Privacy Policy

Version 1.1 · Effective date: 9 July 2026

Pip helps you understand your body by noticing patterns in what you eat and how you feel. We know that's sensitive information, and we treat it that way. This policy explains what we collect, why, and the control you have over it.

Who we are

Pip is provided by Pip Living Ltd, a company registered in England and Wales (company number 17453050), trading as Pip. Our address is 2 Ashcombe Road, Merstham, Redhill, RH1 3BY. For any privacy question or to exercise your rights, contact us at hello@pipliving.com. Pip Living Ltd is the data controller for the personal data described below. We are registered with the UK Information Commissioner's Office (ICO), registration reference ZC270445.

What we collect

• Account details — your email address and name (for example, when you sign in with Google, Apple, or by email). With Sign in with Apple you can use Apple's private-relay email, so we never see your real address.
• Health & wellbeing data you choose to log — this is special-category data and the heart of the app: meals and food items, symptoms and how you feel, conditions, medications you note, elimination trials, and any notes you add.
• Insights we generate — the personal patterns and correlations Pip calculates from your logs.
• Imported health data (Apple Health) — only if you connect it — with your permission Pip reads a small set of signals from Apple Health: sleep, steps, workouts and active energy. When you tap Connect, Pip copies the last 30 days of them to our servers and keeps them until you disconnect (the "Disconnect and remove imported data" button) or delete your account: steps, sleep as hours per night, workouts (start, end, duration and the name of the device that recorded them) and active energy. Sleep can be used in your patterns only if you turn on "Sleep & activity in your patterns"; the other signals are stored but are not used by Pip's analysis at present. If you add medicines from Apple Health's list, their names are saved in your Pip profile. Pip does not save anything to Apple Health in this version. If that changes, we will tell you here before it does. You connect it yourself and can disconnect at any time, and it is never used for advertising or shared to improve any third party's products.
• Barcode & menu scanning (on-device) — when you scan a barcode or menu text, the image is read on your device to pick out codes/text. These photos are not uploaded or stored.
• Waitlist email (this website) — if you join the waitlist here, we store the email address you give us so we can tell you when Pip launches. You can ask us to remove it at any time.
• Limited technical data — basic app/diagnostic information needed to run the service reliably.

We practise data minimisation: we only collect what the app needs to work for you.

How we use your data

• To provide the core service: store your logs and generate your personal insights and summaries.
• To make the patterns Pip shows you more cautious, using imported sleep and activity — only if you turn on the separate "Sleep & activity in your patterns" setting (off by default).
• To send optional, gentle reminders (only if you enable notifications).
• To let you know when Pip launches, if you joined the waitlist.
• To keep the service secure and working.

We do not sell your data. We do not use your health data for advertising, marketing, or use-based data mining, and we do not share it with third parties for those purposes (consistent with Apple Guidelines 5.1.2–5.1.3). We do not use your data to build a profile of you for anyone else. The only third parties who touch your data today are the processors listed below, who act on our behalf. See Research below for the one optional, consented, de-identified exception we are building toward.

Legal bases (UK GDPR)

• Explicit consent (Art. 9(2)(a)) for processing your health/special-category data; and for using imported sleep and activity to interpret your patterns (the "Sleep & activity in your patterns" setting) — each asked for separately, and you can withdraw any of them at any time (see Your rights).
• Performance of a contract (Art. 6(1)(b)) to provide the app you've asked for.
• Consent (Art. 6(1)(a)) for the waitlist — we email you only because you asked us to, and you can unsubscribe any time.
• Legitimate interests (Art. 6(1)(f)) for keeping the service secure and reliable, balanced against your rights.

Who we share it with (processors)

We use a small number of service providers to run Pip. For each one we say below only what we have confirmed.

Processors that handle your health or meal data

• Supabase — secure database and authentication hosting (your logs, account, and waitlist email). Your data is held in the London region.

Infrastructure and communications processors

• Vercel — hosts this website and processes the waitlist form request.
• Resend — sends our account emails (confirming your address, signing in, resetting a password) for us. It receives your email address and a one-time code or link, in a plain message with no health content.
• Apple (Sign in with Apple) — if you choose to sign in with Apple (authentication only); supports Apple's private email relay. At sign-in Pip sends Apple's one-time authorisation code to Apple. Pip keeps the refresh token Apple returns until you delete your account, when Pip asks Apple to revoke it.

