Get the app

Privacy Policy

Last updated: 5 July 2026

This Privacy Policy describes how Fivehy Ltd ("we", "us" or "our") collects, uses, shares and protects information when you use the Nutrivo website and mobile application (together, the "Services"). We are committed to handling your data in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, where applicable, the EU General Data Protection Regulation (EU GDPR).

1. Data Controller

The data controller for personal data processed through the Services is Fivehy Ltd (registered in England and Wales, company no. 17216524), with its registered office at Office 4689 A L, 182-184 High Street North, Area 1/1, East Ham, London, E6 2JA, United Kingdom. You can reach us at nutrivo@fivehy.com, or the company directly at hello@fivehy.com.

2. What We Collect

We process the following categories of personal data:

  • Account data: email address and an authentication secret (stored as a salted hash by our auth provider).
  • Profile data: details you choose to enter such as name, date of birth, sex, height, activity level and goals.
  • Diary data: meals you log (food names, portions and nutrition values), water intake and fasting periods.
  • Body metrics: weight history and body measurements you choose to record.
  • Meal photos: photos you submit for AI scanning. The photo is sent to our AI provider (Google) for analysis and may be retained in our storage so it remains visible in your diary history.
  • Subscription data (Premium users only): if you purchase Nutrivo Premium, Apple or Google sends us an opaque purchase token, the status of your subscription (active, lapsed, refunded), and its expiry date. We do not see your card or bank details — payment is handled entirely by Apple or Google. See our Terms of Service for the full subscription terms.
  • Technical data: device and browser type, operating system, app version, website pages viewed, approximate location, website performance measurements, and standard server logs (including IP address, used for security and abuse prevention). Optional website analytics are subject to the choices described below.

Health, fitness and body data may constitute special-category data under UK GDPR. We process it only on the basis of your explicit consent (given by signing up and using the relevant features) and only to provide the App's functionality to you.

3. Device Permissions

The App asks for certain device permissions. Each is optional and is only requested when you first use a feature that needs it; you can grant or revoke any of them at any time in your device settings.

  • Camera: to take a photo of a meal for AI scanning.
  • Photo library: to choose an existing photo from your device for AI meal scanning.
  • Notifications: to send reminders you enable (such as meal-logging, water and fasting reminders). We only send notifications if you turn them on.
  • Apple Health (HealthKit): on iOS, to read and/or write health and fitness data such as weight, nutrition and energy, with your permission. Health data is accessed on your device only for the features you enable. In line with Apple's requirements, data obtained from HealthKit is never used for advertising or marketing, is not shared with our AI provider, and is not sold or disclosed to any third party.

Denying or revoking a permission only disables the related feature; the rest of the App continues to work.

4. How We Use Your Data

  • To create and manage your account.
  • To store and display your diary, metrics and history.
  • To run AI meal-photo scanning when you submit a photo (the results are returned to your device and saved in your diary).
  • To understand website usage and improve the reliability, performance and security of the Services.
  • To respond to your support requests.
  • To comply with legal obligations.

We do not sell your personal data, we do not use it to serve advertising, and we do not allow our AI provider to use your submitted photos or data to train their models.

5. Legal Bases (UK GDPR and EU GDPR)

  • Contract: to provide the Services and the features you sign up for.
  • Consent: for processing of health and body-related data, AI meal-photo scanning, and optional website analytics where consent is required.
  • Legitimate interests: security, fraud prevention, diagnostics and improving the service.
  • Legal obligation: where the law requires us to process data.

6. Sub-processors

To operate the Services we rely on the following sub-processors. Each is bound by appropriate data-protection terms.

  • Supabase Inc. (USA) — database, authentication, storage and serverless functions hosting. Your account, diary, body metrics and uploaded photos live here.
  • Google LLC (USA) — Gemini API, used to analyse meal photos you submit. Per Google's API terms, paid Gemini API requests are not used to train their models.
  • Open Food Facts — public food database. We send queries such as food names or barcodes; we do not send personal information.
  • Apple Inc. and Google LLC (App Store / Google Play) — distribute the App, process Nutrivo Premium subscription payments on our behalf, and may provide aggregate store analytics and crash data to us.
  • Vercel Inc. (USA) — hosts this website and provides the optional Web Analytics and Speed Insights services described below.

6A. Website Analytics and Storage

The Nutrivo website can use Vercel Web Analytics and Vercel Speed Insights to understand aggregate page usage and real-world website performance. For visitors located in the European Union, these optional services remain disabled unless the visitor accepts analytics through our consent banner. Visitors can change that choice at any time using Cookie settings in the website footer.

We also use limited first-party browser storage to remember a language chosen by the visitor, a dismissed language suggestion for the current session, and the analytics-consent choice. These preferences are used only to provide the requested website experience. Full details, purposes and retention periods are listed in our Cookie Policy.

7. International Transfers

Some of our sub-processors are based outside the United Kingdom and the European Economic Area. Where personal data is transferred outside the UK / EEA, we rely on appropriate safeguards such as the UK International Data Transfer Agreement, the EU Standard Contractual Clauses, or equivalent adequacy mechanisms.

8. Retention

We keep your personal data for as long as your account is active or as needed to provide the App. When you request deletion of your account, we begin a 30-day grace period during which your account is frozen and your data is held pending deletion. If you sign back into the App within those 30 days, the deletion is automatically cancelled. After 30 days, your account and all data linked to it are permanently and irreversibly deleted — including from our backups — except where we are required by law to retain certain records (for example, financial records) for a longer period.

9. Your Rights

Subject to UK GDPR or EU GDPR, as applicable, you have the right to:

  • Access the personal data we hold about you.
  • Have inaccurate data corrected.
  • Have your data erased ("right to be forgotten").
  • Restrict or object to certain processing.
  • Request data portability.
  • Withdraw consent at any time, where processing is based on consent.
  • Lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk, or with the data-protection authority in the EU country where you live or work.

To exercise any of these rights, email nutrivo@fivehy.com. Account and data deletion are also available directly from inside the App, and step-by-step instructions live on a dedicated Delete your Nutrivo account page.

10. Children

The App is not directed to children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us so we can delete it.

11. Security

We use reasonable technical and organisational measures to protect your data, including HTTPS for all network traffic, row-level security on our database so that you can only access your own data, hashed authentication secrets, and the principle of least privilege for our systems. No method of transmission or storage is fully secure, however, and we cannot guarantee absolute security.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The latest version will always be available at this URL with the updated date at the top. Material changes will be communicated in the App where reasonable.

13. Contact

For privacy-related questions, write to nutrivo@fivehy.com.

Company details

Nutrivo is a product of Fivehy Ltd, a company registered in England and Wales under company number 17216524.

Registered office
Office 4689 A L, 182-184 High Street North, Area 1/1, East Ham, London, E6 2JA, United Kingdom
Email
hello@fivehy.com
Website
fivehy.com