Privacy Policy

This policy explains what personal data FunctionAlps collects, why we process it, who it reaches, how long we keep it and what you can require of us. Much of it is health data, which the law treats as especially sensitive and which we process only with your explicit consent. It covers the whole of FunctionAlps — the app, the members dashboard, our website and the emails we send you — because it is one service on several screens, run by one operator, holding one record about you.

1. At a glance

• We process what you log — meals and their photographs, check-ins, symptoms, supplements, measurements — to show you how your body responds to food. It makes no difference whether you logged it in the app or on the members dashboard: it is one record.
• Your meal photographs and meal descriptions are sent to OpenAI, in the United States, to identify the foods and estimate the portions. Everything else is analysed by Infomaniak, a Swiss provider, on infrastructure in Geneva, and is not sent to OpenAI, Google, Anthropic or any other general-purpose AI provider. None of your data is used to train anyone’s models.
• If you use voice input, the recording is transcribed by Infomaniak and then handled like anything else you log.
• If you connect Apple Health on your iPhone, we read the readings you allow — steps, sleep, heart rate and similar, including what your Apple Watch recorded — and nothing is written back. That is described in section 9a.
• If you link a wearable account (Oura, WHOOP, Polar, Garmin, Withings, Suunto or Google Fitbit), we receive the readings that service holds about you, under an access credential you can revoke at any time. That too is described in section 9a.
• If you took the self-assessment on our website, your answers are analysed the same way and we email you the result. That is described in section 8a.
• Your practitioner and the FunctionAlps care team can see your data, in order to support you. Nobody else can.
• We never sell your data, never share it with advertisers or insurers, and never use it for automated decisions with legal effect.
• You can see, export, correct or permanently delete everything at any time, and withdraw any consent you have given.
• We are in Switzerland and apply the Swiss Federal Act on Data Protection (FADP) and, where it applies to you, the EU GDPR.

2. Who is responsible for your data

The controller of your personal data is Alessandra Ginsburg, independent practitioner, Chemin de Bonne-Eau 1, 3975 Crans-Montana, Valais, Switzerland, Swiss business identifier CHE-205.025.089, operating FunctionAlps during its launch phase. FunctionAlps Sàrl is in the course of formation and will become the controller once registered; we will tell you before that happens.

For anything in this policy, and to exercise any right in section 15, write to data@functionalps.ch. We have not appointed a Data Protection Officer, as we are not required to; requests go to that address and are handled by the controller.

3. What this policy covers

It covers every part of FunctionAlps: the app on iOS, Android and the web; the members dashboard, where you can see and manage the same data on a larger screen; the FunctionAlps website, including the self-assessment questionnaire and the forms on it; the emails we send you; and the systems behind all of them.

We say this deliberately, because an earlier version of this policy covered only the app. One operator holds one record about you, so one policy should describe it. Where a rule below applies to only one part — an in-app screen, a website form — it names it.

It does not cover the separate dashboards used by practitioners in their own professional capacity, or your own dealings with a practitioner outside FunctionAlps, including any consultation you book. Those are governed by your arrangements with them and by their own professional obligations.

It also does not cover third parties you choose to deal with directly — for example Google or Apple, if you sign in with a Google or Apple account. Their handling of your data is governed by their own policies.

4. The personal data we collect

We collect only what the service needs to work. In detail:

• Account data — your email address, first and last name, telephone number, date of birth, and an encrypted password (or, if you sign in with Google or with Apple, an identifier from that provider rather than a password; Apple may give us a private relay address instead of your own email address).
• Profile data — age, sex, height, weight, body-composition estimate, activity level, workout habits, dietary pattern, health goals, current complaints and self-reported supplements.
• Meal data — the photographs you take, your written or spoken descriptions, the foods and portions we identify, the nutritional and micronutrient estimates it derives, and the scores it assigns.
• Check-in data — how you feel across sleep, energy, mood and stress; bed and wake times; and any free-text answers you write, including options you create yourself.
• Digestive and symptom data — bloating, stool quality and related symptoms, including any safety flags you report.
• Voice recordings — where you use voice input, the audio you record, and the text transcribed from it. See section 9.
• Wearable data — if you connect Apple Health on your iPhone (including what an Apple Watch or another device has written there): steps, distance, energy burned, exercise minutes and workouts; sleep and its stages; heart rate, resting heart rate and heart-rate variability; breathing rate, blood oxygen and VO₂ max; weight, body-fat percentage and body temperature; and flights climbed. Each reading carries the day or time it was recorded and the device category it came from. See section 9a. The same categories reach us from a wearable account you link, plus what only that service computes: heart-rate variability, recovery or readiness scores, stress, skin-temperature deviation, body composition, blood pressure and, where the service provides it, cycle information.
• Messages — what you write to your practitioner through FunctionAlps, and their replies to you.
• Generated content — your reports, patterns, observations, scores and any practitioner-reviewed interpretation of them.
• Consent records — which consent you gave or refused, when, from which app version and device type, and the exact wording you were shown, identified by a cryptographic hash of that text.
• Technical data — records needed to run and secure the service: authentication events, timestamps, error and diagnostic logs, and the internet protocol address seen when you connect. If you allow notifications on your phone, also the device token Apple assigns to it, so that we can send them (see section 11); the text of a notification never contains health data.
• Optional usage statistics — if, and only if, you separately agree: when you open the app, how long a session lasts, and which screens you visit.
• Website assessment answers — if you complete the self-assessment on our website: your first name, email address, age, sex, and your answers about how you feel, together with the summary we generate from them.
• Enquiry details — if you ask us to contact you through a form on our website: your email address, which consents you ticked and when, and the version of the wording you were shown.

