Privacy Policy

Effective date: 20 October 2026

We take your privacy seriously. This Privacy Policy explains how we treat your personal data when you use the Dose & Lose app and website (the "Services"). Where we rely on your consent, for example for health data, the AI features or text messages, we ask for it separately in the app, and you can withdraw it at any time.

Your use of the Services is also subject to our Terms of Use, which include this Privacy Policy. Terms we use here without defining them have the meaning given in the Terms of Use.

We may change this policy as the Services change. If a change is material, we will tell you in the app before it takes effect and, where the law requires, ask for your consent again. The effective date at the top shows the current version.

1. What this policy covers

Dose & Lose is operated by Petros IT Solutions SRL, Bucharest, Romania (CUI RO45358387) ("we", "us"). We are the controller of the personal data described in this policy. For anything related to privacy, write to office@doseandlose.com.

Dose & Lose is a wellness and tracking app for people using GLP-1 medications. We are not a medical provider, the app is not a medical device, and we do not give medical advice. We are not a "covered entity" or "business associate" under the US Health Insurance Portability and Accountability Act (HIPAA), so the data you give us is not "protected health information" under HIPAA. We protect it as described in this policy and as the EU General Data Protection Regulation (GDPR) and other privacy laws require.

"Personal data" means any information that identifies or relates to a particular person, including what some laws call "personal information", "personally identifiable information" or "sensitive personal information".

2. Personal data we collect

This table lists the categories of personal data we collect, why, and who receives it:

What we do not collect: your precise location, your contacts or your advertising identifier. We do not use advertising or cross-app tracking tools.

3. Why we use personal data

Providing, personalizing and improving the Services

• Creating and managing your account.
• Providing your plan, logs, reminders, progress, widgets and the other features you use.
• Processing subscriptions and restoring purchases.
• Personalizing the app and the AI companion's answers to your situation.
• Providing support.
• Understanding how the Services are used, testing and improving features, and fixing bugs.
• Protecting the Services from fraud, abuse and security incidents.

Telling you about Dose & Lose

• Sending notifications you allowed, including occasional offers.
• If you gave us your phone number and agreed to it, sending texts and making calls about completing your subscription (see section 8).

Corresponding with you

• Answering your messages and support requests.
• Sending sign-in links and important notices about your account or these policies.

Other permitted purposes

We may also use and disclose personal data to meet legal requirements and enforce our terms: to comply with the law, a court order or other legal process; to prevent, detect and investigate security incidents and illegal or prohibited activity; to protect the rights, property or safety of you, us or others; to enforce our agreements with you; to respond to claims that content violates someone's rights; and to resolve disputes.

We will not collect new categories of personal data, or use your data for purposes that are materially different from those described here, without telling you first and, where required, asking for your consent.

4. Legal bases (EEA, UK and Switzerland)

Under the GDPR and similar laws, we rely on these legal bases:

You can withdraw a consent at any time without affecting processing that happened before. Withdrawing consent for health data means we can no longer provide the app to you, so the way to withdraw it is to delete your account.

5. Where personal data comes from

From you

• When you set up the app, create an account or use its features.
• When you type into text fields, answer questions in onboarding, or chat with the AI companion.
• When you post comments, reviews, reactions or other community content.
• When you email us or otherwise contact us.

Automatically

• From your device when you use the app, for example the device data, push token and diagnostic events described above.
• Through cookies on the website, only if you accept analytics (see section 11).

From third parties

• Services you connect: Apple Health or Health Connect, for the data types you allow.
• Sign-in providers: Apple or Google, when you sign in with them.
• App stores and our subscription management provider: the status of your subscription.

6. Who we share personal data with

Service providers

These parties help us provide the Services or perform functions on our behalf, under contracts that limit them to processing personal data on our instructions. They include:

• Hosting, database, storage and technology providers.
• Communication providers that deliver emails, push notifications, and the texts and calls you agreed to.
• Analytics providers for app usage and, if you accept it, website traffic.
• Crash reporting, security and fraud prevention providers.
• Support and customer service tools.
• Payment and subscription providers: Apple, Google and our subscription management provider.
• Sign-in providers: Apple and Google, when you sign in with them.
• AI providers that power the AI companion, food analysis and voice input, only with your consent (see section 7).

Many of these providers are in the United States (see section 14).

When you search for a food or scan a barcode, our server looks it up in public food databases (USDA FoodData Central and Open Food Facts). Only the search text or barcode is sent, never your identity.

Parties you authorize

We share data with other services only when you ask us to.

Legal obligations

We may disclose personal data for the purposes described under "Other permitted purposes" in section 3.

Business transfers

If we are involved in a merger, acquisition, bankruptcy or sale of all or part of our business, personal data may be transferred to the party that takes over. This policy will continue to apply to it.

