HealthIt

← HealthIt

HealthIt Privacy Policy

Last updated and effective: October 16, 2026.

1. Who we are

HealthIt is a healthy-habits, workout and nutrition app. Controller of personal data: MASTER MILS TECNOLOGIA LTDA (CNPJ 44.448.628/0001-20), Av. da França, 393, Edifício Hub Salvador, 2nd floor, Comércio, Salvador/BA, Brazil, ZIP 40010-000. Privacy contact: dpo@mastermils.com.br (we reply within 15 days).

2. Important notice

HealthIt does not provide medical advice, diagnosis or treatment and is not a medical device. Suggestions are general and educational and do not replace a physician, dietitian or physical education professional. Consult a professional before changing your diet or physical activity, especially if you have a health condition. In an emergency, seek medical care immediately.

3. Summary

  • Your health and fitness records (habits, workouts, nutrition, weight, body measurements, water and goals) stay only on your device and are not sent to our server.
  • We send to the server only your account data and the records of your consents (section 4), plus the access record required by law (IP, date/time and route, kept for 6 months).
  • The app is intended for people aged 18 or over.
  • You can delete your data, including on the server, from the app or from the deletion page (section 8). The only exception is the access record, kept for 6 months by legal obligation.

4. Data on the server

The HealthIt server uses Cloudflare (Worker and database). We keep: Account data: Google account ID, e-mail, an HMAC code of the e-mail (an irreversible fingerprint with a secret only the server knows, used to recognize the account), first login date and last access date, without time. Your Google account name and photo stay only on the device. Purpose: identifying who signed in and maintaining the account. Consent records: a random code generated on the device (never derived from your account), the type and version of each acceptance, and the dates of acceptance and last access. Purpose: recording that you accepted the current version of the texts. These records are kept in a table separate from the account data, with no shared column. The server does not store the Google token: it is verified and discarded.

Access record (exception): by legal obligation (Brazil's Marco Civil da Internet, art. 15), the server keeps, in an isolated table and confidentially, the IP address, date/time and route (template) of each request, used for security, for 6 months, and then deletes it automatically, unless an authority asks for it to be kept longer (Marco Civil, art. 15, §2). This record contains no token, search term, barcode, device random code or account identification, and is not linked to the account data or to the consent records. We only provide it under a court order. In addition, Cloudflare, as infrastructure provider, processes the IP address and technical request data on its network to deliver the service and protect it against attacks.

Food search: when you search industrialized products (by text or barcode/EAN), the app sends the term or EAN to our server, which queries Open Food Facts (France) without sending your identity. We use a temporary search token (food_token, 30 days) that does not identify you. The term and EAN are not stored; we keep only public product data in a cache for up to 30 days.

Camera and barcode reader: the camera permission is used only to read product barcodes. The image is processed on the device and is neither saved nor sent. The reader uses Google's ML Kit component, included in the app. This component sends Google technical device and app data (such as model, versions, technical identifiers, performance metrics and error codes) for technical monitoring and usage measurement of the component itself. This data does not include the image, the code read, your account or your health records. This sending starts only after you open the reader; until you open it, the app does not generate this traffic, and the sending may happen a few minutes after opening. Google processes it as a controller, under its own privacy policy, and may process it outside Brazil. If you prefer, you can type the code instead of using the camera.

Notifications: the app schedules local notifications (reminders, such as the end-of-cycle notice and the reminder for the time of each glass of water, when you turn them on). They are generated on the device, with no push server, and with generic text.

We also keep on the device: theme, language, your consent and the session profile (in the system secure storage). We do not collect location, contacts, microphone or advertising identifiers. There are no ad or crash-reporting SDKs, and the app has no usage-analytics tool of its own. Besides Google sign-in (section 7) and the barcode reader component (ML Kit), described above, we do not include any other third-party tool to collect technical data.

5. Purposes and legal basis

  • Health data, on the device: providing the app's features; specific consent (LGPD, art. 11, I).
  • Account data: identifying you and maintaining the account; performance of contract (art. 7, V).
  • Consent records: recording your acceptances; regular exercise of rights, to demonstrate the acceptance (art. 7, VI, and art. 8, §2).
  • Access record: compliance with a legal obligation (art. 7, II; Marco Civil, art. 15).
  • Food search: performance of contract (art. 7, V).
  • Barcode reader (ML Kit): legitimate interest in offering code reading (art. 7, IX).
  • Handling data subject requests: compliance with a legal obligation (art. 7, II).

