Privacy Policy

Last Updated: 25 June 2026

1. Introduction

This Privacy Policy explains how Kalo Health Limited collects, uses, stores, shares, and protects your personal data when you download, install, register for, or use the Kalo mobile application (the App), visit our website at thekalo.app (the Website), or interact with us in any other way.

Kalo Health Limited is the data controller responsible for your personal data. We are a company registered in England and Wales (company number 16449119), with our registered office at Larch House, Parklands Business Park, Denmead, Hampshire, United Kingdom, PO7 6XP. You can contact us at support@thekalo.app or privacy@thekalo.app.

Kalo processes information about your nutrition, body, and lifestyle, including health-related information. This policy explains what we collect, why we collect it, where it is stored, who we share it with, how long we keep it, and the rights and choices you have. We have written it to be specific and clear, in line with our obligations under the UK GDPR, the EU GDPR, the California Consumer Privacy Act (CCPA), the Washington My Health My Data Act (MHMDA), and other applicable privacy laws.

If you do not agree with this Privacy Policy, please do not use the App or the Website.

2. Quick Summary

In short, before the detail:

  • We collect profile information you provide (age, sex, height, weight, goals, food logs) and, if you connect a health platform, selected data from Apple Health or Google Health Connect.

  • We process your health-related data on the basis of your explicit consent, which we ask for separately and clearly when you create your account.

  • Your data is stored in Google Cloud Firestore, on servers in the United States, with cross-border transfer safeguards in place.

  • We do not sell your personal data. We do not share your food logs, body metrics, or health data with advertisers or analytics providers.

  • You can withdraw your consent, request a copy of your data, correct it, or delete it at any time, directly from within the App.

  • You have legal rights under UK GDPR, EU GDPR, CCPA, MHMDA, and other applicable laws. We explain them in section 10.

3. The Information We Collect

3.1 Profile Information You Provide

When you create an account and use Kalo, you give us information about yourself. We refer to this collectively as your Profile Data. It includes:

  • Account credentials: your email address and a password.

  • Identity and demographic information: your name where you choose to give it, age or date of birth, sex assigned at birth, and gender identity where you choose to share it.

  • Body metrics: your height, current weight, target weight, and any body measurements you choose to log.

  • Lifestyle and goals: your activity level, dietary preferences, allergies and intolerances where shared, and your health and fitness goals (such as weight loss, weight maintenance, or weight gain).

  • Nutrition information: foods you log, meals, barcode scans, recipes you save, water intake, and supplements where you log them.

  • Subjective inputs: mood, hunger, energy, sleep, and similar wellbeing entries you choose to log.

  • Communications: feedback, support requests, survey responses, and other content you send us.

Some Profile Data is required for the App to function. For example, your age, sex, height, and weight are needed to calculate your personalised calorie and nutrition targets. The rest is optional and you control what you share. When you provide this information, you are giving us your explicit consent to process it for the purposes set out in this policy. We record your consent against your account.

3.2 Wearable and Health Platform Integrations (Apple Health and Google Health Connect)

If you choose to connect Kalo to a health platform on your device, Kalo can read selected health and activity data from that platform. The two platforms Kalo supports are Apple Health (HealthKit) on iOS and Google Health Connect on Android. We refer to them collectively as Health Platforms.

How Connecting a Health Platform Works

Connecting a Health Platform is optional. Before any data is read, Kalo will:

  • Ask for your explicit consent within the App to process Health Platform data as part of the Kalo service.

  • Trigger the platform's own permission screen (Apple's HealthKit permission prompt on iOS, Google's Health Connect permission prompt on Android), which is a separate technical permission granted at the operating system level.

Both steps are required. The platform permission alone is not your consent to Kalo processing your health data. Your in-App consent is the legal basis for our processing. The platform permission is the technical access control.

What We Read

We only request access to the data categories needed for Kalo's features. Depending on your platform, these may include:

  • Steps and active energy burned.

  • Workouts, exercise minutes, and movement data.

  • Weight and body composition.

  • Heart rate and resting heart rate.

  • Sleep data.

  • Dietary energy and macronutrients, where you choose to share them back.

Each category requires a separate permission grant. The exact categories may change as Kalo's features evolve, and we will update this policy when they do.

