Privacy Policy

Controller Identification

For the purposes of Art. 9, II of the LGPD, the controller of the personal data processed in the Service is:

• Company name: Fitcal Ltda.
• CNPJ (Brazilian tax ID): 61.468.082/0001-98
• Operated brand: OzemPro (www.ozempro.com)
• Data Protection Officer (DPO): Contact via e-mail support@ozempro.com, as per Art. 41 of the LGPD. Postal address available upon request through this channel.

Interpretation and Definitions

Interpretation

The words of which the initial letter is capitalized have meanings defined under the following conditions. The following definitions shall have the same meaning regardless of whether they appear in singular or in plural.

Definitions

• Account: A unique account created for you to access our Service or parts of it.
• Company: Refers to Fitcal Ltda. (CNPJ 61.468.082/0001-98), the entity operating the OzemPro brand and controller of your personal data.
• Personal Data: Any information related to an identified or identifiable natural person.
• Sensitive Personal Data: Data about health, sexual life, biometrics, among others, as defined by Art. 5, II, of the LGPD.
• Data Subject: The natural person to whom the personal data refers — you.
• Processing: Any operation performed with personal data (collection, use, sharing, deletion, etc.).
• Controller: The natural person or legal entity that makes decisions regarding the processing of your personal data — in this case, OzemPro.
• Processor: The natural person or legal entity that processes data on behalf of the controller (e.g., hosting, payment, and notification providers).
• Data Protection Officer (DPO): The person appointed by the controller to act as a communication channel between you, the Company and the ANPD (Art. 41 of the LGPD).
• International Transfer: The transfer of personal data to a foreign country or international organization — subject to the conditions of Art. 33 of the LGPD.
• Cookies: Small files placed on your device containing information about your browsing history.
• Device: Any device that can access the Service such as a computer, cellphone or tablet.
• Service: Refers to the OzemPro website and/or app.
• You: The individual accessing or using the Service.

Collection and Use of Your Personal Data

Types of Data Collected

When using our Service, we may collect the following categories of data:

• Registration data: first name, last name, email, gender, date of birth or age, height, language, and profile photo (optional).
• Sensitive health data (Art. 11 of the LGPD): medication in use, dose, frequency, application dates, weight, BMI, body measurements, symptoms, reported side effects, and progress photos — used exclusively to operate the tracking Service.
• Meals and nutrition: meal descriptions, macronutrients, food photos (when you choose to upload them). Although not by nature sensitive data, they may reference your health condition at your discretion — they are treated as sensitive data as a precaution.
• Messages sent to the AI assistant: free text you type in the AI Chat. These messages are transferred to the AI provider outside Brazil, as detailed in the "International Transfer" section.
• Subscription and payment data: subscription status, platform used (Apple App Store, Google Play, Stripe, Hotmart or Hubla) and an opaque order identifier. Full card details are NEVER processed by us — they are handled directly by the payment providers.
• Support and refunds: messages and images you send to support and, in the refund request form, email (confirmed by a code), phone number, CPF (Brazilian tax ID; optional for requests made in English or Spanish), and the reason for the request.
• Usage and telemetry data: interactions with the application, screens accessed, usage events (which may be associated with your account identifier), device identifiers, model, operating system, language, time zone, IP address, advertising identifiers (IDFA/AAID), and error logs.
• Consent audit: for every consent grant or revocation, we store the date/time, version of the document accepted, IP address, and User-Agent — necessary to evidence the data subject's expression of will (Art. 8 §6 of the LGPD).
• Market research data (when you choose to participate): where you usually purchase the medication, approximate price range, interest in future treatment access solutions, and — if you voluntarily provide it — name, email and phone for follow-up.
• Cookies and identifiers: as detailed below.

Tracking Technologies and Cookies

We use Cookies and similar technologies to track activity on our Service. Cookie types:

• Essential Cookies: Necessary for the Service to function.
• Functionality Cookies: Improve the user experience.
• Analytics Cookies: Collect information for usage and performance analysis.

Apple Health (HealthKit) and Google Fit / Health Connect Integration

On iOS, OzemPro may integrate with Apple Health (the HealthKit framework) and, on Android, with Google Fit / Health Connect, always subject to explicit authorization granted by you within the operating system itself. This integration is optional: you may use all other features of the Service without granting it, and you may revoke it at any time. Data obtained through this integration is used exclusively to display and complement your health tracking within the app.

Data we may read (with your authorization)

• Steps and workout/physical activity time.
• Body weight.
• Active energy (calories burned).
• Water intake (hydration).
• Nutrition: calories, protein, carbohydrates, fat and fiber.

Data we may write (with your authorization)

• Body weight you record in the app.
• Water intake you record in the app.

