Privacy Policy

This Privacy Policy explains how U90 LIMITED LIABILITY COMPANY, a limited liability company incorporated under the laws of the Republic of Armenia, registration number 999.110.1609198 and tax identification number 00552698 (“U90,” “we,” “us,” or “our”), collects, uses, discloses, retains, protects and deletes personal data when you use the U90 app, websites, AI tools, community and support services.

For laws using the terms “controller,” “business” or similar language, U90 is the responsible organization for the processing described here unless a notice states otherwise. A service provider may act as our processor, while Apple and other independent services may act under their own privacy terms.

This Policy does not control Apple’s independent processing of App Store payments, Apple Account data or Apple platform services. Review Apple’s privacy information for that processing.

• We collect data for identified U90 features, safety and legal purposes—not simply because it is available.
• We request protected device permissions in context and respect the choice you make.
• We do not sell personal data, HealthKit data, health information or private progress photos.
• We do not use health, fitness or private photo data for advertising, marketing or third-party data mining.
• We do not publish private progress photos or health measurements unless you deliberately choose to share them.
• We provide controls to withdraw consent, manage permissions and delete the account.
• We require providers handling U90 data to use contractual, technical and organizational safeguards appropriate to the data.

We do not intentionally collect precise location, contacts, microphone recordings or government identification unless a clearly described feature or a necessary security process requires it and the applicable permission or legal basis is in place.

We collect data directly from you; automatically from your use of U90 and its websites; from device frameworks you authorize; from Apple for purchases and sign-in; from another member when they interact with or report you; and from contracted service providers supporting security, delivery and support.

We do not compile personal profiles from data brokers or unrelated public databases. If a new source materially changes this description, we will update this Policy and request consent where required.

• Provide the Service: create accounts, generate plans, display progress, log activity, provide AI features and synchronize user-authorized data.
• Personalize: adapt tasks, recommendations, reminders, language, difficulty and match suggestions.
• Operate community: publish content to the selected audience, deliver messages, suggest partners and enable sharing.
• Process entitlements: validate purchases, restore access, prevent duplicate benefits and handle billing support.
• Protect people and systems: authenticate users, prevent abuse and fraud, filter content, investigate reports and enforce rules.
• Support users: diagnose problems, answer requests, manage deletion and privacy rights and resolve disputes.
• Improve U90: measure reliability and feature performance, conduct controlled testing and develop improvements using data permitted for that purpose.
• Communicate: send service, safety, account and optional marketing messages.
• Comply with law: maintain required records, respond to valid requests and establish or defend legal claims.

We do not use data collected for one purpose for a materially incompatible purpose without a new notice and consent or another valid legal basis.

Where law requires a legal basis, processing may rely on:

• Contract: data needed to provide the account, plan, subscription and requested features.
• Consent: Apple Health access, selected camera or photo processing, optional AI-provider disclosure, marketing, notifications, tracking and processing of certain sensitive data.
• Legitimate interests: securing, troubleshooting and improving U90; preventing fraud; enforcing rules; and protecting users, balanced against your rights.
• Legal obligation: tax, accounting, consumer, safety, regulatory and lawful-request requirements.
• Vital interests or public interest: limited exceptional processing necessary to address a serious threat or another lawful public-interest purpose.

You may withdraw consent at any time. Withdrawal does not affect prior lawful processing. If data is necessary for a requested feature, withdrawing the relevant permission may disable that feature but should not remove unrelated paid functionality.

If you connect Apple Health, U90 requests separate authorization for each data type it needs to read or write. Depending on enabled features, these may include steps, workouts, active energy, weight, body measurements and sleep. The iOS permission interface identifies the exact requested types.

• U90 uses Apple Health data only to provide or improve health and fitness functionality for you.
• We do not sell HealthKit or other health and fitness data.
• We do not use or disclose this data for advertising, marketing, credit, employment, insurance underwriting or unrelated data mining.
• We do not store personal health information in iCloud.
• We do not write false or misleading information into Apple Health.
• We disclose HealthKit data only to a provider supporting the health or fitness feature you requested, where permitted, necessary and protected.

You can change Apple Health permissions in iOS Settings or the Health app. Revoking permission stops future access but does not itself delete data previously imported into U90; use U90 deletion controls for that.

