BCH Scan app: Privacy Policy

This policy describes the personal data processed by the BCH Scan mobile app (iOS and Android), published by BetterCallHealth LLP, and your rights. It supplements the privacy policy of the www.bettercallhealth.com website, which still applies to the website's services.

If you are in the United States, our Consumer Health Data Privacy Policy describes the consumer health data the app collects and your rights under the laws of Washington, Nevada and the other states with similar laws.

BetterCallHealth LLP applies the UK GDPR, the Data Protection Act 2018 and, for people located in the European Economic Area, Regulation (EU) 2016/679 (GDPR). The health data processed by the app are processed only on the basis of your explicit consent, under Article 9(2)(a) of the UK GDPR and of the GDPR.

1. Data controller

2. What never leaves your phone

Your blood test values, their dates and your notes are stored only on your device and are sent neither to BetterCallHealth nor to anyone else. They are stored in the app's memory. Deleting them in the app erases them permanently. Uninstalling the app also erases them, unless you have set up a phone backup yourself (iCloud, Google). BetterCallHealth has no access to them and cannot restore them: blood test values do not follow you to a new phone.

Your shopping list (My list) and your recipe swap choices are backed up to your account so that you can find them on another phone; section 3.10 describes this backup.

The reminders you turn on (the weekly gauge, retesting a marker, the end of the trial) are local notifications, scheduled by the device itself, without any server.

3. Data processed by our servers

For each category below: the data, the purpose, the legal basis and how long it is kept.

3.1. Account

• Creation: since version 1.0.7 of the app, an account is required to use it. You create it by signing in with Apple, with Google, or with your email address: a six-digit code, valid for fifteen minutes, is then sent to you. No password is created or stored.
• Data: the identifier Apple or Google sends us to recognise you, never a password; the email address linked to your sign-in method (with Apple, this may be a relay address that hides yours); your first name if it is sent to us (Apple sends it only once, at the first sign-in; we do not keep the surname); the dates of creation, sign-in and last visit. The app also opens a technical session, with no name or address.
• Purpose: to recognise you from one session to the next and from one phone to another, and to find your scans, your list, your week and your subscription again.
• Legal basis: performance of the service (Article 6(1)(b) UK GDPR / GDPR).
• Retention: until you delete the account in the app, or after 36 months without the app being opened.
• Sign in with Apple: if you remove BCH Scan's access to your Apple ID (in your iPhone settings) or delete your Apple account, Apple informs us and we remove this sign-in method; your account remains accessible by another method. When you delete your BCH Scan account, we ask Apple to revoke the access it gave us.

3.2. Profile you choose to give

• Data: sex, age band (a band, never a date of birth), the shops you use, the French département (the number only, never the town or postcode, and only if you take part in the statistics in section 4), what you expect from the app, label alerts (the allergens you keep an eye on).
• Purpose: to adjust blood test ranges by sex, to highlight your alerts on labels and, for shops and département, to feed the anonymous statistics in section 4.
• Legal basis: your consent, given question by question at first launch; each answer can be skipped, and changed or erased at any time in the Profile.
• Retention: until changed or until the account is deleted.

3.2 bis. Country where you shop

• Data: the country where you do your shopping. In the English version of the app: United Kingdom, Ireland, United States, Canada, Australia, New Zealand, France, Belgium, Switzerland or "Elsewhere".
• Origin: the app suggests it at start-up from the region set on your phone (a setting, never a location), and only if it is one of these countries. You can change it at any time in the Profile ("Country where you shop"); your choice is then never replaced. Without a known country, the app uses France.
• Purpose: to suggest, in the aisles and under "Instead", only products sold in that country, and, in the Profile, the shops of that country.
• Legal basis: performance of the service (Article 6(1)(b) UK GDPR / GDPR).
• Retention: until changed or until the account is deleted.

