App Family Privacy Policy
The app family is fourteen apps made by Pippa LLC: the companion apps Soli, Kipi, Momo, Lumi, Rumi, Miya and Nomi, and the structured apps Vela, Aven, Onda, Sero, Talo, Elio and Aster. Pippa and Nuro have their own documents, linked from the policies page.
These apps help you keep a record of how eating and daily care are going with a health condition, and, if you choose, share that record with a care team. The short version: we use your data only to run the app, we share it with a care team only after you connect to one and agree, we never sell it, we show no ads, and we put no advertising or analytics tools in the apps.
Almost everything you save in these apps is consumer health data, so we also publish a Consumer Health Data Privacy Policy in the form Washington's My Health My Data Act and similar state laws require. If the two ever differ, the one that protects you more applies.
1. What each app lets you save
Each app saves only the kinds of entries listed for it. You choose what to log; nothing is filled in for you from other sources unless you turn on an import.
| App | For | What you can save | Optional features that send something off your phone |
|---|---|---|---|
| Soli | POTS and dysautonomia | Drinks and amounts, salt, symptoms such as dizziness, palpitations, brain fog or fainting with how strong they were, your position and what was going on (heat, illness, poor sleep, your cycle, activity), compression wear, movement, and help requests | AI chat (adults only) |
| Vela | POTS and dysautonomia | The same kinds of entries as Soli | None |
| Kipi | Diabetes | Meals and the carbs you enter, glucose readings you type or choose to import, whether a medicine was taken as planned, movement, lows and how they were handled, symptoms, help requests, and questions for your visits | Barcode lookup, AI chat (adults only), reading glucose and workouts from Apple Health or Health Connect if you allow it, speech-to-text that runs on your phone |
| Aven | Diabetes | The same kinds of entries as Kipi, typed in | None |
| Momo | Weight-loss surgery | Your program phase, drinks, protein, supplements taken or missed and why, meals, how food sat (for example nausea, reflux or food feeling stuck), and help requests | Photo naming, barcode lookup, AI chat (adults only) |
| Onda | Weight-loss surgery | The same kinds of entries as Momo | None |
| Lumi | Digestive health (IBS) | Meals and portion size, symptoms such as bloating or pain, stool form and flags (including blood or black stool), food reintroduction results, context such as sleep or stress, and help requests | Photo naming, barcode lookup, AI chat (adults only) |
| Sero | Digestive health (IBS) | The same kinds of entries as Lumi | None |
| Rumi | Recovery after a procedure | Medicines taken or missed, meals and drinks and how much you managed, symptoms such as fever, wound changes or pain, caregiver tasks, your recovery phase, and help requests | Photo naming, barcode lookup |
| Talo | Recovery after a procedure | The same kinds of entries as Rumi | None |
| Miya | Nutrition during cancer treatment | Treatment, hospital and rest days, whether you could eat, tube or IV feeds given as planned or not, symptoms such as nausea, mouth sores or fever, and which temperatures, textures and flavors you can manage | Photo naming, barcode lookup |
| Elio | Nutrition during cancer treatment | The same kinds of entries as Miya | None |
| Nomi | Eating well as an older adult | Meals eaten, partly eaten or skipped, protein foods, drinks, supplements, what made eating hard (for example chewing, cost, eating alone or feeling low), who you ate with, and symptoms | Photo naming, barcode lookup |
| Aster | Eating well as an older adult | The same kinds of entries as Nomi | None |
2. Everything else we handle
| Data | What it includes | Why |
|---|---|---|
| Account | Your email address and password (handled by our sign-in provider; we never see the password itself) | Creating and securing your account. Each app has its own separate account. |
| Age and Terms (companion apps) | Your date of birth from the age screen, and when and how the Terms were agreed (by you, or by a parent or guardian) | Blocking use under 13, asking a guardian to agree for 13 to 17, and keeping AI chat to adults. These are kept on your phone and are not sent to us. |
| Your entries | What you log, as listed above, with the time and day you chose | Saved on your phone first, then copied to our servers when you are signed in, so it is backed up and can reach a care team you connect |
| Care-team connection | The code or invite you used, the clinic, and the data-sharing agreement you signed, including when you signed or ended it | Letting a care team see your record only with your agreement, and keeping a record of that agreement |
| Messages and help requests | Messages between you and your care team, help requests you send, and any visit summary you choose to share | Talking with your care team |
| Plans from your care team | Plans, routines and reminders your care team sets for you | Showing you the plan your team made |
| Device | An installation identifier, the app and its version, platform, language, time zone, and a push notification token if you allow notifications | Sync, and notifications at sensible times. Notification text is kept general so it does not reveal health details on a lock screen. |
| Subscription status | Whether you have an active Pro subscription, confirmed through Apple or Google | Turning on Pro extras. Apple or Google takes the payment; we never see your card. |
| Network details | Your IP address when the app talks to our server | Security and daily limits on the AI features |
What stays on your phone
- Meal photos are kept on your phone. They are not uploaded to our servers.