Your Controls

You control what Kalo can read:

  • On iOS (Apple Health): grant or revoke access to any individual category at any time through the iPhone Settings app, under Privacy and Security, then Health, then Kalo.

  • On Android (Health Connect): grant or revoke access through the Health Connect app, or through Settings, then Apps, then Health Connect, then App permissions, then Kalo.

You can also withdraw your in-App consent to health data processing at any time through Kalo's Settings (see section 5).

Where Health Platform Data Is Stored

Health Platform data is read from your device. With your explicit consent, the data Kalo reads is also synced to your account in our secure cloud database (see section 4). This allows your information to appear consistently across sessions and devices and supports features such as historical trend analysis and personalised recommendations.

If you disable the integration within Kalo, we will stop syncing new Health Platform data to the cloud. Data previously synced will remain associated with your account until you delete it or close your account.

Specific Commitments

In line with the requirements of Apple's HealthKit guidelines and Google's Health Connect developer terms, we commit that:

  • We will not use Health Platform data for advertising or similar services.

  • We will not disclose Health Platform data to third parties without your permission, except as required by law.

  • We will not sell Health Platform data to advertising platforms, data brokers, or information resellers.

  • We will not use Health Platform data for purposes other than improving your health, fitness, and wellness experience within Kalo, or for medical research where you have given separate explicit consent.

  • We will not access Health Platform data using third-party software that performs analytics or advertising services.

3.3 Information Collected Automatically

When you use the App or the Website, we automatically collect:

  • Device information: device model, operating system version, language and region settings, time zone, and unique device identifiers.

  • Usage information: features used, screens viewed, actions taken, session duration, and interaction events. Used to operate the service, measure performance, and for marketing attribution.

  • Diagnostic information: crash reports, error logs, and performance data.

  • Subscription information: trial starts, purchases, renewals, cancellations, and refund events.

On the Website specifically, we also collect IP address, browser type and version, referring and exit pages, and cookie data (see section 12).

4. Where Your Data Is Stored

Your account data, Profile Data, food logs, and (where you have enabled the integration) Health Platform data are stored in Google Cloud Firestore, operated by Google LLC. Our Firestore database is hosted in the United States.

Locally on your device, Kalo caches certain data (including recent Profile Data, food logs, and Health Platform readings) so the App works smoothly and offline. Local data is protected by your device's standard security controls (passcode, Face ID, Touch ID, fingerprint, or device PIN).

Backups of the Firestore database are taken on a rotating basis and held in encrypted form. Backups are overwritten or deleted on a rolling schedule, normally within 90 days.

See section 9 for how we handle international data transfers.

5. Consent and Legal Bases for Processing

Different types of processing have different legal bases. We are transparent about each one.

5.1 How We Ask for Consent

When you first create your Kalo account, we ask for your explicit consent to process your health data and the personal data you share with us. This is presented as a clear, affirmative tick box on a dedicated consent screen. We do not pre-tick the box. We do not bundle this consent with our Terms of Service or with any optional choices.

If you choose to connect Apple Health or Google Health Connect, we ask for a separate confirmation of consent at that point, before the platform's own permission prompt is triggered (see section 3.2).

Every consent you give is recorded with a timestamp and the version of this policy in force at the time. This record is held against your account and can be reviewed or withdrawn at any time through Settings.

5.2 Lawful Bases under UK GDPR and EU GDPR

For users in the United Kingdom and the European Economic Area, we rely on the following lawful bases under Article 6 of the UK GDPR and EU GDPR:

  • Performance of a contract (Article 6(1)(b)): to provide the Kalo service to you under our Terms of Service, including creating your account, processing payments, and managing your subscription.

  • Legitimate interests (Article 6(1)(f)): to operate, secure, and improve Kalo, to prevent fraud, and to communicate with you about your account. Our legitimate interests are balanced against your rights and freedoms.

  • Consent (Article 6(1)(a)): for non-essential cookies, marketing communications where required, and for processing your health data (in combination with the Article 9 basis below).

  • Legal obligation (Article 6(1)(c)): to meet financial, tax, regulatory, or law enforcement obligations.

5.3 Special Category Data (Article 9)

Some of the data you provide, and that Kalo reads from Health Platforms, is special category data (health data) under Article 9 of the UK and EU GDPR. This includes weight, body composition, food logs, calorie intake, and Health Platform readings.

