Privacy Notice

Published on August 5, 2026.

If you create an account on or after August 5, 2026, this Notice applies to you from the moment you accept them during sign-up.

If you created your account before August 5, 2026, this Notice will take effect on September 1, 2026. Until then, the previous version of the Notice will continue to apply.

You can see our previous Privacy Notice: https://www.formula.care/privacy-policy

We are committed to respecting your data privacy and providing transparency about our data practices. This Privacy Notice explains how Fjor Nutrition Inc. ("Company," "we," or "us") collects, uses, shares, and protects personal data through our mobile application (Formula App, referred to as the "App") and websites (including but not limited to https://formula.care, referred to as the "Website"), referred to together as the "Services".

This Notice was last reviewed on the date indicated above. We may modify or update it from time to time. Where a change may materially affect your privacy (for example, by introducing a new processing purpose, a new legal basis, or a new category of personal data), we will notify you in advance and, where required by applicable law, seek your prior consent. If you do not consent where consent is required, those changes will not apply to you, though this may affect your ability to use certain features of the Services.

By Personal Data we mean (i) information that is associated with an identified or identifiable natural person, and (ii) protected as personal data under applicable data protection laws.

IMPORTANT. Formula App is a general wellness application designed to support healthy dietary habits, exercises, and lifestyle choices. It is not a medical device, does not provide medical advice, and is not intended to diagnose, treat, cure, or prevent any disease or medical condition.

Formula App may collect information related to health conditions only where necessary to provide personalized dietary recommendations, educational content, and nutrition tracking, and only after obtaining your explicit consent.

Always consult a qualified healthcare provider before making changes to your diet, exercise, or health management plan, particularly if you have a diagnosed medical condition.

1. PERSONAL DATA WE COLLECT ABOUT YOU

We collect the following categories of personal data to provide and improve our services:

Personal data you provide to us:

• General account details and Authentication Data: This includes your name, email address, and subscription details.
• Preferences: Information you share with us about your product or content interests and your communication or marketing preferences.
• Communication information: If you contact us, we collect your name, contact information, and the contents of your messages.
• Health and well-being data: You may choose to provide details directly in the App or through web onboarding such as your weight, height, nutrition information, water consumption, medications and supplements you take, any medical history or diagnoses you choose to disclose. With your explicit consent, we may import data from third-party services like Apple HealthKit or other similar platforms, including sports activities, calories burnt, heart rate, number of steps/distance traveled, and other similar metrics.
• Account photo: If you voluntarily upload a profile picture, we will store it as part of your account.
• Demographic information: Data such as your age and gender.
• Payment information: Your billing address and redacted payment details are collected during payment by our payment processor. We do not store full payment card details on our own systems.

Personal data we collect automatically:

• Device information: This includes details about your device, such as its make, model, operating system, advertising identifiers, and similar technical data.
• Log data: Information automatically sent by your browser or device, such as IP address, browser type, and date and time of your access.
• Usage activity: Details about how you interact with our Services, such as your purchase history, content viewed, and areas of the Services you visited.
• Inferred location: We infer your approximate location (country and city) from your IP address during web onboarding. Your billing address collected at payment may also indicate your location. We do not collect precise GPS-based location through the App.

Personal data from other sources

With your explicit consent, we may import health and fitness data from third-party platforms, such as Apple HealthKit and similar platforms. Such data will only be used to provide the App’s core functionality, and will not be shared with any advertising or marketing partners.

Separate consent for disclosed health conditions. If you disclose a health condition during onboarding (in the App or on the web), for example, high blood pressure, we seek your separate, explicit consent to process that health data under applicable health-data laws. You may withdraw this separate consent at any time through the App’s settings or by contacting us at support@formula.care.

Aggregated or De-identified Information

We may aggregate or de-identify personal data so that it can no longer identify you, and use it to analyze the effectiveness of our Services and improve features. Once de-identified, this information may be used without further notice to you. We do not conduct scientific research using identifiable end-user data.

2. HOW WE USE YOUR PERSONAL DATA AND INFORMATION

• a. Providing and improving the Services, such as to:
  • i. To operate, maintain, and improve the App and Website.
  • ii. To generate personalized meal plans, recipe recommendations, and nutritional insights based on your profile and health data.
  • iii. To develop new features and capabilities for the Services.
• b. Communications with and notifications to you, such as to:
  • i. To respond to your inquiries and provide customer support.
  • ii. To send service-related communications, such as account confirmations, security alerts, and subscription updates.
  • iii. To send push notifications about the App. You may manage notification preferences through your device settings or by contacting us.
• c. Marketing communications

We may use your email address associated with your account to send you marketing and promotional communications about our products, including product tips, promotional offers, and announcements of new features, where permitted by applicable law.