Other services we send a request to, or you sign in with

• Google Sign-In — if you choose to sign in with Google (authentication only).
• Open Food Facts — when you type a product name or scan a barcode to look it up, we send the words you typed or the barcode, not your name, email, account or device.
• fatsecret — food and recipe information. When Pip looks up a food or recipe with fatsecret, our server sends the search words (or, for a scanned product, its name and brand), not your name, email, account or device. fatsecret's own terms apply to its information.

We will update this list as the app evolves.

Where your data is stored / international transfers

Your data is hosted by Supabase in the London region (eu-west-2). Where any provider processes data outside the UK/EEA, we rely on appropriate safeguards (such as the UK IDTA or EU Standard Contractual Clauses). We do not store your personal health information in iCloud (consistent with Apple Guideline 5.1.3).

Research (optional, consented, and de-identified)

Pip's mission is to help people understand chronic conditions like IBD, and aggregated learning can help the whole community. You can choose — it's off by default — to let your data contribute to that. Here is exactly what that does, and does not, mean today:

• We share nothing externally yet. Turning "Research" on currently lets us learn from de-identified data inside Pip. No third party receives your data on the basis of this toggle.
• If that ever changes, we will ask you again first — clearly, naming who and why — and you can decline without losing any feature.
• De-identified and never sold. Any future research contribution will use de-identified or aggregate data (so you are not reasonably identifiable), governed by a Data Protection Impact Assessment and written data-sharing agreements that forbid re-identification and onward sale. We will never sell your data.
• Record-level data, if it were ever needed for a specific study, would stay inside a controlled research environment rather than being handed over — and only with your specific, separate consent.
• Withdrawal is forward-looking. You can switch Research off any time; we stop future use. Data that has already been de-identified or aggregated generally cannot be recalled, and we'll always say so before you consent.

Legal basis: your explicit consent (UK GDPR Art. 9(2)(a)); where we rely on scientific-research provisions we apply the Art. 89 safeguards. This section is deliberately conservative — the full programme is subject to a DPIA and legal review before any external sharing begins.

Analytics & cookies

Analytics is optional, and separate from your health record. If — and only if — you turn on analytics, we record that you used a feature, never what you ate or how you felt. Event records carry things like "a meal was logged" and how many items it had; they are technically prevented from carrying food names, notes or symptom detail. Analytics is a separate choice: declining it never reduces the app's features, and never affects any safety feature. These records are linked to your account, so they are not anonymous, although they carry no food, symptom or note content. We intend to delete analytics records after 13 months; that automatic deletion is not running yet, so for now they are kept until you delete your account, and they are deleted with it. Your health record itself is governed by the retention rules below, not by this section.

Analytics events are stored in our own infrastructure — we do not use third-party analytics services, and the app does not serve advertising. This website uses no non-essential cookies and does not track you.

How long we keep it

We keep your data while your account is active. You can export or delete your data at any time from within the app. When you delete your account, we delete your personal data within 30 days, except where we must retain limited records to meet a legal obligation. Waitlist emails are deleted once Pip has launched or when you ask us to remove them, whichever is sooner.

Your rights

Under UK GDPR you have the right to: access your data; correct it; delete it ("right to erasure"); restrict or object to processing; data portability (export); and withdraw consent at any time. Pip provides in-app export and account deletion so you're always in control. You also have the right to complain to the ICO (ico.org.uk) — though we'd appreciate the chance to help first.

Security

We protect your data with encryption in transit, access controls (row-level security so you can only see your own data), and optional device biometric lock. No system is perfectly secure, but we take this seriously and design for privacy first.

Children

Pip is not intended for children. You must be 18 or older to use it. We do not knowingly collect data from children; if you believe a child has used Pip, contact us and we'll delete the data.

Not medical advice

Pip is a personal organiser for your own gut-health information. It reflects patterns in your own records back to you; it does not diagnose, treat, or replace professional medical care, and whether Pip is a medical device is determined by our intended-purpose assessment rather than asserted here. Always seek advice from a qualified clinician for medical concerns, and seek urgent care for red-flag symptoms.

Changes to this policy

We'll update this policy as Pip evolves and post the new version here with a revised effective date. For material changes affecting your health data, we'll ask for your consent again where required.

Contact

hello@pipliving.com · Pip Living Ltd (trading as Pip), United Kingdom