Restrictions on the use of health data (HealthKit)

• Data read from Apple Health (HealthKit) is used EXCLUSIVELY to provide the tracking features within the app.
• We NEVER use HealthKit data for advertising, marketing, or any form of use-based data mining.
• We NEVER share or sell HealthKit data to data brokers, information resellers, advertising platforms, or any third parties for such purposes.
• HealthKit data is not sent to our campaign measurement and attribution processors (Meta, TikTok, Appstack, among others).

You may review or revoke this authorization at any time in Settings → Privacy & Security → Health (iOS), or in the Google Fit / Health Connect settings (Android). Revocation stops future reading and writing, without affecting records already stored in the app.

Legal Bases for Processing

We process your data based on the legal hypotheses provided in Arts. 7 and 11 of the LGPD, according to the purpose:

• Consent (Art. 7, I and Art. 11, I): For processing sensitive health data, sending marketing communications, participating in market research, and sharing with healthcare sector partners.
• Performance of contract (Art. 7, V): To provide and maintain the Service features you contracted.
• Compliance with legal obligation (Art. 7, II): To meet legal, regulatory requirements or orders from competent authorities.
• Legitimate interest (Art. 7, IX): For aggregated usage analysis, information security and fraud prevention, always respecting your fundamental rights.

Purposes of Processing

The Company uses your Personal Data to:

• Provide and maintain the Service, including treatment tracking.
• Manage your Account and provide exclusive features.
• Contact you regarding operational updates of the Service.
• Conduct anonymous or optionally identified market research, aimed at understanding the treatment access landscape — always with specific consent.
• Send marketing communications about treatment access solutions, with your opt-in consent, with the option to unsubscribe at any time.
• Share contact data with selected healthcare sector partners (laboratories, distributors, pharmacies, health plans, platforms), exclusively when you mark the specific consent.
• Monitor Service usage for improvement and security purposes.

Sharing of Personal Data

Your personal data may be shared in the following situations:

• With service providers (processors) that support the operation of the Service, under contract with confidentiality and data protection clauses. The processors that handle data on our behalf are listed in the "Processors and Sub-processors" section below.
• With healthcare sector partners selected by us (laboratories, distributors, pharmacies, health plans, platforms and initiatives related to treatments), only when you manifest specific consent by marking the corresponding option — purpose: present solutions, offers and updates that make treatment more accessible.
• With other users of the Service, in the community: your name, your profile photo, and what you publish (posts, comments, groups, and public recipes) are visible to other users. The community ranking shows other users your name, your profile photo, and your progress — your logging streak in days and how many kg you have lost since you started tracking.
• To comply with legal or regulatory obligations, or in response to orders from competent authorities (Art. 7, II and VI of the LGPD).
• In case of merger, acquisition or corporate reorganization, with prior notice to you.
• We do not sell your personal data and do not share it with third parties for commercial purposes not authorized by you.

Processors and Sub-processors

The list below identifies the processors that handle your personal data on our behalf. The list is updated whenever there is a relevant addition, change, or replacement of a supplier. The abbreviation "IT" indicates international data transfer (Art. 33 of the LGPD).

