Privacy Policy

Last updated: 25 October 2026

1. Introduction

This Privacy Policy ("Privacy Policy") explains how we collect, use, store, disclose and protect information about you when you use our mobile application Zura Health ("Zura" or the "App") and any related websites and online services (together, the "Services").

Zura is provided by Zura Health UG (haftungsbeschränkt), a limited liability company under German law with its registered office in Kirchseeon, registered in the commercial register of the Local Court (Amtsgericht) of Munich under HRB 316115 (“we”, “us”, “our” or the “Company”). The Company determines the purposes and means of the processing described in this Privacy Policy and therefore acts as the controller within the meaning of Article 4 of the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR").

Data Controller:
Zura Health UG (haftungsbeschränkt)
Heinrich-Egger Straße 8
85614 Kirchseeon
Germany
Email: info@zurahealthos.com

Represented by its managing directors Mahsa Iraniara and Amir Hossein Zahiri.

For any question about your personal data or this Privacy Policy, contact us by email at info@zurahealthos.com.

Please read this Privacy Policy carefully. By accessing or using the Services, you acknowledge that you have read and understood it. Where we rely on your consent, we ask for that consent separately and clearly.

2. A quick summary

This summary is for convenience only and does not replace the full text below.

• Zura is a health, fitness and wellness app. It processes health data, which is "special category data" under the GDPR. We process that data only with your explicit consent.
• We use your data to provide the App's features — workout and nutrition guidance, food photo analysis, progress photos, cycle tracking, reading the health documents you upload, wearable integration, and the Zura AI coach (including voice conversations with it).
• You are interacting with an AI when you talk to Zura, the in-app coach. AI output can be wrong and is not medical advice.
• We do not sell your personal data, we do not use it for advertising (including data from Apple HealthKit or Google Health Connect), and we do not use it to train third-party AI models.
• We use a defined set of service providers ("subprocessors"), listed in our separate List of Subprocessors.
• You have strong rights over your data, including access, correction, deletion and withdrawal of consent. You can delete your account from within the App.

3. Personal information we collect

We collect information that identifies, relates to, or could reasonably be linked to you ("Personal Information", also "personal data" under the GDPR). What we collect depends on how you use the Services.

Some data are necessary to create your account and your plan: your name, email address and password (or your Google or Apple sign-in), and your age, gender, height and weight. Without them we cannot build your plan, so you cannot use the App. Because your height and weight can reveal information about your health, we use them only with your explicit consent, which you give on the screen where you enter them, before you start; you can withdraw it by deleting your account. Before you start, we also ask for one explicit consent to use your health data to coach you, including sending it to our AI provider (see Section 4); without it, Zura cannot coach you. Which other health data you give us is up to you: injuries and medical conditions, check-ins, body photos, cycle tracking, documents and wearable data are used only if you enter, log, upload or connect them, and you can switch these features off in the App's settings. Where we are subject to a statutory retention obligation (for example under tax law), the corresponding provision and retention of data is a legal requirement.

