PRIMATE

Privacy Policy

Last updated: 10 September 2026

This Privacy Policy explains how Primate Technologies Private Limited (CIN U62011RJ2026PTC116392), a company incorporated in India with its registered office at 14/184 Kaveri Path, Mansarovar, Jaipur 302020, Rajasthan, India ("Primate", "we", "us", "our"), handles your personal data when you use the PRIMATE app and our website, primate.health.

We have tried to write this in plain English, because you should actually be able to read it. The short version: we collect the data we need to run PRIMATE for you, we use AI providers to process some of it, we don't sell it, and you can see, correct, or delete it whenever you want.

One thing to be clear about up front: PRIMATE is a wellness product. It is not a medical device, and nothing in the app is medical advice, diagnosis, or treatment. Always talk to a qualified doctor about medical concerns.

---

1. What we collect

Depending on how you use PRIMATE, we collect:

• Profile details — things like your name, email address, phone number, date of birth, sex, height, weight, and your health goals, which you give us when you set up your account.
• Health and fitness data — read from Apple HealthKit (on iPhone) or Google Health Connect (on Android). We read only the categories listed in Section 3, only what you explicitly grant permission for, and you can revoke that permission at any time in your phone's settings.
• Food photos — pictures of meals you take or upload so PRIMATE can estimate what you ate.
• Lab reports — blood test results and similar documents you choose to upload so PRIMATE can read your markers.
• Cycle data — if you use PRIMATE's cycle tracking, the menstrual cycle information you log or allow us to read from HealthKit or Health Connect. This is entirely optional.
• Usage and device data — basic technical information such as your device model, OS version, app version, crash logs, and how you use the app's features, so we can keep PRIMATE working well.

If you signed up on our website's waitlist before launch, we also hold the details you gave us there (such as your WhatsApp number, and your name and email if you provided them).

2. Why we collect it

We use your data to:

• Run PRIMATE for you — calculate your Body Age, score your recovery, sleep, and capacity, analyse your meals and lab reports, and track your progress over time.
• Guide you — generate the insights, suggestions, and answers the app gives you, personalised to your data.
• Keep the service working — fix bugs, prevent abuse, and improve features based on how the app is used.
• Talk to you — send you service messages about your account, and product updates you've opted into.

We do not sell your personal information. We have never sold it, we do not rent or trade it, and we do not share it with advertisers or data brokers. We do not use your health and fitness data for advertising. Section 3 sets out exactly how data read from HealthKit and Health Connect is handled, and Section 5 names every service provider that touches your data.

3. Health Connect and HealthKit data

With your permission, PRIMATE reads health and fitness data from Google Health Connect on Android and Apple HealthKit on iPhone. These are the categories we read:

• Heart rate
• Heart rate variability
• Resting heart rate
• Steps
• Active energy
• Sleep
• Blood oxygen
• Respiratory rate
• Workouts, including workout GPS routes where a recorded workout contains route data

We ask for these categories individually, and the app reads only the ones you grant. You can review or withdraw any of these permissions at any time — in Health Connect on Android, or in the Health app's Privacy settings on iPhone. Withdrawing a permission stops further reading of that category immediately; the features that depend on it will stop working, and you can ask us to delete the data we have already read (see Section 7).

Data read from Health Connect and HealthKit is used only to provide health and wellness features to you inside the app — calculating your Body Age, scoring your recovery, sleep, and capacity, and personalising the guidance you see. Specifically, this data is:

• never sold to anyone;
• never used for advertising, marketing, or any similar purpose, including by us;
• never shared with third parties for their own purposes. The service providers described in Section 5 process it only on our instructions to deliver the app's features back to you.

4. Optional AI processing and cross-border transfers

PRIMATE's AI features — including reading a food photo, interpreting a lab report, answering your health questions, writing a daily plan note, and creating a nightly memory summary — use the AI processors named in Section 5. AI processing is optional, off by default, and begins only after you explicitly opt in.

If you opt in, the data sent for AI processing can include your messages and conversation history, sleep, heart rate variability (HRV), Capacity score, food logs and food photos, lab report images, profile information, medications, plans, cycle notes, and stress data. PRIMATE also generates a daily plan note when you open the app and a nightly memory summary. Once AI processing is enabled, those two background tasks can send relevant data to an AI processor without you opening or touching an AI feature at that moment.

You can revoke AI consent at any time in Profile › App Settings › Privacy & Data. Revoking consent stops future AI processing, including the automatic daily plan note and nightly memory summary. You do not need to delete your account to withdraw AI consent.

Our AI processors, and some other service providers, may run servers outside India — see Section 5 for which. If you opt in to AI processing, the data described above may therefore be transferred to or processed in other countries. Wherever your data goes, our providers process it on our instructions to provide their services to us, and we take reasonable safeguards to protect it.

5. Who processes your data, and what reaches them

We do not run all of this ourselves. A small number of third-party service providers process parts of your data so that PRIMATE can work. Each of them acts only as our processor: they handle your data on our instructions to provide their service to us. None of them is permitted by us to sell your data or use it for advertising.