5. Where the data comes from

• From you directly — everything you type, photograph, record or tick.
• From your FunctionAlps record — the answers you gave in the intake questionnaire you completed with the practice, and your date of birth. We use these only to fill in your baseline details (sex, height, weight, activity level and age) so the app does not ask you for what you have already told us; the app shows you which details came from that record, and you can change any of them.
• From Apple Health — only if you choose to connect it, and then only the categories you allow in Apple’s permission sheet. The app reads them on your phone; Apple sends us nothing and receives nothing from us.
• From a wearable account you link — only if you choose to link it, and then only what you authorise on the vendor’s own consent page. The vendor (Oura, WHOOP, Polar, Garmin, Withings, Suunto or Google) sends the readings to us directly; no intermediary service sits between us and the vendor.
• Generated by the service — scores, estimates, patterns and reports we derive from what you logged, and the summary generated from a website assessment.
• From Google or Apple — only if you choose to sign in with one of them, and then only the identifier and email address needed to authenticate you (Apple may provide a private relay address).

6. Why we process your data, and our legal basis

We process your data for the purposes below and no others. Each purpose has a legal basis; where the basis is consent, you can withdraw it at any time and we stop that processing.

• To give you an account and run FunctionAlps for you — account and profile data. Basis: performance of our contract with you (GDPR Art. 6(1)(b); FADP Art. 31(2)(a)).
• To store and analyse your health information so the service can exist at all — meal, check-in, symptom and voice data. Basis: your explicit consent to health-data processing (GDPR Art. 9(2)(a); FADP Art. 6(7)(a)), on top of the contract basis above.
• To bring in the readings from Apple Health that you choose to share, and to read them alongside what you log — wearable data. Basis: that same explicit consent to health-data processing, together with your separate choice to connect, which you can undo at any time (section 9a).
• To keep the access credential a linked wearable account gives us, so that new readings keep arriving without asking you again — the credential itself. Basis: performance of our contract with you and your separate choice to link, which you can undo at any time; the credential is deleted when you unlink.
• To produce your scores, patterns and reports using AI — the same health data, de-identified as far as we are able. Basis: that same explicit consent, AI being part of the service as described.
• To analyse a website self-assessment and send you its summary — the answers you gave and your email address. Basis: your explicit consent, given on the assessment itself before you answer anything.
• To let your practitioner and the care team support you — your logged and generated data. Basis: your explicit consent, and performance of our contract.
• To send you service messages about your account, security or these documents — account data. Basis: our contract, and our legitimate interest in operating the service safely (GDPR Art. 6(1)(f)).
• To keep the service secure, prevent abuse and diagnose faults — technical data. Basis: our legitimate interest in a secure and functioning service, balanced against your rights.
• To comply with legal obligations, including keeping proof of your consents — consent and minimal accounting records. Basis: legal obligation (GDPR Art. 6(1)(c)).
• To send you news and offers — your email address. Basis: consent, always optional, withdrawable in one tap.
• To follow up on a website assessment you completed — your email address, for a short sequence of messages about your result. Basis: consent, given with the assessment; every message carries an unsubscribe link and stopping it affects nothing else.
• To measure whether the app is helping you — optional usage statistics. Basis: consent, always optional.

7. Health data: a special category

Most of what we hold about you is health data. Swiss and EU law treat it as a special, particularly sensitive category that may only be processed on a narrow set of grounds. Ours is your explicit consent, given separately from these documents and recorded against the exact wording you were shown.