Health Connect (Android). If you connect Health Connect, U90 requests read-only access to steps, distance, exercise sessions and sleep. U90 reads this data only while the app is open and only for the last 30 days, and never writes data to Health Connect. We use it to track your daily plan goals (steps and active minutes), estimate active energy expenditure for your calorie budget, show your activity log and let the AI coach take your activity and recovery into account. We do not sell Health Connect data and do not use or disclose it for advertising, marketing, credit, employment, insurance underwriting or unrelated data mining. We disclose it only to a provider supporting the feature you requested, such as the AI provider that generates coach advice, where necessary and protected. You can revoke access at any time in the Health Connect app or Android settings; revoking stops future access, and data already imported can be deleted with U90 deletion controls.

Use of information received from Health Connect will adhere to the Health Connect Permissions policy, including the Limited Use requirements.

Body measurements, health, fitness, nutrition, photos and inferences may be considered sensitive personal data. We process them only for the U90 functionality, safety and legal purposes described here and use heightened access controls appropriate to their sensitivity.

U90 is a general wellness service, not ordinarily a healthcare provider or business associate. Information submitted to U90 should not be assumed to be protected by healthcare-specific secrecy laws such as HIPAA unless U90 expressly tells you that a regulated relationship applies.

Do not upload clinical records, prescriptions, government IDs or unrelated intimate information. If a support request requires sensitive verification, we will explain what is needed and provide an appropriate channel.

U90 accesses only the images you select or capture for a chosen feature. Images may be resized, checked for safety, compared over time, analyzed for user-requested insights or processed to create an illustrative AI preview.

Private progress photos are not placed on a public profile by default. They are disclosed to other users only when you deliberately publish or send them to the audience shown in the interface.

U90 does not use progress photos for facial recognition, identity matching, law-enforcement identification or advertising. Body-related estimates and image embeddings used for a selected feature are not intended to establish identity. If a future feature creates biometric identifiers for identification, we will provide a separate notice and obtain any legally required consent before use.

We do not use private photos, names or transformation stories in public marketing without a separate, specific release.

AI features may process prompts, photos, health or plan context and generated output. Processing may occur on-device or through a contracted AI provider. Before personal data is disclosed to a third-party AI provider, U90 will identify the purpose and obtain explicit permission where required.

AI providers may process data only under documented instructions, for the requested U90 function, under confidentiality, security and retention restrictions. Information about material providers and processing locations is available on request at info@u90.ai.

We do not permit private health information, private progress photos, prompts or messages to train a provider’s general-purpose models for unrelated customers. Any optional use of identifiable data to train or materially improve a general model would require a separate clear choice and legally valid consent.

AI-generated recommendations and matching may affect what content or plan options you see, but U90 does not use solely automated processing to make decisions producing legal or similarly significant effects. You may request human review of a safety or account decision through Support.

Your display name, profile image, selected goals, posts, reactions and other information you deliberately share are visible to the audience shown before publication. Precise measurements, private photos and data from Apple Health or Health Connect are not public by default.

Direct messages are delivered to their recipients and are not public. U90 may apply automated safety detection and may review messages when reported, when risk signals indicate serious harm or when necessary to comply with law. Access is limited to authorized personnel and relevant providers.

Other users may copy, screenshot or redistribute content visible to them. U90 prohibits misuse but cannot guarantee that every recipient will comply. Avoid sharing home addresses, financial credentials, identity documents or information you do not want another member to retain.

Blocking limits future interaction but may not erase messages or content already received. Reporting may cause a protected copy of relevant content to be retained for investigation.

U90 may disclose only the data reasonably necessary to:

• Service providers: host infrastructure, deliver communications, validate purchases, process AI features, provide analytics, prevent fraud and support customers.
• Apple: support App Store purchases, Sign in with Apple, Apple Health and other Apple services you enable.
• Other users or external recipients: fulfill your choice to publish, message, match or share.
• Professional advisers: obtain confidential legal, accounting, audit, insurance or security assistance.
• Authorities and affected parties: comply with valid law, protect safety, investigate fraud, enforce rights or respond to an emergency.
• Corporate transaction participants: evaluate or complete a financing, merger, reorganization or sale under confidentiality and applicable notice requirements.

Providers must use contractual, technical and organizational protections equivalent to those required by this Policy and applicable Apple rules. We do not authorize providers to use U90 personal data for their own advertising or unrelated purposes.

