App Privacy Policy

Last updated: 19 October 2026 · Version 2.1

This privacy policy describes how YUTHI life GmbH (“YUTHI”, “we”, “us”) processes personal data when you use the “YUTHI” app for iPhone and Apple Watch (the “App”). The website yuthi.life has its own privacy policy.

We comply with the Swiss Federal Act on Data Protection (FADP), the EU General Data Protection Regulation (GDPR), the UK GDPR together with the Data Protection Act 2018 and — for users in the USA — the applicable state privacy laws (see section 25).

1. Controller

The controller responsible for processing your personal data in the App is:

YUTHI life GmbH
Kirchgasse 5
6287 Aesch LU
Switzerland
UID: CHE-189.596.813
Email: info@yuthi.life

For all data protection matters — access, rectification, erasure, objection, data portability — please write to info@yuthi.life, subject “Data protection”.

We have not appointed a data protection officer because, in our assessment, the conditions for a mandatory appointment (Art. 37 GDPR) are currently not met. We will review this as the number of users grows.

Representative in the EU and the United Kingdom

Because we are established in Switzerland, we appoint a representative under Art. 27 GDPR for individuals in the EU and a representative under Art. 27 UK GDPR for individuals in the United Kingdom. We will add their contact details here once the appointment is complete. Until then, you can always reach us directly at info@yuthi.life.

2. What data the App processes

The App only processes information that you provide yourself or expressly release. It collects nothing in the background that is not listed here.

Our server does not know what is stored “only on your device”. It may, however, be part of your device backup (e.g. iCloud Backup); you control this in the iOS settings.

3. Health data

Information about your health — such as medication, blood values, symptoms, menstrual cycle, sexual health, stimulants and the values from Apple Health and Oura — is sensitive personal data within the meaning of Art. 5(c) FADP and special categories of personal data under Art. 9 GDPR and UK GDPR. In several US states, it is considered “consumer health data” or “sensitive personal information”.

We process it exclusively on the basis of your explicit consent (Art. 6(7)(a) FADP; Art. 9(2)(a) GDPR or UK GDPR). You can withdraw your consent at any time with effect for the future by deleting the relevant information, disconnecting individual connections or deleting your account. This does not affect the lawfulness of processing carried out before the withdrawal.

You are not obliged to provide any of this information. The App can be used without it — it will simply be able to support you less precisely.

We use health data only to provide you with the features of the App. We do not use it for advertising, do not sell it and do not pass it on to third parties — except the service providers in section 17, who process it exclusively on our behalf.

YUTHI is not a medical device and does not make diagnoses. All notes are for general orientation and do not replace medical advice, diagnosis or treatment.

4. The AI coach

The coach uses language models from Anthropic PBC, San Francisco, USA. For each request, we transmit only what is needed for the answer: your message, attached images or documents, the most recent part of the chat history and an extract from your profile and your entries.

We do not transmit your email address. Of your name, the coach only receives your first name so that it can address you. Anthropic processes the data as our processor, does not use it to train its models and, according to its own information, stores it only temporarily, generally for no more than 30 days, to detect misuse.

The AI is used in the following cases: answers in the chat, recognising meals from text and photos, recognising the type of sport from photos, checking profile and motivation photos, assessing foods, translating search terms for the food search, creating daily, weekly, nutrition and training plans, and writing personal push notifications.

Calendar: If you have granted calendar access, the App transmits the title, start time and duration of your appointments on the relevant days to the coach for daily and weekly planning. We do not store your appointments on our server.

Voice messages and dictation: Spoken input is converted into text by iOS speech recognition; depending on the device and language, Apple processes the recording on its own servers for this purpose. Only the text is sent to the coach.

The transfer to the USA is based on the European Commission’s standard contractual clauses, including the adaptations for Switzerland and the United Kingdom (see section 18). The coach’s answers are generated automatically and may be wrong; see the terms of use for more.

5. Photos and documents

Profile and motivation photo: These images are stored only on your device. If you choose one during onboarding, an automated procedure checks once whether it shows impermissible content; for this purpose only, it is transmitted to Anthropic.

