← ChemYou

Privacy Policy

Last updated: 15 June 2026

1. Who We Are

ChemYou (chemyou.ai) is operated by Timur Farias, Lima, Peru. Contact: [email protected]

2. Data We Collect

  • Blood test values — provided by you to generate your report. We do not link these to your identity.
  • Optional context — country, age, sex (if you choose to provide them). Used only to personalise the report.
  • Payment data — only if paid checkout is enabled. Payment data is processed entirely by Paddle; we receive only a transaction confirmation and never see your card details.
  • Server logs — standard logs (IP address, timestamp, request path) retained for up to 30 days for security purposes.

3. How We Use Your Data

Blood test values and optional context are used solely to generate your nutrition report. They are not stored after the report is delivered, not used for advertising, and not sold or shared with third parties, except where required by law.

4. Legal Basis — EU GDPR

For users in the European Union and EEA, we process health-related data under Art. 6(1)(b) (contract performance) and Art. 9(2)(a) (explicit consent). You provide explicit consent by ticking the consent checkbox before submitting your data.

5. Legal Basis — UK GDPR

For users in the United Kingdom, we process your data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. The legal bases are equivalent to those under EU GDPR: Article 6(1)(b) (performance of a contract) and Article 9(2)(a) (explicit consent for health data). The supervisory authority for UK data protection is the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. You have the right to lodge a complaint with the ICO at ico.org.uk.

6. Data Retention

Blood test data is processed in memory and is not written to persistent storage. Once your report is generated, no copy of your values remains on our servers.

7. Third-Party Services

  • Paddle — payment processing if paid checkout is enabled. See Paddle Privacy Policy.
  • OpenAI — AI model used to generate the report. Data is sent under OpenAI's data processing agreement; OpenAI does not use API inputs to train its models.
  • Vercel — hosting provider. See Vercel Privacy Policy.

8. Your Rights

Under EU GDPR and UK GDPR you have the right to access, rectify, erase, restrict, or object to the processing of your personal data, and the right to data portability. Because we do not store blood test data after report generation, most of these rights apply only to server logs. To exercise any right, email [email protected]. We will respond within 30 days.

9. International Data Transfers

Your data may be processed on servers located outside the UK and EEA (including the United States, via OpenAI and Vercel). Where such transfers occur, they are carried out under appropriate safeguards, including standard contractual clauses approved by the European Commission and recognised under UK GDPR.

10. Cookies

ChemYou does not use tracking or advertising cookies. No cookie consent banner is required under the UK Privacy and Electronic Communications Regulations (PECR) or EU ePrivacy rules.