Privacy Policy

Who we are

The personal data controller and owner of the MeHealthy application is AVYRA S.R.L., with registered office in Bucharest, District 2, Traian Street, No. 139-141, Floor 3, Apt. 31, unique registration code (CUI) 54942139, Trade Register number J2026039853002, European Unique Identifier (EUID) ROONRC.J2026039853002, email support@mehealthy.ro. MeHealthy is a product of AVYRA S.R.L.

What data we process

Depending on how you use the app, we may process the following categories of data:

User account and identification data: first name, last name, phone number, email address, password in secure form, device name, country, city, sex/gender, invitation identifiers, and other data required for account administration.

Professional or verification data: if the app includes flows for physicians or professional users, we may process professional verification documents, clinic name, clinic email, and other information required to validate professional status.

Consent and preferences data: evidence of acceptance of the Terms and Conditions, Privacy Policy, consent for push notifications, marketing emails, and other communication options, including related timestamps and technical logs.

Child, patient, or monitored person data: any data entered into calculators and the app's functional medical history, including: height, weight, date of birth, measurement date, growth velocity, systolic and diastolic blood pressure, waist and hip circumference, gestational age, neonatal length/weight/head circumference, parents' height, age, bone age and its date, IGF-I, Tanner stage, grip strength, dominant hand, head circumference, measurement history, generated results, and any other values entered by the user in features available at a given time.

Technical and usage data: app usage data, technical logs, IP address, device type, app version, errors, security events, technical identifiers required for operation, and, if you enable push notifications, the identifier related to that service.

Purposes and legal bases for processing

Account administration and authentication: We process your account data to create, maintain, and secure your user account, for authentication, access recovery, and management of the contractual relationship. The legal basis is contract performance or steps prior to entering into a contract, under Article 6(1)(b) GDPR.

Providing medical-related features and storing history: We process data entered into calculators and related history to generate indicative results, keep measurement history, and allow effective use of the requested service. For regular data necessary for this functionality, the basis is Article 6(1)(b) GDPR. For health data, the additional lawfulness condition is explicit consent, separately expressed, under Article 9(2)(a) GDPR. If you enter data about a child or patient, you confirm that you act as a parent, legal representative, or authorized person.

Operational notifications and support: We may use your data to send messages necessary for app operation, account security, password reset, confirmation of certain actions, notifications regarding technical interruptions, and responses to support requests. The legal basis is Article 6(1)(b) GDPR and, where applicable, the Operator's legitimate interest in maintaining security and service integrity, under Article 6(1)(f) GDPR.

Commercial communications and marketing: If you separately opted in for such communications, we may send newsletters, commercial information, promotional updates, or other marketing messages, including by email and push notifications. The basis is your consent under Article 6(1)(a) GDPR. You may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal. We do not use health data for direct marketing.

Compliance with legal obligations: We may process data necessary to respond to requests from authorities, for tax, accounting, and compliance obligations, complaint handling, and fulfillment of other applicable legal obligations. The basis is Article 6(1)(c) GDPR.

Security, abuse prevention, and defense of rights: We may process certain data to detect abusive use, security incidents, preserve necessary evidence, and establish, exercise, or defend legal rights. The basis is the Operator's legitimate interest under Article 6(1)(f) GDPR.

Who we may disclose data to

Your data may be disclosed, strictly on a need-to-know basis, to: hosting and cloud infrastructure providers, IT and maintenance providers, email and push notification service providers, technical analytics and security providers, legal, financial, or audit consultants, authorized medical collaborators when required by the used functionality, as well as public authorities and institutions when required by law. All recipients will have access only to the data needed to perform their role and will act under contractual and legal confidentiality and security obligations.

Transfers outside the EEA

To the extent that we use providers located outside the European Economic Area or providers that may access data from outside this area, transfers will be carried out only under conditions permitted by GDPR, including based on an adequacy decision or appropriate safeguards such as standard contractual clauses.

How long we retain data

We apply the storage limitation principle and retain data only for the period necessary for the purposes for which it was collected:

Account data: for the duration of the account. When the account is closed, active profile data is deleted or irreversibly anonymized. Tax, payment, or other records required by law are retained only for the applicable statutory period and are separated from the active profile.

Health data and measurement history: for the duration of account use and monitoring features; after a deletion request or account closure, active data is deleted or anonymized, while backups are removed through a separate technical cycle of no more than 90 days.

Marketing consent records: for the validity period of consent and, afterwards, for up to 3 years for evidentiary purposes.

Technical and security logs: for a period of up to 6-12 months, except where longer retention is necessary for incident investigation or to comply with a legal obligation.

Automated decisions

The calculators and results generated by the app are informative and indicative. Through the app, the Operator does not make decisions based solely on automated processing that produce legal effects or similarly significantly affect you.

Your rights

Under GDPR, you have the right of access, rectification, erasure, restriction of processing, data portability, objection, the right to withdraw consent when processing is based on consent, and the right to lodge a complaint with the competent supervisory authority. To delete your account, follow the MeHealthy account deletion instructions. To exercise your other rights, contact us at support@mehealthy.ro. We will respond within the applicable legal deadline.

Data security

We implement reasonable and appropriate technical and organizational measures considering the nature of processed data, with increased focus on health data, to protect their confidentiality, integrity, and availability. Access to data is limited to persons who have an actual need to access it.

Complaints and contact

For any question regarding this policy or how we process your data, you can write to us at support@mehealthy.ro. If you believe your rights have been violated, you may contact the competent data protection supervisory authority.

Last updated: 04.09.2026