That consent is specific to providing you the service, and it covers the whole of it — the app, the members dashboard and the website assessment alike. You give it once. It does not permit sharing your data outside FunctionAlps, marketing, or research — each of those is a separate choice you can decline without any effect on your service.

If you withdraw it, we can no longer provide FunctionAlps, because processing your health data is what the service consists of. Withdrawal is always available, on any surface where you can give it, and section 16 explains exactly what happens.

8. AI processing, profiling and automated decisions

Identifying the foods in a meal photograph or description, and estimating their portions, is performed by an AI model operated by OpenAI in the United States. Estimating nutrients, scoring meals, detecting patterns and drafting reports are performed by AI models operated by Infomaniak on infrastructure in Geneva, Switzerland.

This is profiling in the sense of the GDPR: we analyse your data to evaluate aspects of your health and habits. It does not, however, make decisions producing legal effects concerning you or similarly significantly affecting you within the meaning of Article 22 GDPR. Nothing in FunctionAlps decides anything about you; it describes and suggests, and every consequential decision remains yours or your practitioner’s.

We de-identify data before analysis: your name, email address and contact details are not attached to what is sent. We want to be straightforward with you about the limits of that, because they are real — a photograph may show your face, hands or home, and free text or a voice recording may contain a name, place or detail that identifies you. De-identification reduces the risk substantially; it does not make the data anonymous.

So we do not claim your data is anonymous. We continue to treat everything sent for analysis as your personal health data, with the same protections, retention periods and rights.

Your data is not used to train AI models, ours or anyone else’s.

Written interpretations in your periodic reports are reviewed by a qualified practitioner before you see them. Meal identification, nutrient estimates, scores and website assessment summaries are generated automatically and are not individually reviewed before you see them; we label automatically generated material where you see it.

8a. The self-assessment on our website

Our website offers a short questionnaire about how you feel. It is open to anyone aged 18 or over, and you do not need an account to take it.

What happens to your answers: we score them with fixed rules in our own code, then two AI models running on Infomaniak in Geneva read the result — the first to structure it, the second to write it in plain language. We store the assessment and the summary, and we email the summary to you, followed by a short sequence of follow-up messages. Every one of those carries an unsubscribe link.

Your answers are health data, and we ask for your explicit consent on the questionnaire itself before you answer anything. The summary is automatically generated and nobody reviews it individually before it reaches you. It is not a diagnosis and it is not medical advice.

If you later create a FunctionAlps account with the same email address, we can connect the assessment to it so you do not lose it. If you do not, the assessment is kept for the period in section 13 and then deleted. You can ask us to delete it sooner at data@functionalps.ch, and you do not need an account to ask.

9. Voice recordings

Where you choose to describe something by speaking — in the app, on the members dashboard, or in a form on our website — we record audio and send it to Infomaniak in Switzerland for speech-to-text conversion. The resulting text is then treated like anything else you log, and the transcript is subject to the same retention rules as the entry it belongs to.

A recording captures whatever is audible around you, so please avoid recording other people. Voice input is optional; you can always type instead.

9a. Apple Health and wearables

If you choose to connect Apple Health in the app, the app reads the categories you allow in Apple’s permission sheet — including what your Apple Watch, or any other device that syncs into Apple Health, has recorded there — and sends them to your FunctionAlps record. It only reads: it never writes anything to Apple Health, and Apple is not a party to the transfer.

The readings are reduced on your phone before they are sent: one value per day for each category (your steps, your resting heart rate, how long you slept and in which stages, and so on) and one entry per workout. Those daily values are stored with the day they belong to and with a marker saying they came from Apple Health, and they are shown to you and to your practitioner next to your meals and check-ins, so that your body’s response can be read together with what you logged. They may be used in the scores and patterns the service computes for you, under the rules in section 8.

Wearable readings are health data and are covered by the explicit consent described in section 7. They are never sent to OpenAI, Google, Anthropic or any other general-purpose AI provider.

You can stop the connection at any time on the Devices screen in the app; the phone then stops sending. You can also withdraw the app’s permission for any category, or for everything, in Settings → Health → Data Access & Devices on your iPhone. Readings already sent stay in your record under the rules in section 13 and are deleted with everything else when you delete your account.