3.1 Information you provide to us

• Account and profile data — your name, email address, password (stored only in hashed form), country, language and time zone, and any photo or details you add to your profile.
• Sign-in information — if you create or access your account using Google or Apple, we receive basic profile information from that provider (see Section 8).
• Onboarding and goal data — information you enter to set up your plan, such as your age, gender, height and weight (required, see above), fitness and activity level, available equipment, goals, dietary preferences and restrictions (including any religious dietary rules you choose to tell us), injury history, medical or health conditions you choose to share with us (for example diabetes or pregnancy), allergies and intolerances, and related lifestyle inputs.
• User-generated content — workout logs, nutrition and water logs, food and fridge photos you scan for AI food recognition (fridge photos are not stored), body progress photos, body measurements you enter (such as weight and waist circumference), and activity history.
• Form check — where this feature is available to you, the App analyses your movement with your phone's camera on the device itself. Only the resulting measurements (such as joint angles and timing) are sent to us to give you feedback; no video or audio is recorded, uploaded or stored.
• Conversations with the Zura coach — the messages you exchange with our AI assistant.
• Daily check-ins — the mood, energy and stress ratings and any note you add in a check-in.
• Cycle tracking — if you use cycle tracking: period dates, cycle and period length, flow, symptoms, notes and contraception type, and the cycle phase and ovulation estimates we calculate from them (with wearable data where available, see Section 5).
• Health documents — documents you choose to upload, such as lab reports, and, with your consent, the information the Zura coach reads from them (for example lab values).
• Zura memory — facts the Zura coach remembers from your conversations to personalise its coaching (for example your preferences and, only with your consent, health details such as injuries, conditions or medications), and patterns it notices, such as your mood over time.
• Calendar — if you allow calendar access, the titles, times and locations of your events for the next 14 days, which the App reads on your phone and sends to our servers with your messages to the Zura coach, so that it can plan around your schedule. We do not store the events themselves; we keep only a summary of the hours at which you are usually busy on each day of the week. Our AI provider receives only the times of your events, not their titles or locations (Section 9). If you turn on adding your workouts to your calendar, the App writes your planned workouts into the calendar on your phone that you choose and changes or removes only the entries it created; if that calendar is synchronised with an online service (for example iCloud or Google Calendar), that service receives these entries under its own terms.
• Area and gym — if you choose them in the App's settings, the town or area you pick (stored only as an approximate location, accurate to about one kilometre) and the gym you train at (its name, address and opening hours, as listed on OpenStreetMap). We use them to show you the local weather forecast and nearby gyms, and the Zura coach takes them into account when planning with you (Section 9). The App does not access your device's location. You can remove your area or your gym in the App at any time, which deletes it.
• Voice conversations with the Zura coach — when you start a voice conversation with the Zura coach (for example during onboarding or by tapping the voice button), your voice is processed in real time and we keep the text transcript of the conversation. We do not store the audio. The App does not listen passively to your microphone.
• Payment and billing data — if you buy Zura Premium, you pay through the App Store or Google Play, which handle your payment details; we never receive them. We receive your subscription status, and RevenueCat (see the List of Subprocessors) receives your Zura user ID and your purchase records (see Section 11).
• Support and feedback data — survey responses, bug reports, and anything you send us when you contact support or give feedback, including through the contact, feature-request and bug-report forms on our website (your name if you give it, your email address, your message and any screenshot you attach to a bug report). If you joined our former website waitlist, we hold the email address and any name you gave us.
• Pilot programme data — if you take part in our pilot programme: your answers to our surveys and interviews, and the phone number or messenger ID you gave us so that we can stay in touch. We use this data to run the pilot and improve Zura, on the basis of our agreement with you for the pilot (Article 6(1)(b) GDPR), and keep it until the end of the pilot.
• Pilot-programme applications — if you apply through our website to take part in a pilot programme, your answers in the application form: your name, age range, city, phone number or messenger ID, email address, the type of phone you use, whether you use a wearable and which one, which health apps you use, your training and nutrition habits, whether you can take part for the full period and your answers to the participation questions, together with your browser's technical identification (user-agent). We ask for your gender only to check eligibility; it is not stored in our website database, but it is included in the notification email to our team.

3.2 Information collected automatically

When you use the Services, we automatically collect:

• Device and usage information — IP address, device model, operating system, app version, language and time zone, features and screens accessed, and the date and time of your interactions (including when you were last active).
• Push-notification tokens — identifiers that let us deliver notifications to your device (sent through Google's Firebase Cloud Messaging, which uses Apple's Push Notification service for iPhones; the text of each notification passes through these services).
• Technical and diagnostic logs — server logs; the access logs of our load balancer, which record IP addresses and the address of each request; a record of each access to the photos and documents you upload, including the IP address of the device that opened them; and error reports, performance measurements and crash diagnostics generated by the App and our infrastructure (including those processed by Sentry, see Section 6), used for security and troubleshooting.
• Analytics, crash and performance data — see Section 6.
• Health Information delivered through background synchronisation — once you connect a wearable, Health Information may be received through background sync and webhook events from our wearable integration on an ongoing basis, even when you are not actively using the App (see Section 5).