3.3. Health data: your situation and how you feel

• Data: the situation you declare (for example Hashimoto's, irritable bowel syndrome, fibromyalgia, inflammatory bowel disease, rheumatoid arthritis) and the feelings you tick (fatigue, pain, digestion, sleep, weight, skin, mood).
• Purpose: to weight the reading of products according to your situation. The reading always describes the product, never your state of health, and is neither medical advice nor any kind of diagnosis.
• Legal basis: your explicit consent, given by ticking a dedicated box after reading the explanation (Article 9(2)(a) UK GDPR / GDPR). Without this box, no situation or feeling is recorded and the app works in exactly the same way.
• Withdrawal: at any time in the Profile. Removing your situation erases the situation, the feelings and all readings already calculated for that situation.
• Since version 1.0.7: these data are linked to an account identified by the email address of your sign-in method (section 3.1). The consent you gave remains valid and is withdrawn in the same way.
• Retention: until consent is withdrawn or the account is deleted.

3.4. Product scans

• Data: for each scan, the date, the mode (barcode, label, plate), the barcode, the product name, the ingredient list read, the calculated verdict and, where relevant, its reading for your situation.
• Purpose: to show and keep your history, to calculate the weekly gauge, to improve the product database.
• Legal basis: performance of the service.
• Retention: until the account is deleted.
• Processor: for a barcode scan, the barcode is sent to Open Food Facts (a French non-profit association, open database under the ODbL licence) to retrieve the product record. No data about you is sent with this request.

3.5. Photos of labels or plates

• Data: the photo you take of a label or a plate.
• Purpose: to extract the list of ingredients for the reading.
• Legal basis: your consent, asked for before the first photo.
• Processor: the photo is sent to an artificial intelligence provider, Anthropic (United States), which extracts the text. This transfer outside the United Kingdom and the European Union is governed by the standard contractual clauses of the European Commission and, for transfers from the United Kingdom, by the UK International Data Transfer Addendum, included in the data processing agreement signed with this provider, which undertakes not to use the photos to train its models.
• Retention: BetterCallHealth does not keep the photo after the extraction; only the ingredient list obtained is saved with the scan, unless, for a product you add, you then send it with the photo of the front of the pack (section 3.5 bis). Please do not photograph faces or personal documents.

3.5 bis. Photos of a product you add

• When: only if you add a product BCH Scan did not know (its ingredient list read, then confirmed by you), and only if you choose, at the last step, to photograph the front of the pack. "Later" skips this step without sending anything.
• Data: the photo of the front of the pack and the photo of its ingredient list taken just before; the name and brand read on the front; your account identifier and the date.
• Purpose: to build the BCH Scan product database. The front photo becomes the product's image, shown to everyone who scans it; the name read on the pack names the product when you have not typed it.
• Check: before being kept, each photo is examined by the artificial intelligence provider of section 3.5 (Anthropic, same safeguards). A photo showing a person, or not showing a pack, is never kept.
• Legal basis: your consent: the step is optional and requires your consent to the reading of photos by artificial intelligence (section 3.5).
• Retention: as long as the product is in the database. Deleting your account detaches these photos from you: they remain the product's image, with no further link to you. To have one removed, write to privacy@bettercallhealth.com.

3.6. Tuesday newsletter

The BetterCallHealth Tuesday newsletter is written in French and is not offered in the English version of the app. If you subscribe to it from the French version, section 3.6 of the French privacy policy applies.

3.6 bis. App news and feedback requests

• Data: the email address of your sign-in method (section 3.1) and your first name if we know it.
• Purpose: to tell you about what is new in BCH Scan and, from time to time, to ask your opinion of the app.
• Legal basis: our legitimate interest in telling the people who use BCH Scan how it is changing and in collecting their feedback (Article 6(1)(f) UK GDPR / GDPR). You are told about this when you create your account, on the sign-in screen.
• Objection: at any time and free of charge, using the link in every message or the "Get BCH Scan news" switch in the Profile. Your choice applies immediately.
• Retention: as long as the account exists and you have not objected.

3.7. Premium subscription

• Data: the subscriber identifier, the subscription status, the start, end and trial dates.
• Purpose: to unlock Premium features on your account.
• Legal basis: performance of the subscription contract.
• Processors: payment is made through Apple (App Store) or Google (Google Play) on your store account; subscriptions are managed by RevenueCat (United States, standard contractual clauses). No bank details pass through or are kept by BetterCallHealth.
• Retention: for the duration of the subscription, then only as long as accounting obligations require.