Photos and documents in the chat — for example of meals, a blood test or a medication package — are sent to Anthropic for the answer (see section 4) and afterwards remain only on your device.

Progress photos in “My goal”: At your request, we store these photos on our server in private storage that only your account can access. They are displayed only via time-limited addresses. Before you save the first photo, the App asks for your consent. You can delete individual photos or all photos at any time; deleting all of them also withdraws your consent.

6. Apple Health

At your request, the App reads values from Apple Health: sleep stages, steps, distance, exercise time, active energy, workouts, heart rate, resting heart rate, heart rate variability, weight and water intake. You grant access in iOS and can withdraw it there individually at any time (Settings › Privacy & Security › Health).

On our server, we store daily values and your workouts derived from this. With your permission, the App writes the workouts, tours and water intake recorded in YUTHI back to Apple Health.

We do not use data from Apple Health for advertising and do not pass it on to third parties. Like all your entries, it may be included in the extract the coach receives for an answer (see section 4).

7. Oura

At your request, the App connects your Oura account (Ōura Health Oy, Finland). To do so, you sign in to Oura and release there what YUTHI may read. YUTHI only requests access to daily data.

Only information about your sleep, recovery and steps is read: sleep times and stages, readiness and sleep score, heart rate variability and lowest heart rate during sleep, and your number of steps per day. You choose in the App whether your steps are taken from Oura or from Apple Health; only one of the two sources counts for any given day. Any other values Oura supplies are discarded immediately by our server and are not stored.

The access tokens are stored on our server, never on your device, and are transmitted in encrypted form. Data is retrieved from Oura exclusively via our server. The imported values are stored in your personal area like your other data (see section 19). Like all your entries, imported nights and steps may be included in the extract the coach receives for an answer (see section 4).

The legal basis is your explicit consent (Art. 6(7)(a) FADP; Art. 9(2)(a) GDPR or UK GDPR), which you give by connecting.

You can disconnect at any time under Settings › Connections; the access tokens and daily values, including the imported steps, are then deleted, and the imported nights too if you wish. When you disconnect, we also revoke the authorisation at Oura. You can also withdraw the authorisation directly in your Oura account. If you delete your YUTHI account, we remove all Oura data held by us; in this case, please also withdraw the authorisation in your Oura account.

Ōura Health Oy is responsible for the processing of your data by Oura itself; its privacy policy applies. We do not use data from Oura for advertising, do not sell it and do not pass it on to third parties. This does not apply to values you release yourself in the friends comparison, such as your weekly step total; these are visible to the people you compare with (see section 10).

8. Outdoors: location, maps and weather

Recording sessions: If you start a session in the “Outdoors” area, the App stores your route track (GPS positions with time and altitude), the session’s key figures (distance, duration, pace, calories, elevation gain, minutes in the sun) and — if permitted — heart rate values. Your location is only recorded while a session you started is running, including when the screen is off. Outside a session, we do not create a movement profile.

Maps: The App loads map tiles directly from the servers of OpenStreetMap (OpenStreetMap Foundation, United Kingdom). OpenStreetMap receives your IP address and the map section displayed, but no information from your account.

Planning routes: If you draw a route, the GraphHopper service (GraphHopper GmbH, Germany) calculates the path along real roads and trails. The request runs via our server; GraphHopper only receives the waypoints and the type of sport, not your IP address and no information from your account.

Weather: For weather, UV index and hydration recommendations, the App requests the forecast for your weather location from Open-Meteo (open-meteo.com). You set this location by place name or — with your permission — by your location. Open-Meteo receives the place name or the coordinates of the location and your IP address, but no information from your account.

9. Food databases

If you scan a barcode, the App queries the open database Open Food Facts (France) for the product. Open Food Facts receives the barcode and your IP address, but no information from your account.

If you search for a food, our server may additionally query the FoodData Central database of the US Department of Agriculture (USDA). Only the search term is sent there — translated into English by the AI beforehand if necessary — not your IP address and no information from your account.

Products you record by barcode are added to a shared product list (barcode, name, nutritional values) that is available to all users of the App. Who created a product is not visible to anyone in the App; we store this only to be able to investigate misuse. This link is removed when you delete your account.

