Yema Privacy and Personal Data Processing Policy

Last updated: October 19, 2026
In force: from October 18, 2026, for as long as Yema is available.
Published at: tryyema.com/en/privacidad, with a version in each language.

This page explains what data Yema collects about you, what for, who it is shared with, how long it is kept and how to exercise your rights. This policy complies with Colombia's Law 1581 of 2012 and Decree 1377 of 2013 (compiled in Decree 1074 of 2015), and adds what the laws of the other countries where Yema is available require (section 17).

The short version: Yema is a food and weight diary, so it processes health data. It uses it only for your plan and for what you ask it to do. It doesn't sell your data, show ads or track you, and it doesn't use your health data for advertising. Your cycle and your mood never leave your phone. Each kind of health data has its own permission, which you can refuse or withdraw at any time. And you can delete your account whenever you want, from the app or from this site.

Contents

1. Data controller
2. What Yema is and isn't
3. Data we collect
4. Your health data
5. Apple Health and Health Connect
6. Yema's AI and Google Maps
7. What we don't collect
8. What we use your data for
9. Notifications and emails
10. Your authorization
11. Who we share data with
12. International transfers
13. How long we keep it
14. Deleting your account
15. Your rights
16. How to exercise them
17. If you live outside Colombia
18. Adults only (18+)
19. Security
20. Website and cookies
21. Changes to this policy
22. Contact

• Annex A. Consumer Health Data Privacy Policy (Washington, Nevada and other U.S. states)
• Annex B. Privacy notice

1. Data controller

The controller of your personal data is Duvan Vargas, a private individual (persona natural), domiciled at Calle 32 #52b-150, Rionegro, Antioquia, Colombia, who develops and runs the Yema app and website ("Yema", "we", "us").

• Email for personal data: soporte@tryyema.com.
• LinkedIn: https://www.linkedin.com/in/duvandroid.
• Data protection officer (encarregado) for Brazil (LGPD Art. 41): Duvan Vargas, at soporte@tryyema.com.

For any question about your data, write to us at that email address: it's the channel we answer, and it keeps a record of your request.

2. What Yema is and isn't

Yema is an app to log what you eat and look after your weight: your meals, water, weight and exercise, with a calorie and macro plan built with reference formulas. With Yema Plus it also recognizes the dish in a photo, reads a restaurant's menu, suggests recipes and tells you what to order nearby with Google Maps.

• Yema is in the stores of many countries, but for now not in the European Union, the European Economic Area, Switzerland or the United Kingdom (section 17). Wherever you live, the controller of your data is the same, in Colombia. We process your data under this policy, Colombian law, and the law of your country where it gives you more rights (section 17).
• Yema is not a medical service. It doesn't diagnose, treat or prevent any disease, it isn't a medical device, and it doesn't replace your doctor or your dietitian. The health data you give us is used to make your plan safer, not to treat you.
• Yema is not an emergency service. If you write something that looks like an emergency, we show you your country's emergency number, but we don't alert anyone and we don't keep that message (section 6).
• What Yema knows about you is what you tell it, or what you let it read from your phone's health app.

3. Data we collect

Your account

• Sign-in: with Apple, with Google, or with a 6-digit code we email you. We receive your email address and an account identifier and, if the provider shares them, your name. If you use Apple's "Hide My Email", we receive the address Apple generates. We don't use passwords. For the code, we keep only an encrypted version (a hash), which expires after 10 minutes.
• Profile and settings: your name, country, language, time zone, units, the day your week starts, your notification preferences, the lessons you finished and your streak.

Your plan

To work out your energy needs and your goals we ask for your date of birth, your sex for the formula (female or male), your height, your weight, your goal (lose weight, maintain, eat healthier or build muscle), your goal weight if you want to lose weight, your pace and your activity level. From that we calculate your calorie, protein, carbohydrate, fat, fiber and water goals. Your weight, height and goals are health data (section 4).