U90 maintains an internal provider inventory covering hosting, databases, authentication, email, support, analytics, error reporting, AI processing and other material processing. Information about provider categories and material international processing is available at info@u90.ai.

We review providers proportionate to risk, restrict access, require incident notification and delete or return data at the end of service where applicable. App Store privacy disclosures and privacy manifests must reflect U90’s code and every included third-party SDK.

U90 does not sell personal data. U90 does not share personal data for cross-context behavioral advertising and does not use HealthKit data, health information or private progress photos for advertising or marketing.

If U90 introduces activity that Apple defines as tracking—such as linking U90 data with data from other companies’ apps or websites for targeted advertising or measurement—we will first use App Tracking Transparency, explain the purpose and update this Policy and App Store disclosures. We will not fingerprint a device or substitute another identifier after tracking permission is refused.

Paid functionality will not depend on optional tracking permission, and U90 will not reward, pressure or mislead a user into granting it. You can manage Apple tracking permission in iOS Settings and use any additional privacy choice U90 provides.

U90 websites may use strictly necessary storage for security, session continuity, language and consent choices. With required consent, we may use limited analytics to understand page performance and campaign effectiveness.

Where required, a cookie control will let you accept, reject or change non-essential categories. Browser settings may also block storage, but essential site functions may be affected. Information about the cookies currently in use, their purposes and durations is available from info@u90.ai.

Webviews used for app functionality are treated consistently with app privacy choices and do not bypass device tracking preferences.

We may send account, purchase, security, privacy, safety and material-service messages when necessary to operate U90. These are not promotional and may continue while the account remains active.

Marketing email, push notifications and similar optional messages are sent only with the permission or other lawful basis required in your location. You can unsubscribe through the message, disable push notifications in iOS Settings or change available U90 preferences.

Opting out stops future marketing but we may retain a minimal suppression record so the choice is honored. We do not use Contacts or Photos to message another person unless you individually select the recipient and initiate the specific share.

We keep personal data only for the feature, safety, contract and legal purposes described here. The following periods are the default maximums unless a shorter product setting applies or law requires longer retention:

A legal hold, fraud investigation, safety concern or statutory duty may temporarily extend a period. Access is restricted and the data is removed when the reason ends.

You can initiate permanent account deletion in U90: open your Profile (your avatar in the top-right corner) and select Delete account at the bottom of the page. U90 may require a recent sign-in or proportionate verification to prevent unauthorized deletion.

Deletion covers the account and associated data U90 is not legally required to keep, including plan history, private photos, health information, coach conversations and your community profile. Posts, comments and messages you shared with other people stay where they were read, but are no longer linked to you: your name, photo and profile are removed and they appear as written by a deleted member. Limited purchase, consent, fraud, safety or dispute records may be retained for the periods above.

Deleting the account or app does not cancel an Apple subscription. See Delete Account & Data for the exact steps, timing and billing warning.

Depending on your location, you may have rights to access, know about, correct, export, delete or restrict personal data; withdraw consent; object to processing; opt out of sale, sharing, targeted advertising or profiling; limit certain uses of sensitive data; and complain to a regulator.

• Update profile and plan information in U90 settings.
• Change Health, Photos, Camera, notification and tracking permissions in iOS Settings.
• Delete individual photos, posts, logs or other items using their controls.
• Initiate account deletion in U90 settings.
• Use unsubscribe controls for marketing.
• Send a request to info@u90.ai.

We may verify identity using information proportionate to the request and data sensitivity. Authorized agents may submit requests where law permits, subject to proof of authority. U90 will not discriminate or reduce paid service because you exercise a privacy right.

We will respond within the period required by applicable law and explain any lawful denial or extension. You may appeal a denied request by replying with “Privacy appeal.”

Users in these regions may request access, rectification, erasure, restriction, portability and objection, and may withdraw consent. Where processing relies on legitimate interests, you may object based on your circumstances; direct-marketing objections are honored without balancing.

If data is transferred to a country without an adequacy decision, U90 will use an approved mechanism such as Standard Contractual Clauses, the UK Addendum or another lawful safeguard, plus supplementary measures where appropriate. You may request information about the relevant safeguard.

You may complain to the data-protection authority where you live, work or believe a violation occurred. Contact U90 first if you would like us to try to resolve the matter. If applicable law requires U90 to appoint a regional representative, current representative details will be provided in this Policy before the relevant processing begins.

