Privacy Policy

This Privacy Policy explains what personal data Merios collects, why, who processes it on our behalf, and how you stay in control of it. It applies to the Merios iOS app and to this website. It is version 2.0.1, in effect since October 27, 2026; it is the version you are asked to accept in the app.

1. Who We Are

Merios is published by Merios Health LLC, a limited liability company registered in Wyoming, United States (“Merios,” “we,” “us”). Merios Health LLC is the data controller for the personal data described in this policy.

Data protection contact: privacy@merios.life

2. Data We Collect

Account data

Your email address (or the address relayed by Sign in with Apple), your name if you provide it, your date of birth and your biological sex. Your date of birth is used to confirm you are 18 or older and, with your sex, to interpret your data against the right reference ranges.

Apple Health data

If you connect Apple Health, we read the data types you allow, including up to 365 days of history when you first connect: activity (steps, distance, active energy, exercise and stand time, flights climbed), heart (heart rate, resting and walking heart rate, heart rate variability, heart rate recovery), sleep, vitals (respiratory rate, blood oxygen, blood pressure, blood glucose, wrist and basal body temperature, VO2 max), body measurements (weight, height, body fat, lean mass), mobility, time in daylight, mindful minutes and, if you track them in Apple Health, menstrual cycle data and symptoms. See Section 5 for the rules that apply to this data.

Blood test results

Biomarker values you enter by hand or confirm after scanning a lab report, with their dates and units, and the photos or PDFs you choose to scan (see Section 4: they are processed to read the values and are not kept on Merios’s servers).

Journal and cycle

What you choose to log: how you feel, symptoms, sleep, stress, exercise, nutrition, medications, a free-text daily note and, if you use cycle tracking, your period days and related symptoms.

Data we derive

Your daily Merios Score and its pillars (Activity, Recovery, Zen), your personal baselines, biomarker trends, biological age estimate, insights and, if you subscribe to Merios Plus, your written reports.

Consent and subscription records

Which consents you gave or withdrew, when, and under which policy version; your subscription status (never your payment card, which Apple handles).

Technical data

Crash reports and diagnostics (device model, OS and app version, error traces) and product events such as “subscription screen viewed” or “plan selected”, linked to your account, which tell us whether the app works. These events never contain health values.

3. How We Use Your Data

• Compute your daily score, pillars, baselines and biological age estimate
• Show your trends and your blood results over time, in plain language
• Read the values from a lab report you scan, when you ask for it (Section 4)
• Write your monthly report and insights, if you subscribe and consent (Section 4)
• Manage your account and subscription, and send service emails (sign-in, password reset, account notices)
• Fix crashes, measure whether key screens work, and keep the service secure
• Comply with our legal obligations

We never sell your data to anyone, and we never use your health data or your Apple Health data for advertising, marketing or data mining. We do not share it with data brokers or advertisers, and we do not use it to train AI models.

4. AI Processing

Two features use OpenAI’s API. Each is optional, is asked for when you first use it, and can be switched off at any time in Settings › Privacy & Consents.

Reading a lab report

When you scan a lab report, the photo or PDF is sent over an encrypted connection to OpenAI, which reads the biomarker values. The document is sent as you captured it, including any name or date of birth printed on it. When a reading looks uncertain, a second automated pass re-checks it against the same document and flags anything you should verify. You review the values before they are saved. Merios does not keep the photo or PDF on its servers: only the values you confirm are kept in your account.

Reports and insights

If you subscribe to Merios Plus and consent to AI insights, your reports are written by an OpenAI model from aggregated figures (for example monthly averages, score trends and biomarker changes), never from raw daily Apple Health samples, then checked automatically against our wellness charter so they stay non-medical.

Safeguards

OpenAI does not use data sent through its API to train its models. It may keep requests in its abuse-monitoring logs for up to 30 days, unless the law requires longer (OpenAI, “Your data”). Every AI request is logged by Merios with a request ID, without its content, for audit purposes.

5. Apple Health Data

• Merios reads Apple Health data only with your permission and never writes to Apple Health.
• It is used only to provide the Merios features described in this policy: scores, baselines, trends, insights and reports.
• It is never used for advertising, marketing or data mining, and never sold or shared with data brokers, advertisers or any third party not needed to run Merios.
• It is never stored in iCloud by Merios. It is synced to your Merios account, encrypted in transit and at rest.
• Only aggregated figures may be sent to our AI provider for your reports; raw samples are never sent to third parties.
• You can stop access at any time in iOS Settings › Health › Data Access & Devices › Merios, and delete the data already synced by deleting your account.

6. Service Providers

We rely on the following providers (sub-processors). Each receives only what it needs to do its job.