Your date of birth is also used to confirm that you are 18 or older (section 18).

What you log

• Meals: the name, time, portion, calories, protein, carbohydrates, fat, fiber and allergens of each food, how you logged it (photo, voice, search, barcode, label, recipe…) and whether you'd have it again. If you log it from What to Order or from a menu, also the name of the place.
• Water, weight and exercise you log by hand, and whether you marked "Day complete" or "Rest day".
• Your foods and recipes, your week plan, your grocery list and your recipe budget. The budget is never shared.
• Food photos: they stay on your phone, in your diary. We don't upload them to your account. The ones you send so Yema can recognize the dish go to Google only to answer you (section 6), and we don't keep them.
• The photo of your foods and recipes, and your profile photo: the ones you choose with the camera or your gallery are kept smaller only on your phone. We don't upload them to your account or to any server, except a recipe's that you share «With my photo» (below). They are deleted when you remove them, when you delete the food or the recipe, or when you delete your account.
• My places: the places you mark with 👍 or 👎 in What to Order are kept on your phone, with their name and their Google Maps identifier. The ones you don't like go with every What to Order search so they are never suggested.

What you share with a link

• A recipe or a food you share with «Share» is public at tryyema.com for whoever has the link or scans its QR code, until you turn it off with «Stop sharing» or delete your account. Only the recipe goes: its name, the servings, the time, the ingredients in grams with their values, the steps and the figures per serving Yema works out. Never your weight, your day, your goals or your name, unless you choose to sign it with your name. Its photo goes only if you choose it («With my photo»): then it goes up to our server, smaller and without the data of where it was taken, and it only shows inside the recipe's image. The link carries your invite code, which does not say who you are.
• The house's week you share with whoever cooks shows at tryyema.com only with its 6-digit code, which you can change or turn off. It carries the dishes with their servings in grams, the ingredients, the steps and the shopping list, without prices. Whoever cooks can tick what they buy, and that reaches you. They never see your calories, your weight or anything about your health.
• Reporting: if someone reports a shared recipe, we keep the reason, the date and an encrypted summary of their connection (not their address), to review it within 24 hours.

Dishes you share to help others

• If, when you log a dish at a restaurant, you turn on «Share this dish to help others» (it starts off, it is per dish and we ask your permission every time), other people on Yema will see at that place the dish's name and Yema's estimate of its calories and macros, as «Shared by people on Yema», with the month you shared it. We never share your name, your account, the photo, the day, the time, your weight, your goals or anything else about your day: that is why only the month goes, so nobody can tell who ate there.
• In your account we keep, separately, which dishes you shared, only so you can stop sharing them. When you stop sharing one, it is deleted for everyone; when you delete your account, too.
• Before showing it we check that the name has no insults, links or contact details. If someone reports it, we hide it for everyone right away and review it within 24 hours.

Yema Plus: photos, voice, chat, menus and What to Order

Yema Plus features use Google's artificial intelligence (Gemini) and, in What to Order, Google Maps. What data goes, when, and what Google does with it is in section 6.

Feedback you send us

If you write to us from the app (in "We want to hear from you", by tapping 👍 or 👎 on one of Yema's answers, or in "Report a problem"), we receive your comment, the reason you pick, your plan, your profile's country, your language, your phone's operating system and the app version. With a 👍 or 👎 we also receive the Yema answer you rated, except What to Order answers, which aren't kept (because of Google Maps' terms). That answer may mention your day or your health.

Photos and videos. You can attach up to 5 photos and 1 video that you choose from your gallery. We store them in Firebase, in a folder of your account that only the Yema team can see.

We use this to improve Yema and to reply to you, at your account's email address.

Purchases and subscriptions

Yema Plus is paid for in the App Store or Google Play. Yema doesn't receive or store your card details. RevenueCat, the service the app uses to check your purchases, receives your Yema account identifier and the purchase data the stores provide: the product, the purchase, renewal and expiry dates, the store country and a transaction identifier. That's how we know whether your plan is active. RevenueCat doesn't receive your health data.

