One L1fe is operated by One L1fe, Nørrebro Vænge 2, 2200 Copenhagen, Denmark. We are the data controller for the personal data described in this policy.
Questions or requests: privacy@one-l1fe.com
You give us:
| Category | Examples |
|---|---|
| Account | Email address and password. Signing in is optional; the app works on your phone without an account. |
| Profile | Birth date or year, sex, height, country, and your display preferences |
| What you log | Entries in the hubs, such as training sessions, meals, sleep, weight and lab markers, and your plans and goals |
| Coach conversations | Messages you send an AI coach and its replies. These stay on your phone (section 4). |
| Support | Emails you send us and our replies |
You connect or hand in: nothing is imported unless you allow it, and you can withdraw that permission at any time in your phone's settings.
| Source | Data imported |
|---|---|
| Health Connect (Android) | Steps, sleep, heart rate, resting heart rate, heart-rate variability, workouts, weight, aerobic fitness (VO2 max), calories and distance |
| Lab reports and meal photos | A lab report or a meal photo you hand to a coach or add to a hub, and the values read from it |
We collect automatically: nothing of our own. The app has no analytics and sends no crash reports. The services named in section 6 see what any server sees in a request, such as your IP address and the app version.
Most of what makes One L1fe useful is data about your body. Under Article 9 GDPR, health data is a special category and gets stronger protection.
What you log is kept on your phone. While you are signed in and have allowed storage, a copy of your hubs, plans and profile is also kept in our database, so a new phone can have it back. That database is hosted by Supabase in Frankfurt, Germany.
Coach conversations are not copied to our server. They live on your phone only: a new phone or a reinstall starts with none, and you can delete a conversation in the app.
| Purpose | Legal basis |
|---|---|
| Create and run your account | Contract, Art. 6(1)(b) |
| Copy your hubs, plans and profile to your account | Explicit consent, Art. 6(1)(a) and 9(2)(a) |
| Provide support | Contract, Art. 6(1)(b) |
| Keep the service secure and working | Legitimate interests, Art. 6(1)(f) |
Where we rely on legitimate interests, we have weighed our interest against your rights, and you can object (section 9). We do not use your health data to train AI models ourselves.
We do not sell your data and do not share it with advertisers. These providers process data for us:
| Provider | What it does | Where |
|---|---|---|
| Supabase | Database, sign-in, and the server function that passes coach questions on to Google | Frankfurt, Germany |
| Google (Gemini) | Reads your questions to the AI coaches, and the photos and lab reports you hand them, to answer | Can be outside the EU/EEA (section 7) |
| Expo | Delivers app updates, and sees your device's IP address and app version when the app checks for one | United States (section 7) |
We may also disclose data to public authorities where legally required, or in a merger or acquisition, in which case we notify you in advance so you can ask us to delete your account first if you prefer.
The AI coach. When you use it, you are interacting with an AI system, not a person. To answer, we send Google your question and what you have told that coach, together with the entries the hub screens show it: the week's sessions, meals, nights and described days, and your markers and record. A photo or report you hand it is sent as well. Nothing else leaves your phone for this. We do not make solely automated decisions with legal or similarly significant effects under Article 22; the coach suggests, you decide.
Google and Expo may process data outside the EU/EEA, including in the United States. For such transfers they rely on their own mechanisms, such as the EU/US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
The app sets no cookies and has no advertising, tracking pixels or third party analytics. It keeps your sign-in on your phone so that you stay signed in.
You have the right to access your data, have it corrected or deleted, restrict or object to processing, receive it in a portable format, and withdraw consent at any time.
Deleting your account and getting a copy of your data are not in the app yet. For now, email privacy@one-l1fe.com from the address you signed up with, and we delete your account and the data on our server, or send you a copy, by hand. We respond within one month, and will tell you within that month if a complex request needs longer. It is free. We may need to verify your identity first. Data on your phone is yours to delete in the app or by uninstalling it.
You can also complain to Datatilsynet, or to the supervisory authority where you live.
Traffic between the app and our server is encrypted, and the database only lets an account read its own rows. No system is perfectly secure. If a breach occurs we will notify Datatilsynet within 72 hours where Article 33 requires it, and notify you directly without undue delay where the breach is likely to be a high risk to you.
| Data | Retention |
|---|---|
| Account, profile and copied hub data on our server | While your account is open; deleted within 30 days of your deletion request |
| Coach conversation history | On your phone until you delete it or uninstall the app; not on our server |
| Support correspondence | 24 months after the case closes |
We may update this policy as the product develops; the date at the top shows the current version. For material changes, a new category of data, a new purpose, a new provider handling health data, or a change of controller, we notify you by email or in the app before it takes effect. Where a change needs your consent, we ask for it separately rather than treating continued use as agreement.