Lio

Overview

Lio (“we,” “our,” or “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and protect your information when you use our mobile application and services.

Information We Collect

Information You Provide

• Account Information: Email address, name, and profile details
• Health & Nutrition Data: Meal logs, dietary preferences, goals, weight entries, and health metrics
• User Content: Food descriptions, meal photos, and chat messages

Information Collected Automatically

• Usage Data: App interactions, feature usage, screen views, and session information
• Device Information: Device type, operating system, app version, and device identifier
• Coarse Location: Country and region based on IP address (not GPS)
• Audio Recordings:Voice recordings for meal logging and personalization. Audio is transcribed by our AI service, then retained for up to 90 days to power Lio's Memory (see below) before being automatically deleted from raw storage.
• Photos: Food and menu images for nutrition analysis and personalization. Raw copies used for Memory extraction are retained for up to 90 days before being automatically deleted; confirmed meal photos remain in your meal history until you delete them.

Health Data (Apple HealthKit / Google Health Connect)

With your explicit permission, we may read:

• Exercise Data: Active calories burned, steps, and exercise sessions

This data is used solely to provide personalized nutrition recommendations based on your activity level. When Health Sync is enabled, we sync exercise summaries and workout metadata to our servers (Supabase) so you can view history and insights across devices. Our app only reads data from Apple HealthKit and Google Health Connect — it never writes to them. Health data is not used for advertising, is not stored in iCloud, and is not sold or shared with third parties.

Lio's Memory (Personalization)

To make Lio's coaching feel like it actually knows you, the app builds a long-running Memory from your meals, voice notes, photos, and chat messages. Memory is always on for signed-in accounts and is the foundation for the personalized insight cards you see on your dashboard.

What goes into Memory

• Raw artifacts: the voice clips, meal photos, menu photos, chat images, and text snippets you submit. These are stored in a private, per-user bucket and are only readable by your own account.
• Episodes: short, normalized summaries of events (a confirmed meal, a chat turn, a weight entry, a daily pattern, a milestone) together with the local date and timezone.
• Vector embeddings: mathematical representations of each episode that let Lio find similar past moments and reason over your history.
• Evidence and insights: the patterns Lio extracts from your episodes (for example, recurring foods, eating-out frequency, meal timing, sugar/sodium proxies, mood signals, exercise context, weight trends, preferences, goal context) and the insight cards generated from them.
• Insight feedback: when you mark an insight as helpful or not helpful, we use that signal to refine future suggestions.

How Memory is processed

Memory extraction runs in our backend as a queue of background jobs. Voice, image, and text content is sent to Google Gemini to produce summaries, evidence, and embeddings; the rest of the pipeline (storage, queue, embeddings index, insight thresholds) runs on Supabase. Memory data is never used for advertising, is never sold, and is never shared with third parties beyond the AI providers listed in this policy.

Retention

• Raw artifacts (voice audio, raw photos used for extraction, etc.): retained for up to 90 days, then automatically deleted from our storage by our cleanup workers.
• Episodes, evidence, insights, and feedback: retained while your account is active so Lio can keep learning from your history. They are deleted when you clear your memory or delete your account.

Your controls

• Clear Memory:you can wipe Lio's Memory at any time without deleting your account. This removes your episodes, evidence, insights, and insight feedback, and queues all remaining raw artifacts for deletion from storage.
• Dismiss insights: you can dismiss any individual insight card from the dashboard.
• Account deletion: deleting your account automatically performs a full Memory purge in addition to removing your meals, weights, chat history, and other account data.