We also count how many photos, questions and searches you've used in the day and in the month, to apply your plan's limits.

App failures

Crash reports. If the app fails and you allow it, Firebase Crashlytics sends a technical report: what failed, the screen, an error code, the phone's model and operating system, the app version, an installation identifier and your account identifier, so we can find the failure if you write to us. It never contains your weights, your meals, your health data, your name, your email or anything you type. You turn it on or off in More > Privacy ("Crash reports").

Technical log on your phone ("black box"). The app keeps its last 300 technical steps on your phone: when it opens, with which version, operating system, model and language; the screens you open; when it goes to the background; and the code of each error or freeze. It never stores weights, calories, names, emails or anything you type. It reaches us only if you say yes: when you report a problem and tick "Send the technical log", or if you leave crash reports on. It arrives with your account identifier, so we can find it if you write to us.

How you use the app

We keep in our database which days you open Yema and how many times, the platform and app version, whether you have notifications and the theme turned on, and how many meals you logged each day and how (for example, "2 by photo, 1 by search"), never what you ate. That tells us whether Yema is helping you. The team sees it only as aggregate figures, without your name or email.

Usage data (Google Analytics for Firebase). If you leave "Usage data" on in More > Privacy, the app sends Google Analytics for Firebase a closed list of events: which screen you open and for how long, how you log (for example, "by photo"), which feature you use and whether it worked, and whether you buy Yema Plus and which kind. It goes with an installation identifier, the phone's model and operating system, the app version, the language and the approximate country. It never carries your account identifier, the advertising identifier, your weights, your meals, calories, your cycle, your mood, your conditions, your name, your email or anything you type. It isn't used for advertising, and Google signals and ads use are off. If you turn it off, the app stops sending and deletes what it hadn't sent.

4. Your health data

Yema processes health data. The law calls it sensitive data (in Colombia, Brazil and Mexico), special category data (in the European Union and the United Kingdom) or consumer health data (in several U.S. states), and gives it stronger protection. This is Yema's:

If you choose "On this phone only" mode (section 10), what says "Your phone and your account" stays only on your phone.

What always applies to this data:

• Giving it is optional. Because it's sensitive data, you aren't required to authorize its processing, and no feature that doesn't need it depends on you giving it. Each group has its own permission (section 10).
• We use it only to provide the service you ask for: your plan, your diary, your recipes, What to Order and Yema's answers.
• We don't sell it, use it for advertising or build profiles for advertisers, and we don't use it to make decisions about insurance, credit or employment.
• It never appears in what you share: Your month and badges carry no figures, no weight and no health data.
• The Yema team can't see it. The database rules don't let anyone but you read it. For metrics the server only counts how many meals you logged, never which ones.
• Google only receives what's needed for the answer you asked for (section 6), and Google doesn't use it to train its models.

5. Apple Health and Health Connect

If you connect Yema with your phone's health app (Apple Health on iPhone, Health Connect on Android), the system asks your permission for each type of data, and you can refuse or withdraw it at any time in its settings. In Yema, each type also has its own switch, which says what it's for.

If you change or delete a meal, a glass or a weight in Yema, it changes or is deleted there too, and nothing is written twice. What Yema wrote to Health is yours: if you delete your account, it stays there and you delete it from Apple Health or Health Connect. We don't ask for distance or floors: steps and workouts are enough. We don't read body fat, lean mass, resting or basal energy, resting heart rate, its variability or mindful minutes either: no feature of Yema uses them.

What we never do with Apple Health and Health Connect data: use it for advertising, marketing or data mining; sell it or pass it to advertising platforms, data brokers or resellers; store it in iCloud; display it publicly; or write false data into Health. We only use it to give you what the app offers, as Apple's rules (App Store guideline 5.1.3) and Google Play's rules (Health Connect policy) require.

