Privacy Policy

1. Introduction

SomaZeus ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and web services.

2. Information We Collect

Personal Information

• Name and email address
• Date of birth and biological sex
• Physical measurements (height, weight, body composition)
• Health and fitness data (vitals, lab results, bloodwork panels)
• Workout and nutrition logs
• Supplement and medication information
• Medical history, allergies, and injury records you choose to enter
• Reproductive stage, pregnancy plans within six months, and breastfeeding status
• Training goals and performance preferences

Usage Data

• App usage patterns and preferences
• Device information and identifiers
• IP address and browser type
• Commercial funnel events and advertising attribution identifiers, only where described below

Pro Analysis Data

• Queries you submit to Pro Analysis features
• Automated analysis responses and recommendations
• Health and performance context used to personalise those responses (see §7 for the full list)

3. How We Use Your Information

• Provide personalised recommendations and Pro Analysis health insights
• Generate automated analysis of your bloodwork, nutrition, training, and vitals
• Track and analyse your fitness progress
• Send notifications and reminders
• Improve our services and user experience
• Process payments and manage subscriptions
• Communicate with you about updates and features

4. Data Security

We use HTTPS/TLS to protect data while it travels between your device or browser and our public service. Selected sensitive database fields, including lab results and flags, are encrypted at rest using AES-256-GCM. We also use authentication, access controls, security updates, and internal security testing. No system or transmission is completely secure, and we cannot guarantee absolute security.

5. Your Rights (GDPR)

If you are in the European Economic Area (EEA), you have the following rights under GDPR:

• Access: Request a copy of your personal data
• Correction: Request corrections to inaccurate data
• Deletion: Request deletion of your personal data
• Restriction: Request restricted processing in applicable circumstances
• Portability: Request your data in a portable format
• Objection: Object to processing based on legitimate interests or for direct marketing
• Opt-out of Pro Analysis features: You may decline Pro Analysis data sharing at any time via Settings → Pro analysis. Other features remain fully available.
• Opt-out of marketing: Unsubscribe from marketing communications at any time
• Complaint: Lodge a complaint with your local data protection authority

6. Data Retention

We retain account-linked personal data while your account is active or as needed to provide the services you request. Deleting your account removes account-linked data from our active database and requests deletion of the linked Stripe customer.

We retain detached consent records showing the decision, policy version, and time after removing the account link, IP address, user agent, and consent metadata. Copies may remain temporarily in backups, and service providers or records required for tax, fraud prevention, disputes, or legal compliance may follow separate retention periods.

If you choose to save a public panel read, its encrypted marker summary and restore link are retained for up to 30 days. The associated email and source record remain until account creation or a verified deletion request. Contact [email protected] for a deletion request involving an anonymous saved read or a service provider.

7. Third-Party Services & Automated Analysis Data Sharing

Providers we use may include:

• Stripe: Payment processing
• PostHog: Optional cookieless aggregate product analytics, loaded only after this browser records your explicit choice. PostHog receives the network request IP address and browser user agent in transit and uses cookieless server-side processing to derive a rotating, short-lived identifier for grouped event counts. We disable browser persistence, automatic page views and URLs, page-element capture, session recording, and person profiles. We do not send your email, account identifier, lab values, marker names, plan or medication entries, or free text.
• Meta: A consent-gated, server-side membership Purchase event through Conversions API; we do not load Meta tracking tools in your browser
• DeepSeek:Powers the automated coaching and Pro Analysis features — see “Pro Analysis Features” section below for full details of what data is sent
• Resend: Transactional email delivery; receives recipient addresses, email content, and delivery metadata
• Sentry, when configured: Error and performance diagnostics; diagnostic context may include request, browser, or device metadata
• Cloudflare and our hosting provider: Traffic delivery, security, and infrastructure hosting
• Apple and Google: App distribution, subscription verification, and connected-health integrations you request

First-Party Payment Attribution

When an account is created after an approved ad visit, we may store three first-party commercial attribution labels—acquisition source (acquisitionSource), acquisition campaign (acquisitionCampaign), and acquisition content (acquisitionContent)—plus a test-run identifier (acquisitionRunId) and the time the approved ad visit was captured (acquisitionCapturedAt). These fields identify the paid channel, campaign, creative version, and test window that led to account creation. We may forward the same fields to Stripe in checkout and subscription metadata so we can attribute payments and evaluate advertising performance. They do not contain health data, a page referrer, a Meta click ID (fbclid), or device data.

We keep these fields with your SomaZeus account and include them in your account data export. The account copy is deleted with your account. Stripe or we may retain limited transaction records where required or permitted by law, as described in §6.

Optional Measurement Choices

Product analytics and Meta purchase attribution are separate, optional choices. Declining either does not restrict any SomaZeus feature, and changing one does not change the other.

Optional Product Analytics

If you choose Allow product analytics, PostHog receives reviewed generic feature-use, onboarding, and membership-funnel steps. Its ingestion service derives a rotating, short-lived cookieless identifier from request metadata such as IP address and browser user agent; events use generic names and never your SomaZeus account ID. Automatic URLs, page and element capture, session recording, person profiles, remote feature flags, health values, entries, report content, and free text stay off. Campaign-attributed steps also include the generic test-run label shown in the approved ad link so separate tests cannot be combined.

This choice is stored only in this browser. Stopping analytics prevents future PostHog events from this browser and removes legacy PostHog browser state. It leaves this browser's narrow first-party acquisition labels unchanged. Attribution saved with a SomaZeus account or Stripe is also separate from PostHog product analytics and follows the first-party payment-attribution and retention terms above.

Meta Advertising Measurement

When server-side Meta measurement is enabled and you choose Allow ad measurementbelow, our server may send Meta one neutral membership Purchase event after a completed payment. It may include the checkout event ID and time, value and currency, the fixed event label “SomaZeus membership,” a fixed neutral success-page URL, a one-way SHA-256 hash of the account email, browser user agent, and available Meta browser or click identifiers (fbp or fbc). We do not load Meta tracking tools in your browser or send visited page URLs, lab values, marker names, health entries, medical history, medications, performance-plan details, or your questions to Meta.

We use this information only to attribute purchases and improve paid advertising. Declining does not restrict any SomaZeus feature. You can change your choice below; after an authenticated account-setting sync succeeds, stopping measurement prevents future Meta events from SomaZeus and suppresses pending unsent Purchase events. The browser choice also removes Meta attribution cookies available to this site.

Pro Analysis Features — Data Processing

Depending on the feature, automated-analysis prompts sent to DeepSeek may include profile details, bloodwork, vitals, sleep, medical history, medications, allergies, injuries, protocol and performance-plan entries, compounds, side effects, check-ins, training, cardio, nutrition, supplements, connected-health data, notes, questions, and text extracted from reports you submit.

• Identity & demographics: First name, age, biological sex, height
• Body composition: Weight, body-fat percentage
• Bloodwork & lab panels: Hormone markers (e.g. testosterone, estradiol), metabolic markers (e.g. glucose, HbA1c), lipid panel, CBC, kidney/liver function, and other biomarkers you have entered
• Vitals: Blood pressure, resting heart rate, heart-rate variability, glucose readings
• Training data: Workout logs (exercises, sets, reps, weight), cardio logs, training plan and season goals
• Nutrition data: Recent food logs (meal descriptions, macros), nutrition targets
• Supplement stack: Active supplements (name, dose, timing)
• Health history: Medical history, allergies, medications, and injuries you have entered
• Check-in and free-text data: Sleep, mood, energy, side effects, notes, questions, and other context you enter

What we do not deliberately add: Your account email, password, payment information, or internal database identifiers are not deliberately added to structured prompts. Uploaded reports, pasted text, and free-text notes may themselves contain personal information; remove anything you do not want sent.

Provider processing:Data sent to DeepSeek may be processed outside the EEA, including in China. DeepSeek's API uses disk-based context caching and may temporarily cache inputs and outputs, usually for hours to days. Its retention and use of de-identified inputs and outputs to improve services depend on its terms and our account settings. Provider-side processing is not limited to the immediate request.

SomaZeus may store generated outputs and encrypted, short-lived response-cache entries with your account to deliver results and improve performance. Cache entries expire and are erased when you reset or delete account data, subject to the other retention rules in §6.

Your consent: Pro Analysis features are opt-in. You are asked for explicit permission before any health data is sent for Pro Analysis processing. You may withdraw this consent at any time via Settings → Account → Pro analysis. Withdrawing consent stops future provider requests but cannot undo processing already completed and does not affect your access to other features.

8. Health Connect & Apple Health

With your permission, SomaZeus reads health and fitness data from Health Connect (Android) and Apple Health(iOS) so your vitals can power your insights without manual entry. We only ever read from these sources — SomaZeus never writes data back to Health Connect or Apple Health.

Data we read

• Heart-rate variability (HRV)
• Resting heart rate
• Sleep
• Steps
• Active energy
• Workout date and time, activity type, duration, distance, and workout heart-rate summaries, where available

Access is read-only. You grant this access in the Health Connect or Apple Health permission screen and can revoke it at any time from your device settings; revoking it does not affect your access to other SomaZeus features.

How it is used and shared.When you use a Pro Analysis feature, relevant data read from Health Connect / Apple Health may be included in a request to our third-party analysis provider to generate your personalised insights, under the provider-processing terms and consent described in §7. We do not sell this data.

Retention.Connected-health records remain associated with your account until account deletion or a verified privacy request (see §6).

9. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us at:

[email protected]