How We Use Your Information

We use your information to:

• Provide AI-powered nutrition analysis and recommendations
• Process voice recordings to identify meals and nutrition information
• Analyze food photos to estimate nutrition content
• Track your progress toward health goals
• Build Lio's Memory and generate personalized insights (see the “Lio's Memory” section above)
• Personalize your experience based on dietary preferences
• Send push notifications (meal reminders, streak alerts, achievements)
• Improve our AI models and app functionality
• Analyze app usage to improve features (via analytics)

Permissions We Request

Third-Party Services

We use the following third-party services to provide and improve our app:

AI Service Provider

• Google Gemini: Processes voice recordings, images, and chat messages for nutrition analysis, Memory extraction (episodes, evidence, insights), and to generate vector embeddings used for personalization
• Data Shared: Voice audio, meal photos, menu photos, chat images, chat messages, and text descriptions
• Purpose: AI-powered food recognition, nutritional analysis, and personalized insight generation

Authentication & Database

• Supabase: Secure account management and data storage
• Data Shared: Account information, meal logs, user preferences
• Purpose: User authentication and data persistence

Analytics

• Amplitude: Anonymous usage analytics to improve the app
• Data Collected: Device ID, app interactions, feature usage, coarse location (country/region from IP)
• Purpose: Understanding how users interact with the app to improve features
• Note: Analytics data is not used for advertising or tracking across other apps

Push Notifications

• Expo Push Notification Service: Delivers push notifications to your device
• Data Shared: Push token, notification content
• Purpose: Delivering timely reminders and updates

Data Sharing

We DO NOT sell your personal information. We only share data with the third-party services listed above, and only as necessary to provide app functionality. All third-party providers are contractually obligated to protect your data.

Data Security

We implement industry-standard security measures:

• End-to-end encryption for data transmission (HTTPS/TLS)
• Secure cloud storage with Row Level Security (RLS) so only your account can read your data
• Regular security audits and updates
• Memory raw artifacts (voice audio, raw photos) are stored in a private, per-user bucket and are automatically deleted after up to 90 days
• Meal photos are stored securely with signed URLs
• Rate limiting and server-side checks protect against abuse of Memory writes and AI calls

Your Rights

You have the right to:

• Access: View all your personal data stored in the app
• Correct: Update inaccurate information in your profile
• Delete: Delete your account and all associated data
• Export: Request a copy of your data
• Opt Out: Disable analytics, notifications, or specific features
• Revoke Permissions: Withdraw camera, microphone, or health data access at any time
• Clear Memory:Reset Lio's Memory at any time without deleting your account. This deletes your episodes, evidence, insights, and insight feedback, and queues all remaining raw artifacts for deletion from storage.

To exercise these rights, contact us at privacy@heylio.ai or use the in-app account deletion feature.

Data Retention

• Account Data: Retained while your account is active
• Meal Logs: Retained to provide historical tracking and insights
• Chat History: Retained to provide context for AI conversations
• Voice Recordings (raw audio):Retained for up to 90 days to power Lio's Memory and then automatically deleted from raw storage. Transcripts derived from your audio may be kept as part of your meal log or chat history.
• Photos: Confirmed meal photos are stored for your meal history and deleted when you delete the meal or your account. Raw photos used solely for Memory extraction are retained for up to 90 days and then automatically deleted.
• Memory (episodes, evidence, insights, feedback): Retained while your account is active so Lio can keep personalizing. Deleted when you use Clear Memory or delete your account.
• Exercise Data: Stored with your account to power insights; deleted when you delete your account
• Analytics Data: Retained by Amplitude per their data retention policy

When you delete your account, all personal data is permanently removed from our systems within 30 days.

Children's Privacy

Lio is not intended for children under 13. We do not knowingly collect personal information from children under 13. If we discover that a child under 13 has provided us with personal information, we will delete it immediately.

International Users

Your data may be processed in the United States and European Union where our service providers operate. By using Lio, you consent to the transfer of your information to these jurisdictions.

Updates to This Policy

We may update this Privacy Policy periodically. We'll notify you of significant changes through the app or email. Continued use of the app after changes constitutes acceptance of the updated policy.

Contact Us

If you have questions about this Privacy Policy or your data:

• Email: privacy@heylio.ai
• Website: https://heylio.ai

Compliance

This policy complies with:

• Apple App Store Guidelines
• Google Play Developer Policy
• California Consumer Privacy Act (CCPA)
• General Data Protection Regulation (GDPR)
• Children's Online Privacy Protection Act (COPPA)