• Supabase (database, authentication, file storage, server functions): hosts all your account and health data, in the European Union (AWS eu-west-1, Ireland).
• OpenAI (United States): reads scanned lab reports and writes reports and insights, only with your consent (Section 4).
• Apple: Sign in with Apple, Apple Health on your device, and in-app purchases. Apple processes your payment; we never see your card.
• RevenueCat (United States): manages subscriptions. Receives an anonymous user ID and your purchase and subscription status, never health data.
• Sentry: crash and error monitoring. Receives technical diagnostics; health data is scrubbed from reports before they are sent.
• Resend and Substack: send the Baseline newsletter and its welcome email. They receive your email address, never app or health data.
• Vercel and Google Analytics: host this website and measure its audience (Section 11). They receive no app or health data.

7.Storage & Security

• Data is stored on Supabase in the European Union (Ireland).
• Encrypted in transit (TLS 1.2 or higher) and at rest (AES-256).
• Row Level Security: each row in the database can be read only by the account it belongs to.
• Sign-in tokens are kept in the iOS Keychain on your device.
• File storage buckets are private; no health file is ever reachable through a public link.

No system is perfectly secure. If a breach affecting your data occurs, we will notify you and the competent authorities as required by law.

8.Legal Bases & International Transfers

Where the GDPR or a similar law applies, we rely on:

• Your explicit consent (GDPR Art. 9(2)(a)) for health data, Apple Health data and each AI feature. You give it in the app, feature by feature, and can withdraw it at any time; withdrawal does not affect processing done before it.
• Performance of our contract with you for your account and subscription.
• Our legitimate interests for crash diagnostics, product events and security, which never involve health values.
• Legal obligations, for example keeping consent records.

Your data is hosted in the EU. Some providers listed in Section 6 are based in the United States; where data is transferred there, we rely on the safeguards provided for by law, such as the European Commission’s Standard Contractual Clauses or the provider’s certification under the EU-U.S. Data Privacy Framework.

9. Data Retention

• Your account and health data are kept as long as your account exists.
• Scanned lab report photos and PDFs are not kept on Merios’s servers. OpenAI may keep them in its abuse-monitoring logs for up to 30 days (Section 4).
• When you delete your account in the app, your account and all its data are deleted permanently. Residual copies in encrypted backups are erased as those backups expire.
• AI request logs (without content) are kept for 12 months.
• Consent records are kept for the life of your account and 3 years after deletion, to prove what you agreed to.

10. Your Rights

Wherever you live, you can do most of this yourself in the app:

• Access and portability: Settings › Export my data gives you a complete copy in a machine-readable format (JSON).
• Rectification: edit your profile, your journal and your biomarker values in the app.
• Deletion: Settings › Delete my account erases your account and all its data.
• Withdraw consent: Settings › Privacy & Consents, feature by feature; Apple Health access from iOS Settings.
• Objection and restriction, and any other right your local law gives you (including under the GDPR and US state privacy laws): write to privacy@merios.life. We answer within one month.

You can also lodge a complaint with your local data protection authority.

11. Our Website

merios.life is hosted by Vercel. We measure its audience with Vercel Web Analytics and Google Analytics (pages visited, referring site, approximate location, device and browser type). If you subscribe to the Baseline newsletter or use the contact form, we keep your email address and message to send the newsletter or answer you; every newsletter has an unsubscribe link. The free calculators on the site run in your browser. None of this is linked to your app account or health data.

12.Children’s Privacy

Merios is for adults 18 and older. The app asks for your date of birth before an account is created and blocks anyone under 18. If we learn that we hold data from someone under 18, we delete the account and its data. Parents or guardians can contact privacy@merios.life.

13.Changes & Version History

Each version of this policy has a number. When a change affects what data we process, where it goes or who has access, the app shows you what changed and asks you to accept the new version before you continue; your acceptance is recorded with the version number. Other changes are announced on this page.

• 2.0.1 (October 27, 2026): corrected how long OpenAI may keep the data we send it (up to 30 days in its abuse-monitoring logs, not zero retention) and removed the mention of a data processing agreement; stated that a scanned document is sent with any name or date of birth printed on it, and that the second automated pass runs only when a reading looks uncertain. Nothing changed in what Merios collects or where it sends it.
• 2.0.0 (September 2026): Merios 2.0. Import of up to 365 days of Apple Health history for daily scores and baselines; journal and cycle logging; reports written by an AI model from aggregated figures only and checked against our wellness charter; clarified that scanned lab report files are not stored.
• 1.2.0 (April 28, 2026): separate consent for AI insights.
• 1.1.0 (April 27, 2026): automated second pass re-checking lab report readings.
• 1.0.0 (April 11, 2026): first version.

14. Contact Us

Questions about this policy or your data: