Privacy policy
Last updated: 31 July 2026 · Applies to the Lora iOS app and this website.
Lora is a nutrition-care service. To do its job it holds some of the most personal data there is — what you eat, what you weigh, what you're allergic to, what you're prescribed. This page says plainly what we collect, why, where it lives and how you take it back. If anything here is unclear, write to us before you share anything.
Who is responsible
The data controller is JV Dietbox (trading as Lora), registered in the United Kingdom. Contact: privacy@lora.app.
What we collect, and why
| Data | Why | Lawful basis |
|---|---|---|
| Email address | It is your account — we send a sign-in code to it. No passwords are stored, because none exist. | Contract (Art. 6(1)(b) UK GDPR) |
| Profile — name, date of birth, sex at birth, height | Calculating your energy and protein targets honestly. Age and sex change the arithmetic. | Contract |
| Health data — weight history, food diary, favourites, allergies and intolerances, medical conditions, medications (including GLP-1 treatment), scheduled doses and the time you mark them as taken, eating patterns you choose to describe | This is the product: your plan, your targets and your coach are built from it. Allergies and medications also act as hard safety constraints on everything the AI coach and plan generator are allowed to suggest. | Your explicit consent (Art. 9(2)(a)) — asked for in plain terms during onboarding, refusable, and withdrawable at any time |
| Apple Health data — only if you connect it: weight, height, date of birth, activity and medications you choose to share | So your profile, progress chart and safety checks start from real information instead of guesses. With separate iOS write permission, Lora also saves weight and height measurements you record back to Health. Apple's medication API is import-only for third-party apps, so Lora cannot create or edit your Health medications. | Your explicit consent, granted through iOS itself |
| Coach conversations | Continuity of care across your devices: your dietitian can review what the AI coach told you, and the coach can remember the complete conversation history. | Contract; health content within it, consent |
We do not collect advertising identifiers, we do not track you across other apps or sites, and we do not sell data — to anyone, ever.
Where it lives
Your data is stored with Supabase in the European Union (Ireland), encrypted in transit and at rest, behind row-level security — meaning the database itself enforces that only your authenticated session can read your rows. A copy is cached on your device so the app works offline; it is removed when you sign out.
Who processes it
- Supabase (EU) — database, authentication and server functions.
- AI providers, via OpenRouter — when you talk to the coach or a plan is generated, the relevant context (your targets, today's diary, and the clinical facts needed for safety) is sent to a language model to produce the reply. It is used to answer you, not to train models on our instruction.
- Email delivery provider — sends your sign-in codes. Sees your address, nothing else.
- Your dietitian — a registered professional bound by their own clinical confidentiality duties, who sees your profile and thread in order to care for you.
How long we keep it
For as long as you have an account. Delete the account and everything goes with it — see below. Backups age out within 30 days.
Your rights
- Take it all with you. Settings → About → Health Data → Export your data hands you everything we hold, as JSON, on the spot (Art. 20).
- Delete everything. Profile → Edit account → Delete account is immediate and irreversible: profile, diary, weights, plan, conversations — all of it, including at our processors (Art. 17).
- Withdraw consent for health data at any time — deleting the account is the cleanest way; writing to us works too.
- Access, rectify, restrict, object — the full set of UK GDPR rights applies. Write to privacy@lora.app; we answer within a month.
- Complain to the ICO at ico.org.uk if you think we've got something wrong — though we'd rather you told us first.
What Lora is not
Lora is not a medical device and the AI coach does not diagnose, prescribe, or advise on medication doses — those questions go to your dietitian or GP, and the coach is built to say so. In an emergency, call 999.
Changes
If this policy changes in a way that matters, we tell you in the app before the change applies — not in a footnote afterwards.