6. Yema's AI and Google Maps

Yema Plus features use Gemini, Google's artificial intelligence model, on Vertex AI, within Yema's own Google Cloud project. Yema is an AI and can make mistakes: double-check anything important.

When something is sent. Only when you tap one of these features; while you only log by search, barcode or by hand, nothing is sent. The first time, we tell you and ask your permission (section 10).

In all of them, if you authorized it, the list of what you don't eat also goes (for example, "avoid: peanuts, shrimp"), plus a few care notes based on your health (for example, "pregnant: no raw fish" or "diabetes: no added sugars"), so the answer is safe for you. Your full health answers never go. What you don't like also goes (for example, "doesn't like: cilantro"): it isn't health data and doesn't need that permission.

Your day in Health, with the suggestions. What to Order, menus, recipes, your fridge, the week plan and the chat carry a summary of your day: your workouts (from Health and the ones you log) and, if you connected them, your steps, your active energy, your sleep and your weight trend. It lets Yema suggest more protein on a training day or something more filling after a short night. Your cycle, mood, glucose and blood pressure never go: with them, Yema only uses rules that run on your phone. Nor does the height from Health (Yema uses your profile's). With numbers-free mode or a history of an eating disorder, your weight doesn't go either. Our server doesn't keep it.

What Google does with it (under Google Cloud's terms):

• It doesn't use it to train its models.
• It processes it on Yema's behalf, as a processor, only to give you the answer. Yema turned off Vertex AI's cache, so Google doesn't keep what we send it to reuse it. Under its terms, Google may log it for a limited time only to detect abuse of its service.
• What Google also keeps, under its terms: in What to Order, what was asked of Google Maps, including your location, and its answer, for 30 days, only to debug its service; and in product on the web, the search, for 3 days. That can't be turned off.

What Yema does: it doesn't store your photos, menus, questions, recordings or answers on its server, or write them to its logs. Your location isn't stored or tracked: it's requested only when you tap "Search" in What to Order. What to Order answers live only on the screen; if you log a dish, it stays in your diary with the name of the place. Your conversation with Yema isn't kept on our server: it stays on your phone, with the notes of what Yema remembers of it, which you see and delete in More > Privacy ("Your chat with Yema").

Google Maps. The places What to Order shows come from Google Maps, exactly as Google Maps provides them, with their link. When you open a Google Maps link you enter a Google service, governed by the Google Maps/Google Earth Additional Terms of Service (https://maps.google.com/help/terms_maps.html) and the Google Privacy Policy (https://policies.google.com/privacy).

Emergencies. If you write something in the chat that looks like an emergency (for example, chest pain, a severe allergic reaction, or wanting to hurt yourself), the server checks it without AI and replies with your country's emergency number and helplines. That message doesn't reach Gemini, isn't stored, and we don't alert anyone.

Automated decisions. Yema calculates your plan and recommends dishes automatically, but it doesn't make decisions that have legal effects on you or affect you in a similarly significant way: you decide what to eat, and you can set your goals by hand in Goals and plan.

Recipe videos on YouTube. "Want to see how it's made?", under a recipe, opens a YouTube search in your browser or in its app. The search carries the name of the dish and, if you let us use how you eat and your allergies, words like "vegan", "gluten-free" or the allergens to leave out, so the videos suit you. Yema doesn't use the YouTube API for this, doesn't connect to your YouTube account and sends it nothing else. What you watch there is governed by the YouTube Terms of Service (https://www.youtube.com/t/terms) and the Google Privacy Policy (https://policies.google.com/privacy). Later on, Yema Plus may get a recipe out of a video you choose; if it comes, we'll tell you here what data it uses before you can use it.