4. Special category data (health data)

Some of the data Zura processes is "special category data" under Article 9 of the GDPR — the most strongly protected class of personal data. For Zura this includes:

• body progress photos you upload, and body measurements and body-composition values you enter or that come from a smart scale (for example body-fat percentage);
• health information you enter during onboarding or in your profile, such as your height and weight, injury history, medical or health conditions, allergies and intolerances, and religious dietary rules (which may reveal your religious beliefs);
• health data from a connected wearable, including heart rate, resting heart rate, heart-rate variability, sleep, blood-oxygen saturation, respiratory rate, skin and body temperature, physical activity, and body measurements;
• cycle-tracking data you log, and the cycle phase and ovulation estimates we derive from it;
• mood, energy and stress check-ins, and mood patterns noticed in your conversations with the Zura coach;
• health documents you upload and the information read from them;
• information you share with the Zura coach — in text or by voice — that relates to your health, body or wellbeing, including transcripts of voice conversations;
• other health-related outputs generated by our AI features.

A note on voice. Where voice content is special category data, it is so because of what you say about your health, body or wellbeing — not because we treat your voice itself as a biometric identifier. We do not use voice characteristics, voiceprints or any other voice biometrics to identify or verify you. Audio is processed to produce a text transcript and a response from the Zura coach; that is the only purpose.

We process special category data only on the basis of your explicit consent under Article 9(2)(a) of the GDPR. That consent is collected through a specific, informed, granular and clearly worded mechanism in the App, separately from your acceptance of the Terms of Use, before any such data is processed. The mechanism lets you consent to each type of special-category processing independently — for example, you may consent to wearable data while declining body images.You may withdraw your consent at any time in the App's settings, after which we stop the related processing. If you switch off the health details you entered, we keep them stored but do not use them until you switch them back on or delete your account. To withdraw your consent completely, delete your account. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Connecting a wearable or uploading body progress photos is optional. You can use the rest of the App without doing either.

Important. Zura is not a medical device under the EU Medical Device Regulation (Regulation (EU) 2017/745). Your Health Information is processed solely for wellness and personal-fitness purposes and is governed by this Privacy Policy.

5. Third-party health information (wearables)

With your permission, the Services connect to third-party health platforms to import health and fitness information; this runs on our own servers in Frankfurt, Germany. If you connect a Google or Oura account, that provider may also share the account's email address with us.

Depending on the device you connect, Open Wearables accesses data either through your device's native health platform — Apple HealthKit on iOS (operated by Apple Inc.) or Google Health Connect on Android (operated by Google) — which in turn aggregates data from your wearables and any other health apps you have authorised, or directly through a wearable provider's API (the providers available are shown in the App, currently Google (Google Health), Oura and Polar).

Through these integrations we may import: heart rate, resting heart rate and heart-rate variability; sleep duration, stages and quality; movement and physical activity, including steps, distance, workouts and active and resting energy; blood-oxygen saturation; respiratory rate; skin and body temperature; body measurements such as weight, height, body fat and lean mass where available; menstrual cycle data (such as period dates, flow, and related cycle indicators); and derived scores. When you first connect, we may import up to 240 days of history. This information is referred to in this Privacy Policy as "Health Information".

Health Information received this way is special category data and is processed under your explicit Article 9(2)(a) GDPR consent (Section 4). The wearable providers themselves are independent of Zura and act under their own terms and privacy policies; we recommend you review the privacy policy of any wearable provider you connect. If you use cycle tracking, we also use your temperature, heart-rate and heart-rate-variability data to estimate your cycle phase and ovulation. Disconnecting a wearable stops new imports; Health Information already imported remains in your account until you delete your account.

We never use Health Information accessed via Apple HealthKit or Google Health Connect for advertising or marketing, and we never sell or share it with data brokers or other third parties for advertising purposes. Health Information is used solely to deliver the wellness features you have chosen to enable.

6. Analytics, crash reporting and performance monitoring

The App includes the following tools, provided by Google as part of the Firebase platform, which help us understand how Zura is used and keep it stable:

• Firebase Analytics — measures how the App is used, such as which screens and features are opened and basic session information, together with a pseudonymous user ID and general profile attributes (such as age group, gender, country and goals).
• Firebase Crashlytics — collects crash and error reports, including device diagnostics and the state of the App at the time of an error, and a pseudonymous user ID.
• Firebase Performance Monitoring — measures performance such as start-up time and network response times, including the addresses of the requests the App makes to our servers.
• Firebase Remote Config and Firebase Cloud Messaging — used to configure features remotely and to deliver push notifications.