• For users located in the European Economic Area (“EEA”) and the United Kingdom, and other jurisdictions requiring opt-in consent for electronic marketing, we will send such communications only where you have provided your explicit consent, in accordance with applicable data protection and ePrivacy laws.
• For users located outside the EEA and the UK, including the United States, we may send marketing communications based on our legitimate interests, where permitted by applicable law.

You can opt out of receiving marketing communications at any time by using the unsubscribe link included in our messages or by contacting us at support@formula.care. Such withdrawal will not affect the lawfulness of communications sent before your withdrawal.

If you opt out of marketing communications, you will be removed from our marketing communications list. However, this will not affect your receipt of non-marketing, service-related or transactional emails, which are necessary for account administration and your use of the App.

• d. Analytics and performance, such as to:
  • i. To measure usage trends, feature engagement, and the overall performance of the Services.
  • ii. To understand how users interact with the Services in order to improve the user experience.
• e. Marketing campaigns measurement

We partner with advertising platforms to measure the performance of our marketing campaigns and reach new users. We use device identifiers and usage data (but never health or wellness data!) for marketing measurement and targeting. See Section 8 for information about opting out of marketing-related data sharing.

• f. Security and Legal Compliance, such as to:
  • i. To protect the rights, privacy, safety, and property of our users and the Company.
  • ii. To prevent misuse of the Services and maintain the security and integrity of our systems.
  • iii. To comply with legal obligations, including verifying eligibility to use the Services.
• g. AI-assisted processing. Some features of the Services may be generated using automated and AI-based processing of your profile and health and wellness data. These outputs are informational and do not produce legal or similarly significant effects. We do not make decisions about you based solely on automated processing (see "Automated Decision-Making" under the Your Privacy Rights section). You can find more about the nature and limitations of these AI-generated recommendations in our Terms & Conditions.

3. LEGAL BASES FOR PERSONAL DATA PROCESSING (EEA AND UK USERS)

For users in the European Economic Area (EEA) and the United Kingdom (UK), we identify a legal basis for each processing activity under the GDPR and the UK GDPR as follows:

Where we rely on legitimate interests, we have conducted a balancing test confirming that our interests do not override your fundamental rights and freedoms. You may request details of any such test by contacting us.

Where we rely on consent, you may withdraw it at any time through the App's settings or by contacting us at support@formula.care. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

4. SHARING YOUR PERSONAL DATA AND INFORMATION

4.1 Data Processors

We share personal data with the following third-party service providers who process data on our behalf and under our instructions (also referred to as “Data Processors”). All Data Processors are bound by data processing agreements in place and are required to implement appropriate security measures.

We use Data Processors that assist us in the following categories of activities:

• Infrastructure and data storage
• Subscription payment processing and payment gateway
• Communications management
• Analytics
• Marketing tag management, marketing campaigns measurement

Important: We do not share health or wellness data (weight, height, nutrition data, HealthKit data, or similar) with analytics or marketing partners under any circumstances.

4.2 Other disclosures

We may disclose your personal data:

• a. as required by law, court order, or any other legal obligation, such as to comply with a subpoena, or similar legal process.
• b. when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.
• c. if we are involved in a merger, acquisition, or sale of all or a portion of its assets, you will be notified via email and/or a prominent notice on our Website of any change in ownership or uses of your personal information, as well as any choices you may have regarding your personal information.

5. DATA RETENTION

We retain your personal data for as long as your account is active or until you request its deletion. There is no fixed deletion timeline imposed on active accounts: your personal data remains available for the full lifecycle of your use of the Services.

When a deletion is requested, or you delete your account through the App's settings:

• Deletion from our primary database is immediate.
• We maintain encrypted daily backups that are automatically purged after seven (7) days. Deleted data may therefore persist in backup copies for up to seven days before being fully removed.
• Certain data may be retained for longer periods where required or permitted by law: for example, transaction and billing records for tax, accounting, or dispute resolution purposes (typically up to seven years, or as required by applicable law).

If you are unable to delete your data using the in-app settings, please contact us at support@formula.care. We will process your request promptly, including by sending you a direct deletion link, all in accordance with applicable legal requirements.

Requests to our Data Processors for deletion of data held by those providers will be made where and as required by applicable law.

6. DATA STORAGE AND CROSS-BORDER DATA TRANSFERS

Our primary servers are located in the United States (“U.S.”). Your personal data may be transferred to, processed, and stored in the U.S., where it is governed by U.S. law.