3.8. Usage log

• Data: events linked to your account (for example: subscription screen shown, better-ranked product opened and which product, product added to the list, scan completed and what followed, aisle browsed, search typed), without any health data, and your optional answers to the question "Did it go in your basket?" after opening a better-ranked product. A typed search is kept cut to forty characters, and never if it looks like an address or a number.
• Purpose: to understand how the app is used and improve it; if you take part, to feed the anonymous statistics in section 4.
• Legal basis: BetterCallHealth's legitimate interest in improving its service, with respect for your rights; the answers to "Did it go in your basket?" are given freely, with one tap, and can be ignored.
• Retention: 24 months, then erasure or permanent aggregation.

3.8 bis. Where the installation came from (iPhone)

• Data: at launch, the app reads an attribution token provided by Apple (AdServices framework), which contains no advertising identifier. If you installed the app after tapping an Apple Ads advert, Apple tells us in particular the campaign, the ad group and the keyword of that advert; otherwise, the installation is recorded without an advert. This information is linked to your account.
• Purpose: to know which adverts lead to an installation, then to a subscription, in order to decide where to place ours.
• Legal basis: BetterCallHealth's legitimate interest in measuring the effectiveness of its own adverts, with respect for your rights. No data is shared with an advertising network and no advertising profile is built. This is not tracking in Apple's sense, and this measurement does not depend on the tracking permission window, which concerns only the measurement of our adverts (section 3.11).
• Processor: RevenueCat (United States, standard contractual clauses), which sends the token to Apple and keeps the answer with the subscription record.
• Retention: that of the subscription record (section 3.7).
• Objection: you can object to this measurement at any time by writing to privacy@bettercallhealth.com.

3.9. Technical data

• Data: IP address and connection information, in the server logs.
• Purpose: security, preventing abuse, limiting scans per account.
• Legal basis: legitimate interest in security.
• Retention: 12 months.

3.9 bis. App language

• Data: at first opening, the country of your connection, derived from your IP address by our server ("IP to Country Lite" database, IP Geolocation by DB-IP, CC BY 4.0 licence); then the language used (English or French) and, if you change it, your choice.
• Purpose: to open the app in English or in French depending on that country. If you were already using the app, it stays in French. You can change the language at any time on the welcome screen or in the Profile.
• Legal basis: our legitimate interest in showing you the app in a language you read.
• Retention: neither the country nor, for this purpose, the IP address is kept. The language used is kept on your phone; your account records English when you have chosen it, so that we do not write to you in French.

3.10. Backup of your list, your week and your choices; account recovery

• Data: your shopping list (My list: products and recipe ingredients, with their name, their aisle and the date they were added), the log that calculates your week (the products and recipes you had, with their score and date, and the products scanned), and your recipe swap choices. Never a blood test value: our servers reject any data of this kind in this backup.
• Purpose: to find these items again on another phone, or after reinstalling the app. The backup is replaced at each change; it is not a history.
• Finding your account again: on a new device, sign in with the same method as before (Apple, Google or your email address): your account comes back, with its history, its declared situation, its subscription, its list and its week. To move from an iPhone to an Android phone, where Sign in with Apple does not exist, sign in with your account's email address: a code is sent to it, valid for fifteen minutes, with five attempts at most.
• Legal basis: performance of the service.
• Retention: until the account is deleted, which erases the backup with it.

4. Anonymous statistics that are sold: only if you say yes

In the Profile, the app offers you the chance to take part in statistics. This choice is optional, made by an explicit action, has no effect on your scans, and can be withdrawn at any time in the same place.

• Data: your product scans (barcode, result), your actions in the app (aisle opened, product added to the list, replacement chosen, search typed), and the shops and French département you declare.
• Purposes: to produce anonymous statistics by product and by aisle (how often a product is scanned, what replaces it, what makes it go back on the shelf); to sell them to food manufacturers and retailers to help improve their recipes; BetterCallHealth research.
• Legal basis: your consent, given in the Profile and withdrawn in the same place.
• What never goes in: your situation, your feelings, your goals, your alerts, your blood tests, your email address, your age band, your sex. These data never join any statistic, even aggregated.
• Anonymisation: aggregates by product, aisle, shop and département; no aggregate is produced for fewer than twenty different people; no individual line leaves our servers.
• Recipients: manufacturers and retailers, under contract, as aggregates only.
• Retention: raw scans and actions, 24 months; aggregates, without limit, because they are anonymous.

