Privacy Policy
Effective date: September 3, 2026 Last updated: October 8, 2026
1. Scope
This Privacy Policy describes how the personal data of the people who use the Molec app for iPhone and Apple Watch (the “Application”) is collected, used, shared and protected, as well as the rights they have over that data. It also applies to the molec.app pages from which the account is managed and to the website’s waiting list.
It does not apply to third-party services that the user decides to connect (Apple Health, WHOOP), which are governed by their own privacy policies.
Where processing is based on consent, that consent is requested expressly, separately and on an informed basis within the Application.
2. Data controller
| Controller | Yodai LLC |
| General and data protection contact | [email protected] |
For any matter relating to this Policy or to the exercise of the rights described in section 13, you may write to the address above.
3. General principle: data lives on the device, with a copy in the account
Training activity, plans, food logs, daily metrics and the conversation history with the assistant are stored in a database located on the user’s own device.
An account is required to use the Application. Workout logging works without an internet connection; the assistant, meal estimation, food search and social features require one.
Copy in the account. So that users can recover their plan, history and tracking when they sign in again, on the same iPhone or on another one, the Application keeps a copy of that database in private storage of the Controller, linked to their account. The copy is updated automatically and when signing out; the latest copy and the previous one are kept, only the account itself can read it, and it is deleted when the account is deleted. Apple Health permissions are granted on each device and do not travel with the copy. Purpose: to preserve and restore the user’s data. Legal basis: performance of a contract and, for the health data it contains, explicit consent (Art. 9(2)(a) GDPR).
Apart from that copy, data only leaves the device in the cases described in sections 4 to 9: the assistant, social features and the relationship with a trainer (if enabled), the WHOOP connection, food search and notifications. In each case the purpose and the legal basis are identified.
4. Categories of data processed
4.1 Data provided by the user
| Category | Content | Purpose | Legal basis |
|---|---|---|---|
| Account data | Email address and password (stored encrypted by the authentication provider); Apple or Google identifier when signing in with those accounts | Creating and maintaining the account; access from another device | Performance of a contract (Art. 6(1)(b) GDPR) |
| Profile data | Name, sex, date of birth, height, weight, experience level, available days and minutes, equipment, goals (including target weight), activity outside the gym and declared physical limitations or discomfort | Building the training plan and the nutrition targets | Performance of a contract; explicit consent for health data (Art. 9(2)(a) GDPR) |
| Training logs | Sessions, exercises, sets, loads, repetitions, perceived exertion, duration and how the user felt at the end | Tracking progress and adjusting the plan | Performance of a contract |
| Food logs | Foods and dishes logged, quantities and times; photos of dishes; voice dictation | Calculating calories and macronutrients | Explicit consent |
| Communications with the assistant | Messages and attachments sent to the assistant | Generating the response (section 7) | Performance of a contract |
| Social features (optional) | Alias, display name, friend requests and groups | Sharing progress with accepted contacts (section 5) | Explicit consent |
| Relationship with a trainer (optional) | Invitation code, messages, weekly check-ins (energy, mood, discomfort or pain, and difficulties) and habits checked off. If the user is a trainer: name, profile photo and invitation code | Follow-up by a trainer chosen by the user (section 6) | Explicit consent |
| Progress photos | Those the user may have uploaded in earlier versions of the Application, which no longer allows new ones to be uploaded | Visual follow-up by the trainer, only if the user allows it | Explicit consent |
Voice dictation is transcribed on the iPhone itself; the audio does not leave the device. Photos of dishes are sent to the assistant to estimate their content and are not kept on any server.
4.2 Data from connected health services
Apple Health. With prior express authorization, the Application reads: sleep (duration, stages, efficiency and schedule), heart rate variability, resting and daytime heart rate, heart rate recovery after exertion, respiratory rate, estimated VO₂ max, steps, active and basal energy, exercise minutes, flights climbed, weight, and workouts recorded by other apps with their metrics (speed, power, cadence and strokes).
The Application writes to Apple Health the workouts that the user completes in it (type, duration and energy), so that they count toward their activity. During a workout, the Apple Watch app also records heart rate and active energy, and saves them to Apple Health together with the workout. If the user allows it, when a workout ends the Application also saves to Apple Health the place where it took place (to within about 100 metres); that location is only used on the device, is not sent to our servers and is deleted from the Application as soon as the workout is in Apple Health.
