Linnea Privacy Policy

This Privacy Policy explains how Linnea handles your information. It applies to the Linnea apps for iPhone, iPad, Apple Watch and Android and to the services behind them (together, “Linnea”). Linnea is provided by its developer, as named on Linnea’s App Store and Google Play listings (“we,” “us” or “our”).

1. Information we collect

• Account. Your email address or the identifier Apple or Google gives us when you sign in with them, and an account number. We don’t receive your Apple or Google password.
• Profile and settings. Your name if you give one, date of birth, sex, height, weight, dietary preferences and allergies, goals, the medications and supplements you add with their schedules, and your reminders and other settings.
• What you log. Food, drinks and water, medications and supplements taken or skipped, exercise, sleep, mood, symptoms, body measurements, blood pressure, pulse, blood glucose, body temperature and notes, with when and where each entry was made (for example, a widget, Siri or Apple Watch). Data entered with earlier versions of Linnea, such as medication doses or menstrual cycle phase, stays in your account.
• What Linnea creates. Your scores, trends, reviews, meal plans and other results, including AI results.
• Photos, recordings and food searches. Photos and voice recordings you submit to log an entry (see section 3), and the words or barcode numbers you send to look up a food, which aren’t stored with your account. A photo of a nutrition label is read on your device and isn’t uploaded.
• Health records. If you use Records, your records and their attachments are encrypted on your device before they’re uploaded, with keys that only you and the people you share them with hold. We can’t read them; we see only technical details such as sizes and dates.
• Family. What you and your family members choose to share (see section 4).
• Purchases. Subscription details from Apple or Google, such as the product, dates and status, but not your payment card details.
• Device and usage information. Your app version, language and time zone, identifiers for sending notifications and verifying entries from widgets, Siri and Apple Watch, and crash reports and usage events, which never include values, medication names, notes or what you type and aren’t linked to your account. You can turn them off in You › AI features and data use.
• Messages to us. Your email address and what you write.

2. Apple Health and Health Connect

With your permission, Linnea reads data such as sleep, activity and workouts, heart rate, body measurements, vital signs, mindfulness and water from Apple Health on iPhone or Health Connect on Android, and uses it on your device for your score, goals and trends. Raw samples stay on your device. Our servers keep only daily totals, your workouts and nights of sleep as timeline entries, the profile details you confirm and the names and times of medications you import.

With your permission, Linnea also saves what you log for yourself, such as food, water, workouts, sleep, weight and blood pressure, to Apple Health or Health Connect, and keeps it in step when you edit or delete an entry. It never saves medications or entries for a family member. What Linnea saved stays there, under Apple’s or Google’s terms, until you delete it there, even if you delete your Linnea account.

We use this data only to provide Linnea’s features to you. We never sell it or use it for advertising, marketing or data mining, and we share it only as described in section 6. You can withdraw your permissions at any time in the Health app or Health Connect, and stop saving any type in You › Apple Health or You › Health Connect.

3. AI features

Some features use AI services run by other companies, currently OpenAI and Anthropic in the United States, to produce a result you ask for, such as recognizing a meal in a photo, understanding an entry your device can’t, answering Ask Linnea, or writing meal plans and review summaries.

• We ask first. The app shows what each feature sends and to whom, and nothing is sent until you agree. You can turn AI features off at any time in You › AI features and data use; the rest of Linnea keeps working.
• Only what the feature needs. For example, the photo, text or recording you submit; your question with the related entries, daily totals and scores; or your goals, food preferences, allergies, age range, body-size range and daily totals. We don’t add your name, email address or date of birth (anything you include in your own text, photo or recording is sent with it). Raw Apple Health and Health Connect data, health records, entries for managed members and what family members share with you are never sent.
• On your device when possible. Where your device can read a typed entry or transcribe speech itself, nothing is sent.
• Provider terms. The providers process requests on our behalf. Under our agreements, they may not use them to train their general models, and they may keep them for up to 30 days to monitor for abuse.

4. Family

A family in Linnea has up to six members, who join by invitation. Every member sees the family’s name and each member’s display name, role and status.