7. What we don't collect

• Yema doesn't show ads and doesn't track you: it doesn't use your phone's advertising identifier, it doesn't share data with ad networks or data brokers, and it doesn't sell your data.
• We don't use third-party analytics on the website, and in the app only Google Analytics for Firebase, if you leave "Usage data" on, with what section 3 says: never for advertising.
• We don't access your contacts, your calendar or your location in the background. The camera, microphone, gallery and location are used only when you tap the feature that needs them.
• Your voice, only to understand you: when you dictate, the recording goes to Gemini to read it better and answer you, and it isn't kept: not on our server, nor at Google, whose cache is off; your phone deletes it as soon as it's read. While you speak, your phone's dictation writes the text; depending on your settings, Apple or Google may process that audio under their own policies.
• We don't ask for ID documents, card details or biometric data.

What never leaves your phone: your cycle, your mood, what you note about your fridge, the exercise that comes from your health app, your food photos, your conversation with Yema and the files you download with "Download my data".

8. What we use your data for

We don't sell your data, rent it or use it for advertising. If we ever wanted to use your data for a different purpose, we'd tell you first and ask for a new authorization.

9. Notifications and emails

Phone notifications (your meals, water, streak, "your week is ready") are local notifications: your own phone schedules them, they never show your weight or calories, because anyone can see the lock screen, and you turn them off in More > Notification settings or in your phone's settings.

Yema doesn't send you advertising emails and doesn't give your email to anyone else to contact you. Today we only write to you for the service: for example, the sign-in code, replies to your requests, important notices about your account or your subscription and the confirmation that your account was deleted. They have no switch, because they are the service itself.

Today we don't send summaries or news by email. If we ever do, we'll tell you first, you'll be able to turn them off at any time with their switch in the app and with the link in each email, and they'll never show your weight or calories.

10. Your authorization

When you create your account you accept this policy and authorize us to process your non-sensitive data (your account, profile, purchases and how you use the app) for the purposes in section 8.

Your health data comes with separate authorizations, each with its own unticked box, which you may choose not to give:

Before each one we tell you what data it is, what we use it for and that giving it is optional. We keep a record of what you accepted: which text, in which language and when. If we change that text, we ask you again.

You can withdraw each authorization at any time, as easily as you gave it: in More > Privacy, in your phone's health app settings, by deleting your account (section 14) or by writing to us (section 16). When you withdraw it, we delete that data from your account and tell you what stops working. What we did before with your authorization remains valid.

Phone permissions (camera, microphone, location, notifications, Health) are requested by the system the first time you use the feature, and you withdraw them in your phone's settings.

11. Who we share data with

We don't sell or transfer your data. We only share it, as far as necessary, with these processors, who handle it on Yema's behalf under contracts that require them to protect it:

• Google Cloud and Firebase (Google LLC, U.S.): sign-in (Firebase Authentication), database (Cloud Firestore), server functions (Cloud Functions), attachments to your feedback (Cloud Storage for Firebase), the website (Firebase Hosting), crash reports (Crashlytics), usage data if you leave it on (Google Analytics for Firebase) and checking that the app is genuine (App Check).
• Google Cloud Vertex AI (Google LLC): Gemini, Grounding with Google Maps and Grounding with Google Search, with what's in section 6.
• RevenueCat, Inc. (U.S.): the status of your purchases (section 3).
• Resend, Inc. (U.S.): sending our emails. It receives your email address, your language and the message.
• Expo (650 Industries, Inc.) (U.S.): app updates; it receives your phone's IP address and app version.

Whoever has the link to a recipe or a food you share, and whoever cooks with the code of the house's plan (section 3, «What you share with a link»). Other people on Yema, in What to Order and on a place's page, see the dishes you share to help others, without your name or your account (section 3, «Dishes you share to help others»).

Others who receive something, under their own policies:

• Apple and Google, for signing in with their account, selling Yema Plus in their stores, your phone's health app and your phone's dictation. They are responsible for the payment data they process.
• Open Food Facts (non-profit association, France): when you scan a barcode, your phone asks it about that code; it receives the code and the IP address, never your account.
• Google Maps, when you open a place's link, and YouTube, when you open its search from a recipe (section 6).