Google acts as our processor for these tools. Analytics and performance monitoring run only with your consent: you can grant or withdraw that consent at any time in the App's settings, and they stay switched off until you consent. Crash reporting operates on the basis of our legitimate interest in keeping the App secure and free of defects. We do not use any of these tools for advertising, and we do not use them to track you across other apps or websites. We do not operate advertising networks and we do not carry out behavioural-advertising profiling. If we add or change analytics or monitoring tools, we will update this Privacy Policy.

Our own usage records. If you agree to share usage data, the App also tells our own servers when you open it and which screens you view. Whether or not you agree, it tells them how you respond to the Zura coach's suggestions and notifications, because that is part of your coaching. We keep these records with your account for 90 days and use them to understand how you use Zura and to choose which reminders and suggestions to show you (see Section 10).

In addition, our servers report technical errors and performance measurements to Sentry (Functional Software, Inc.), using its EU data region, so that we can find and fix defects and slow responses. These reports contain technical information, such as the type of error and how long a request took, and can include the pseudonymous identifier of your account. We configure Sentry not to receive the contents of your requests or of your conversations with the Zura coach, and to remove health data; this filtering is best effort, so an error report can occasionally contain a short excerpt of the data being processed.

Google ML Kit. The App uses Google's ML Kit on your phone to cover faces in body photos, to recognise your body position during form check and, on Android, to read barcodes. Your photos and camera images stay on your phone. ML Kit sends Google technical information about its use, such as the device model, the App version and an identifier for the installation of the App, regardless of your choice about usage data.

7. How we collect your personal information

We collect Personal Information from these sources:

• Directly from you — when you register, complete onboarding, enter information in the App, contact us, or give feedback.
• Automatically — through standard server logs and operational telemetry, and through the analytics and monitoring tools described above.
• From your connected wearables and health apps — through Open Wearables, Apple Health or Health Connect, with your permission, including by background synchronisation and webhook events.
• From your calendar — the titles, times and locations of upcoming events, if you allow calendar access.
• From sign-in providers — if you choose to sign in with Google or Apple, we receive basic profile information from that provider.
• From Apple or Google — your subscription status, through RevenueCat, if you buy Zura Premium.

8. Signing in with a third-party account

If you choose to create or access your account using Google or Apple, the provider authenticates you and shares a limited set of profile information with us — typically your name, email address and an account identifier. We use that information only to create and secure your account. Your use of the third-party account remains governed by that provider's own terms and privacy policy. If you sign in with Apple, you may choose to hide your email address, in which case Apple supplies a private relay address.

9. The Zura coach and other AI features

Several features of the Services use artificial intelligence and machine-learning technologies, including the Zura coach, a conversational assistant (in text and by voice), food recognition from photos, reading the health documents you upload, generating your workout and meal plans, and personalised insights and recommendations.

In line with Article 50 of the EU Artificial Intelligence Act (Regulation (EU) 2024/1689), we tell you clearly:

• The Zura coach is an AI system. When you talk to it, you are interacting with an AI, not a human.
• AI output is generated automatically, may be inaccurate or incomplete, and is not medical advice. Always consult a qualified professional before making health decisions.
• We do not use AI to make automated decisions that produce legal effects concerning you, or that similarly significantly affect you, within the meaning of Article 22 of the GDPR.
• We do not use voice or facial characteristics or other biometric data to infer your emotions in order to influence your decisions.

How AI processing works. When you use an AI feature, we send the data needed for the task to AI models on Google Cloud's Vertex AI in the European Union — for example food photos, your messages to the Zura coach, documents you ask it to read, and context from your profile, check-ins, cycle tracking and wearable data, the times at which your calendar shows you as busy (without titles or locations) and, if you have chosen them, your town, your gym and the local weather. We do not add your name or email address, and if you type an email address or phone number into a message to the Zura coach, we remove it before the message is sent; documents are sent as they are, so anything written in them, including your name, reaches Google. Google Ireland Limited acts as our processor under the Google Cloud Data Processing Addendum, the processing stays within the European Union, your data may not be used to train the models, and it holds inputs only temporarily to provide the service.