This section supplements the rest of the Policy for residents of states with comprehensive privacy laws. In the preceding 12 months, U90 may have collected the categories described in Section 3, including identifiers, commercial information, internet or electronic activity, approximate geolocation, audio/visual information, health and body information, communications, user content, sensitive personal information and inferences.

Sources, business purposes and recipient categories are described in Sections 4, 5 and 13. U90 does not sell personal information and does not share it for cross-context behavioral advertising. U90 does not knowingly sell or share personal information of people under 18.

Sensitive personal information is used only to provide requested health, fitness, photo, security and safety functionality and other legally permitted purposes. It is not used to infer characteristics for advertising. If practices change, we will provide any required “Do Not Sell or Share” or sensitive-data limitation control before the change.

Where applicable, residents may request access, categories and specific pieces, correction, deletion, portability, opt-out and limitation, and may appeal. We will not discriminate for exercising rights. Authorized-agent requests require authority and may require direct identity confirmation.

California metrics and financial incentives: U90 does not currently offer a program that pays for personal information. If introduced, separate terms will describe the value calculation and opt-in/withdrawal process.

Brazilian users may exercise rights under the LGPD, including confirmation, access, correction, anonymization, blocking or deletion where appropriate, portability, information about sharing, consent withdrawal and review of certain automated decisions. The responsible privacy contact is listed below; a local DPO contact must be added if required.

Users in Canada, Australia and other regions may have comparable access, correction, deletion, consent and complaint rights. U90 will apply mandatory local protections even if they are not individually repeated in this Policy.

U90 and its providers may process data outside your country. Privacy laws in those locations may differ, but the transfer does not remove protections described here.

We use contractual safeguards, transfer assessments, access restrictions, encryption and other legally recognized mechanisms where required. Information about material processing countries and safeguards is available on request at info@u90.ai.

U90 uses administrative, technical and organizational measures proportionate to the nature and sensitivity of data. Measures may include encryption in transit, protected storage, least-privilege access, authentication controls, logging, environment separation, secure development, vulnerability management, provider review, backups and incident-response procedures.

No network, application or storage system can be guaranteed completely secure. You should use unique credentials, protect access to your email and device, install updates and notify Support of suspected compromise.

U90 personnel and contractors may access personal data only when required for their role, support, safety, security or law and are subject to confidentiality obligations.

U90 maintains procedures to identify, contain, investigate and remediate security incidents. Providers must notify us of relevant incidents under their contracts.

If an incident creates a legal notification obligation, we will notify affected users, regulators or other parties in the required manner and period, explain known risks and provide reasonable protective steps. We may delay public detail where law enforcement or incident containment lawfully requires it.

U90 is intended only for adults aged 18 or older. We do not knowingly permit children to create accounts or intentionally collect their personal data.

U90 may use proportionate age-confirmation or age-assurance measures to enforce this restriction. If you believe a person under 18 has provided data, contact info@u90.ai. We will investigate and delete the data where appropriate, while retaining only what law or child-safety investigation requires.

U90 may preserve or disclose information when we reasonably believe it is necessary to comply with valid legal process; investigate fraud, exploitation or security abuse; protect a person from serious harm; enforce agreements; or establish, exercise or defend legal claims.

We review requests for validity and scope, disclose only what is legally required and challenge overbroad requests where appropriate. We may notify you unless prohibited, dangerous or impractical.

U90 is not an emergency service and does not continuously monitor messages. Contact local emergency services for immediate danger.

If U90 is involved in a financing, merger, acquisition, restructuring, insolvency or sale of assets, personal data may be reviewed or transferred under confidentiality and applicable law. A recipient must honor this Policy for acquired data unless it provides notice and obtains consent where a materially different use requires it.

We will provide notice of a change in controller where law requires and preserve available deletion and objection rights.

We may update this Policy to reflect product, provider, legal, security or organizational changes. The current version will show a new effective date.

We will provide additional notice before a material change where required. If a new use depends on consent, we will request new consent before that use. An update does not retroactively authorize an incompatible use of previously collected data.

Controller: U90 LIMITED LIABILITY COMPANY

Registered office: 8, 9th Street, Nor Aresh, Yerevan 0075, Republic of Armenia

Registration number: 999.110.1609198

Tax identification number: 00552698

Privacy, rights and support requests: info@u90.ai

Website: https://u90.ai

You may also complain to the privacy, consumer-protection or data-protection authority responsible for your location.