For users in the EEA and UK, we ensure that any transfer of personal data to third countries is subject to appropriate safeguards under the GDPR and the UK GDPR:

• Standard Contractual Clauses (SCCs): Where we transfer personal data from the EEA, we rely on SCCs approved by the European Commission (Commission Decision 2021/914 or successor decisions). For UK transfers, we use the UK Addendum to the SCCs or the UK International Data Transfer Agreement (IDTA).
• EU-US Data Privacy Framework (DPF): Where applicable, we may rely on the EU-US DPF, the UK Extension to the DPF, or the Swiss-US DPF as recognized frameworks for transatlantic transfers.
• Additional Safeguards: We implement supplementary technical measures, including encryption in transit and at rest, where necessary to maintain an essentially equivalent level of protection.

7. COOKIES, SOFTWARE DEVELOPMENT KITS, AND OTHER TRACKING TECHNOLOGIES

When you use our Services, we and our service providers may use cookies (small text files placed on your computer or mobile device to identify your browser or device) and other tracking technologies to collect information about your interactions with the Services. This includes information about the features you use, your actions within the Services, and your device or browser settings.

However, it’s not only cookies that can be used in this way. Functions performed by a cookie can be achieved by other means, too. By reference to “cookies”, therefore, we also refer to any similar technology that stores or accesses information on your device. This could include, for example:

• HTML5 local storage,
• local shared objects (e.g., Flash cookies),
• beacons and pixels,
• plug-ins and widgets,
• Software Development Kits (SDKs).

Why we use cookies and similar tracking technologies:

We use cookies and similar tracking technologies to:

• operate and administer the Services, such as enabling key functionalities,
• provide analytics and measure traffic to understand how users engage with our Services,
• enhance user experience by remembering preferences and settings,
• deliver personalized content and advertisements (interest-based advertising),
• ensure the security and integrity of the Services.

Types of cookies and similar tracking technologies we use:

• Strictly Necessary: These cookies are essential for the operation of the Services and enable features like secure logins, network distribution, and billing. You cannot disable these cookies without affecting the functionality of the Services.
• Preferences: These cookies enable a website to remember information that changes the way the website behaves or looks, like your preferred language or the region that you are in.
• Statistics: These cookies help us understand user behavior and interactions with the Services to improve their performance. Examples include:
  • tracking page views and usage trends;
  • measuring errors and testing new features.
• Marketing: These cookies are used to deliver personalized advertisements based on your preferences and interactions with the Services. We do not use health or wellness data for marketing purposes.

Your choices:

• Browser settings: most browsers allow you to block or delete cookies. Disabling cookies may affect the functionality of certain features.
• Device settings: on iOS, enable "Limit Ad Tracking"; on Android, enable "Opt-out of Ads Personalization".
• Cookie Preferences: you can manage your cookie preferences at any time through our Manage Cookies tool, accessible from the App and Website.
• Prior consent (EEA/UK): If you are in the EEA or UK, all non-essential cookies and similar technologies are disabled by default and set only after your prior opt-in consent via our consent banner. You can withdraw consent anytime through the Manage Cookies tool, and withdrawal is as easy as giving it. Strictly Necessary cookies do not require consent.
• Advertising opt-out: you may opt out of interest-based advertising through the Digital Advertising Alliance (DAA) at optout.aboutads.info, or the Network Advertising Initiative (NAI) at optout.networkadvertising.org.
• Analytics opt-out: you may opt out of Google Analytics using the Google Analytics Opt-Out Browser Add-on at tools.google.com/dlpage/gaoptout.
• Global Privacy Controls (GPC): we honor GPC browser signals from California residents as an opt-out of the sharing of personal information for cross-context behavioral advertising. See Section 9.7 for details.

Impact of Disabling Cookies

Disabling cookies or similar tracking technologies may prevent you from accessing certain features of the Services or degrade the user experience. Your preferences for cookies and tracking technologies are device- and browser-specific.

8. YOUR PRIVACY RIGHTS

If you reside in the EEA or UK, you have the following rights:

• Right to Know / Right of Access. You may review and access your personal data through the App's account settings or by contacting us at support@formula.care.
• Right to Correction. You may update or correct inaccurate data through the App's account settings or by contacting us.
• Erasure (Right to Delete). You may delete your account and associated personal data directly through the App's settings. If you are unable to complete deletion through the App, contact us at support@formula.care, and we will process your request or send you a direct deletion link.
• Withdrawal of Consent. Where we process your data on the basis of your consent (including health and wellness data), you may withdraw consent at any time through the App's settings or by contacting us. Withdrawal does not affect the lawfulness of processing prior to withdrawal.
• Right to Object. You may object to processing based on legitimate interests (Art. 6(1)(f)), and we will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests and rights.
• Restriction of Processing. You may request that we restrict processing of your personal data in certain circumstances (e.g., while we verify a dispute about accuracy).
• Data Portability. You may request a copy of your personal data in a structured, machine-readable format.
• Automated Decision-Making. We do not make decisions about you based solely on automated processing that produces legal or similarly significant effects.
• Right to Lodge a Complaint. You have the right to lodge a complaint with your local supervisory authority. A list of EEA supervisory authorities is available at edpb.europa.eu. The UK supervisory authority is the Information Commissioner's Office (ico.org.uk). We encourage you to contact us first so that we may attempt to resolve your concern before you contact a supervisory authority.

To exercise any of the above rights, contact us at support@formula.care or privacy@formula.care. We may ask you to verify your identity before processing your request. We will respond within the timeframe required by applicable law and will explain any limitations on your ability to exercise a particular right.

9. U.S. NOTICE

This section applies to residents of U.S. states with applicable consumer privacy laws, including California (CCPA/CPRA), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Texas (TDPSA), Montana (MCDPA), Oregon (OCPA), New Jersey (NJDPA), and New Hampshire, among others. Washington State residents should also read Section 9.8 regarding consumer health data.

9.1 Categories of Personal Information Collected

We have collected the following categories of personal information in the preceding 12 months:

• Identifiers: name, email, IP address, device ID, advertising ID
• Personal records: subscription details, billing address
• Characteristics (age, gender): age, gender
• Commercial information: ​​subscription history, purchase records
• Internet / electronic network activity: app usage, features accessed, content viewed
• Inferences: dietary preferences inferred from usage
• Sensitive Personal Information (SPI): health/wellness data: weight, height, nutrition, food logs, HealthKit data, logged symptoms, biomarkers, medications and supplements, health conditions/diagnoses you disclose, etc. only with your explicit consent.

9.2 Sensitive Personal Information (SPI)

We collect the following categories of SPI as defined under the CCPA/CPRA and similar U.S. state laws:

• health and wellness data you voluntarily enter, including weight, height, nutrition goals, water consumption, and food intake logs, physical activity, sleep, energy levels, mood and stress, logged symptoms, medications and supplements, and any medical history or diagnoses you choose to disclose;
• health metrics imported from Apple HealthKit or similar platforms with your explicit consent, including steps, calories, and heart rate.

We use SPI only for purposes directly necessary to provide and improve the Services — specifically to generate personalized meal plans, nutritional insights, and progress tracking. We do not use SPI for advertising, profiling unrelated to the Services, or any purpose other than those disclosed in this Notice. California residents have the right to request that we limit our use and disclosure of SPI to these permitted purposes (see Section 9.5).

9.3 Sale and Sharing of Personal Information

We do not sell your personal information for monetary consideration.

We do share certain personal information (specifically device identifiers and usage data (but not health or wellness data)) with advertising partners for the purpose of cross-context behavioral advertising and campaign measurement. This may constitute "sharing" of personal information under the CCPA/CPRA. California residents have the right to opt out of this sharing (see Section 9.5).

We never sell, rent, license, or otherwise disclose your health or wellness data, your personal data, contact data (email, telephone number) and consent data (email opt-in, SMS opt-in) with any third parties or affiliate parties for their own marketing or advertising purposes.

9.4 Data Retention

We retain personal information for the periods described in Section 5.

9.5 Your U.S. State Privacy Rights

Subject to applicable state law and applicable thresholds, you may have the following rights:

• Right to Know / Access: The right to know what personal information we have collected about you, including the categories, specific pieces, sources, purposes, and third parties with whom we have shared it.
• Right to Delete: The right to request deletion of personal information we have collected from you, subject to certain exceptions (e.g., legal obligations, fraud detection, internal operations).
• Right to Correct: The right to request that we correct inaccurate personal information we hold about you.
• Right to Data Portability: The right to receive a copy of personal information you have provided to us in a portable, machine-readable format.
• Right to Opt-Out of Sale / Sharing / Targeted Advertising: The right to opt out of the sale of your personal information and/or the sharing of your personal information for cross-context behavioral advertising. To opt out, contact us at support@formula.care or send a GPC signal through your browser (see Section 9.7).
• Right to Limit Use of Sensitive Personal Information (California): California residents may request that we limit our use and disclosure of SPI to the purposes permitted under the CPRA (i.e., providing the Services as requested). To exercise this right, contact us at support@formula.care with the subject line "Limit Use of Sensitive Information."
• Right of Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights. We will not deny services, charge different prices, or provide a lower quality of service because you exercised a privacy right.
• Right to Appeal: If we deny your request, you may appeal by contacting us at support@formula.care with the subject line "Privacy Rights Appeal." We will provide a written response with the reasons for our decision within the period required by your state's law.