We may also disclose data when required by law or by an order of a competent authority, and only what's needed.

12. International transfers

Your data is stored on Google Cloud and Firebase servers in the United States, and RevenueCat, Resend and Expo also process data there. To answer you, Gemini uses Vertex AI's global service, which may process your request in any country where Google has data centers. Open Food Facts is in France.

• From Colombia this is a transmission to processors acting on Yema's behalf, under contracts that require them to protect your data (Decree 1377 of 2013, Arts. 24 and 25). The United States is on the Superintendence of Industry and Commerce's list of countries with an adequate level of protection (External Circular 005 of 2017).
• If you live in Brazil, the transfer to these processors is necessary to give you the service you ask for, and it's made under contracts that require them to protect your data (LGPD Art. 33). You can ask us for more information about those safeguards.
• If you live in Mexico, these are disclosures to processors (remisiones), which don't require your consent.

You can ask us for a copy of the safeguards we use (section 16).

13. How long we keep it

When you delete your account, your data is removed from our database at that moment and, within 30 days at most, from backups and from our providers' technical copies, except what the law requires us to keep.

14. Deleting your account

You can delete your account and all your data whenever you want:

• In the app: More > Privacy > Delete my account.
• On the web, without the app: at tryyema.com/borrar-cuenta (in Spanish for now), signing in with the same account you use in Yema, or by writing to soporte@tryyema.com from your account's email address.

It's deleted immediately and can't be undone. We delete your profile, your plan, your health answers, your way of eating and allergies, your diary, weight, water and exercise, your foods and recipes, the dishes you shared, your week and grocery list, your usage counters, your feedback with its photos and videos, your technical log, the record of your authorizations and your sign-in. What lives on your phone is deleted from that phone. If you signed in with Apple, we also ask Apple to remove Yema's access to your Apple ID.

Deleting your account doesn't cancel a subscription bought in the store: cancel it in your Apple or Google Play account too. The details are at tryyema.com/borrar-cuenta.

15. Your rights

As the owner of your data you have the right to:

• Know what data we hold about you and how we use it, and access it free of charge. In the app you see everything you log, and "Download my data" gives you a copy (diary, weight and water as CSV; the rest as JSON).
• Update and correct your data. In Yema you can correct or delete any entry.
• Ask for proof of the authorization you gave us.
• Be informed about how we use it.
• Delete your data and revoke your authorization, where there's no legal or contractual duty to keep it.
• File complaints with Colombia's Superintendence of Industry and Commerce (SIC), after making your inquiry or claim with us.

If you live outside Colombia, you also have the rights in section 17.

16. How to exercise them

To delete your account, the fastest way is the app or tryyema.com/borrar-cuenta (section 14). For everything else, write to soporte@tryyema.com with your name, your account's email address, what you're asking for and how you'd like us to reply. Each request gets a tracking number, with the date and time, so you can follow it. We may ask you to confirm that you're the account holder, without asking for more data than needed.

• Inquiries (knowing your data): we reply within 10 business days at most. If we can't, we tell you why and reply within 5 more business days at most.
• Claims (correcting, updating, deleting or revoking): we reply within 15 business days at most. If we can't, we tell you why and reply within 8 more business days at most. If the claim is incomplete, we ask you for what's missing within 5 days; if you don't complete it within 2 months, it's considered withdrawn.
• If your country's law sets a shorter deadline, we apply that one.

If you're not satisfied, you can go to the Superintendence of Industry and Commerce (www.sic.gov.co) or to your country's authority (section 17).

17. If you live outside Colombia

European Union, European Economic Area, Switzerland and United Kingdom

For now Yema isn't offered there: it isn't in those countries' stores. Before opening there we'll have a representative (Art. 27 of the GDPR and the UK GDPR) and a data protection impact assessment (Art. 35), and we'll update this policy. If you still write to us from there, we'll handle your rights through the channels in section 16.

