Effective date: 2026-03-28. Last updated: 2026-10-11.
1. Who we are
Wellix ("we", "us") provides an AI-powered calorie and macronutrient tracking mobile application (the "App"). The data controller is Valeria Levitan, registered as a tax-exempt sole proprietor (Osek Patur) in Israel under tax-file no. 341083038. Postal address: Anna Frank 34, Rishon LeZion, Israel. Contact: privacy@wellix.cc. We have not appointed a representative under GDPR Article 27; EEA and UK data subjects may exercise their rights by contacting us directly at the address above.
2. What we collect
- Account: email, hashed password, name, date of birth, country, language.
- Health-related profile: gender, height, weight, activity level, optional body measurements, nutrition goals, dietary preferences. We treat this as special-category data (GDPR Art. 9).
- App usage: photos of food you submit for AI analysis, recognised items, meals you log, water and weight history, nutrition recommendations generated for you, support messages.
- AI coach: the messages you write in the in-app Coach chat and the coach's replies (see sections 4 and 5).
- In-app activity: events describing how you use the app — onboarding steps completed, Premium screens viewed and the buttons tapped on them, purchase outcomes, and your optional answer to “How did you hear about Wellix?”. They are linked to your account and used only for product analytics; Premium screen views are also reported to RevenueCat, our subscription provider. We never use them for advertising or share them with advertisers, and we delete them after 12 months or when you delete your account.
- Install and usage statistics: on first launch, before you sign in, the App generates a random install identifier (not derived from any device or advertising identifier) and sends it with your platform and the App's build number, so we can count installs and measure how many installs lead to sign-ups; once you sign in, it is linked to your account. We also record the calendar days on which you use the App, to compute usage and retention statistics. Both are used only for product analytics, on the basis of our legitimate interest. We never use them for advertising or share them with advertisers, and we delete them after 12 months; when you delete your account, the link to your account is removed.
- Device: device model, OS version, language, time-zone offset, IP address, and crash logs. We serve only non-personalised ads: on iOS we do not use the advertising identifier (IDFA) or App Tracking Transparency. On Android, our advertising partner Unity (Unity Ads, delivered through its LevelPlay platform) may use the Google Advertising ID (AAID) solely to deliver non-personalised ads, cap ad frequency and prevent ad fraud; you can reset or delete it in your device settings.
- Billing: a RevenueCat subscriber ID and your subscription state. Card payments are handled by Apple or Google — we never see card numbers.
3. Why we process it (legal bases under GDPR Art. 6 / Art. 9)
- Performance of contract: creating your account, AI food recognition, generating recommendations, processing subscriptions.
- Explicit consent (Art. 9(2)(a)): processing of health-related profile and food intake data — collected via an onboarding checkbox; withdrawable at any time via account deletion.
- Legitimate interest: abuse prevention, rate limiting, security, product analytics, defending legal claims, and showing non-personalised (contextual) ads in the Free tier.
- Consent (GDPR Art. 6(1)(a)): optional push notifications — manageable in your device settings. These include an optional daily meal-logging reminder, which you can turn off in the App's Profile settings, and a reminder before a free trial ends.
- Legal obligation: tax records, fraud reporting, lawful requests from competent authorities.
4. AI processing and sub-processors
Food photographs and short textual descriptions are sent for inference to our AI providers xAI (https://x.ai, United States) and Anthropic (https://www.anthropic.com, United States); which provider handles a request depends on the feature and on our configuration. Images sent to xAI are processed transiently and, per our agreement with xAI, are not retained for model training. We do not store the raw image after analysis — only the parsed nutrition result, in your account.
When you use the in-app Coach chat, the messages you write are sent to Anthropic together with a summary of your Wellix data — logged meals, nutrition targets, recent intake, weight entries, profile basics (gender, age, height, activity level, country) and dietary preferences — so the coach can answer questions about your own data. Conversations (your messages and the coach's replies) are stored in your account until you clear the chat in the App or delete your account.
Other sub-processors:
- RevenueCat (US) — subscription state.
- Google (Firebase, Google Sign-In) (US) — push delivery, authentication.