Here is every processor that touches your data, what reaches them, why, and where they run it:

• Supabase — hosting, database, file storage, and sign-in. Supabase holds your account and effectively everything in it: your profile details, the health and fitness data read from HealthKit and Health Connect, your food photos, your lab reports, and your cycle data if you use cycle tracking. This is where PRIMATE stores your data and runs the service; without it there is no app. Hosted in Mumbai, India.
• OpenRouter — AI routing. For AI requests routed through it, OpenRouter receives the prompt and the relevant context, which can include your in-app messages and conversation history, profile information, sleep, HRV, Capacity, food logs, medications, plans, cycle notes, stress, and the content behind the daily plan note or nightly memory summary. It passes the request to the model processor that will answer it, and returns the answer. Servers outside India.
• Google Gemini, through Vertex AI — vision and general model processing. Depending on the feature, Google receives food photos, lab report images, and the text or health context needed to identify a meal, read an uploaded report, answer a question, or generate another in-app AI result. Servers outside India.
• Sentry — crash and error reporting. Sentry receives technical diagnostics when something goes wrong: device model, OS and app version, and the state of the app around a crash or error. We do not send your health data, food photos, or lab reports to Sentry. We use this only to find and fix bugs and keep the app stable. Servers outside India.
• Resend — transactional email. Resend receives your email address and the contents of the message, so that account and service emails, and the product updates you have opted into, actually reach you. Servers outside India.
• Razorpay — payments. If you buy a subscription, Razorpay receives your name, contact details, and the payment details you enter, and processes the transaction. Card and bank details go to Razorpay directly; we never see or store them. Processed in India.

AI processing happens only after you have given consent in the app, and you can withdraw that consent at any time in Settings (Profile › App Settings › Privacy & Data). Until you consent, nothing goes to OpenRouter or Google; after you withdraw consent, nothing further does.

Some of these providers run their servers outside India; Section 4 explains those transfers and how AI consent works.

We do not sell your personal information. We do not share your personal data with advertisers or data brokers, and we do not use it to build advertising profiles. We would disclose data outside the categories above only if the law required us to.

6. How long we keep it

We keep your data for as long as your account is active, so the app can show your history and trends. If you delete your account, we delete your personal data from our systems within 90 days — that window allows for backup cycles to roll over — except for the minimum we may need to keep to meet a legal obligation or to resolve a dispute. Waitlist data from before launch is deleted once it is no longer needed.

7. Your rights

Under the DPDP Act, you have the right to:

• Access the personal data we hold about you and ask how it is used. Your health and fitness data is visible to you in the app; for a copy of everything we hold, email us.
• Correct data that is wrong or incomplete. Most profile details can be edited directly in the app; for anything you cannot edit yourself, email us.
• Delete your data. You can delete your account and all of its data — including everything read from Health Connect and HealthKit — directly in the app: go to Settings → Account → Delete Account. You can also email us and we will do it for you.
• Withdraw consent at any time. AI consent is withdrawn in Profile › App Settings › Privacy & Data. Health Connect and HealthKit permissions are withdrawn in your phone's settings — Health Connect on Android, or the Health app's Privacy settings on iPhone — and take effect immediately.
• Raise a grievance about how your data is handled, with the Grievance Officer named in Section 8, and escalate to the Data Protection Board of India if you're not satisfied with our response.

To exercise any of these rights, use the in-app options above or email us at support@primate.health. We aim to respond within 48 hours.

8. Grievance Officer

As required by the DPDP Act, we have designated a Grievance Officer to handle complaints about how your personal data is handled:

• Name: Vaibhav Sharma
• Company: Primate Technologies Private Limited (CIN U62011RJ2026PTC116392)
• Address: 14/184 Kaveri Path, Mansarovar, Jaipur 302020, Rajasthan, India
• Email: team@primatehq.com

The Grievance Officer will respond to your complaint within 30 days of receiving it. If you are not satisfied with the response, you may escalate to the Data Protection Board of India.

For anything that is not a data-protection grievance — help with the app, your account, or a score — please use primate.health/support instead; that reaches us faster.

9. Security

We protect your data with reasonable security safeguards — encryption in transit, access controls, and infrastructure from established providers. No system is perfectly secure, but if a breach ever affects your personal data, we will notify you and the authorities as the law requires.

10. Children

PRIMATE is for adults (18 and over). We do not knowingly collect data from anyone under 18. If you believe a minor is using PRIMATE, contact us and we will remove their data.

11. A wellness product, not a medical one

PRIMATE is a health-and-fitness and wellness product. Its scores, estimates, and suggestions — including Body Age — are for general wellness purposes only. PRIMATE is not a medical device. It does not provide medical diagnosis or treatment, it is not medical advice, and it is not a substitute for a qualified healthcare professional. If something in your data worries you, see a doctor.

12. Changes to this policy

We may update this policy as PRIMATE evolves. If we make significant changes, we will update the date above and let you know in the app. Continuing to use PRIMATE after a change means the updated policy applies.

13. Contact

Questions or requests about this policy, or help with the app:

support@primate.health  ·  primate.health/support

Formal data-protection grievances go to the Grievance Officer named in Section 8, at team@primatehq.com.

Primate Technologies Private Limited
CIN U62011RJ2026PTC116392
Registered office: 14/184 Kaveri Path, Mansarovar, Jaipur 302020, Rajasthan, India.