Your choice about AI. The consent you give before you start covers sending your data to Vertex AI (Section 4). You can switch the AI features off at any time in the App's settings; our servers then stop sending your data to Vertex AI, and the Zura coach, the plans it builds, food photo analysis, reading your health documents and the coach's memory are switched off, while you can still log food, water, workouts and your cycle.

Body progress photos. These photos are not analysed by AI or sent to any other service. Before upload, the App covers any face it detects, removes location and other metadata, and shows you the result so that you can retake it. Covering faces is a best-effort measure: a face the App does not detect is not covered.

Periodic insights. To prepare personalised insights, we periodically send a summary of your recent workout, nutrition, health and (if you use it) cycle data to Vertex AI in the European Union; the files used for this are deleted after processing.

Live voice conversations with the Zura coach. During a live voice conversation, your audio passes through our servers in Frankfurt to Google Cloud's Vertex AI in the European Union, which answers by voice. We do not record or store the audio. We store the text transcript with your Zura conversation history, so that the Zura coach keeps context and you can review or delete past conversations; where it relates to your health, body or wellbeing, it is stored under your explicit consent (Section 4). Your inputs may not be used to train the models.

Model training. We do not use your personal data, health data, images or Zura conversations to train generative AI models, whether our own or those of any third party. Within Zura we use two kinds of statistical learning: (1) if you have consented to cycle tracking, the cycle and wearable data of all users who have given that consent is used each week to update the average cycle curves from which our cycle-phase estimates start before they adapt to you; and (2) we learn from how people respond to reminders and suggestions which ones are most helpful (see Section 10). If we decide to train AI models on user data, we will update this Privacy Policy, explain the legal basis, and — where that basis is consent — ask for your consent first through a clear opt-in, which you can decline without losing access to core features and withdraw at any time.

How voice works. When you use voice features:

• Voice starts only when you act. The microphone is used only during a voice conversation or voice-guided session that you start yourself. We do not listen in the background, and we do not stream audio passively from your device.
• You stay in control of the microphone. You can end a voice conversation at any time, delete its transcript, or turn off microphone access in your phone's settings; the rest of the App keeps working.
• Voice is not used to identify you. We do not use voiceprints, voice biometrics or any acoustic features of your voice to recognise, verify or distinguish you from other users. Audio is used only to produce a text transcript and to power the Zura coach's response.
• What is stored. Only the text transcript is stored, never the audio. It follows the retention rules in Section 18, and you can delete conversations, or your whole conversation history, in the App at any time.

10. How we use your personal information, and our legal bases

We process your Personal Information for the following purposes and on the following legal bases under the GDPR:

We may also use aggregated and anonymised data — information from which you can no longer reasonably be identified — to improve our Services, develop new features, carry out analytics, and support research and product development, including in collaboration with academic or clinical partners. Where data has been irreversibly anonymised, it is no longer personal data under the GDPR and is not subject to the rights described in Section 15. We do not anonymise data as a means of circumventing your rights over identifiable data.

Personalisation and profiling. To personalise your plans, reminders and coaching, we automatically analyse your activity, logs, check-ins, wearable data and how you respond to reminders. This includes a learning system that chooses which reminders and suggestions to show you, and automated rules that can adjust your plans. We may also test different versions of features with different groups of users (A/B testing) to find out what works best. None of this produces legal effects or similarly significant effects for you (Section 9). Our legal bases are the performance of our contract with you and our legitimate interest in improving the Services (Article 6(1)(b) and (f)) and, for health data, your explicit consent (Article 9(2)(a)). You can pause Zura's reminders or switch off notification types in the App's settings.

You can unsubscribe from marketing communications at any time using the link in any marketing email or by contacting us; this does not affect service or administrative messages. Where our basis is consent (Article 6(1)(a) or 9(2)(a)), you may withdraw it at any time (see Section 15). Where our basis is legitimate interests, you may object (see Section 15), and we have balanced our interests against your rights and freedoms.

11. Payment information

If you buy Zura Premium, you buy it through the Apple App Store or Google Play. Apple or Google process your payment and your payment details; we never receive them. We receive your subscription status and the information needed to manage it through RevenueCat, which manages subscriptions for us (see the List of Subprocessors); RevenueCat receives your Zura user ID and your purchase and subscription records. The terms of any paid plan, including renewal and cancellation, are set out in our Terms of Use.