We only process special category data on the basis of your explicit consent under Article 9(2)(a). We ask for this consent separately and clearly when you create your account. You can withdraw it at any time through Settings.

If you withdraw your consent, Kalo may no longer be able to provide some or all of its features to you. You will be given a clear explanation of what will happen before you confirm withdrawal.

5.4 Lawful Bases under US Privacy Law

Where US state privacy laws apply, we process your personal information on the bases described in our notice at collection and consistent with the disclosures in this policy. For California and Washington residents, see section 10.2 for your specific rights.

6. How We Use Your Information

We use your information for the following purposes:

  • To provide the Kalo service: creating and maintaining your account, calculating personalised calorie and macronutrient recommendations, logging and analysing your food, weight, and activity, and syncing your data across your devices.

  • To personalise your experience: tailoring recommendations, content, and insights to your profile and goals, and showing your progress against the goals you set.

  • To operate Health Platform integrations: reading selected health data from your device where permitted, and syncing it to your Kalo account where you have explicitly enabled this.

  • To provide customer support: responding to your queries, troubleshooting issues, and contacting you about your account.

  • To improve the Kalo service: understanding how features are used, identifying bugs, prioritising improvements, and developing new features. This is done through aggregate, non-identifiable analysis of how the App is used.

  • To process payments: managing trials, purchases, renewals, refunds, and chargebacks, and preventing payment fraud.

  • For marketing attribution: understanding which marketing campaigns brought new users to Kalo, through the providers listed in section 7.1.

  • For marketing communications (with consent where required): sending you updates about Kalo where you have agreed to receive them, and measuring the effectiveness of our marketing.

  • For safety and security: detecting, investigating, and preventing fraud, abuse, security incidents, and breaches of our Terms of Service.

  • For legal and compliance purposes: complying with our legal and regulatory obligations, and establishing, exercising, or defending legal claims.

We do not use your Profile Data, food logs, body metrics, or Health Platform data for advertising, and we do not sell this data to anyone.

7. How We Share Your Information

We share your information only as described below. We never sell your personal data.

7.1 Service Providers (Processors)

We use carefully selected third-party providers to operate Kalo. These providers act as our processors and are bound by written contracts that restrict how they can use your data. They include:

  • Google Cloud (Firestore, Firebase Authentication, Cloud Functions): database hosting, user authentication, and backend services. Receives account data, Profile Data, food logs, and synced Health Platform data. Lawful basis: performance of contract.

  • FatSecret Platform: nutrition data, food search, and barcode lookups. Receives food search queries. Does not receive account-level personal data. Lawful basis: performance of contract.

  • Open Food Facts: open-source food and barcode information under the Open Database License. No personal data shared. Attribution: Kalo contains data from Open Food Facts, available under the Open Database License.

  • AppsFlyer: mobile attribution and marketing measurement. Receives device identifiers, install data, and a Kalo-issued user identifier. Does not receive your food logs, body metrics, or Health Platform data. Lawful basis: performance of contract.

  • Adapty: subscription and paywall management. Receives an account identifier, subscription events, and purchase data. Lawful basis: performance of contract.

  • Apple: App Store distribution, in-app purchases, and HealthKit framework operations.

  • Google Play: Play Store distribution, in-app purchases, and Health Connect framework operations.

  • Stripe (where applicable): payment processing. Receives payment information and billing details.

  • Email and customer support tools: service communications and support tickets. Receive your email address and support correspondence.

We review this list periodically and update this policy when it changes.

7.2 Other Disclosures

We may also disclose your information in the following limited circumstances:

  • Legal and regulatory: where required to comply with a court order, regulatory request, lawful demand from law enforcement, or applicable law.

  • Protection of rights and safety: where necessary to investigate, prevent, or take action against suspected illegal activity, fraud, threats to physical safety, or breaches of our Terms of Service.

  • Corporate transactions: in connection with a merger, acquisition, financing, restructuring, or sale of assets. We will require the recipient to protect your data consistently with this policy.

  • With your consent or at your direction: where you have asked us to share your data with a specific third party.

