App: MeShape
Controller (Administrator): HEALTH TECHNOLOGIES SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ
Registered office: ul. Świętego Rocha 14A/48, 15-879 Białystok, Poland
Delivery address: ul. Świętego Rocha 14A/48, 15-879 Białystok, Poland
KRS: 0000576227 | NIP: 9662099568 | REGON: 362512946
Email: [email protected]
This Privacy Policy is informational in nature. It describes the rules for processing personal data by the Administrator in the MeShape application, including the legal bases, purposes and scope of processing, the rights of data subjects, and information on cookies and analytics tools.
1. GENERAL PROVISIONS
1.1. The Administrator of personal data collected through the MeShape application is HEALTH TECHNOLOGIES SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ (details above), hereinafter the “Administrator” and the Service Provider of the application.
1.2. Personal data is processed in accordance with applicable law, in particular Regulation (EU) 2016/679 (GDPR). Official text: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679.
1.3. Using the application, including entering into contracts, is voluntary. Providing personal data is also voluntary, except where:
- data is required to conclude and perform a contract for Electronic Services with the Administrator; or
- providing data is required by law (e.g. accounting/tax obligations).
1.4. The Administrator ensures that personal data is processed lawfully; collected for specified, legitimate purposes; adequate and accurate; retained no longer than necessary; and protected by appropriate technical and organizational measures, including protection of data transmitted electronically.
2. LEGAL BASIS FOR DATA PROCESSING
The Administrator may process personal data where at least one of the following applies:
- the data subject has given consent;
- processing is necessary for the performance of a contract or to take steps prior to entering into a contract;
- processing is necessary to comply with a legal obligation; or
- processing is necessary for the legitimate interests of the Administrator or a third party, except where overridden by the data subject’s interests or fundamental rights and freedoms.
Specific bases for particular processing purposes are described below.
3. PURPOSE, BASIS, PERIOD, AND SCOPE OF DATA PROCESSING
The purpose, basis, retention period, scope, and recipients of personal data depend on the User’s actions in the application. The Administrator may process data in particular as follows:
| Scope of processed data | Purpose | Legal basis and retention |
|---|---|---|
| Name and surname; email address; residential address (if provided) | Performance of a sales contract and/or Electronic Service contract, or steps prior to entering into such contracts | Art. 6(1)(b) GDPR. Retained for the period necessary to perform, terminate, or otherwise expire the contract. |
| Email address | Direct marketing | Art. 6(1)(f) GDPR. Retained for the duration of the legitimate interest, no longer than the limitation period for related claims (generally up to 3 years under Polish civil law). Processing stops if the data subject objects. |
| Name; email address | Marketing based on consent | Art. 6(1)(a) GDPR. Retained until consent is withdrawn. |
| Name and surname; residential address of the User/Client | Maintaining accounting records | Art. 6(1)(c) GDPR in conjunction with Art. 74(2) of the Polish Accounting Act. Retained for the period required by law (5 years from the beginning of the year following the relevant financial year). |
| Name and surname; email address; residential address | Establishing, pursuing, or defending legal claims | Art. 6(1)(f) GDPR. Retained for the duration of the legitimate interest, no longer than the applicable limitation period for claims. |
| Account and profile data (email, user ID, age/date of birth, gender, height, weight, dietary preferences, activity goals, etc.) | Providing MeShape features (account, diet plan, training, statistics, notifications) | Art. 6(1)(b) GDPR and, where applicable, Art. 6(1)(f) GDPR. Retained while the account is active and as needed after account closure for legal/settlement purposes. |
| HEALTH and fitness data (see Section 4) | Calorie balance, activity tracking, health sync, statistics, personalization of diet/activity features | Art. 9(2)(a) GDPR (explicit consent) and Art. 6(1)(b) GDPR as applicable. Retained until account deletion, withdrawal of consent/permissions, or as otherwise required by law. |
| Purchase/subscription history; device identifiers; push tokens; diagnostics/crash logs; in-app interactions; photos for AI meal scanning; chat messages | App functionality, payments, notifications, security/diagnostics, customer support/chat | Art. 6(1)(b) and/or Art. 6(1)(f) GDPR, as applicable. Retained as needed for the service, security, and legal obligations. |
4. HEALTH DATA (APPLE HEALTH AND HEALTH CONNECT)
The MeShape app may access, collect, use, store, and (where enabled) write health and fitness data (HEALTH) to provide diet, activity, and calorie-balance features.
4.1. How we access this data
- data entered by the user in the app (e.g. weight, meals, water intake, workouts, goals);
- data read from Apple Health (iOS) and/or Health Connect (Android), only after the user grants the relevant system permissions.
