Privacy Policy

1. Who we are

Calorie-Wise (the website at calorie-wise.com and the Calorie-Wise mobile app, together "the Service") is operated by Xentra Health, a division of Maynard Procurement Solutions Ltd, a company registered in England and Wales, number 08753201, registered office P O Box 8, Wilmslow, Cheshire, United Kingdom ("we", "us").

We are the data controller for your personal data. We are registered with the Information Commissioner's Office (ICO) under number [ICO REGISTRATION NUMBER].

Contact us about privacy at info@xentrahealth.com.

2. Data we collect

3. How we use your data and our lawful basis

Service messages are not marketing. You will receive them even if you opt out of marketing, because they concern your contract with us.

We never use your health data, medication, supplement, symptom or appetite records to decide who receives marketing, and we never send them to advertisers.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Food estimates produced by artificial intelligence are shown to you to check and correct before they are saved.

4. Anonymous research data (optional)

You can choose to share anonymous research data with us. It is entirely optional and off unless you tick the box "Share my anonymous research data" at sign-up or in your account. The Service works the same whether or not you share. If you don't tick it, we don't collect any of your data for research.

• What is collected: once a week the app sends a summary: your age band (for example 45-54), sex, country, body mass index band, percentage weight change since you started, how many weeks you have tracked, whether you record a GLP-1 medicine and which one and what dose, whether you record GhrelinX and how often you confirm taking it, your average calories, protein, water, exercise and alcohol, your hunger and craving scores, and which symptoms you recorded.
• What is never collected for research: your name, email address, account details, exact age or date of birth, height, exact weight, photos, food descriptions, notes or precise location.
• How it is protected: the summaries are stored under a random code, not your account. Only our server can link that code to your account, using a secret key kept separately, and it does so only to delete your research data if you ask. Because that link exists, the law treats this data as pseudonymised personal data and special category health data, so we protect it in the same way as the rest of your health data and only process it with your explicit consent.
• How we use it: to measure the progress people make, in particular people using GLP-1 medicines and GhrelinX, to improve the Service, and to produce research and reports. We only ever look at or report figures for groups of at least 5 people. We will not publish, sell or share anything that identifies you.
• Third parties: we will only share research figures with others in combined form for groups of at least 5 people. We will never pass data that identifies you to a third party without separate, specific consent naming that third party.
• Changing your mind: untick the box in your account at any time. We stop collecting straight away and delete the research data you have already given. Combined figures already published cannot identify anyone, so they cannot be withdrawn.

5. Who we share data with

We use trusted service providers who process data only on our instructions, under written contracts:

We may also disclose data where the law requires it, or to protect our legal rights. If our business is sold, your data may transfer to the new owner, who must honour this policy.

6. How long we keep your data

We warn you clearly before any deletion and always give you the chance to download your data first.

7. Your rights

You have the right to:

• access your data, and get a copy of it;
• export it in a common machine-readable format (data portability). Use "Download my data" in your account for an instant JSON export; the app also offers CSV files;
• correct inaccurate data;
• delete your data. Use "Delete my account" in your account;
• restrict or object to some processing, including any based on our legitimate interests;
• withdraw consent at any time, for health data, research data or marketing, without affecting processing already done.

Email info@xentrahealth.com for anything you can't do in your account. We reply within one month and do not normally charge. If your request is complex we may extend this by up to two further months, and we will tell you why within the first month.

If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put things right first.

8. Other important information

International transfers. Our data is stored in the United Kingdom (London). Some providers may process data outside the UK, for example in the United States. Where they do, we use UK-approved safeguards such as the International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or UK adequacy regulations, including the UK-US data bridge where a provider is certified.

Users outside the UK. If you live in the European Union, Australia or the United States, you may have additional rights under your local law. Nothing in this policy takes those away. Contact us to use them.

Security. Data is encrypted in transit and at rest, passwords are hashed, each user can only ever access their own records, and staff access is limited to those who need it. If a breach is likely to put you at risk, we will tell you and the ICO as the law requires.

Children. The Service is for people aged 18 and over. We do not knowingly collect data from children. If we learn that we have, we delete it.

Cookies and visit counting. Our website uses only storage that is essential to sign-in and payment. We do not use advertising or tracking cookies. We count visits without cookies and without storing anything on your device: our server records the page, the website you came from, your country and device type, and a one-way code made from your connection details and a secret that changes every day, so we can count unique visitors per day but cannot recognise you on another day or identify you. Your IP address is not stored. If your browser sends a Do Not Track or Global Privacy Control signal, we don't count your visit. If we add optional analytics in future, we will ask for your consent first through a cookie banner.

Changes. We will notify you by email and in the app at least 30 days before any significant change to this policy takes effect.