- Unity (Unity Ads, LevelPlay) (US/Israel) — non-personalised advertising in the Free tier.
- Apple (Sign in with Apple) (US/IE) — authentication.
- Resend (US) — transactional email.
- VPS hosting in Frankfurt, Germany (EU) — application and database hosting.
Transfers from the EEA/UK to the United States rely on the EU-US Data Privacy Framework where the provider is certified, or otherwise on the European Commission's Standard Contractual Clauses with supplementary measures.
5. Retention
- Account and profile data: until you delete your account, or after 3 years of inactivity.
- Food scan jobs (AI recognition and conversation state, no raw image): up to 24 hours.
- Meal, weight, water history: until deletion.
- Coach conversations: until you clear the chat or delete your account.
- AI usage logs (no prompt text, metadata only): 12 months for billing audit.
- Install identifier and app-usage days (install and usage statistics): 12 months; the link to your account is removed when you delete your account.
- Daily database backups: 7 days.
- Records we are legally required to keep (e.g. tax invoices): the statutory retention period of the relevant jurisdiction.
6. Your rights
You have the right to access, rectify, erase, restrict, port, or object to the processing of your personal data, and to withdraw consent at any time. To exercise these rights, email privacy@wellix.cc or use the in-app "Delete account" option. You may lodge a complaint with your data protection authority.
California (CCPA / CPRA) — Do Not Sell or Share My Personal Information
California residents have the right to know, delete, correct, and to opt-out of the "sale" or "sharing" of personal information. Wellix serves only non-personalised advertising via Unity Ads and does not "sell" or "share" personal information for cross-context behavioural advertising as defined by the CPRA. We nonetheless honor opt-out requests:
You can opt out at any time:
- In the app: no action needed — the App sends a "Do Not Sell or Share" signal to our advertising partner for every user by default.
- By email: privacy@wellix.cc with the subject "CCPA Do Not Sell or Share". We respond within 15 business days.
- Via your browser's Global Privacy Control (GPC) signal — when our web surfaces detect
Sec-GPC: 1on an incoming request, we treat it as a valid opt-out for that browser without requiring any further action.
We do not knowingly sell personal information of users under 16.
Russia (152-ФЗ)
Wellix is operated from Israel and is not specifically directed at users in the Russian Federation. All personal data is stored and processed on servers located outside Russia. We are not registered as an operator of personal data with Roskomnadzor and we do not represent that the App satisfies the local-storage requirement of Russian Federal Law 152-ФЗ. Russian residents who choose to use the App do so on their own initiative; if you are not comfortable with this, please do not use the App.
Israel (Privacy Protection Law 5741-1981)
If you are an Israeli resident you have substantially the same rights as set out above for EU residents. Marketing emails require opt-in and contain an unsubscribe link in every message.
7. Children
Wellix is not intended for children under 13. We do not knowingly collect data from children under 13 anywhere, or under 16 in the EU member states whose national law sets that threshold. If we learn we have collected such data, we will delete it promptly.
8. Cookies and trackers
The App does not use cookies. We serve only non-personalised ads and do not use the Apple IDFA or App Tracking Transparency on iOS. The App uses the following on-device identifiers: Google Advertising ID (Android, used by our advertising partner only to deliver non-personalised ads, cap ad frequency and prevent fraud; controllable via OS settings), Firebase installation ID, RevenueCat anonymous ID, a random Wellix install identifier (used only for install and usage statistics, see section 2). Every ad request is flagged as non-personalised (no consent to personalised advertising, "Do Not Sell or Share"), so the App does not show an ad-consent banner.
9. Security
Data is encrypted in transit (TLS 1.2+) and at rest at the database and backup layers. Passwords are stored hashed with bcrypt. Access to production systems is restricted to authorised personnel under a least-privilege policy.
10. Data breach notification
In case of a personal data breach likely to result in a risk to your rights, we will notify the competent supervisory authority within 72 hours and inform affected users without undue delay.
11. Changes
We will publish material changes to this Policy and notify you in-app at least 30 days before they take effect. Continued use after that date constitutes acceptance.
12. Contact
Email: privacy@wellix.cc · Support: support@wellix.cc