**Linked wearable accounts.** On the Devices screen you can also link an account you hold with Oura, WHOOP, Polar, Garmin, Withings, Suunto or Google (Fitbit). You are sent to that vendor’s own sign-in and consent page; what you allow there is what we receive. The vendor then sends us your readings — sleep, heart rate and heart-rate variability, activity and workouts, body measurements and, where the service computes them, its scores — either as they arrive or through a daily pull, and we store them with the day they belong to and the vendor they came from. To do this we keep an access credential for your vendor account, encrypted, on our servers; nobody reads it, it is used only to fetch your readings, and it is deleted the moment you unlink the account in the app, revoke it at the vendor, or delete your account. The vendor remains responsible for its own service under its own privacy policy; we do not send it anything about you. No aggregator or intermediary company is involved. Readings already received stay in your record under the rules in section 13. When you unlink, you can also choose to delete the readings that account had already sent: we then remove them from your record right away, and the raw copies we keep for traceability follow within a month. Every link, unlink and deletion is recorded in a log that you can ask us for at any time. Readings from a linked account serve only your own scores and your practitioner’s view; they are never passed to an artificial-intelligence service.

10. Who inside FunctionAlps can see your data

Your practitioner and the FunctionAlps care team can see your logged and generated data, in order to support you. Access is limited to those who need it for your care and to the small number of people who administer the service.

Where we detect a pattern or a flagged symptom that may deserve attention, a summary may be reviewed. Your identity is re-associated only where a reviewer needs to follow up with you, and every such look-up is recorded in an internal log.

A reviewer’s message is informational and supportive. It is not a diagnosis, and it is never an emergency response — see the Terms of Service, section 5.

11. Who else your data reaches

We rely on a small number of providers, each acting on our instructions under a data processing agreement, and none of them may use your data for their own purposes:

• Supabase — database, authentication and file storage. Hosted in the European Union (Stockholm, Sweden).
• Infomaniak — AI analysis, speech-to-text, and our transactional email. Switzerland (Geneva).
• OpenAI — identifying the foods in your meal photographs and meal descriptions. United States. OpenAI may keep what it receives for up to 30 days to detect abuse, then deletes it, and does not use it to train its models.
• Google or Apple — only if you choose to sign in with one of them, and then only for authenticating you.
• Apple — for push notifications, if you allow them on your iPhone: Apple delivers the notification and receives only your device token; the text never contains health data.
• Vercel — hosts the web app and the members dashboard and delivers their files through a global network; it sees the technical data of your connection, including your IP address, and nothing you log.
• We may also disclose data where the law requires it, to establish or defend a legal claim, or to protect someone’s vital interests. We do not sell your data, share it with advertisers or insurers, or transfer it for anyone else’s marketing.

12. Where your data is processed, and transfer safeguards

Your data is stored and processed in the European Union and in Switzerland, with one exception: your meal photographs and meal descriptions are sent to OpenAI in the United States to identify the foods, under the safeguards described in the next paragraph. The European Union and Switzerland are each recognised by the other as providing an adequate level of data protection, and Switzerland is recognised as adequate by the European Commission. The web app’s files are delivered by Vercel’s global network, which sees only your connection data; everything you log is stored in the EU and Switzerland as described.

Where a provider or its parent is established outside Switzerland or the EEA, transfers are protected by appropriate safeguards — the European Commission’s Standard Contractual Clauses, in the version recognised by the Swiss authorities, together with supplementary technical measures such as encryption in transit and at rest. You can ask us for details of the safeguards applying to any specific provider.

13. How long we keep your data

We keep data only as long as it serves the purpose it was collected for:

• Account and profile data — while your account is active.
• Meals, check-ins, symptoms and supplements — while your account is active, so your own history and trends remain available to you.
• Voice recordings — the audio is retained only as long as needed to produce and verify the transcript, and is then deleted; the transcript follows the entry it belongs to.
• Wearable readings — while your account is active, like the rest of your record; the raw submissions from your phone are kept alongside them so that a value can always be traced back to what the phone sent.
• Access credentials for linked wearable accounts — until you unlink the account, revoke it at the vendor, or delete your account; then deleted immediately.
• Raw copies of what a linked wearable account sent — 30 days after you unlink it, or right away when you ask us to delete those readings.
• Generated reports and interpretations — 12 months, or until you delete them.
• Website assessments and their summaries — 12 months from the day you took the assessment, or until you ask us to delete them, or until they are connected to an account, after which they follow that account.
• Messages — while your account is active.
• Technical and security logs — a short period appropriate to diagnosing and investigating incidents, and no longer than 12 months.
• After you delete your account — all your personal data is erased within 30 days.
• Consent records — retained after deletion for as long as the law requires, because they are the proof that we processed your data lawfully. They contain no health data.
• Records your practitioner must keep — retained by them, separately from FunctionAlps, for the period Swiss law requires.