Data that is not personal data

We may create aggregated, de-identified or anonymized data from the personal data we collect, by removing what makes it identifiable. We may use such data to analyze and improve the Services, including our AI features, and share it for lawful business purposes, but never in a way that could identify you. We do not use data from Apple Health or Health Connect for this.

We do not sell personal data or share it for advertising.

7. AI features

Dose & Lose uses AI to power the AI companion chat, food photo and label analysis, and voice input. The AI companion gives general, educational information about GLP-1 medications, nutrition and lifestyle. It does not give medical advice, diagnose conditions, or recommend treatments or dose changes, and it does not replace your doctor or pharmacist. Do not use it in an emergency: call 112 (EU), 911 (US) or your local emergency number.

These features are powered by third-party AI providers, which the app names when it asks for your consent. Before you use any of these features, the app explains what is shared and asks for your consent. If you decline, nothing is sent.

When you use them, we send the provider only what the feature needs:

• AI companion: your message and photos, recent conversation, memories, your health profile and recent daily logs, so answers fit your situation.
• Food analysis: the food photo, label or description you ask us to analyze.
• Voice input: the recording, for transcription.

The providers process this data on our behalf under their commercial terms. They do not use it to train their models, and they may keep it for a limited time (up to 30 days) to detect abuse before deleting it. AI answers are generated automatically and can be wrong; they are for information and education only.

8. Text messages and calls

During onboarding, the "Save your progress" page asks for your first name and a US phone number. Giving them is optional: you can skip the page, and consent is not required to buy a subscription. If you give them, you agree that we and our service providers may send you recurring marketing texts and calls about completing your subscription, including by automated technology and AI or prerecorded voice.

• We use your name and number only for these texts and calls and to keep a record of your consent.
• Message frequency varies. Message and data rates may apply.
• Reply STOP to any text to opt out, or HELP for help. You can also email us to opt out.
• Your number is shared only with the providers that send the texts and place the calls. We do not sell it or share it for others' marketing.

9. Apple Health and Health Connect

If you connect Apple Health (iOS) or Health Connect (Android), the app can read steps, walking distance, active energy, workouts, weight, height, date of birth, sex, nutrition and water. It only reads: it does not write anything to Apple Health or Health Connect. You choose which types to allow in your phone's settings and can change this at any time.

Data from Apple Health and Health Connect:

• is used only to provide the app's features to you;
• is never used for advertising, marketing or data mining, and never sold;
• is shared only with the service providers that run the app and, after your consent, with the AI providers for the AI companion;
• is not stored in iCloud by us.

Our use of data from Health Connect follows the Health Connect Permissions policy, including its Limited Use requirements.

10. Community features

What other members can see

When you use community features, such as commenting, posting food reviews, reacting or voting in polls, what you post is visible to other members, together with your username and profile picture. We cannot control what other people do with content you make visible, including copying or screenshotting it. Think carefully before sharing details about your medication, symptoms, side effects or health. Your health logs, progress photos and AI chats are never shown to other members.

When you delete your content or your account, we remove it from Dose & Lose, but we cannot delete copies other people have already made.

Usernames

You take part in the community under a username you choose, which does not have to be your real name. We keep the link between your username and your account internally. We cannot guarantee anonymity: other members may be able to guess who you are from what you post, and we may have to disclose the account behind a username when the law requires it, for example in response to a court order.

Moderation and reports

To keep the community safe, we may review and remove content that breaks our Terms of Use. For this we may process the content and its metadata, reports from other members, and account and device data, using automated tools and human review. When you report content, we may review the reported content and relevant information about both you and the member you reported.

Your controls

You can delete your own comments and reviews, and report or block other members, in the app.

11. Cookies and website analytics

The app does not use cookies or advertising trackers. The website uses no cookies by default. If the website shows an analytics bar and you accept, it uses a third-party analytics service, which sets cookies to count visits and clicks and to understand which guides and tools are useful. It never records what you type into a tool, and its advertising features are turned off. Your choice is saved in your browser for 180 days, and you can change it at any time with the "Privacy choices" link in the website footer. You can also block or delete cookies in your browser settings.

To learn more about cookies and how to manage them, see allaboutcookies.org.

12. Data security

We protect personal data with physical, technical, organizational and administrative measures suited to the type of data and how we process it. Data is encrypted in transit. Photos are stored in private storage and served only through links that expire within minutes. Access to production systems is limited to the people who need it.

You can help by keeping your phone and sign-in methods secure. No method of sending or storing data is completely secure, but we work to protect your data and will notify you and the authorities of a breach as the law requires.

