Last updated: 2 September 2026 · Versión en español
The data controller is REGENERA CLINIC WORLD, SL (tax ID B63757538), based in Barcelona, Spain. For anything related to privacy, including exercising your rights: consulta@regeneraclinic.com.
This app processes health data, which the GDPR treats as a special category. We only process it with your explicit consent (Art. 9(2)(a) GDPR), which you give when you create your account and can withdraw at any time.
| Data | Why | Legal basis |
|---|---|---|
| Email address and password (stored as a cryptographic hash, never in the clear) | To create your account, sign you in, recover access and send you service notices | Performance of a contract |
| Profile: year of birth, sex, height, weight | To compute your indicators and personalise your recommendations | Explicit consent (health) |
| Daily entries: meals, sleep, activity, hydration, mood, habits and free-text notes | To build your tracking and your Healthspan | Explicit consent (health) |
| Health questionnaires you complete in the app | To score them and show you your progress | Explicit consent (health) |
| Photos of meals you take | To identify which food groups are on the plate. The image is not stored: it is analysed and discarded; only the result is kept | Explicit consent (health) |
| Barcodes (EAN) of packaged food you scan | To look up the product's composition. Only the code travels, never your identity | Performance of a contract |
| Apple Health (HealthKit), if you authorise it on your iPhone: steps, activity, sleep and its stages, heart rate variability, resting heart rate and blood oxygen | To make use of what your iPhone or Apple Watch already measures, so your day and your Healthspan are computed without you writing it down | Explicit consent (health) |
| Wearable data, if you connect one (Polar): heart rate, resting heart rate, heart rate variability, breathing rate, sleep and nightly recovery | To bring them into your tracking | Explicit consent (health) |
| Your messages to the clinical team and to in-app support, and the content of video consultations | To care for you and to keep a clinical record of what you are told | Explicit consent (health) and legal obligation (clinical records) |
| Appointments: date, professional and associated contact details | To manage your schedule and notify you | Performance of a contract |
| Subscription and payments: plan, status, purchase history | To give you access to paid features and to invoice | Performance of a contract and legal obligation (tax) |
| App usage: which screens you open and which actions you complete | To understand what works and what doesn't, so we can improve the app | Legitimate interest (our own, aggregated measurement) |
Some data never leaves your phone: the trusted contact you can set is stored only in your device's local storage and is never sent to our servers. Voice dictation runs entirely on your device, using a model we serve from our own server: the audio is never sent anywhere, only the text you choose to save.
We do not sell your data and we do not share it with anyone so they can advertise to you. We work with providers acting as processors, with the minimum necessary and under contract:
| Provider | What it receives | Why |
|---|---|---|
| Stripe (Ireland / USA) | Your email and the amount. Your card details are captured by Stripe directly: we never see or store them | To charge the subscription |
| Anthropic (USA) | The text of your question or the photo of your plate, without your name or your email | To classify the meal photo and to help draft and triage support requests. Not used to train models |
| Polar Electro (Finland) | Only if you connect your band: the authorisation to access your Polar account | To bring your metrics into the app. You can disconnect it whenever you want |
| Open Food Facts (France) | Only the scanned barcode | To look up the food's composition |
| Jitsi Meet | The audio and video stream for the duration of the video consultation | To carry the call. Sessions are not recorded |
| Google Fonts | Your IP address when the app loads | To serve the interface typefaces |
| Hosting and email providers | The data held in your account and the emails we send you | To operate the service |
The app contains no third-party analytics or tracking pixels (no Google Analytics, Meta, Hotjar or similar): usage measurement is our own and stays on our servers.
On iPhone, the app can read data from Apple Health. You grant that access yourself, item by item, on the iOS permission screen, and you can revoke it at any time under Settings › Privacy & Security › Health on your phone. The app only reads: it never writes anything to Apple Health.
We make three specific commitments about that data:
If you delete your account, the data we hold that came from Apple Health is deleted along with everything else. What lives in the Health app on your iPhone is yours, and we do not touch it.
Stripe and Anthropic may process data in the United States. Those transfers rely on the European Commission's Standard Contractual Clauses and on each provider's additional safeguards. You can ask us for a copy of those safeguards at consulta@regeneraclinic.com.
For as long as your account is open. When you delete it under Settings › Delete my account, we immediately and irreversibly erase your profile, your daily entries, your questionnaires, your wearable data, your sessions and your consents.
Two exceptions, required by law:
Outside those two cases, deleting your account means deleting the data, not hiding it.
At any time you can exercise your rights of access, rectification, erasure, objection, restriction and portability, and withdraw your consent without affecting processing carried out before. The fastest route for erasure is the app itself (Settings › Delete my account); for anything else, write to consulta@regeneraclinic.com and we will reply within one month at the latest.
If you believe we have not handled your data properly, you can complain to the Spanish Data Protection Agency (aepd.es).
The app computes indicators and suggests recommendations from what you record. These are wellbeing pointers: they do not replace a diagnosis and they produce no legal effects on you, and any clinical guidance is always reviewed by a member of the healthcare team.
The app is intended for people aged 18 and over. We do not knowingly collect data from minors. If we identify a minor's account, we delete it.
Traffic travels encrypted (HTTPS), passwords are stored using key-derivation functions — never in the clear —, clinical team access is limited by role and logged, and we apply data minimisation in everything we send to each provider.
If we change anything material, we will tell you in the app or by email before it takes effect. The last updated date appears at the top of this page.
Regenera Clinic Delta · Versión en español · Subscription terms · Legal notice