• Amazon Web Services (AWS) — Brazil (sa-east-1): Application hosting, PostgreSQL database, and image storage (profile, progress, meal, community, and recipe photos, and support attachments). How each type of image can be accessed is described in the "Information Security" section.
• Stripe — USA (IT): Processing of subscription payments contracted via the web. Receives only the data strictly necessary for payment; card data is handled exclusively by Stripe under the PCI-DSS standard.
• Hotmart and Hubla: Processing of payments for subscriptions contracted via the web. They receive the registration and purchase data needed for billing, which you provide on the payment page, and send us the purchase confirmation (such as name and email) to activate your account.
• Apple and Google — USA (IT): In-app subscription processing (In-App Purchase / Google Play Billing) and optional social authentication (Apple Sign In / Google Sign In).
• Firebase (Google) — USA (IT): Push notification delivery (Firebase Cloud Messaging) and app usage analytics (Firebase Analytics / Google Analytics), with usage events associated with your account identifier.
• Resend — USA / European Union (IT): Sending of transactional emails (confirmation, password recovery, operational communications).
• OpenAI — USA (IT): Generation of AI assistant responses, image and document analysis, and automatic photo moderation. It receives: (i) in the AI Chat, the messages and images you send and, to personalize the answers, your name and tracking data (age, gender, height, initial, current and goal weight, dose, and daily goals) — processing conditioned on your specific consent, captured upon first use of the AI Chat; (ii) when you use the corresponding features, the content you send, to provide the feature you triggered: meal photos, text, or spoken descriptions (transcribed on the device), scale or body composition screenshots, the nutritionist meal plan you import (photo, PDF, or text), and the information used to generate meal plans and recipes; (iii) photos posted in community posts and groups, for automatic moderation (OpenAI Moderation). We do not send your email.
• Google (Gemini) — USA (IT): Processing of voice and messages in the AI Chat voice chat (speech recognition and speech synthesis). To personalize the conversation, it also receives your first name and tracking data (such as age, gender, weight, height, and goals). Processing is conditioned on your specific consent.
• ElevenLabs — USA (IT): Processing of voice and messages in the AI Chat voice chat (speech recognition and speech synthesis). To personalize the conversation, it also receives your first name and tracking data (such as age, gender, weight, height, and goals). Processing is conditioned on your specific consent.
• Inworld — USA (IT): Processing of voice and messages in the AI Chat voice chat (speech recognition and speech synthesis). Processing is conditioned on your specific consent.
• Superwall — USA (IT): Remote delivery of subscription screens (paywall) and A/B testing of commercial configurations. To personalize the subscription screen, it receives your first name, email, current weight, goal weight, how much is left to reach the goal, medication, and dose.
• Sentry — USA (IT): Collection of error logs for diagnostics and bug fixing. Error reports may contain your account identifier and your email.
• Meta (Facebook SDK and Conversions API) — USA (IT): Measurement and optimization of advertising campaigns. The Facebook SDK in the app logs usage and conversion events (install, registration, trial start, subscription); on iOS, tracking for advertising is only enabled if you allow it (ATT). Through the Conversions API, our server sends conversion events with hashed email, phone number, and name, IP address, and user agent. They do not receive sensitive health data.
• TikTok (TikTok Business SDK) — USA (IT): Measurement and attribution of advertising campaigns. It receives conversion events (install, registration, subscription) and device identifiers. On iOS, it is only enabled if you allow tracking (ATT). It does not receive sensitive health data.
• Appstack: Attribution of installs and advertising campaigns, including Apple Ads (Apple Search Ads) campaigns. It receives install and conversion events and device identifiers.
• Paywallo (Virex Tech) — Brazil: Internal platform for attribution, A/B testing, paywall management, and push notification delivery. It receives your email, first name, last name, date of birth (when provided), gender, country, and language, plus the A/B test variants shown to you. When used to send push notifications, it receives the content of the notifications, which may include your name and your medication. Sub-processor of the controller, under the same obligations of this Policy.
• Núcleo — CRM and customer support platform: Support, moderation, and sales recovery panel. It receives registration data (such as name, email, and device type), support tickets and their messages (including attached images), content reports, community posts and comments, subscription events, and affiliate program data.

Sharing with Apple in Refund Requests

If you bought your subscription through the App Store and ask Apple to refund that purchase, Apple may contact us about the request. In that case, with your consent, we will send Apple only the following information:

• whether the subscription was delivered and worked correctly;
• how much of the subscription was used;
• whether you had access to a free trial or to information about the app before the purchase;
• our recommendation on the request (grant or decline the refund).

To arrive at this information, we check whether you used the app again after the purchase and whether you used its features. We do not share the content of your records with Apple, such as weight, doses, symptoms, meals or messages.

• Purpose: helping Apple review the refund request. The final decision is always Apple's.
• Legal basis: consent (art. 7, I, of the LGPD).
• International transfer: Apple may process this data outside Brazil, in accordance with Apple's Privacy Policy (art. 33 of the LGPD).
• Retention: Apple keeps this data only for as long as needed to review the request, in accordance with its policy.
• How to withdraw consent: you can withdraw it at any time by emailing support@ozempro.com. From then on, we will no longer send this information. Withdrawing consent does not affect your right to ask Apple for a refund. To access or delete the data Apple received, visit privacy.apple.com.

International Data Transfer (Art. 33 of the LGPD)

Some of our processors are located outside Brazil — predominantly in the United States. For this reason, part of the processing of your data involves international transfer. We ensure that these transfers occur under the hypotheses authorized by Art. 33 of the LGPD:

• Standard contractual clauses (Art. 33, II, d): With Stripe, AWS, Google/Firebase, Sentry, and our other processors, we maintain contracts (DPAs — Data Processing Agreements) with protection clauses compatible with the LGPD.
• Specific consent of the data subject (Art. 33, VIII): The use of the AI Chat, which involves sending messages and images to OpenAI in the USA (and, in voice chat, also to Google, ElevenLabs, and Inworld), depends on your specific and highlighted consent, requested upon first use of the feature. You may choose not to use the AI Chat and continue using the other features of the Service normally.
• Performance of contract (Art. 33, V): Some transfers (such as payment processing by Apple/Google/Stripe when you subscribe to the Service) are necessary for the performance of the contract entered into between you and the Company.

