Privacy Policy — SALUNOTE
Last updated: 2026-10-10 · Applies to: SALUNOTE (on-device; linking to a professional is your choice)
Summary
SALUNOTE runs on your device. It has no account and no sign-up, and what you enter — your profile, your logs, your plan — stays on your phone. Nothing is sent automatically, and nothing you enter is used for advertising, analytics, or profiling.
Three things can leave your phone, and each one only when you choose it, every time: a technical error report, after the app shows it to you; your summary report, if you link the app to a professional (a doctor, a nutritionist or a trainer) and choose to send it to them; and the receipt your phone gives when it collects a plan that professional sent you. A report you send is encrypted on your phone so that only that professional can read it — not us.
What we collect
Nothing is collected from your device automatically. We — the developer — do not receive, store, or have any access to the information you enter.
The one thing we can receive is an error report, and only when you send it. If something goes wrong, the app writes down what broke: the type of error, where in the app’s own code it happened, and the names of the screens you passed through on the way there. It shows you that report in full and asks whether to send it. Each report is asked about separately — there is no setting that keeps sending them, and saying yes once does not say yes again.
An error report contains no health information. Before it is written down, every digit in it is replaced with a “#” and anything in quotation marks is removed, so a weight, a lab result, or a date cannot be inside it. It carries no name, email address, phone number, or device identifier. It does carry your patient code — the same code printed on your summary — so that several reports from one person can be recognised as one problem rather than several. That code names nobody by itself, but it is the same every time, so we treat it as personal data and delete it on a schedule: three months after a report has been dealt with, and twelve months at the outside.
If you would rather not send it, decline. The report stays on your phone, is never transmitted, and is deleted when you erase your data. You can also turn the question off entirely.
What you enter, and where it stays
To provide the app’s features, you may enter information such as: general profile details from onboarding, the medication you self-report taking, injection notes, any foods you ask us to leave out of your meal ideas, and lifestyle logs (for example weight, waist, water, steps, and how you feel).
All of it is stored locally on your device only, in the app’s private storage. It stays there until you delete it or uninstall the app.
How your information is used
Your entries are used solely, and only on your device, to:
- tailor a simple lifestyle (diet and movement) plan, or follow one a professional sent you,
- show you your own trends over time,
- generate a summary you can choose to export, or send to a professional you linked.
The app does not interpret your data medically and does not give medical advice or advice about your medication.
Linking to a professional, and sending your summary
If a doctor, a nutritionist or a trainer you see uses the SALUNOTE portal, you can link the app to them by scanning the QR code they give you. The app checks the code against the professional’s key, shows you who you are linking to, and creates a pair of keys for that link alone. Nothing is linked or sent until you confirm.
When you choose to send your summary, the app shows you the report first, then encrypts it on your phone to that professional’s key and signs it. Our server stores the encrypted report until the professional opens it and for at most 12 months; we cannot read it, and neither can anyone with access to our server or its backups. We do keep what it takes to deliver it: a label your app chose for you (never your name), when you linked and when you sent, and the report’s size. A link that has ended is kept for 90 days for the security record, and its secret is erased the moment it ends.
Nothing is ever sent automatically. You can unlink a professional in the app at any time: reports they have not opened are withdrawn at once. A report they have already opened stays with them, as a document you handed over on paper would.
This is not a way to reach anyone urgently or to ask for medical advice. A report may be read days later. For anything about your treatment, contact your doctor the way you normally would.
A plan a professional sends you
A professional you linked to can send you a diet and movement plan they wrote. It is encrypted to your app on their side and opened only on your phone. Our server holds it, unreadable, for at most 30 days, and records only whether your phone has collected it; a plan not yet collected is deleted when the link ends. Your app checks that the plan really comes from the professional you linked to and that it holds only diet and movement content, then keeps it on your phone.
A plan is used for your daily tracking only if you choose to follow it. You can follow one plan at a time, and stop whenever you like. While you follow it, it takes the place of SALUNOTE’s own plan for its dates, and your summary shows which plan you followed, the professional’s own daily figures if they set any, what you ticked, and an estimate of the energy your ticked movements used. The summary is still sent only when you choose to send it.
Sharing
We do not share the information you enter, because we never receive it. A summary you send through the app to a professional you linked is encrypted to them and readable only by them. If you choose to export a summary (for example as a PDF), that file is handed to your device’s own share sheet, and you decide where it goes; that does not involve us at all.
An error report you choose to send comes to us. Where it describes a fault we need to fix, its technical contents — the error, the place in the code, and your patient code — may be copied into our own private issue tracker so that the fix can be followed through. Nothing you entered into the app is in it, and it is not shared with anyone else, sold, or used for advertising.
Third parties, tracking, and ads
There are no third-party analytics, advertising, or tracking SDKs in the app, and no data is sold or shared. Reports, plans and links travel only between your phone and our own server. The app does not use device health platforms (Apple HealthKit / Android Health Connect) in this version.
Your control and choices
You can edit or delete your entries in the app at any time. Settings has an option that erases everything on this device and returns you to the start; it also ends your links and removes their keys from your phone. Deleting the app also removes its on-device data.
Unlink a professional to stop sending to them, stop new plans from them, and withdraw any report they have not opened. Stop following a plan at any time; the days you already followed keep it. Delete a plan on your phone to remove it entirely.
Children
The app is intended for adults who have been prescribed a GLP-1 / GIP medication by their own doctor. It is not directed at children.
Changes
This policy will be updated before any feature that transmits more data ships, and the app’s store privacy declarations will be revised accordingly. Swiss FADP and, where it applies, the GDPR govern the data described here.
Contact
Questions about this policy: contact@salunote.ch (Hyrcan Bio Data Team).
This policy describes a version of SALUNOTE that keeps what you enter on your phone. What can leave it — an error report, a summary for a professional you linked, a plan’s receipt — leaves only when you choose, each time.