Introduction
Jilpy ("we", "our") is a mobile application designed to help users track their GLP-1 medication therapy and monitor related health parameters.
This Privacy Policy describes how we collect, use, store, and protect your personal and health data when you use Jilpy.
IMPORTANT: Jilpy collects and processes sensitive health data. Using the app requires your explicit consent to the processing of this data as described in this policy.
1. Data Collected
1.1 Account Information
- Email: Used for authentication and essential communications
- Full name: To personalize the user experience
- Profile photo: Optional, for account personalization
- Password: Stored in encrypted form (hash) via Supabase Auth
- Apple ID: If you use "Sign in with Apple" for authentication
1.2 Health Data (GDPR Special Category Art. 9)
Jilpy collects the following health data that you voluntarily enter:
GLP-1 Medication Tracking:
- Injection date and time
- Medication dosage (mg)
- Injection body area (with specific position)
- Perceived discomfort level (1-10)
- Perceived fear/anxiety level (1-10)
- Personal notes
Body Parameters:
- Body weight (kg), Height (cm), BMI (automatically calculated)
- Circumference measurements: waist, hips, chest, arms (right/left), thighs (right/left)
- Body composition: body fat %, lean mass %, body water %, protein %
Symptoms and Conditions:
- Daily symptoms with intensity (scale -5 to +5)
- Energy and appetite levels
- Descriptive notes
Supplements:
- Supplement name, dosage, intake date
1.3 Apple Health / Google Health Connect Integration
With your explicit consent, Jilpy can read the following data from Apple Health (iOS) or Health Connect (Android):
- Body weight (kg)
- Body fat percentage (%)
- Lean mass (kg, converted to %)
Important:
- The integration is optional and disabled by default
- You can enable/disable it at any time from Settings
- Data is only read when the app is opened
- We do not write data to Health/Health Connect
1.4 Location Data
- Approximate location used ONLY to show nearby pharmacies when explicitly requested
- Location is not permanently stored
- You can deny location access in your device settings
1.5 Usage Data
- Technical information: app version, operating system, device type
- Anonymous app usage statistics
1.6 Photos and Images (Camera)
- Profile photo (optional) and screenshots for reports
- Stored on secure servers and associated only with your account
- Camera access requires your explicit permission
1.7 Device Sensors
- Accelerometer: Used for the "Shake to Report" feature
- Accelerometer data is not stored or transmitted
1.8 Notifications
- Injection reminders, daily symptoms, weekly weight
- You can enable/disable each notification type from Settings
2. Legal Basis for Processing (GDPR)
- Explicit consent (Art. 6(1)(a) and Art. 9(2)(a)): For sensitive health data
- Contract performance (Art. 6(1)(b)): To provide the app's core services
- Legitimate interest (Art. 6(1)(f)): To improve the app and prevent abuse
3. How We Use Your Data
3.1 Primary Purposes
- Provide you with the GLP-1 therapy tracking service
- Generate personalized charts and statistics
- Save your recording history
- Send you reminder notifications (if enabled)
- Sync data from Apple Health / Health Connect (if authorized)
- Show you nearby pharmacies (if requested)
3.2 What We Do NOT Do
- We do not sell your data to third parties
- We do not share health data with third parties
- We do not use health data for profiling
- There are no advertisements in the app
- We do not use data for research without separate consent
- We do not write data to Apple Health or Health Connect
4. Data Sharing with Third Parties
4.1 Essential Service Providers
Supabase — Backend, EU servers, TLS/AES-256 encryption (Privacy Policy)
Google Maps Platform — Coordinates only for pharmacy search (Privacy Policy)
Apple HealthKit / Google Health Connect — Read-only with consent
4.2 No Advertising
Jilpy does not contain advertising. We do not use any advertising SDK and do not share data with advertisers.
4.3 No Other Sharing
We do not share data with other third parties, social networks, data brokers, or aggregators.
5. Data Storage and Security
- Supabase database on servers in the European Union
- Encryption in transit (TLS 1.3) and at rest (AES-256)
- Passwords hashed with bcrypt (non-reversible)
- Row Level Security (RLS): each user can only access their own data
- Session tokens with automatic expiration
- ISO 27001 certified servers
Retention: Data is kept as long as the account is active. Deletion within 30 days of account removal. Backups up to 90 days.
6. Your Rights (GDPR)
- Access (Art. 15): Request a copy of all your data
- Rectification (Art. 16): Correct inaccurate data
- Erasure (Art. 17): Delete account and data (Settings → Delete Account)
- Portability (Art. 20): Export data in JSON/CSV
- Objection (Art. 21): Object to specific processing
- Withdraw Consent (Art. 7(3)): Withdraw consent at any time
- Complaint (Art. 77): File a complaint with the Privacy Authority (www.garanteprivacy.it)
7. App Permissions
| Permission | Purpose | Required |
|---|---|---|
| Internet | Data synchronization with server | Yes |
| Notifications | Injection, symptom, weight reminders | No |
| Location | Nearby pharmacy search | No |
| Camera | Profile photo, report screenshots | No |
| Apple Health / Health Connect | Read weight, body fat, lean mass | No |
| Sensors (Accelerometer) | Shake to Report | No |
8. Minors
Jilpy is not intended for minors under 16 years of age. If we discover that a minor has provided personal data, we will delete it immediately.
9. International Transfers
Your data is stored on servers in the European Union. We do not transfer data outside the European Economic Area (EEA).
10. Changes to the Privacy Policy
We may update this Privacy Policy periodically. We will notify you of significant changes via in-app notification or email.
11. Cookies and Tracking Technologies
- Session tokens for authentication
- Local preferences saved on the device
- Anonymous analytics for aggregate statistics
We do not use third-party cookies for cross-site advertising tracking.
12. Contact
Data Controller: Leonardo Toro
Email: info@jilpy.app
App: Settings → Report a Problem
Guaranteed response within: 30 days (GDPR Art. 12)
13. Jurisdiction
This Privacy Policy is governed by Italian law and EU Regulation 2016/679 (GDPR).
By using Jilpy, you confirm that you have read, understood, and accepted this Privacy Policy, including explicit consent to the processing of sensitive health data for the purposes described.