4.2. What HEALTH data we may collect
- steps,
- distance,
- exercise sessions / workouts,
- active and resting calories burned,
- nutrition / dietary intake,
- hydration,
- body weight,
- related activity and fitness statistics linked to the user account.
4.3. How we use this data
- to calculate daily calorie balance and activity progress,
- to display health and fitness statistics in the app,
- to personalize diet and training-related features,
- to sync selected data back to Apple Health / Health Connect when the user enables export (e.g. workouts, meals, water, weight).
4.4. Sharing and security of HEALTH data
HEALTH data is processed in connection with the user’s MeShape account and transmitted securely using encryption in transit (HTTPS). It may be shared with service providers strictly necessary to operate the app (e.g. hosting/backend). Selected profile/health context may be shared with the dietitian chat provider (Crisp) only when the user uses that feature. We do not sell HEALTH data.
4.5. Consent and control
Access to Apple Health / Health Connect is optional and based on user permission. The user may revoke permissions in system settings and/or disable health sync in MeShape. The user may request deletion of their account and related data (including HEALTH data stored by MeShape) here: https://meshape.app/meshape-account-deletion/.
5. RECIPIENTS OF DATA IN THE APPLICATION
5.1. For the proper functioning of the application, the Administrator uses external service providers that offer appropriate GDPR safeguards.
5.2. Data is shared only when necessary and only to the extent required for a given purpose.
5.3. Personal data may be transferred to the following categories of recipients:
- entities processing electronic or card payments / subscription billing (including Google Play, App Store, and RevenueCat), to the extent necessary to process payments and manage subscriptions;
- hosting / backend / infrastructure providers;
- Crisp — dietitian chat (e.g. email, nickname, selected profile/health context when chat is used);
- Sentry — crash logs and diagnostics;
- Google / Apple / Facebook — OAuth sign-in providers, to the extent they provide identity data;
- Apple Health / Health Connect — on-device health data read/write according to user permissions;
- accounting, legal, and advisory providers, where necessary;
- trusted advertising/analytics partners on websites (e.g. cookies), where applicable, including partners such as entities from the Wirtualna Polska capital group, according to their own privacy policies.
6. PROFILING IN THE APPLICATION
6.1. The Administrator may use profiling mainly to improve the application (e.g. identifying and fixing errors). The Administrator may also use profiling for direct marketing, but such decisions do not refuse access to Electronic Services.
6.2. Effects of profiling may include offering a discount, sending a promo code, reminding about unfinished purchases, or suggesting products/offers that may match the user’s interests.
6.3. Profiling involves automatic analysis or prediction of a user’s behavior in the application based on prior activity.
6.4. The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects them.
7. RIGHTS OF THE DATA SUBJECT
The User has the right to:
- access, rectification, erasure, restriction of processing, and data portability;
- withdraw consent at any time (without affecting prior lawful processing);
- object to processing based on legitimate interest, including profiling;
- object to direct marketing;
- lodge a complaint with a supervisory authority (in Poland: President of the Personal Data Protection Office — UODO).
To exercise these rights, contact the Administrator at [email protected] or via the contact form available in the application.
8. ACCOUNT AND DATA DELETION
Users may delete their MeShape account and request deletion of related data in the app (Profile → Delete account) or by emailing [email protected].
Detailed instructions: https://meshape.app/meshape-account-deletion/.
9. COOKIES, OPERATIONAL DATA, AND ANALYTICS
9.1. Cookies are small text files stored on the user’s device. More information: https://en.wikipedia.org/wiki/HTTP_cookie.
9.2. The Administrator may process cookie data to:
- identify logged-in users;
- remember form/login data;
- customize content and optimize the service;
- prepare anonymous usage statistics;
- perform remarketing/analysis of visitor behavior, including via advertising networks (e.g. Meta/Facebook), where applicable.
9.3. Most browsers accept cookies by default. Users can change cookie settings in their browser. Where consent is required, it may also be expressed via browser settings.
9.4. The Administrator may use Google Analytics (Google LLC) to analyze traffic. Data processed for this purpose may include sources/medium of visits, behavior on the site, device/browser information, IP/domain, geographic data, and demographic interest data, often in aggregated/anonymized form. Users may opt out via: https://tools.google.com/dlpage/gaoptout?hl=en.
10. FINAL PROVISIONS
10.1. The MeShape application may contain links to other websites. After navigating to other sites, the User should review the privacy policy applicable there. This Privacy Policy applies only to the Administrator’s application.
10.2. This Privacy Policy may be updated. The current version is always available at this HTML URL.
Version published: 28 July 2026