Privacy Policy
Last updated: May 8, 2026
At AxioHuman, we take the protection of your personal information seriously. This Privacy Policy explains what information we collect, how we use it, who we share it with, and your rights under the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights (LOPDGDD).
1. Data Controller
| Controller | AxioHuman |
| Contact email | info@axiohuman.com |
| Website | axiohuman.com |
2. Information We Collect
2.1 Account Information
- Name
- Email address
- Password (encrypted at rest, never stored in plain text)
- Profile photo (optional)
2.2 Biological Profile Information
- Date of birth, gender, height, and weight
- Health goals (longevity, performance, weight loss, etc.)
- Nutrition preferences and activity level
- Medical conditions and current medications (voluntarily provided by the user)
2.3 Health and Wellness Information
This information is considered “special category data” under the GDPR (Article 9) and receives the highest level of protection:
- Lab results (voluntarily uploaded as PDFs or images)
- Nutrition logs (meals, macronutrients, calories)
- Health journal entries (habits, symptoms, and biometric metrics such as steps, sleep, and heart rate)
- Conversations with the AI assistant
- Generated wellness plans
2.4 Technical Information
Our infrastructure providers (web hosting and database services) may automatically log certain technical information, such as your IP address, as part of normal operations. These providers handle this information under their own privacy policies; AxioHuman does not directly access or process it.
AxioHuman does not use traffic analytics tools such as Google Analytics or actively collect browsing data.
For more information about cookies, see our Cookie Policy.
3. Legal Basis for Processing
| Purpose | Legal Basis (GDPR) |
|---|---|
| Create and manage your account | Contract performance (Art. 6(1)(b)) |
| Process health information for the Digital Twin and AI insights | Explicit consent (Art. 9(2)(a)) |
| Manage subscriptions and payments | Contract performance (Art. 6(1)(b)) |
| Service communications (changes and security) | Legitimate interest (Art. 6(1)(f)) |
| Fraud prevention and security | Legitimate interest (Art. 6(1)(f)) |
| Compliance with legal obligations | Legal obligation (Art. 6(1)(c)) |
4. How We Use Your Information
- Providing the service: Process your lab results, generate Digital Twin correlations, personalize nutrition suggestions, and respond to your chat questions.
- Personalization: Adapt plans, recipes, and suggestions to your individual profile.
- Security: Protect your account, prevent unauthorized access, and detect suspicious activity.
- Service improvement: Analyze aggregated and anonymized usage patterns to improve the user experience.
What we NEVER do:
- Sell, rent, or otherwise commercialize your personal or health information.
- Use your information to train our own or third-party AI models.
- Share your information with advertisers or marketing companies.
- Create advertising profiles based on your health information.
5. AI Processing
AxioHuman uses third-party AI models to analyze your information and generate personalized responses. Specific providers may change to improve the service. Please note:
- Your information is sent to the AI provider’s API for real-time processing.
- Under these providers’ standard business API terms, submitted information is not used to train their models.
- No legally significant automated decisions are made based on AI processing. All suggestions are informational and require human review.
6. Service Providers (Subprocessors)
To provide the service, we share information with the following providers under appropriate safeguards:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication, and file storage | U.S. (Data Privacy Framework) |
| Vercel | Web hosting and content delivery | Global (Data Privacy Framework) |
| Proveedores de IA | AI processing for insights and responses | Global (Data Privacy Framework) |
| Lemon Squeezy | Payment processing, billing, and tax compliance (Merchant of Record) | U.S. (Data Privacy Framework) |
Providers participate in the EU-U.S. Data Privacy Framework or equivalent mechanisms approved by the European Commission to ensure an adequate level of protection.
7. International Data Transfers
Some subprocessors may process information outside the European Economic Area (EEA). In those cases, we ensure appropriate safeguards under Chapter V of the GDPR, such as:
- European Commission adequacy decisions.
- Standard Contractual Clauses (SCCs) approved by the European Commission.
- Participation in the EU-U.S. Data Privacy Framework.
8. Data Retention
| Type of information | Retention period |
|---|---|
| Datos de cuenta y perfil | While the account is active |
| Datos de salud y bienestar | While the account is active |
| Conversaciones de chat | While the account is active |
When you delete your account, all your personal and health information is permanently and irreversibly deleted, except information we must retain by law, such as billing records.
9. Your Rights
Under the GDPR and LOPDGDD, you have the following rights:
- Acceso: Know what personal information we process about you.
- Correction: Correct inaccurate or incomplete information.
- Deletion (“right to be forgotten”): Request deletion of your information. You can do this from your Profile.
- Restriction: Request that we restrict processing in certain circumstances.
- Portability: Receive your information in a structured, commonly used, machine-readable format.
- Objection: Object to processing based on legitimate interests.
- Withdrawal of consent: Withdraw your consent at any time without affecting the lawfulness of processing before withdrawal.
To exercise any of these rights, contact us at info@axiohuman.com. We will respond within 30 days.
If you believe your rights have not been properly addressed, you may file a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.
10. Children’s Privacy
AxioHuman is not intended for anyone under 18, and we do not knowingly collect personal information from minors. By registering, you confirm that you are at least 18. If you learn that a minor has registered, contact us at info@axiohuman.comso we can take appropriate action.
11. Security
We use technical and organizational measures to protect your information:
- Communications encrypted with TLS 1.3.
- Passwords stored using secure hashing (bcrypt).
- Token-based authentication with expiration.
- Data access is restricted under the principle of least privilege.
No system is 100% secure. If a security breach affects your information, we will notify you within 72 hours as required by Article 33 of the GDPR.
12. Changes to This Policy
We may update this Privacy Policy periodically. The updated version and revision date will appear on this page. We will notify you of significant changes through the Platform or by email.
13. Contact
For questions about your privacy or how your personal information is handled:
- Email: info@axiohuman.com
- Website: axiohuman.com