Privacy Policy

Effective Date: May 14, 2026
Last Updated: May 14, 2026

1. Introduction

Welcome to keel ("we," "our," or "us"). We respect your privacy and are committed to protecting your personal data. keel is a personal health tracker that helps you monitor weight, manage a pantry, store medical documents, and get AI-powered health advice. This privacy policy explains how we collect, use, and safeguard your information.

2. Information We Collect

2.1 Information You Provide

• Account Information: Name, email, and profile via Meta-Me SSO (auth.meta-me.uk).
• Health Data: Weight readings, weight goals, milestones, and progress tracking.
• Pantry Data: Food items, quantities, and consumption history in your store cupboard.
• Medical Documents: Blood test results, sonograms, Zoe reports, and other health-related documents you upload.
• Chat Messages: Conversations with the keel AI assistant for meal planning, recipe suggestions, and health advice.
• External Health Data: If you connect Apple Health (via iOS Shortcuts) or Google Health Connect (Android), we receive weight and other health metrics.

2.2 Information We Collect Automatically

• Usage Data: Features accessed and interaction patterns within keel.
• Device Information: Device type, operating system, and app version.
• Log Data: Server logs including timestamps and technical diagnostics.

2.3 Sensitive Personal Data — Health Information

keel is a health tracker. By design, you may record and upload:

• Health data: Body weight, weight goals, BMI-related metrics
• Medical information: Blood test results, sonogram images, Zoe microbiome reports, doctor's letters
• Dietary data: Pantry contents, food consumption patterns, meal plans
• Health advice: AI-generated meal suggestions and health recommendations

Under the General Data Protection Regulation (GDPR), this is "special category data" (Article 9) that requires explicit consent and additional protection.

Our Commitment:

• We only process this data with your explicit consent (GDPR Article 9(2)(a))
• Your health data is isolated with Row-Level Security — only you can access it
• You can withdraw consent at any time and request deletion of your data
• Your data is never used to train general AI models
• We do not share your health data except as necessary to provide our services (e.g., AI processing via Google Gemini as described in Section 4.1)

Legal Basis: GDPR Article 9(2)(a) — Explicit Consent

3. How We Use Your Information & Legal Basis

Service Provision (Contract — GDPR Article 6(1)(b))

• Weight tracking with target-curve visualisation
• Pantry management and consumption tracking
• Medical document storage and viewing
• AI-powered health chat for meal/recipe/health advice
• Health data synchronisation from Apple Health and Google Health Connect

Explicit Consent (GDPR Article 9(2)(a))

For processing health data, medical documents, and AI-generated health advice. You provide explicit consent before using keel and can withdraw at any time.

Legitimate Interest (GDPR Article 6(1)(f))

For maintaining service quality, debugging, and improving keel's features. You can opt out of non-essential processing in Settings.

4. How We Share Your Information

We do not sell, trade, or otherwise transfer your personal information to third parties, except in the following circumstances:

4.1 Service Providers

• Google AI (Gemini): Your chat messages, weight history, pantry contents, and uploaded documents are sent to Gemini for AI processing (health advice, meal suggestions, document OCR, pantry classification).
  • Your content is processed but never used to train general AI models
  • AI requests are processed in real-time and not permanently stored by Google
  • Privacy: Google AI Terms
• Meta-Me Platform: Authentication via auth.meta-me.uk (shared SSO). Your session is validated on every request.
• Infrastructure: Self-hosted on Docker/OrbStack. No third-party cloud hosting — your data stays on our hardware.

4.2 Legal Requirements

We may disclose your information if required by law or in response to valid legal requests.

5. Data Security

What We Do to Protect Your Data:

• Row-Level Security (RLS): Every database query enforces user-level isolation at the PostgreSQL level. You can only access your own data.
• Authentication: Secure SSO via auth.meta-me.uk with Google OAuth or email/password.
• TLS/HTTPS: All data transmitted between your device and keel is encrypted using TLS 1.3 via Cloudflare Tunnel.
• Database Isolation: keel uses its own dedicated PostgreSQL database with a restricted runtime user (NOBYPASSRLS).

Important Limitations (Transparency):

Data Breach Notification

In the event of a data breach, we will notify you within 72 hours as required by GDPR Article 33.

6. Data Retention

• Active accounts: Retained indefinitely while you use keel
• Deleted accounts: Immediately and permanently deleted (all health data, documents, chat history)
• Backups: Database backups retained for 30 days for disaster recovery

7. Your Rights

Under GDPR, you have the following rights:

• Access: View all your health data, documents, and chat history within keel
• Correction: Edit or delete any weight reading, pantry item, or document
• Deletion: Request complete account deletion — all data permanently removed
• Portability: Request a copy of your data in a portable format
• Withdraw Consent: Withdraw consent for health data processing at any time
• Lodge a Complaint: File a complaint with the ICO or your local data protection authority

To exercise these rights, contact us at [email protected].

8. Automated Decision-Making & AI

keel uses Google Gemini to provide:

• Health-aware chat responses (meal planning, recipe suggestions, health advice)
• Document OCR (blood test parsing, sonogram analysis, Zoe report interpretation)
• Pantry item classification and tagging

No significant automated decisions: The AI provides suggestions and analysis. You remain in full control of your health decisions. AI advice is supportive, not diagnostic.

9. Contact Us