Draft, pending legal review. This text describes what Kimboo does with your data today, but it hasn't yet been reviewed by a lawyer for Uruguay's data protection law (Ley 18.331) or registered with the URCDP. Don't treat it as a final legal document.

Kimboo privacy policy

Last updated: 2026-10-23

What Kimboo is

Kimboo is an app for logging meals, activity and glucose, and seeing how they relate. It is not a medical device: it doesn't diagnose or treat any condition, and its glucose values come from a community calibration, not Abbott's algorithm. Don't base treatment decisions on them.

What we store

• Account: your email, and your password (stored hashed by the sign-in system).
• What you log: meals, water, weight, sleep, workouts, diary notes and tags.
• Meal photos: in private storage; only you (and your clinic, if you added one) can see them.
• Glucose from your sensor (CGM): the readings the app receives from it.
• Health Connect / Apple Health data, only if you turn it on (see below).

Meal text and photos are turned into data by models running on Kimboo's own server. If an outside service is ever used for that, we'll say so here first.

Health Connect and Apple Health

Kimboo can exchange data with Health Connect (Android) or Apple Health (iOS). It's off until you turn it on in Settings → Health app sync, where you choose reading and writing separately for each type. The platform asks for your permission for each one.

What it reads, and why:

• Weight, sleep, water and workouts: to show them in your day and on the glucose chart, so you don't log them twice.
• Steps: the hourly total, drawn as bars under the glucose chart.
• Blood glucose from other apps (another sensor or a meter): to show it on the same chart.

What it writes, and why:

• The weight, water, workouts and glucose readings you logged in Kimboo: so your other health apps have them too. If you edit or delete one in Kimboo, it's updated or deleted there.

Sync runs when you open the app, when you tap "Sync now", and in the background (about hourly). The first sync can read up to a year back where the platform allows it. Kimboo never writes back to the platform what it read from it.

Health Connect and Apple Health data is never used for advertising, never sold, and never shared with third parties for any purpose other than showing it to you and, if you allowed it, your clinic. The use of information received from Health Connect APIs adheres to the Health Connect Permissions Policy, including the Limited Use requirements.

Location (smart gym)

If you pin your gym in Settings → Smart gym location and turn tracking on, Kimboo uses your location in the background ("Allow all the time") only to notice when you arrive at that place and when you leave, so it can time your workout with the app closed. Your phone's own system does this (a geofence around the gym): Kimboo doesn't follow your route or keep a location history. The gym's location stays on your phone and is never sent to our server; what's saved is the resulting workout (start, end and duration), like any other. You can turn it off or remove your gym in the app, or take back the location permission in your phone's settings.

Where your data lives and who sees it

• On Kimboo's own server (self-hosted Supabase), not a third-party cloud. The app also keeps a copy on your phone so it works offline.
• Every table has row-level access rules (Row Level Security): only you can see your data.
• If you agree to share with a nutrition clinic, its staff can view (not edit) your data while the link is active. Every time they open your record, it's logged.
• We don't sell your data or use it for advertising.

Revoking permissions and deleting data

• Health Connect / Apple Health: turn sync off in Kimboo, or remove the permissions in the platform itself (Android: Settings → Health Connect → App permissions → Kimboo; iPhone: Health app → your profile → Apps → Kimboo). What was already imported stays in Kimboo until you delete it.
• Clinic: you can stop sharing at any time from the app; from then on the clinic can't see your data.
• Logs: you can delete any log of your own in the app. Imported ones are deleted in the app they came from, and Kimboo removes them on the next sync.
• Whole account: in the app, go to Settings → Delete account. Your account, profile, logs, photos, readings and clinic shares are deleted right away. Nothing is kept. You can also email us at agustin.tomas.larghi@gmail.com from the email you signed up with, and we do it within 30 days.

Your rights

Under Uruguay's Ley 18.331 you can ask to access, correct, update or delete your data. Email the same contact address.