WHOOP. If the user connects it, the Application obtains their recovery, their sleep (stages, efficiency, respiratory rate and schedule), their cycles, their weight and their WHOOP identifier. Access credentials are stored encrypted on the server and never reach the device; the data is downloaded to the device, and the server keeps the WHOOP identifier and the sleep notifications it sends in the morning. The Application does not write data to WHOOP. Disconnecting WHOOP from the Application revokes the permission in WHOOP and deletes the credentials, the link and the notifications from the server.
Purpose: to adapt training to the user’s daily condition and to show their progress.
Legal basis: explicit consent (Art. 9(2)(a) GDPR), which may be withdrawn at any time without affecting the lawfulness of prior processing. When the connection with a health service is revoked, new data stops being imported; data already imported remains on the device until the user deletes it from Settings.
4.3 Data generated by use of the Application
| Category | Purpose | Legal basis |
|---|---|---|
| Session identifier | Linking the data to the account rather than to a device | Performance of a contract |
| Installation identifier (random) | Delivering to each installation its own assistant responses and notifications | Legitimate interest in ensuring the service (Art. 6(1)(f) GDPR) |
| Notification identifier | Sending the notifications expressly accepted | Consent |
| Assistant technical error report | Detecting and fixing errors: time, screen, type of error and duration, without the content of messages | Legitimate interest |
| Technical usage data: one record per account and day with the approximate country, region and city of the connection (inferred by the network from the IP address, which is not stored for this) and the version of the Application and of iOS. Kept for twelve (12) months and then deleted automatically | Producing internal usage statistics (how many people use the Application, from where and with which version) to maintain and improve it. Only consulted as counts, in an internal dashboard that only the Controller can access, and never shared | Legitimate interest (Art. 6(1)(f) GDPR) |
5. Friends and groups
Social features are voluntary and remain inactive until the user sets an alias and accepts a friend request.
Once enabled, a daily summary is uploaded to the server: plan adherence, streak, recovery, average calories and macronutrients, aerobic capacity, hours of sleep, weight, training volume, last session with its exercises and loads, and achievements. Accepted friends can see plan adherence, streak, recovery, average nutrition, aerobic capacity, last session and achievements.
- Granular control. Each visible block (streak, nutrition, recovery, capacity, achievements and last session) can be hidden from friends independently, with immediate effect.
- Never visible to friends. Hours of sleep, weight, individual meals, conversations with the assistant and declared limitations or discomfort.
- Restriction by design. Access is controlled in the database itself through row-level security policies: no one other than accepted friends can read that data, whatever the means of access.
- Groups. Whoever creates a group can only add their own friends, and the data remains visible only between direct friends.
- Reversibility. Ending a friendship cuts off access immediately.
- Alias. The alias and the display name can be found by other users, because that is the intended search mechanism. The email address is never visible.
Legal basis: explicit consent.
What is uploaded for the social features is also used, only as aggregated counts (how many workouts, meals or completed days there are in a period, never those of one person), for internal usage statistics of the Application in the dashboard described in section 4.3.
6. Relationship with a trainer
The user may voluntarily link with a trainer by entering the trainer’s invitation code. From that moment the trainer sees the user’s name and alias and, by default, their training: sessions, exercises, sets and loads from the last thirty days. Sleep, nutrition, weight and progress photos are only visible to the trainer if the user turns them on in “What I share”, and the user can turn them off at any time.
For this purpose, the sessions from the last thirty days and the meals from the last seven days (name and time) are uploaded to the server; the trainer only accesses what the user has turned on. The trainer also sees the weekly check-ins, messages and habits that the user sends or checks off.
When the user leaves a trainer, the trainer stops seeing new data. The history of messages and weekly check-ins already exchanged remains accessible to both parties while the account exists; its deletion can be requested at [email protected].
The profile photo of anyone who registers as a trainer is public, so that their clients can recognize them.
What is uploaded for the trainer is also used, only as aggregated counts and never those of one person, for the internal statistics in section 4.3.
Legal basis: explicit consent (Art. 9(2)(a) GDPR for health data).
7. The assistant
Messages addressed to the assistant are transmitted to a server of the Controller and, from there, to Anthropic, which produces the response with its Claude models. Along with the message, the context needed for a relevant response is sent: profile, goals, declared limitations and discomfort, current plan, workouts with their sets and loads, recent health metrics, the day’s and the week’s nutrition, and a summary of previous conversations.