Children and Adolescents (Art. 14 of the LGPD)

The Service is intended exclusively for individuals aged 18 (eighteen) or older. We do not intentionally collect data from children or adolescents. If we identify that an account was created by a person under 18 without the specific consent of at least one parent or legal guardian, the account will be deleted and the data will be erased, except where retention is legally required. If you are responsible for a minor who has used the Service, please contact our Data Protection Officer through the channels listed at the end of this Policy.

Information Security (Arts. 46 to 49 of the LGPD)

We adopt reasonable technical and administrative measures appropriate to the scale of the processing and the sensitivity of the data involved, including:

• Storage of your session token (JWT) in protected locations on the device: iOS Keychain on Apple and EncryptedSharedPreferences on Android, making access by third-party applications difficult even on rooted/jailbroken devices.
• Passwords are stored as one-way hashes, never in plain text.
• Connections with the server are protected by TLS/HTTPS.
• Images are uploaded through a temporary upload URL (it expires within minutes), with no storage credentials in the app, and stored in per-user folders. Profile photos, photos posted to the community, and photos of public recipes are shown to other users and are accessible through a direct link (public URL). Other images (progress photos, meal photos, and support attachments) are not shown to other users of the Service and are also served through a direct link at an undisclosed address.
• The database is accessible only via the server's internal network, with strong credentials generated at deploy time.
• Structured auditing of every sensitive action (consent grant/revocation, export, account deletion), with date/time, IP, and User-Agent.
• Rate limiting on public endpoints to mitigate brute-force attacks.
• Periodic review of the DPIA (Data Protection Impact Assessment — Art. 38 of the LGPD) and of the technical controls.

Response to Security Incidents (Art. 48 of the LGPD)

Despite the measures adopted, no system is absolutely immune to incidents. Should a security incident occur that may result in relevant risk or harm to you, we will report the incident to the ANPD and to you within a reasonable period, in accordance with the determination of the National Data Protection Authority, providing: (i) a description of the nature of the data affected; (ii) the data subjects involved; (iii) the technical and security measures used to protect the data; (iv) the risks related to the incident; (v) the reasons for any delay, in the case of non-immediate notification; and (vi) the measures adopted to reverse or mitigate the effects of the harm.

Data Retention and Deletion

We retain your data for as long as necessary to fulfill the described purposes and applicable legal periods:

• Registration and usage data: Kept while your account is active and for up to 12 months after account deletion, unless otherwise legally required.
• Sensitive health data: Kept while your account is active, deleted after account deletion, except when retention is required for defense in legal proceedings or regulatory obligation.
• Market research data: Kept for up to 5 years from collection, or until consent revocation, whichever comes first.
• Security logs: Kept for up to 6 months, in accordance with the Brazilian Internet Civil Framework (Federal Law No. 12.965/2014).

Your Rights as Data Subject

Pursuant to Art. 18 of the LGPD, you may exercise the following rights at any time, free of charge. Many of them can be exercised directly within the app, on the "Privacy and Consents" screen — including exporting a copy of your data, permanently deleting your account, and revoking specific consents. For any other requests, please use our contact channel:

• Confirmation: Confirm whether we process data about you.
• Access: Access the data we hold about you.
• Correction: Correct incomplete, inaccurate or outdated data.
• Anonymization, blocking or deletion: Request anonymization, blocking or deletion of unnecessary, excessive or non-compliant data.
• Portability: Request portability of your data to another service provider, observing commercial and industrial secrets. Available directly within the app ("Privacy and Consents" screen → "Export my data"), which generates a JSON file with all your records.
• Deletion: Request permanent deletion of your data, except where legal retention applies. Available directly within the app ("Privacy and Consents" screen → "Delete my account"). Deletion is permanent and covers your registration information, sensitive health data, photos, AI Chat messages, and community history.
• Information about sharing: Obtain information about public and private entities with which we share your data.
• Consent revocation: Revoke consent at any time, without prejudice to the lawfulness of processing previously performed.
• Opposition: Object to processing based on legal hypothesis other than consent, in case of LGPD non-compliance.
• Complaint to ANPD: File a complaint with the Brazilian Data Protection Authority (ANPD) at www.gov.br/anpd.

Changes to this Privacy Policy

We may update this Policy periodically. Whenever there is a relevant change, we will communicate through registered contact channels or in the app itself. We recommend reviewing this page regularly.

Data Protection Officer and Contact Channel

To exercise your rights, clarify questions or file complaints related to the processing of your data, you may contact our Data Protection Officer (DPO) through the channel below. We will respond within the legal period of up to 15 (fifteen) days.

• By email: support@ozempro.com