10. Friends comparison and referral programme

Friends comparison: You can connect with friends via a personal code and compare your week. The connected people see your display name and only the weekly values you expressly release (longevity score, steps, training minutes, share of your hydration goal). You can end individual releases, individual connections or the entire comparison at any time; your shared values are then deleted. The legal basis is your consent.

Referral programme: If you recommend the App with your code, we store who invited whom and the resulting credits. The invited person does not see any data from your account; you only see how many people have entered your code.

11. Subscription and payment via Apple

You buy the subscription via the App Store. Payment is processed by Apple; we do not receive payment details such as credit card numbers. To activate your subscription, our server verifies the purchase receipt with Apple and stores the product, term, expiry date and transaction identifier. Apple also notifies us of renewals, cancellations and refunds.

Apple (in Europe: Apple Distribution International Ltd., Ireland) is itself responsible for the processing involved in the purchase; Apple’s privacy policy applies.

12. Push notifications and reminders

If you agree, YUTHI sends notifications — for example an answer from the coach, a personal note about your day or a reminder. For this, we store a device identifier from Apple (push identifier). The coach writes personal notes based on an extract of your entries (see section 4). Delivery takes place via Apple’s push service (APNs); Apple receives the text displayed.

Reminders such as the hydration reminder are scheduled on your device. You can withdraw your consent to notifications at any time in the iOS settings.

13. Support via the coach

If you ask the coach to pass on a request to our team, it asks you first. With your confirmation, we create a support request containing your description, the necessary context and your email address so that we can reply to you. It is also deleted when you delete your account.

14. Device permissions

iOS asks for each permission separately. You can refuse any of them or withdraw them later in the iOS settings — the App remains usable; only the respective feature is unavailable.

15. No advertising, no tracking

The App contains no advertising or analytics tools. There is no tracking via services such as Google Analytics or Firebase Analytics. We do not create advertising profiles, do not pass any data to advertising networks and do not sell any data. For this reason, the App does not ask for Apple’s App Tracking permission either.

The App loads the overview of magazine articles from our website yuthi.life and, if you wish, opens articles and legal texts there. Our web host receives your IP address in the process (see section 17). The posts from our social media channels shown in the App display preview images that are loaded from the server on which they are stored; if you tap a post, the respective network opens with its own privacy policy.

16. Legal bases

We base the processing on the following legal grounds (Switzerland: Art. 31 FADP; EU: Art. 6 and 9 GDPR; United Kingdom: Art. 6 and 9 UK GDPR):

• Contract (Art. 6(1)(b) GDPR): account, App features, coach, subscription, activation and support.
• Explicit consent (Art. 9(2)(a) GDPR; Art. 6(7)(a) FADP): health data, Apple Health, Oura, progress photos.
• Consent (Art. 6(1)(a) GDPR): location, calendar, push notifications, friends comparison.
• Legal obligation (Art. 6(1)(c) GDPR): e.g. retention obligations under commercial and tax law.
• Legitimate interest (Art. 6(1)(f) GDPR): security of the App, prevention of misuse (e.g. for the shared product list and the referral programme) and the technical requests to map, weather and food services.

You can withdraw any consent at any time with effect for the future.

17. Service providers

We use carefully selected service providers who process your data only on our behalf and in accordance with our instructions (processors). We have concluded data processing agreements with them.

Independently of this, the services named in sections 8 and 9 (OpenStreetMap, Open-Meteo, Open Food Facts, USDA) receive the technical information described there when a request is made and process it under their own responsibility. Apple and Oura are themselves responsible for their own services.

18. International transfers

We store your data in Switzerland. For individual features, data is transferred to other countries:

• EU and United Kingdom (e.g. Germany, France, Ireland, Finland, United Kingdom): Switzerland, the EU and the United Kingdom mutually recognise each other as providing an adequate level of data protection.
• USA (Anthropic, Supabase, Apple): based on the EU-US Data Privacy Framework, the Swiss-US Data Privacy Framework and its UK extension, insofar as the provider is certified, and otherwise on the European Commission’s standard contractual clauses (Implementing Decision 2021/914) with the adaptations for Switzerland and the UK Addendum.