Once aggregated in this way, these statistics are no longer personal data within the meaning of the UK GDPR and the GDPR. If you do not say yes, or if you withdraw your choice, your scans do not go into any aggregate; an account that withdraws or is deleted disappears from the aggregates at the next calculation, within twenty-four hours. Aggregates already sent no longer make it possible to identify you in any case.

5. Recipients and processors

Your personal data are neither sold nor rented. The anonymous statistics in section 4 are sold to manufacturers and retailers: they contain no personal data. Your data are processed by BetterCallHealth LLP and by the following processors, each bound by a data processing agreement:

• Hostinger International Ltd (Lithuania): hosting of the app's servers, located in Paris, France.
• Supabase Inc.: creation and verification of the app's technical sessions, with no name or address, Paris region, France.
• Open Food Facts (France): records of products scanned by barcode.
• Anthropic PBC (United States): reading of label and plate photos, and checking the photos of a product you add (section 3.5 bis), with consent, standard contractual clauses.
• Apple Inc. and Google LLC: distribution of the app and collection of subscription payments, under their own policies; Apple also indicates where the installation came from (section 3.8 bis). If you choose to sign in with them, they verify your identity and send us the identifier, address and first name described in section 3.1 (Sign in with Apple, Google Sign-In).
• RevenueCat Inc. (United States): subscription management, on iPhone the origin of the installation (section 3.8 bis) and, if you accept, sending trial and subscription events to Meta (section 3.11), standard contractual clauses.
• Resend: delivery of the sign-in code, the address confirmation message and app news.

Only with your consent (section 3.11), Meta Platforms Ireland Ltd (Ireland) receives the data used to measure our adverts, as joint controller.

Account, profile, health and scan data are hosted in the European Union. The United Kingdom recognises the European Economic Area as providing an adequate level of protection, and the United Kingdom, where BetterCallHealth LLP is based, benefits from an adequacy decision of the European Commission.

6. Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability, as well as the right to withdraw a consent you have given at any time, without affecting the lawfulness of the processing carried out before the withdrawal.

Deleting your account takes two taps in the app, Profile tab, Data section. If you have uninstalled the app, the steps are on the page Delete your BCH Scan account, which also explains what deletion erases and what it does not.

Most rights can be exercised directly in the app, in the Profile tab:

• Export my data: a readable copy of your account and your scans;
• Delete my account: immediate and permanent erasure of your account, your scans, your situation, your alerts and your answers; your scans leave the anonymous statistics at the next calculation; the photos of a product you added remain that product's image, with no further link to you (section 3.5 bis);
• Situation, Anonymous statistics, Measure our adverts: withdrawal of the corresponding consents. Withdrawing from the statistics also erases the département you declared.
• Get BCH Scan news: objection to app news and feedback requests (section 3.6 bis).

For any other request, write to privacy@bettercallhealth.com. We reply within one month. You can also lodge a complaint with the supervisory authority where you live: the Information Commissioner's Office (ICO) in the United Kingdom, the Data Protection Commission in Ireland, or, for example, the CNIL in France.

7. Security

Exchanges between the app and our servers are encrypted (TLS). Accounts are authenticated by signed tokens, checked on every request. Access to the servers is restricted and logged. Backups are kept for 30 days. No measure guarantees absolute security: in the event of a personal data breach likely to result in a risk to your rights, we will inform the supervisory authority and, where appropriate, the people concerned, within the time limits set by the UK GDPR and the GDPR.

8. Children

BCH Scan is intended for people aged at least 15. We do not knowingly collect data about younger children; if you think a child has created an account, write to us and we will erase it.

9. Advertising and tracking

The app shows no adverts and contains no advertising network. It only tracks you from one app or website to another if you accept the measurement of our adverts (section 3.11) and, on iPhone, Apple's tracking permission that follows it. It does not use cookies. Apart from the usage log described in section 3.8, kept by BetterCallHealth on its own servers, the only measurements are the origin of the installation on iPhone (section 3.8 bis) and, with your consent, the measurement of our adverts (section 3.11).

10. Changes

This policy may change as the app changes. The date and version number are shown at the top. In the event of a substantial change, in particular to the purposes or the recipients, the app will inform you and, where the law requires it, ask for your consent again.