Numero Health

Privacy Policy

Last updated July 13, 2026 · Operated by Master Health LLC dba NUMERO HEALTH

Numero Health (“the App”) is operated by Master Health LLC dba NUMERO HEALTH (“we,” “us”). This Privacy Policy explains what information we collect, how we use it, who processes it on our behalf, and the choices you have. Numero Health is an educational and wellness app for adults using prescribed GLP-1 medications. It is educational and wellness software — not a medical device, not medical advice, and not a substitute for your healthcare provider; it does not diagnose, treat, monitor, or manage any condition, and it does not prescribe. It is not a covered entity under HIPAA, but we treat your information as sensitive personal health information and, as a health app, follow the FTC Health Breach Notification Rule. By creating an account or using the App, you agree to this Policy.

In short: We never sell your data, never share it with advertisers, insurers, or employers, and never use your health data to train AI models without your explicit opt-in. You can download a copy of your data and delete your account and all associated data from within the App at any time.

1. Information we collect

We collect only what the App’s educational features need (data minimization). You enter all of it yourself:

Account & identity	Name, email, password (stored only as a salted bcrypt one-way hash), optional profile photo.
Medication profile	Your GLP-1 medication, dose, titration week, injection day, start date, and any medication changes you record.
Logs	Weight, nutrition (protein, carbs, fiber, hydration), supplement adherence, symptoms/side effects, and injection history (including the body site you optionally record to help rotate injection sites).
Health profile	Optional birth year and gender, height, units, activity level, dietary preferences, health conditions, and allergies — used to tailor educational nutrition and supplement content (including age- and gender-aware guidance).
Free-text notes	Daily check-in notes and private Diary entries (these are never sent to analytics).
Emergency contact	Optional name and phone you choose to enter.
Meal photos (optional)	If you use the AI photo scan, the photo is sent for a one-time estimate and is not stored by us (see Section 3).
Progress photos (optional)	Daily photos you choose to add to My Journey are stored securely in our database and are visible only to you — never shown to other users, never included in Provider Summaries, and never used to train AI models. Delete any photo individually in the App, or all of them by deleting your account.
Camera (barcode)	Barcode scanning analyzes the camera frame on your device only; no image is stored or transmitted.
Device push token	If you enable reminders, a push token from Apple or Google so notifications can be delivered to your device.
Device timezone	Detected from your device (and refreshed if you travel) so reminders fire at your local time. It’s a coarse region setting — not GPS or precise location — and is used only for reminder timing.
Usage analytics	Non-identifying product events (e.g., screen views, dwell time) — opt-in, no free-text health content.

Biometric unlock (Face ID / fingerprint): handled entirely by your device’s operating system. We never receive, store, or transmit your biometric data; only your own login token is held securely in the device keychain.

2. How we use your information

To generate your personalized, educational supplement and nutrition guidance and insights from your own logs.
To create the read-only Provider Summary you choose to share with your healthcare team.
To send the reminders you turn on (injection-day and daily check-in).
To operate, secure, and improve the App.

3. Third parties who process data for us (sub-processors)

We use a small set of service providers to run specific features. They process data only on our behalf for the purposes below — not for their own advertising:

AI model provider	When you use the AI photo nutrition scan, your meal photo is sent over an encrypted connection to our AI model provider for a one-time macronutrient estimate that you review and edit. The photo is processed transiently and is not retained by Numero Health — we store only the resulting estimate and a usage count. We do not permit your photos to be used to train AI models.
Apple (APNs) & Google (Firebase Cloud Messaging)	Deliver push reminders to your device using a push token. No health data is sent beyond the reminder text.
cron-job.org	An external scheduler that triggers our reminder job on a fixed interval. It receives no personal data.
Open Food Facts	Barcode lookups and food-name searches send only the barcode number or the food name you type (no identity, no health data) to retrieve packaged-food nutrition.
Supabase & Render	Managed cloud database and application hosting where your account data is securely stored and the App runs.

4. What we will never do

Sell your health data to any third party.
Share your medication, diagnosis, or other health data with advertisers, data brokers, insurers, or employers.
Use your health data or photos to train AI models without your explicit opt-in consent.
Track you across other companies’ apps or websites.

5. Sharing you control

Provider Summaries are generated and shared only when you choose to send one (via your device’s share options). You choose the recipient and channel. Progress photos are never included in Provider Summaries. Analytics is opt-in and can be withdrawn at any time in Profile → Consent & Sharing.

6. Data security

We apply layered technical safeguards designed for sensitive health information:

Encryption. Your data is encrypted in transit (TLS with HTTP Strict Transport Security) and at rest (AES-256) in our managed cloud database.
Password protection. Passwords are stored using a slow, salted one-way hash (bcrypt) designed to resist offline cracking; we never store or can recover your plaintext password.
Access control. Our database is not exposed to the public internet: the data API is disabled and row-level security is enabled, so records are reachable only through our authenticated application. Each request can access only the signed-in user’s own data.
Account protection. Sign-in is rate-limited to slow brute-force attempts, session tokens are HTTP-only and can be revoked, and deleting your account requires re-entering your password.
Hardened delivery. The App sends a strict Content-Security-Policy and related browser security headers to reduce the risk of injection and clickjacking.
Monitoring & least privilege. Security-relevant events (such as failed sign-ins) are logged, and access to systems and credentials is limited to authorized personnel under least-privilege controls, with administrative dashboards restricted to a named allowlist.

7. Your rights and choices

Deletion: Settings → Delete Account performs a complete, double-confirmed erasure of your account and all associated records. This is your right to erasure.
Access & portability: You can view and edit your data in the App, and download a complete copy of it anytime from Settings → Your Data.
Consent: Toggle provider sharing, provider invitations, and analytics in Profile → Consent & Sharing.

8. Data retention

We keep your data only while your account is active. Account deletion removes all associated records; routine encrypted backups are retained for up to 30 days and then purged. Opt-in analytics are kept in aggregate and dissociated from free-text content.

9. Breach notification

As a health app and vendor of personal health records, we follow the FTC Health Breach Notification Rule (16 CFR Part 318, as amended). In the event of a breach of security involving identifiable health information, we will notify affected users and the FTC within the timelines the Rule requires, and the media where the Rule requires it.

10. Children

Numero Health is intended for adults (18+) using prescribed GLP-1 medications and is not directed to children.

11. Changes to this Policy

We may update this Policy as the App evolves. You can opt in to update notifications in Settings to be told about material changes to privacy terms and new regulatory disclosures. Continued use after an update means you accept the revised Policy.

12. Contact

Questions about privacy? Use Contact Us in the App, or email info@numerohealth.com. Master Health LLC dba NUMERO HEALTH.