12. Who we share your information with

We share Personal Information only as described here. We do not sell your personal data, and we do not share it for cross-context behavioural advertising.

• Service providers (processors and subprocessors). We use a defined set of providers to host, store and operate the Services. Each is bound by a written data processing agreement. They are listed, with their purpose, data categories and location, in our separate List of Subprocessors (https://zurahealthos.com/subprocessors), which forms part of the context of this Privacy Policy.
• Wearable and health platforms — where you choose to connect them (Section 5).
• At your direction — for example, if you export or share your own content.
• Embedded videos and images — some meditation videos, videos in Zura's feed and some exercise demonstrations are shown through an embedded YouTube player in privacy-enhanced mode, for which the App uses YouTube API Services, and some exercise previews are YouTube preview images. Some other pictures are loaded directly from the services that publish them, such as stock photos of meals and ingredients from Unsplash, product photos from Open Food Facts and the pictures that accompany articles, videos and podcasts in Zura's feed. Exercise pictures are loaded from our own storage at Google Cloud, which receives your IP address as our processor. When a screen with such a video or picture is shown, it is loaded from its provider, which receives technical data such as your IP address under its own privacy policy; for YouTube, this is the Google Privacy Policy.
• MuscleWiki — Exercise data and videos provided by MuscleWiki.com. These videos reach you through our servers, so MuscleWiki receives no information about you.
• Maps and weather — if you choose your area or your gym, our servers look up the place name you type, or your approximate location, with OpenStreetMap, and fetch the weather forecast for your approximate location (rounded to about one kilometre) from the Norwegian Meteorological Institute (MET Norway). These requests come from our servers, so these services receive neither your IP address nor any account identifier.
• Legal and safety reasons — where we are required to disclose information to comply with the law, a court order or a lawful request, or to protect the rights, safety or property of you, us or others.
• Business transfers — if Zura is involved in a merger, acquisition, financing or transfer of assets, Personal Information may be transferred as part of that transaction; we will require the recipient to honour this Privacy Policy and will notify you of any change of controller.

13. Where your information is stored and international transfers

• Account data and user-generated content (non-image). Your account, Zura conversation history, workout and nutrition logs and other non-image data are stored on Amazon Web Services in Frankfurt, Germany, within the European Economic Area ("EEA").
• Emails. Service emails, such as password-reset codes, are sent through Amazon Simple Email Service in Frankfurt.
• Wearable-derived health data. Data from your connected wearables is stored on AWS in Frankfurt.
• Photos and documents. Photos and documents you upload are stored on AWS in Frankfurt and can be opened only through time-limited links.
• AI processing. AI processing takes place within the European Union, as described in Section 9.
• Voice transcripts. Transcripts of your voice conversations with the Zura coach are stored on AWS in Frankfurt with your Zura conversation history. We do not store the audio.
• Live voice. Live voice conversations pass through our servers in Frankfurt and are processed by Vertex AI in the European Union. We do not store the audio.
• Website. Our website and what you send us through its forms, including screenshots attached to bug reports, are stored on AWS in Frankfurt. Our website emails your messages and pilot-programme applications to our team through Amazon SES in Frankfurt; they arrive in our business mailbox (see below). Google Analytics on our website is described in Section 20.
• Other transfers. Some providers — such as Google (Firebase, Google Analytics on our website and our business email) and Apple (push notifications) — operate global infrastructure that includes the United States. Those transfers are protected by Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework, together with supplementary measures. You can ask us for a copy of the safeguards in place by contacting info@zurahealthos.com.

Full details of each provider and the applicable safeguard are in our List of Subprocessors.

14. How we keep your information secure

We apply technical and organisational measures, appropriate to the sensitivity of health data, to protect your Personal Information against unauthorised access, disclosure, alteration and loss. These measures include:

• Encryption — data travelling between the App and our servers is encrypted (HTTPS/TLS), and our databases, their backups and the photos and documents you upload are encrypted at rest.
• Access control — access to production systems and personal data is restricted on a role-based, least-privilege basis to authorised personnel who need it to operate the Services, and administrative access requires multi-factor authentication. Authentication and credentials — account passwords are stored only in hashed and salted form, and private photos and documents can be opened only through time-limited links.
• Secrets and key management — application credentials and encryption keys are held in a managed secret stores, access to them is restricted and logged, and they are rotated on a defined schedule.
• Infrastructure — our servers run on managed cloud infrastructure in the European Union.
• Secure development and vulnerability management — we follow secure-development practices, monitor our software dependencies for known vulnerabilities, apply security updates on a defined schedule, and carry out security testing of the application and its APIs.
• Logging and monitoring — we keep a record of changes to our cloud configuration and of each access to the files you upload, and we monitor our services for errors and unauthorised activity.
• Incident response — we maintain a documented incident-response process for handling suspected security incidents and personal-data breaches.
• Vendor security — we bind our service providers by data processing agreements.
• Confidentiality — personnel with access to personal data are bound by confidentiality obligations.

Because our processing involves special category data, we follow a privacy-by-design and accountability approach: we maintain records of our processing activities and carry out Data Protection Impact Assessments for high-risk processing, including our AI, wearable-integration, image-processing and voice features.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You also help keep your account safe — please keep your credentials confidential and tell us promptly of any suspected unauthorised access. If we become aware of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours where required, and we will inform you without undue delay where the breach is likely to result in a high risk to you, in line with Articles 33 and 34 of the GDPR.

15. Your rights

Subject to the conditions and exceptions in applicable law, you have the right to:

• access the Personal Information we hold about you, and obtain a copy;
• request correction of inaccurate or incomplete data;
• request erasure ("right to be forgotten");
• request restriction of processing;
• object to processing based on our legitimate interests, and to object at any time to processing for direct marketing;
• data portability — receive certain data in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible;
• withdraw consent at any time, where processing is based on consent, without affecting processing carried out before withdrawal; and
• lodge a complaint with a supervisory authority.

You can use many of these rights in the App: edit your profile, download a copy of your data (Menu → Settings → Export my data) and delete your account (Menu → Settings → Delete Account). For any other request, contact us at info@zurahealthos.com. We will respond within the time limits set by the GDPR (normally within one month). We do not charge a fee for exercising your rights unless a request is manifestly unfounded or excessive.

If you are in the EU/EEA, you may complain to your local data protection authority or to the authority competent for us, the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany.

16. UK users

If you are in the United Kingdom, the UK GDPR and the Data Protection Act 2018 apply to the processing of your data in addition to this Privacy Policy. Your rights are substantially the same as those set out in Section 15. You may complain to the UK Information Commissioner's Office (ICO), ico.org.uk. Transfers of UK personal data outside the UK are protected by the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

17. United States — your privacy rights

This Section applies to users resident in the United States and supplements the rest of this Privacy Policy. It addresses the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the "CCPA"), and comparable laws in other U.S. states (including Virginia, Colorado, Connecticut and Utah).

Notice at collection. The categories of Personal Information we collect are described in Section 3. They include identifiers (such as name and email), account and profile information, commercial information (subscription history), internet and device activity, audio and visual information (photos you submit, and your voice during live conversations, which we do not store), and sensitive personal information — namely health information (including menstrual cycle and contraception data), information that may reveal religious beliefs (religious dietary rules, if you enter them) and account log-in credentials. We collect this information for the purposes described in Section 10, and we keep it for the periods described in Section 18.

No HIPAA application. Zura is a consumer wellness app and is not a "covered entity" under U.S. health-privacy law (HIPAA). Your Health Information is not "protected health information" under HIPAA and is governed by this Privacy Policy and the laws referenced in this Section.

No sale or sharing. In the past 12 months we have not sold Personal Information and have not shared it for cross-context behavioural advertising, and we do not do so. We do not knowingly sell or share the Personal Information of minors.

Use of sensitive personal information. We use sensitive personal information only to provide the Services you request, to secure them, and as otherwise permitted by the CCPA. We do not use it to infer characteristics about you. Because our use is limited to these permitted purposes, the CCPA "limit the use of my sensitive personal information" right does not change how we process it; you can nevertheless withdraw the consent on which our health-data processing is based at any time (Section 4).

Your U.S. state rights. Subject to your state's law, you have the right to know and access the Personal Information we have collected, to delete it, to correct it, to obtain it in a portable form, to opt out of any sale or sharing or targeted advertising (which we do not carry out), and not to receive discriminatory treatment for exercising your rights.