14. How we protect your data

• Encryption in transit and at rest.
• Access control enforced at the database level, so that your account can only ever read and write your own rows.
• Contact details and other directly identifying information held separately from your health data, and not attached to data sent for AI analysis.
• Practitioner identity look-ups recorded in an internal audit log, as are all changes to your consent records.
• Access limited to the people who need it, under confidentiality obligations.
• No security is absolute. If you believe your account has been compromised, contact support@functionalps.ch immediately.

15. Your rights, and how to use them

You can exercise any of these at any time, free of charge, in the app, on the members dashboard, or by writing to data@functionalps.ch. We will respond within 30 days; if a request is unusually complex we may extend that, and we will tell you why within the same 30 days.

• Access — see the data we hold about you. In the app or on the members dashboard: Privacy & Data › View my data.
• Portability — receive a copy in a structured, machine-readable format. In the app or on the members dashboard: Privacy & Data › Export my data, which produces a JSON file.
• Rectification — correct anything inaccurate, by editing your profile or asking us.
• Erasure — permanently delete your account and data. In the app or on the members dashboard: Privacy & Data › Delete my account. Read section 13 first, and export anything you want to keep.
• Restriction and objection — ask us to pause processing, or object to processing based on our legitimate interests.
• Withdraw consent — at any time, with the consequences set out in section 16. Withdrawal does not affect the lawfulness of processing before you withdrew.
• Complain — to a supervisory authority; see section 21.
• We may need to verify your identity before acting on a request, to make sure we do not disclose your data to someone else.

16. Withdrawing consent, and what happens then

Withdrawal is always available and is never penalised beyond the direct consequence described here. You can withdraw in Privacy & Data — in the app or on the members dashboard, whichever you have open. It is deliberately no harder to withdraw a consent than it was to give it.

Withdrawing consent for news and offers, or for usage statistics, stops that specific processing and changes nothing else. The app continues exactly as before.

Withdrawing consent for health-data processing switches FunctionAlps off — the app and the members dashboard together, because it is one consent for one service. This is not a penalty: that processing is what the service consists of, and without it there is nothing we can do for you. Your data is not deleted by withdrawing — you can restore access by giving consent again, or delete your account to erase it.

The Terms of Service are not a consent and cannot be "withdrawn"; if you no longer accept them, stop using FunctionAlps and delete your account.

17. Data breaches

If a breach of security leads to the accidental or unlawful destruction, loss, alteration or unauthorised disclosure of your personal data, we will notify the competent supervisory authority as the law requires, and we will inform you directly and without undue delay where the breach is likely to result in a high risk to your rights and freedoms.

We will tell you what happened, what data was involved, what we are doing about it, and what you can do to protect yourself.

18. Children and young people

FunctionAlps is for adults aged 18 and over — every part of it, including the self-assessment on our website. We do not knowingly collect data from anyone under 18, and we ask for your date of birth at registration to confirm this. Where we cannot confirm it, no consent record can be created and the service does not open.

If you believe someone under 18 has given us data, write to data@functionalps.ch and we will delete it promptly.

19. Cookies and on-device storage

The app and the members dashboard store data on your device to work: your login session, your display preferences, and a local cache of your own entries so they remain usable with a poor connection. Our website stores your progress through an assessment on your own device, so that closing the tab does not lose your answers.

All of this storage is strictly necessary to provide the service you asked for. We do not use advertising cookies, tracking pixels, or third-party analytics that follow you across other sites and apps, on any part of FunctionAlps.

20. Changes to this policy

We may update this policy — for example when we add a feature, engage a new provider, or the law changes. Minor changes are reflected by updating the date at the top.

Where a change materially affects how we use your data, or extends processing that rests on your consent, we will tell you before it takes effect and, where the law requires it, ask for your consent again — once, on whichever part of FunctionAlps you next open. Every version you accept is recorded, together with the date, the language and the exact wording you were shown.

21. How to complain

Please tell us first at data@functionalps.ch — we would rather fix it than have you go elsewhere unsatisfied.

You also have the right to complain to a supervisory authority. In Switzerland: the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern. In the EEA: the data protection authority of your country of residence, place of work, or where you believe the problem occurred.

22. Contact

Privacy questions and all data requests: data@functionalps.ch. General support: support@functionalps.ch. Post: FunctionAlps, Chemin de Bonne-Eau 1, 3975 Crans-Montana, Valais, Switzerland.