6. International transfer

Data stored on the server (account data, consent records and access record) is kept in a Cloudflare, Inc. database in the United States (eastern North America region). Cloudflare acts as our processor, under a contract that provides for security measures. Requests pass through Cloudflare's global network, and access metadata, such as the IP address, may be processed in data centers in the United States and Europe for a limited time. In those countries the level of data protection may differ from Brazil's. Based on our understanding, this international transfer is necessary to perform the contract for using the app and to comply with the legal obligation to keep access records (LGPD, art. 33, IX, together with art. 7, II and V).

7. Sharing

We do not sell your data. Processor: Cloudflare, Inc. (server hosting; see section 6). Independent controllers: Google, for sign-in with your Google account, which you initiate, and for the ML Kit component of the barcode reader, under Google's privacy policy. Open Food Facts (France): source of the product catalog; it receives from our server only the search term or EAN code, without your identity, your IP or any identifier. Data also leaves the device when you choose to export, generate a PDF or share a plan; in that case the recipient's policy applies.

8. Your rights, deletion and revocation (LGPD, art. 18)

You can confirm processing, access, export (Profile > My data > Export my data), correct and delete your data.

  • Delete the account (Profile > My data > Delete account): erases on the server the account data, including the e-mail HMAC, and, if this device has already sent the random code, also the consent records of that code. Device data remains until you erase it. Requires internet. The request state is recorded without identifying you (section 9).
  • Delete local data (Profile > My data > Delete local data): deletes the records on this device; the account and the server do not change. You can export first.
  • Without the app: use the page https://www.mastermils.com.br/healthit/en/delete-account or write to dpo@mastermils.com.br; we reply within 15 days (LGPD, art. 19, II).
  • Legal exception: deletion does not erase the access record (IP, date/time and route), which the law requires us to keep for 6 months (section 4); it is deleted automatically afterwards.
  • Revoke health consent (Profile > My data): erases on the server the record of that consent, and the app stops recording and showing your health data until you consent again. It does NOT delete the account or the records of your acceptance of the Terms and the Policy: for that, use "Delete account" or write to dpo@mastermils.com.br. Your local data is kept, unchanged, and the app returns to the health consent screen. Without internet, the request is queued and sent when a connection is available.
  • Reinstalling or changing devices: the app no longer has the old random code. Deletion erases the account data, but the consent records linked to the old code cannot be identified as yours; they are erased after 1 year without access from that device. If you still have the old device with the app, also delete from it.
  • Switching accounts: if you sign in with another Google account, the app erases this device's consent records on the server and asks before erasing local data. The previous account's data cannot be erased from this device (the app no longer has its access) and is erased after 1 year without access (section 9). To erase it sooner, sign in with that account and use deletion, or write to dpo@mastermils.com.br.

Other requests: dpo@mastermils.com.br (reply within 15 days).

9. Retention and security

Device: until you erase local data or uninstall the app. Account data: while you use the app; after 1 year without access we erase all of it, including the e-mail HMAC; if you come back after that, the account is created again as a new account. Consent records: the health record is erased when you revoke it; all of them are erased when you delete the account in the app or after 1 year without access from the device. Access record (IP, date/time, route): 6 months, then erased automatically (Marco Civil, art. 15). Deletion request (without identifying you): if completed, the state record is erased 90 days later; if not completed, it expires after 30 days and the app notifies you; in that case, request again in the app or at dpo@mastermils.com.br. Food search: the search token expires after 30 days and the cache of public product data is erased within 30 days. Network metadata processed by Cloudflare and ML Kit technical data processed by Google follow those providers' periods.

The Google token is not stored. We adopt reasonable security measures, but no system is completely secure; protect your device with a screen lock.

10. Audience 18+

HealthIt is intended exclusively for people aged 18 or over and is not directed at children or teenagers. Use by anyone under 18 is prohibited, and we ask you to confirm you are 18 or over before using the app. If we learn that an account belongs to someone under 18, we will erase that account's data on the server. Parents or guardians may report use by a minor and request deletion at dpo@mastermils.com.br.

11. Changes

We may update this policy. Relevant changes will be announced in the app and may require new consent (new version). The date appears at the top.

12. Contact and data protection officer

Data protection officer (encarregado): Edmilson Santana Souza de Almeida, dpo@mastermils.com.br. Controller's address: Av. da França, 393, Edifício Hub Salvador, 2nd floor, Comércio, Salvador/BA, Brazil, ZIP 40010-000. You may also contact Brazil's National Data Protection Authority (ANPD).