Brazil

• The LGPD (Law 13,709 of 2018) calls your health and belief data sensitive personal data (dados pessoais sensíveis). We process it with your specific and highlighted consent, for the purposes in section 8.
• Your rights (Art. 18): confirmation that we process your data, access, correction, anonymization, blocking or deletion of unnecessary data, portability, deletion of data processed with your consent, information about who we share it with and about the possibility of not giving consent, and revoking consent.
• Encarregado: Duvan Vargas, at soporte@tryyema.com.
• Complaints: to the National Data Protection Authority (ANPD).

Mexico

This policy is also our comprehensive privacy notice (aviso de privacidad integral) under the Federal Law on the Protection of Personal Data Held by Private Parties (DOF, March 20, 2025):

• Controller and address: section 1.
• Data we process: section 3. Sensitive data: health data and data that may reveal your religious or philosophical beliefs, each named in section 4. We process it only with your express written consent, which you give by ticking each box within your authenticated account.
• Purposes: all those in section 8 are necessary for the service you ask for. We have no secondary purposes (no advertising, marketing or commercial prospecting).
• Transfers: we make no transfers that require your consent; disclosures to processors are in section 11.
• ARCO rights (access, rectification, cancellation and objection) and withdrawal of consent: as in section 16, free of charge.
• Limiting use or disclosure: in More > Privacy or by writing to us.
• Changes to the notice: section 21.
• Complaints: to Mexico's personal data protection authority.

United States

• Consumer health data: if you live in Washington, Nevada or another state with a health data law, also read Annex A, our Consumer Health Data Privacy Policy, which is also on its own page: tryyema.com/en/privacidad-salud.
• State privacy laws (for example Connecticut, which since July 1, 2026 applies to anyone processing sensitive data): we process your sensitive data only with your consent; we don't sell your data, we don't do targeted advertising and we don't do profiling that produces legal or similarly significant effects. You have the right to confirm whether we process your data, access it, correct it, delete it, obtain a portable copy, and opt out of sale, targeted advertising and such profiling (which we don't do). We reply within 45 days, which we can extend by 45 more days by letting you know. If we deny your request, you can appeal by replying to our response, and we answer within 45 days; if we still don't agree, we tell you how to complain to your state's attorney general.
• California: we don't sell or share your personal information for cross-context behavioral advertising, and we use your sensitive personal information only to provide the service you ask for.
• Breaches: if a breach affects your health data, we notify you without unreasonable delay and within 60 days at the latest, as required by the FTC's Health Breach Notification Rule (16 CFR Part 318).
• Minors: Yema isn't for anyone under 18 and doesn't knowingly collect data from children under 13 (COPPA).

Other countries

If your country's law gives you other rights over your data, write to us and we'll handle them through the same channels.

18. Adults only (18+)

Yema is only for people aged 18 or older. That's why the app's first step is your date of birth.

• If the date shows you're under 18, Yema doesn't continue, doesn't keep what you typed (not even the date) and leaves only a marker on the phone so another date can't be tried.
• Yema's AI never answers anyone under 18.
• We don't knowingly collect data from minors. If you're a parent or legal guardian and believe a minor created an account, write to us and we'll delete it.

19. Security

We protect your data with reasonable technical and organizational measures:

• encrypted connections and data encrypted at rest on Google Cloud;
• access rules so that each person reads and writes only their own data, and so that no one on the team can read your health data;
• server functions with only the permissions they need;
• checking that whoever calls is the genuine app (App Check);
• and restricted administrative access, with the team's Google account.

Your plan's status is decided by the stores, not by the app. No system is infallible: if an incident affects your data, we'll tell you without undue delay, with what happened and what you can do, and we'll report it to the Superintendence of Industry and Commerce and to the other authorities within the deadlines each law sets (for example, within 60 days at most to notify you in the U.S., section 17).