- AI chat history (Kipi, Soli, Momo and Lumi) is kept on your phone for your account, and you can clear it at any time. It is not shared with your care team.
- Your date of birth and Terms acceptance in the companion apps, as above.
- Kipi's speech-to-text runs on your phone.
3. Optional features that send something off your phone
- Photo naming (Momo, Lumi, Rumi, Miya, Nomi). Off until you turn it on: the first time you take a meal photo, the app asks whether to turn it on, and you can change your answer in Settings at any time. When it is on, a copy of the meal photo is sent once, through our server, to our AI provider OpenAI, which replies with a short food name. We do not keep the photo or log it, and the reply never includes amounts, calories or judgments. The original photo stays on your phone.
- Barcode lookup (Kipi, Momo, Lumi, Rumi, Miya, Nomi). Only the barcode number is sent, from our server, to Open Food Facts, a public food database, to find the product name and the label values the app shows. We do not log the barcode, and Open Food Facts does not receive your account or entries.
- AI chat (Kipi, Soli, Momo, Lumi; adults only). What you type is sent through our server to OpenAI (model gpt-4o-mini) to write a reply, and checked by OpenAI's moderation service. Our server does not store the conversation and does not log what you type. See AI chat safety.
- Apple Health or Health Connect (Kipi). If you allow it, Kipi reads glucose readings and workouts so you don't have to type them. It does not write to Apple Health or Health Connect. Readings you import are saved like other entries.
OpenAI processes this content only to answer the request. Under our API terms it is not used to train their models, and we never use your data to train AI models.
4. What we never do
- We never sell your data.
- We show no ads and share nothing with advertisers or data brokers.
- The apps contain no advertising or analytics tools from other companies.
- We never use your data to train AI models.
- We collect no precise location and do no facial recognition.
5. Who can see your data
- You.
- A care team you connect. Nothing reaches a care team until you connect to a participating program (with a code or an invite) and sign a data-sharing agreement. After that, the team can see what you log in that app, your help requests, messages, and anything you choose to share. You can end the agreement in the app, and the team's access stops. Every time the team reads your record, our server checks that the agreement is still in place.
- Crisis alerts. If AI chat detects that you may be in crisis and you have a connected, consented care team, a confidential alert goes to them. Without one, no one is alerted and the app shows crisis resources to you directly.
- Service providers that run the apps for us, only on our instructions. See section 6.
- The law. We disclose data only when validly required, and only what is required.
6. Service providers
| Provider | What they do for us |
|---|---|
| Amazon Web Services | Database and sign-in |
| Cloudflare | Our application server |
| OpenAI | AI chat replies, safety moderation and photo naming |
| Open Food Facts | Barcode lookups (receives the barcode number only) |
| Apple and Google | Push notifications, app store subscriptions, and on Android, Google's on-device barcode and label scanning |
The full list is on our subprocessors page. We have no affiliates.
7. How long we keep it
- While your account is open: we keep your entries so the app works.
- When you delete your account: it is closed right away, you are signed out, any connected care team loses access, and the data on your phone for that account is erased. Your data on our servers is permanently erased within 30 days.
- What we must keep: records of the data-sharing agreements you signed or ended, the deletion itself, and any audit records of care-team access, for about six years, as the law requires. These are kept against an internal identifier, not your name or email.
How to delete: Delete your account.
8. Children and teens
- Under 13: the apps are not for children under 13. The companion apps ask for a date of birth before anything else and stop there for anyone under 13.
- 13 to 17: a parent or legal guardian must agree to the Terms for the teen, and the teen confirms they want to use the app.
- AI chat is for adults only. In Kipi, Soli, Momo and Lumi, anyone the age screen shows as under 18 does not see the chat. Instead they see: "Chat with [app] is for adults. Your care team is here for questions."
- A parent or guardian may ask what we have collected about their teen, withdraw consent, and ask us to delete it, at pippa.app.general@gmail.com.
9. Security
Data is encrypted in transit and stored in access-controlled cloud systems. Care-team access is checked against your data-sharing agreement on every read. No system is perfectly secure. If a breach affects your data we will tell you without unreasonable delay and within the time the law requires.
10. Your rights
Wherever you live, you can ask to see and get a copy of your data (the apps also let you export your record), correct it, delete it, and withdraw consent, including ending a care team's access. We respond within 45 days (extendable once by 45 days with notice). If we say no, you can appeal by replying, and we answer appeals within 45 days. We will never treat you differently for using these rights. Because we sell nothing and show no ads, there is nothing to opt out of under "do not sell or share" laws.
11. Changes
If we make a material change we will tell you in the app before it applies, and we will not use data already collected in a new way without your consent. The date at the top shows the current version.
12. Contact
Pippa LLC, pippa.app.general@gmail.com.