13. Data retention

We keep personal data only as long as we need it for the purposes in this policy, considering where it came from, why we collected it and how sensitive it is. We may keep it longer where the law requires it or to resolve disputes. For example:

• Your account data is kept while you have an account. When you delete your account in the app, we erase your data from our database immediately and remove your photos from storage within minutes. If you are suspended or banned from the community when you delete your account, we keep a one-way keyed hash of your sign-in identifiers (your Apple or Google account ID and verified email address) together with the restriction's type and end date, so that the restriction applies again if you return; we delete it when the restriction ends. Reports you have made about other members' content are kept after you delete your account, without your name or account, so that moderators can finish reviewing them; the record that you filed a report is deleted after about an hour.
• Your name and phone number from the "Save your progress" page are kept, with the record of your consent, until you delete your account. If you opt out, we stop texting and calling you and keep only what we need to respect your opt-out.
• Backups of our database are kept for up to 7 days, after which deleted data is gone from them too.
• Crash reports are kept for up to 90 days.
• Server logs are kept for a short period, at most 30 days.
• Support emails are kept as long as needed to resolve your request and for up to 2 years after.
• Purchase records are kept by Apple, Google and our subscription management provider under their own policies and as required by tax and accounting law.

We may keep anonymized or aggregated data that no longer identifies you.

14. International transfers

Several of our providers are in the United States. Where a provider is certified under the EU–US Data Privacy Framework, transfers rely on that framework; otherwise they rely on the European Commission's Standard Contractual Clauses, with additional safeguards where needed.

15. Children

Dose & Lose is for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you are under 18, do not use the Services or send us personal data. If we learn we have collected data from someone under 18, we will delete it as quickly as possible. If you believe a child has given us personal data, contact us at office@doseandlose.com.

16. Your rights (EEA, UK and Switzerland)

Under the GDPR and similar laws you have the right to:

• access your personal data and get a copy of it;
• correct inaccurate data;
• have your data erased (you can do this yourself by deleting your account in the app);
• restrict or object to processing based on our legitimate interests;
• receive your data in a portable format;
• withdraw consent at any time.

To exercise these rights, email office@doseandlose.com. We answer within one month. You can also complain to the Romanian data protection authority, ANSPDCP (www.dataprotection.ro), or to the authority where you live or work.

17. US state privacy rights

If you live in a US state with a consumer privacy law, such as California, Colorado, Connecticut, Delaware, Iowa, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah or Virginia, you may have the rights below, subject to the conditions and exceptions in your state's law. Questions about this section can go to office@doseandlose.com.

• Access: to confirm whether we process your personal data and to get a copy of it. Oregon residents may also ask for a list of the specific third parties, other than individuals, to which we have disclosed it.
• Deletion: to have us delete the personal data we collected about you.
• Correction: to have us correct inaccurate personal data.
• Portability: to get your personal data in a machine-readable format, where technically feasible.

Sensitive personal data

Health data and some account data are "sensitive" under certain state laws. We describe what we collect and why in section 2, and we process health data only with your consent. California residents: we use and disclose sensitive personal data only for the purposes permitted by section 7027(m) of the CCPA regulations, so we do not offer a separate right to limit it.

Automated decisions and profiling

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects on you.

Sale and targeted advertising

We do not sell personal data, including as defined in Nevada law, and we do not share it for cross-context behavioral or targeted advertising. California residents: we do not disclose personal data to third parties for their direct marketing (Cal. Civ. Code §§ 1798.83–1798.84).

No discrimination

We will not deny you the Services, charge you a different price or give you a lower quality of service because you exercised your privacy rights.

How to make a request

Email office@doseandlose.com. Include enough information for us to verify that you are the person the data is about (for example, the email address of your account), and describe your request clearly. You do not need an account to make a request. We use the information in your request only to verify you and respond. We answer within the time the law requires and do not charge a fee unless requests are excessive, repetitive or clearly unfounded, in which case we will explain why first.

Where your state allows it, you can ask an authorized agent to make a request for you. We may ask the agent for your written permission and ask you to verify your identity.

Appeals

If we decline your request, you can appeal by replying to our answer or emailing office@doseandlose.com with enough information to identify you and the original request, and the reason for your appeal. We will respond within the time your state's law requires. If we deny your appeal, you can contact your state's Attorney General.

18. Changes to this policy

We may update this policy. If a change is material, we will tell you in the app before it takes effect and, where the law requires, ask for your consent again. If you keep using the Services after the change takes effect, the updated policy applies. The effective date at the top shows the current version.

19. Contact

If you have questions about this policy, how we use your personal data, or your rights, contact us:

Petros IT Solutions SRL, Bucharest, Romania (CUI RO45358387)
Email: office@doseandlose.com
Website: doseandlose.com