8. Health Data: Our Specific Commitments

Because Kalo processes health-related information, we make these additional commitments alongside the rest of this policy:

  • We process your health-related data only on the basis of your explicit consent under Article 9(2)(a) of the UK and EU GDPR.

  • We never use your health data for advertising.

  • We never sell your health data.

  • We do not share your food logs, body metrics, or Health Platform data with any third-party analytics, attribution, or marketing providers.

  • We comply with the specific Apple HealthKit and Google Health Connect requirements set out in section 3.2.

  • You can withdraw your consent at any time, and you can delete your data at any time, directly from within the App.

9. International Data Transfers

Kalo is a global service. Your information is stored in Google Cloud Firestore in the United States, and may be processed in other countries where our service providers operate.

For users in the United Kingdom, the European Economic Area, Switzerland, or other regions with data transfer restrictions, transferring your personal data outside your home country involves transferring it to jurisdictions that may not provide the same level of data protection. Where we transfer data internationally, we rely on the following legal mechanisms:

  • Standard Contractual Clauses (SCCs): approved by the European Commission, for transfers from the EEA.

  • UK International Data Transfer Addendum or UK IDTA: for transfers from the UK.

  • Swiss Federal Data Protection and Information Commissioner's SCCs: for transfers from Switzerland.

  • UK Extension to the EU-US Data Privacy Framework: for transfers to certified US recipients.

  • Adequacy decisions: where applicable.

We have signed Data Processing Agreements with our key processors (Google Cloud, AppsFlyer, Adapty) which include SCCs and the UK Addendum. You can request a copy of the relevant safeguards by contacting us at privacy@thekalo.app.

10. Your Rights

10.1 Rights for Users in the UK and EEA

You have the following rights under the UK GDPR and the EU GDPR:

  • Right of access: request a copy of the personal data we hold about you.

  • Right to rectification: ask us to correct inaccurate or incomplete data.

  • Right to erasure: ask us to delete your personal data, subject to limited exceptions (for example, where we need to retain records for legal or tax purposes).

  • Right to restriction: ask us to restrict how we process your data in certain circumstances.

  • Right to data portability: ask for a copy of the data you have provided to us in a structured, commonly used, machine-readable format.

  • Right to object: object to processing based on legitimate interests, or to direct marketing at any time.

  • Right to withdraw consent: withdraw consent at any time, where we rely on consent (including for health data processing).

  • Right to lodge a complaint: complain to your local data protection authority. In the UK this is the Information Commissioner's Office at ico.org.uk. In the EEA, your national supervisory authority.

10.2 Rights for Users in the United States

If you are a resident of certain US states, you have additional rights described below.

California Residents (CCPA / CPRA)

Under the California Consumer Privacy Act, as amended by the California Privacy Rights Act, you have the right to:

  • Know what categories of personal information we collect, the sources, the business purposes, and the categories of third parties we share it with.

  • Access and obtain a copy of your personal information.

  • Correct inaccurate personal information.

  • Request deletion of your personal information.

  • Opt out of the sale or sharing of your personal information for cross-context behavioural advertising. We do not sell or share personal information in this way.

  • Limit the use and disclosure of sensitive personal information.

  • Not be discriminated against for exercising your rights.

Categories of personal information we collect about California residents in the past 12 months: identifiers (email, device identifiers); customer records information (account credentials); commercial information (subscription history); internet or other electronic network activity (app usage, interaction events); geolocation data (general region); professional or employment-related information (none); inferences (preferences and goals derived from your inputs); and sensitive personal information (health-related data including body metrics, food logs, and Health Platform data).

We collect this information from you directly, from your device, and from our service providers.

Washington Residents (My Health My Data Act)

Under the Washington My Health My Data Act, you have specific rights regarding consumer health data, including the right to:

  • Confirm whether we are collecting, sharing, or selling consumer health data.

  • Withdraw consent to the collection and sharing of your consumer health data.

  • Request deletion of your consumer health data.

We do not sell consumer health data. We collect and process it only with your explicit consent and for the purposes set out in this policy.

Other US States

Residents of other US states (including but not limited to Virginia, Colorado, Connecticut, Utah, Texas, and Oregon) may have similar rights under their state privacy laws. To exercise these rights, please contact us using the details below.