Once a day, when the Application is opened, the assistant uses that same context to review how the user is doing in order to adjust the day’s session, without the user having to write to it.
Attached photos and documents are converted to text so that the assistant can read them, and the original file is deleted once this is done. The server keeps the response in memory for up to fifteen (15) minutes so that it can be delivered if the connection drops; its technical logs do not include the content of messages. The conversation history is stored on the user’s device.
8. Food search
To identify a product by its barcode or to search for a food by name, the Application queries the open database Open Food Facts. Only the barcode or the search text is sent, without personal data or identifiers of the user. Product images are loaded from the Open Food Facts servers.
9. Recipients
Personal data is not sold, transferred or disclosed for advertising or commercial profiling purposes. The Application does not include third-party advertising, analytics or tracking technologies.
Data is disclosed exclusively to the following providers, which act as processors under documented instructions:
| Provider | Service provided | Data processed |
|---|---|---|
| Supabase | Authentication, database and storage (hosted in the European Union) | Account data, copy of the Application’s data (section 3), data shared with friends and trainer, encrypted WHOOP credentials, notification identifiers, progress photos and technical usage data (section 4.3) |
| Anthropic | Generating the assistant’s responses | Message content and associated context (section 7) |
| DigitalOcean | Hosting of the assistant’s server | Message content in transit |
| Cloudflare | Delivery network and protection for the assistant’s server and for molec.app | Traffic in transit and IP address |
| Expo (650 Industries) | Sending notifications | Notification identifier and notification text |
| Resend | Sending account emails (confirmation and recovery) | Email address |
| Apple | Distribution of the Application, Sign in with Apple and notification delivery | Apple identifier and notification identifier |
| Sign in with Google, through a service of the Controller itself | Google identifier and email address | |
| WHOOP | Only if the user connects it | Access credentials and WHOOP data (section 4.2) |
| Open Food Facts | Open food database | Barcode or search text, without personal data |
Data may be disclosed to competent public authorities where there is a legal obligation to do so.
10. Retention and deletion
Data is kept for as long as the account remains active. Technical usage data (section 4.3) is deleted after twelve (12) months, or earlier if the account is deleted.
The user can delete their account and all of their data, both on the device and on the server, from Settings (“Delete my account”), or the account and the server data from molec.app/cuenta. In both cases deletion is immediate: the account, the shared data, the files and the messages with the trainer are deleted, and the permission granted to WHOOP is revoked. Deletion can also be requested at [email protected], in which case it is carried out within a maximum of thirty (30) days.
The responses that the assistant’s server keeps in memory are deleted automatically within fifteen (15) minutes. Signing up for the website’s waiting list is independent of the account: removal from it can be requested at [email protected].
11. Security measures
Technical and organizational measures appropriate to the risk are applied, including: encryption of communications in transit; row-level access control in the database; credentials for connected services stored in an encrypted vault on the server, with no access from the device; and private storage spaces separated per user.
No information system is completely secure. In the event of a security breach that poses a risk to the rights and freedoms of the people affected, it will be notified in accordance with Articles 33 and 34 GDPR.
12. International transfers
The database is hosted in the European Union. Some providers (Anthropic, DigitalOcean, Cloudflare, Expo, Resend and Google) may process data in the United States or in other countries outside the European Economic Area. In such cases, the transfer relies on the EU-U.S. Data Privacy Framework when the provider participates in it or, failing that, on the Standard Contractual Clauses approved by the European Commission.
13. Rights of data subjects
In accordance with Regulation (EU) 2016/679, data subjects have the following rights:
- Access to the personal data being processed.
- Rectification of inaccurate or incomplete data.
- Erasure of the data when it is no longer necessary.
- Restriction of processing in the cases provided for by law.
- Objection to processing based on legitimate interest.
- Portability of the data in a structured, commonly used and machine-readable format.
- Withdrawal of consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
Exercising these rights is free of charge and can be requested at [email protected]. Requests will be answered within one month, which may be extended by two further months in view of their complexity, in which case the data subject will be informed.
Data subjects also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es).
14. Minors
The Application is not directed at people under sixteen (16) years of age, and their personal data is not knowingly collected. If such processing comes to light, the data will be deleted without undue delay.
15. Changes
This Policy may be amended. Any material change will be communicated through the Application before it takes effect. The date of the last update appears at the top of the document.