• Sharing. Members with their own account choose what to share and with whom, such as their Linnea score, medication status (how many scheduled medications were logged, never names or doses), sleep, steps, weight trend, emergency card and records folders. Shared records stay encrypted.
• Care alerts and greetings. A member can turn on care alerts about themselves, which tell the members they choose only that a scheduled medication hasn’t been logged. Greetings are fixed phrases, and family notifications show only the kind of event.
• Shared meals and family recipes. A member can send a meal they logged, with its dishes and their nutrition, to members they choose; we keep it for up to 48 hours or until each of them responds, and each person saves their own portion. Recipes you choose to remember (a dish’s name, ingredients and weights) are kept for your family, or only for you, and any member can delete a family recipe.
• Managed members. An organizer can keep a profile for someone who doesn’t use Linnea, such as a child or an older parent. It’s encrypted end to end, can be opened only by the organizer and co-managers, and is never saved to Apple Health or Health Connect or sent to an AI provider.

Only add or share information about other people if you’re allowed to. What a member has already seen or saved can’t be recalled.

5. How we use information

We use information to:

• provide Linnea, including your log, scores, trends, reminders, plans, records, family features, export and sync;
• save the entries you choose to Apple Health or Health Connect, and provide the AI features you turn on;
• verify subscriptions, keep Linnea secure, prevent abuse and fix problems;
• understand in aggregate how Linnea is used, to improve it (leaving out accounts that turned analytics off); and
• respond to you, comply with the law and enforce our terms.

We don’t sell your personal information, use it for advertising, or track you across other companies’ apps and websites.

6. How we share information

We share personal information only:

• with service providers that host our servers and database in the United States, process AI requests (see section 3), and process crash reports and analytics with health and contact details removed. They act only on our instructions and are bound by contract to give your information the same or equal protection as this policy;
• with Apple and Google, which provide sign-in, purchases, Apple Health, Health Connect, Siri and notification delivery under their own terms (our notifications carry only fixed text or a signal to update, never your health information);
• with Open Food Facts, a public product database, which receives only the number of a barcode our database doesn’t have, never information about you;
• with family members you choose, and wherever you send an export or another file;
• if required by law, or if needed to protect the rights, property or safety of our users, us or others; and
• as part of a merger, acquisition, financing or sale of assets, subject to this policy.

7. Your choices and rights

In the app, you can export your data (You › Export all data; the exported file isn’t encrypted, including any health records you add to it), correct or delete entries, delete your account (You › Account › Delete account), turn AI features, analytics and crash reports off (You › AI features and data use), choose what you share with your family (You › What I share), and manage Apple Health or Health Connect (You › Apple Health or You › Health Connect).

Depending on where you live, you may have the right to access, correct, delete or get a copy of your personal information, to object to or restrict its processing, and to withdraw your consent. For anything you can’t do in the app, email privacy@arcturatech.com. We may need to verify your request, and we won’t discriminate against you for exercising your rights. You may also complain to your data protection authority.

8. Retention and deletion

We keep your information while your account exists and as long as we need it to provide Linnea, and longer only where the law requires it or to resolve disputes.

• Deleting data. You can delete individual entries and records in the app at any time.
• Deleting your account. In You › Account › Delete account, or by email if you can’t open the app. Your account is deactivated at once and, within 24 hours, deleted with its data, including your entries, health records, the meals you shared and the recipes you created. If you organize a family, the organizer role passes to another member, and managed members whom nobody else manages are deleted. Copies in encrypted backups are deleted as the backups expire.
• What stays. Your App Store or Google Play subscription (cancel it there) and what Linnea saved to Apple Health or Health Connect.
• Leaving a family. When you leave a family or are removed from it, sharing in both directions stops.

9. Security

We use reasonable technical and organizational measures to protect your information, including encryption in transit and on your device, restricted access, and end-to-end encryption for health records and managed members. No system is completely secure, so we can’t guarantee absolute security. Keep your records recovery code safe: we don’t have it, so if you lose it and all your devices, your records can’t be recovered.

10. Children

Linnea isn’t directed to children under 13, or under the higher minimum age that applies where you live, and we don’t knowingly collect their personal information. A parent or guardian can keep a managed member profile for a child, who doesn’t use Linnea or have an account. If you believe a child has given us personal information, email privacy@arcturatech.com and we’ll take steps to delete it.

11. International transfers

Our servers are in the United States, and our service providers may process information in other countries, so your information may be processed outside the country where you live, under laws that may allow authorities there to access it. Where the law requires, we use appropriate safeguards, such as contractual protections.

12. Changes to this policy

We may update this policy. We’ll post the new version with a new effective date and, for material changes, give notice as required by law, for example in the app.

13. Contact us

For privacy questions or requests, including for our privacy officer, email privacy@arcturatech.com. If you live in Washington, Nevada or another U.S. state with a consumer health data law, our Consumer Health Data Policy (arcturatech.com/linnea/consumer-health-data.html) also applies to you.