How to exercise them. Submit a request at info@zurahealthos.com or use the in-App account controls. We will verify your request using information associated with your account. You may use an authorised agent to submit a request on your behalf with proof of authorisation. If we decline a request, you may appeal by replying to our response.

18. How long we keep your information

We keep Personal Information only for as long as necessary for the purposes set out in this Privacy Policy:

• Account and user-generated data — for as long as your account is active.
• Account deletion. When you delete your account, we permanently delete your account data and files after 90 days; until then, you can restore your account by signing in again. Copies in our backups are deleted when those backups expire. We keep only a minimal record that the account was deleted, to show that we honoured your request.
• Health data — kept while the related feature is switched on, and deleted when you delete your account. Switching off cycle tracking deletes your cycle data, and switching off document reading deletes the information read from your documents; for other features, switching them off stops their use, and the data is deleted with your account.
• Photos and documents — kept until you delete them in the App or delete your account; the information read from your documents is deleted after 10 days. Fridge photos are not stored.
• Voice transcripts — kept with your Zura conversation history until you delete them in the App or delete your account. We do not store audio.
• Messages and applications sent through our website — kept for up to 24 months after we last dealt with them. Entries on our former website waitlist are deleted after we announce our launch, and no later than 31 December 2026.
• Diagnostic and security logs — deleted automatically: server logs after 30 days at most, access logs (which include IP addresses) after 90 days, and records of each access to the files you upload after 180 days.
• Analytics, crash and performance data — kept by Google under Firebase's default retention, about 2 to 14 months depending on the tool.
• Payment and tax records — retained for the periods required by law. In Germany, accounting and tax records are generally kept for up to 10 years under §147 of the German Fiscal Code (Abgabenordnung, AO).
• Marketing data — kept while you remain subscribed to marketing communications; after you unsubscribe we keep a minimal record so that we do not contact you again.

19. Children

Zura is not directed to children. You must be at least 18 years old to create an account and use the Services. We do not knowingly collect Personal Information from anyone under 18. If we learn that we have collected data from a person under 18, we will delete it. If you believe a minor has provided us with Personal Information, contact us at info@zurahealthos.com.

20. Our website and cookies

If you visit our website, zurahealthos.com, your IP address and technical request data, such as the page requested and your browser type, are processed to deliver the pages. The website is hosted on AWS in Frankfurt, and its server logs are deleted after 30 days. The website stores your language choice in a cookie, and your cookie-banner choice, your display theme and, while you fill in a pilot-programme application, a draft of your answers (deleted when you send it) in your browser's local storage; this is strictly necessary to provide the website you have asked for. We use Google Analytics 4, provided by Google Ireland Limited, to understand how our website is used. Google Analytics sets cookies on your device only if you select "Accept" in the cookie banner, in line with the German Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz, TDDDG). Until you select "Accept", the website does not load Google's analytics script, so nothing about your visit is sent to Google. Selecting "Accept" allows analytics only, not advertising. You can change your choice at any time through the "Cookie settings" link at the bottom of every page; if you then select "Reject", analytics stops and its cookies are deleted. Google may process this information in the United States (see Section 13). The App itself does not use advertising cookies or third-party advertising trackers.

The requirement to obtain consent under Section 25 TDDDG is not limited to our website. Where our App stores information on, or gains access to information already stored on, your device by means of software development kits or similar technologies — in particular Firebase Analytics, Firebase Crashlytics and Firebase Performance Monitoring — this equally constitutes access to terminal-equipment information within the meaning of Section 25 TDDDG. Such access requires your prior consent unless it is strictly necessary to provide a service you have expressly requested; non-essential access (in particular for analytics and performance monitoring) therefore takes place only with your consent, which you can withdraw at any time in the App’s settings.

21. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. If we make a material change, we will notify you in advance through the App or by email and, where the change requires it, ask for your renewed consent. The "Last updated" date at the top shows when the policy was last revised. Continuing to use the Services after a change takes effect means the updated Privacy Policy applies to you.

22. Contact us

For any question about this Privacy Policy or about how we handle your data, or to exercise your rights, contact us at:

Email: info@zurahealthos.com
Post: Zura Health UG (haftungsbeschränkt), Heinrich-Egger Straße 8, 85614 Kirchseeon, Germany