In the USA, authorities may access data under certain conditions in accordance with local law. We therefore only transfer what is necessary for the respective feature. On request, we will provide you with a copy of the relevant safeguards.

19. Storage location, retention and deletion

Your data is stored with Supabase on servers in Zurich, Switzerland. Each record is assigned to your account; technically, the database only returns the rows that belong to your signed-in account. Exceptions are the coach (section 4), the friends comparison (section 10) and the shared product list (section 9).

We store your data for as long as you have your account. You can delete individual entries and photos yourself at any time.

Deleting your account: You can delete your account yourself under Profile › “Delete account”. This removes your profile, all entries, your progress photos, your Oura connection including access tokens, your friend connections and shared values, your support requests and your push identifier — on the server and on the device, including chat history and local photos. The deletion takes effect immediately and cannot be undone. Please also cancel your subscription in your Apple account.

Exceptions: We retain Apple’s notifications about purchases, renewals and refunds without any link to your account where statutory retention obligations require this (up to ten years, Art. 958f of the Swiss Code of Obligations). Database backups are overwritten regularly; deleted data disappears from them when the backup period expires.

Downloading your data: Under Settings › Legal › “Export all my data”, you can obtain a copy of your data in a machine-readable format (JSON) at any time.

20. Data security

We take technical and organisational measures in accordance with Art. 8 FADP and Art. 32 GDPR, in particular:

• encrypted transmission (HTTPS/TLS) for all connections;
• access rules in the database (row level security): each account can only read its own data;
• progress photos in private storage, accessible only via time-limited addresses;
• access tokens for connected services only on the server;
• sign-in data for Face ID / Touch ID in the device’s protected keychain;
• access to the systems only for authorised persons who are bound to confidentiality.

No one can guarantee complete protection. If we become aware of a data security breach that affects you, we will inform you and the competent authority in accordance with the legal requirements.

21. Your rights

Within the scope of the applicable law, you have the following rights:

• Access (Art. 25 FADP; Art. 15 GDPR)
• Rectification (Art. 32 FADP; Art. 16 GDPR)
• Erasure (Art. 32 FADP; Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 28 FADP; Art. 20 GDPR)
• Objection to processing based on legitimate interests (Art. 30(2)(b) FADP; Art. 21 GDPR)
• Withdrawal of consent at any time with effect for the future

In the United Kingdom, you have the same rights under the UK GDPR. For your rights in the USA, see section 25.1.

You can do much of this directly in the App: change information, delete entries, download data, disconnect connections, delete your account. Please send all other requests to info@yuthi.life, subject “Data protection”. We generally respond within 30 days and may ask for reasonable proof to verify your identity.

22. Automated evaluations

The App evaluates your information automatically in order to show you evaluations, target values, plans and tips that suit you. This is the core of the App. We do not make any decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 21 FADP; Art. 22 GDPR). You decide for yourself whether and how to follow suggestions.

23. Minimum age

The App is intended for people aged 16 and over. We do not knowingly collect data from children under 16, in particular not from children under 13 within the meaning of the US Children’s Online Privacy Protection Act (COPPA). If we learn that an account belongs to a younger person, we delete it. Parents can contact us at info@yuthi.life.

24. Right to lodge a complaint

You can lodge a complaint with a data protection supervisory authority if you believe that the processing of your data is unlawful:

• Switzerland: Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern — edoeb.admin.ch
• EU: the supervisory authority of your place of residence or work; the European Data Protection Board provides an overview — edpb.europa.eu
• United Kingdom: Information Commissioner’s Office (ICO) — ico.org.uk

25. Additional information for specific countries

Depending on where you live, the following provisions also apply. They supplement the other information and do not replace it.

25.1 USA

For users in the USA, the following also applies, in particular under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) and the privacy laws of other states (e.g. Virginia, Colorado, Connecticut, Utah, Texas, Oregon).

