. How Data Is Stored

All your health data is stored locally on your device using Apple's SwiftData framework. If you have iCloud enabled for Cora, your data syncs across your Apple devices via Apple's CloudKit using your personal iCloud account. This is governed by Apple's Privacy Policy. Pelvi Health does not have access to your iCloud data.

Cora does not operate its own servers or cloud databases. We do not store any of your health data on Pelvi Health servers.

3. AI Food Scanner & Third-Party Data Sharing

Important: Cora asks for your explicit consent before sending any data to the AI service. You can use the app without the AI scanner.

When you use the AI food scanner, Cora sends only the food photo you capture or select to Google Gemini AI (via Firebase Vertex AI) to identify foods and estimate nutritional values.

• What is sent: Only the food photo. No personal information (name, age, health data, location) is included.
• Who receives it: Google Gemini AI via Firebase Vertex AI.
• How it's protected: Photos are transmitted over an encrypted (TLS) connection. Per Google's data processing terms, API inputs are not used to train Google's models.
• Your control: You are asked for explicit consent before your first AI scan. You can revoke consent at any time in Settings. You can always log food manually or via barcode without AI.

Google's privacy policy: policies.google.com/privacy

Firebase data processing terms: firebase.google.com/terms/data-processing-terms

4. Barcode & Food Search

When you scan a barcode or search for a food product, the barcode number or search query is sent to Open Food Facts, a free and open-source food database. No personal information, device identifiers, or health data is sent.

Open Food Facts privacy policy: world.openfoodfacts.org/privacy

5. Analytics

Cora uses Clarity by Microsoft to collect anonymous usage analytics (screen views, session duration, interaction patterns). This is used solely to understand how users navigate the app and improve the experience. No personal health data, food logs, photos, or identifiable information is shared with Clarity.

Clarity privacy policy: clarity.microsoft.com/terms

6. Apple HealthKit

If you enable HealthKit integration, Cora may read active energy (calories burned) and weight data from Apple Health, and may write weight data back. This requires your explicit permission. HealthKit integration is off by default. Cora never shares HealthKit data with third parties, advertising platforms, or data brokers, in compliance with Apple's HealthKit guidelines.

7. No Ads & No Tracking

Cora contains zero advertisements. We do not use advertising SDKs, tracking pixels, social media SDKs, or data brokers. We do not sell your data to anyone.

8. Deleting Your Data

Since everything is stored on your device and your iCloud account, you have full control. Use the “Delete All Data” option in Settings, or uninstall the app. To remove iCloud-synced data, go to Settings > [Your Name] > iCloud > Manage Storage > Cora.

9. Children's Privacy

Cora is not directed at children under 13. We do not knowingly collect personal information from children.

10. Your Rights

You may:

• Access all data stored by the app (on-device at any time)
• Delete all your data (Settings > Delete All Data)
• Export your data (PDF export feature in the app)
• Opt out of AI food analysis (revoke consent in Settings or log manually)
• Disable iCloud sync (iOS Settings > iCloud)

11. Changes to This Policy

If anything changes, we'll update this page. Material changes will be communicated through an in-app notice.

12. Contact

Questions? Reach us at [email protected]