10.3 How to Exercise Your Rights

You can exercise most of your rights directly within the App:

  • Access your data: go to Settings, then Privacy and Data, then Download My Data. You can request a copy of your Profile Data, food logs, and Health Platform readings in a structured, machine-readable format.

  • Correct your data: edit your profile information directly in Settings.

  • Withdraw consent: go to Settings, then Privacy and Data, then Manage Consents. You can withdraw consent to health data processing or marketing communications.

  • Delete your account and your data: go to Settings, then Privacy and Data, then Delete Account. This will permanently delete your Profile Data, food logs, and Health Platform data from our systems within 30 days, except where we are legally required to retain certain records (for example, payment history for tax purposes).

You can also exercise any right by emailing us at privacy@thekalo.app from the email address associated with your account, or by writing to us at the address in section 17.

We will respond within the timeframes required by applicable law: one month under UK and EU GDPR (with a possible two-month extension for complex requests), and 45 days under CCPA (with a possible 45-day extension).

We may need to verify your identity before responding, particularly for access and deletion requests. We do not charge a fee unless your request is manifestly unfounded or excessive.

10.4 Authorised Agents

California residents may use an authorised agent to submit a request on their behalf. The agent must provide proof of authority and we may verify the request directly with you.

11. Data Retention

We retain your personal data only for as long as necessary for the purposes set out in this policy, or as required by law:

  • Account and Profile Data: for as long as your account is active. Deleted within 30 days of account closure, except where retention is required by law.

  • Food logs, weight history, Health Platform data: for as long as your account is active. Deleted within 30 days of account closure.

  • Subscription and payment records: retained for up to 7 years to meet financial, tax, and audit obligations.

  • Customer support correspondence: retained for up to 3 years from last contact.

  • Attribution data (where you have consented): typically retained for 12 to 24 months.

  • Backups: cloud backups are rotated and overwritten on a rolling schedule, normally within 90 days.

You can request deletion at any time. Some data may remain in backup or archive systems for a short additional period before being overwritten.

12. Cookies and Similar Technologies

The Kalo App does not use browser cookies. The App uses software development kits (SDKs) from the providers listed in section 7.1 to operate attribution and subscription management.

The Website uses cookies and similar technologies to enable essential site functions and security (always on), to analyse Website performance and usage (with your consent where required), and to improve your experience. Where required by the UK Privacy and Electronic Communications Regulations, the EU ePrivacy Directive, or applicable US state law, we will ask for your consent before setting non-essential cookies. You can change your preferences at any time through our cookie banner or your browser settings.

13. Security

We protect your personal data using a combination of technical and organisational measures, including:

  • Encryption of data in transit using TLS.

  • Encryption of data at rest in Google Cloud Firestore.

  • Secure authentication, with industry-standard password hashing and support for multi-factor authentication where available.

  • Role-based access controls, with access to production data limited to personnel who need it.

  • Security logging, monitoring, and alerting.

  • Regular review of our service providers' security posture.

  • A documented incident response process.

No system can be guaranteed completely secure. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant regulator within 72 hours where required, and we will notify you without undue delay where the breach is likely to result in a high risk to you.

14. Children's Privacy

Kalo is not intended for children. You must be at least 16 years old to use Kalo. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, please contact us at privacy@thekalo.app and we will take steps to delete it.

15. Not a Medical Service

Kalo is a wellness and nutrition tracking tool. It is not a medical device, and the information Kalo provides is not medical advice, diagnosis, or treatment. Always consult a qualified healthcare professional about any medical condition or before making significant changes to your diet, exercise, or lifestyle. If you think you are experiencing a medical emergency, contact your local emergency services.

16. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, our services, or the law. When we make material changes, we will notify you by email, through an in-App notice, or by posting a prominent notice on the Website, and we will update the date at the top of this policy. We encourage you to review this policy periodically.

Where a material change affects the basis on which we process your data, we will ask for your renewed consent before continuing to process your data on the new basis.

17. Contact Us

If you have any questions or comments about this Privacy Policy or how we handle your personal data, please contact us at:

Kalo Health Limited

Email
support@thekalo.app

Privacy queries
privacy@thekalo.app

Postal address:
Larch House, Parklands Business Park, Denmead, Hampshire, United Kingdom, PO7 6XP