9.6 How to submit a privacy rights request

• Email us at support@formula.care and describe the right you wish to exercise.
• Use the App's settings to access, correct, or delete your data directly without needing to contact us.

We will acknowledge receipt of your request and respond within 45 calendar days. For complex requests, we may extend our response period by an additional 45 days, in which case we will notify you of the extension and the reason for it.

We may need to verify your identity before processing your request. For requests involving SPI, additional verification steps may apply. We will not use information provided solely for verification purposes for any other purpose.

California residents may designate an authorized agent to submit rights requests on their behalf by providing written authorization. We may require you to confirm the agent's authority directly before processing such requests.

9.7 Global Privacy Control (GPC)

We recognize and honor Global Privacy Control (GPC) signals. If you are a California resident and your browser or device transmits a GPC signal when visiting our Website, we will treat this as a valid request to opt out of the sharing of your personal information for cross-context behavioral advertising from that browser or device. GPC signals operate at the browser level and must be enabled separately for each browser you use. Learn more at globalprivacycontrol.org.

9.8 Washington My Health MY Data Act (WA MGMDA)

If you are a Washington State resident, additional rights apply to you under the Washington My Health MY Data Act (“MHMDA”), which applies to "consumer health data", broadly defined to include personal information that identifies your past, present, or future physical or mental health status.

The following data we collect may constitute consumer health data under the MHMDA: weight, height, nutritional intake, food logs, calorie data, and health metrics imported from Apple HealthKit or similar platforms, physical activity, sleep, energy levels, mood and stress, logged symptoms, medications and supplements, and any medical history or diagnoses you choose to disclose.

Under the MHMDA, we commit to the following:

• We will not sell your consumer health data.
• We will not use or disclose consumer health data for targeted advertising.
• We collect consumer health data only with your prior consent, which is obtained during onboarding and for each specific import (e.g., HealthKit integration).
• You may withdraw consent and request deletion of your consumer health data at any time through the App's settings or by contacting us at support@formula.care.
• If you believe we have violated your rights under the MHMDA, you may file a complaint with the Washington State Attorney General.

9.9. California Shine the Light (Civil Code § 1798.83)

California Civil Code Section 1798.83 permits California residents to request information about personal information disclosed to third parties for their own direct marketing purposes during the preceding calendar year. We do not currently disclose personal information to third parties for their own direct marketing purposes. If this practice changes, we will update this Notice and provide a mechanism for Shine the Light requests.

9.10 Nevada Privacy Rights

Nevada Revised Statutes Chapter 603A gives Nevada residents the right to opt out of the sale of covered information for monetary consideration. We do not sell personal information for monetary consideration. If you wish to submit a Nevada opt-out request, contact us at support@formula.care.

10. CHILDREN'S PRIVACY

The Services are intended for adults only. You must be at least 18 years old to use the Services, and we do not knowingly collect personal information from anyone under 18.

In any event, consistent with the U.S. Children's Online Privacy Protection Act (COPPA), we do not knowingly collect personal information from children under 13.

In any event, for EEA and UK users, we do not knowingly collect personal information from children under the age of 16.

If we become aware that we have collected personal information from a child under the applicable age threshold without the required parental or guardian consent, we will take prompt steps to delete such information and, where applicable, the child's account.

If you are a parent or guardian and believe your child has provided personal information to us, please contact us at support@formula.care.

11. DATA SECURITY

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, alteration, or disclosure. Our security measures include, but are not limited to:

• Encryption of personal data in transit (TLS/SSL) and at rest.
• Pseudonymization and tokenization of certain categories of personal data.
• Role-based access controls, limiting employee access to personal data to those who require it for their specific role.
• Regular vulnerability scanning and penetration testing.
• Data Protection Impact Assessments (DPIAs) for new processing activities that may present high risks to individuals' rights and freedoms.

Despite these measures, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security. If you believe your account has been compromised or become aware of any potential security incident, please contact us immediately at support@formula.care.

12. CONTACTING US

General contact details. If you have any questions or concerns about your privacy, any provisions of this Privacy Policy or any of your rights, you may contact us at: support@formula.care.

Appointed EEA representative. If you are a resident of the EEA and you have any questions about this Privacy Policy, please contact us via email at support@formula.care or via our EEA representative’s email address: privacy@formula.care.

Data Protection Contact. You may contact our Data Protection Contact at support@formula.care or privacy@formula.care.