Categories of personal information we collect: identifiers (email address, account ID, push identifier), personal characteristics (first name, date of birth, gender), commercial information (subscription via Apple), precise geolocation (routes during a session) and your weather location, audio and visual information (photos, voice messages — mostly only on your device), health and fitness data and inferences derived from it. The sources are you yourself and — with your permission — Apple Health and Oura. Purposes and recipients are described in sections 2 to 17, retention in section 19.

No sale, no sharing: We do not sell your personal information and do not “share” it for cross-context behavioural advertising (“sale” or “sharing” within the meaning of the CCPA) — including in the twelve months preceding the date of this policy. We do not sell the personal information of consumers under 16 years of age. We therefore do not offer a “Do Not Sell or Share My Personal Information” link.

Sensitive personal information: We use health data, precise geolocation and your sign-in credentials only to provide the App to you, and not to infer characteristics about you for other purposes.

Your rights: You can request access to the categories and specific pieces of personal information collected, request their correction or deletion and obtain a copy in a portable format. We will not discriminate against you for exercising these rights. You may use an authorised agent to submit a request. If we decline a request, you can appeal to us; if the decision is upheld, you can contact the Attorney General of your state. Please send requests to info@yuthi.life; you can also obtain a copy and delete your data directly in the App.

Consumer health data: For residents of Washington (My Health My Data Act), Nevada and Connecticut, the following also applies: we collect consumer health data only with your consent and only for the features of the App, do not share it with third parties without your separate consent (except our processors, section 17), do not sell it and do not use geofencing around healthcare facilities. You can request a list of the parties with whom we have shared your consumer health data, withdraw your consent and request deletion. Which consumer health data we collect, where it comes from and what we use it for is set out in sections 2, 3, 6 and 7.

HIPAA: We are not a healthcare provider or health plan; the US Health Insurance Portability and Accountability Act (HIPAA) does not apply to YUTHI. We nevertheless protect your health information as described in this policy.

Do Not Track and Global Privacy Control: The App does not track you across other apps or websites. Such signals therefore do not change how we process data.

Children: see section 23.

25.2 United Kingdom

For users in the United Kingdom, the UK GDPR and the Data Protection Act 2018 apply. The legal bases (section 16) and rights (section 21) apply accordingly. For our representative under Art. 27 UK GDPR, see section 1. You can lodge complaints with the Information Commissioner’s Office (ICO).

25.3 Canada

We process your data in accordance with Canada’s PIPEDA. Your consent for health data is express and can be withdrawn at any time. Your data is stored outside Canada (Switzerland) and transferred to the USA for the coach feature; there it is subject to the respective law and may become accessible to authorities under the legal conditions applicable there. Complaints can be addressed to the Office of the Privacy Commissioner of Canada.

25.4 Japan

In accordance with Japan’s APPI, we expressly point out that your data is stored in Switzerland and transferred to the USA for the coach feature. In Japan, health information is considered “special care-required personal information”; it is processed exclusively with your prior consent.

25.5 Brazil

We process your data in accordance with Brazil’s LGPD. Health information is “dados sensíveis” and is processed exclusively on the basis of your express consent. You are entitled to access, rectification, deletion, portability, withdrawal of consent and to lodge a complaint with the ANPD. Please send requests to info@yuthi.life.

25.6 Australia and New Zealand

We act in accordance with the Australian Privacy Principles and the New Zealand Privacy Act respectively. Health information is “sensitive information” there and is processed only with your consent. Your data is stored abroad (Switzerland) and transferred to the USA for the coach feature. You can lodge complaints with the Office of the Australian Information Commissioner or the New Zealand Privacy Commissioner.

25.7 Authoritative language version

This policy is available in several languages. For users resident in Switzerland, Germany and Austria, the German version is authoritative; for all others, the English version.

26. Changes to this privacy policy

We update this privacy policy when the App, the services used or the legal situation change. You can find the current version in the App under Settings › Legal and at yuthi.life/datenschutz-app.html.

We will inform you of material changes — for example a new service provider involving a transfer to a third country — in an appropriate manner, for example in the App. Where new consent is required, we will obtain it.

Last updated: 19 October 2026 · Version 2.1 · YUTHI life GmbH, Aesch LU