20. Website and cookies

This site doesn't use advertising cookies or analytics tools. It only stores in your browser, if you use it, the Firebase Authentication session of the account deletion page, which you use to confirm it's you. Firebase Hosting, the Google service that delivers the site, receives technical data from your browser (such as your IP address). Fonts are loaded from Google Fonts, which also receives that data to deliver them.

21. Changes to this policy

We may update this policy. We'll publish the new version here with its date and keep the previous ones. If the change is important (for example, a new purpose or a new processor handling your health data), we'll tell you in the app before it applies and ask for a new authorization where the law requires it.

22. Contact

• Controller: Duvan Vargas, private individual, operator of Yema.
• Address: Calle 32 #52b-150, Rionegro, Antioquia, Colombia.
• Email for personal data: soporte@tryyema.com.
• LinkedIn: https://www.linkedin.com/in/duvandroid.

See also the Terms and Conditions (tryyema.com/en/terminos).

Annex A. Consumer Health Data Privacy Policy

For residents of Washington State (My Health My Data Act, RCW 19.373), Nevada (SB 370) or any other U.S. state with a consumer health data law. It's also published on its own page, tryyema.com/en/privacidad-salud, linked from the home page.

Controller: Duvan Vargas (section 1). Contact: soporte@tryyema.com.

1. What consumer health data we collect: your weight, height, goal weight and targets; the meals, water and exercise you log; pregnancy or breastfeeding; your conditions and medicines; a history of an eating disorder; your allergies, intolerances and celiac disease; your way of eating; what Yema infers from that (what's left of your day, your trend, your adaptive goal); and, if you connect them, the weight, workouts and height from your phone's health app, and a summary of your workouts, steps, active energy and sleep that goes with each suggestion and that we don't keep. We don't collect your cycle, mood, glucose or blood pressure: they stay on your phone.
2. Why we collect and use it: only to give you what you ask for: your plan, your diary, your recipes, What to Order and Yema's answers (sections 4 to 6 and 8 of the privacy policy).
3. Where it comes from: from you and, if you allow it, from Apple Health or Health Connect.
4. Who we share it with: only the processors that process it on our behalf (Google Cloud and Firebase, Vertex AI and, for emails, Resend), under contracts that forbid them to use it for anything else. We don't share it with third parties or affiliates (we have no affiliates). If we ever wanted to share it, we'd first ask for your separate consent.
5. We don't sell it. Ever. Nor do we use geofences around places where health care is provided.
6. Your rights: to confirm whether we collect, share or sell your health data; to access it, with the list of who we gave it to and how to contact them; to withdraw your consent; and to have it deleted, including from backups and from our processors. We reply within 45 days (we can extend by 45 more days by letting you know). It's free up to twice a year. You don't need to create an account to ask, and we won't discriminate against you for doing so.
7. How to exercise them: in More > Privacy, at tryyema.com/borrar-cuenta or by writing to soporte@tryyema.com.
8. Appeals: if we deny your request, reply to our email with "Appeal". We'll answer in writing within 45 days, with what we did and why. If we still don't agree, you can complain to the Washington State Attorney General (www.atg.wa.gov) or to your state's attorney general.

Annex B. Privacy notice

The short version we show you in the app when we collect your data (Colombia: Decree 1377 of 2013, Arts. 14 and 15; Mexico: simplified privacy notice).

Duvan Vargas, a private individual who runs Yema, domiciled in Rionegro, Antioquia, Colombia (soporte@tryyema.com), processes your data to create your account, build your plan and diary, provide Yema Plus features and assist you. Your health data is sensitive: giving it is optional, and Yema works without it, just without that care. We don't sell your data or use it for advertising. You can know, update, correct and delete your data, and revoke your authorization, at any time. The full policy, with your rights and how to exercise them, is at tryyema.com/en/privacidad.