1. Who we are (data controller)

nssistant is an AI-powered personal fitness coach operated by Nevo Malca (the "operator", "we", "us"), an individual operator based in Israel, who is the controller of the personal data described in this policy.

Registered address: [ TO FILL: business address, and company registration details if applicable ]

Contact for privacy requests: message the nssistant WhatsApp number you already chat with (also reachable from the signup flow on the home page), or email [ TO FILL: contact email for privacy requests ]. We answer requests within 30 days.

2. Providing data is voluntary

You are under no legal obligation to provide any data. Providing it is voluntary and depends on your consent. However, nssistant is a data-driven coaching service — without your health and fitness data we simply cannot provide it. (This notice is given per Israel's Protection of Privacy Law, section 11.)

3. What data we collect

• Identity: your name and WhatsApp phone number (the phone number is your account identifier).
• Health & fitness data — special category data: metrics from your sports watch (e.g. Garmin: activities, heart rate, sleep, HRV, body battery, stress, race predictions), weight and body-composition measurements, DXA scan reports you upload, nutrition and food logs, workout and gym logs, and daily state (e.g. mood, energy) you report.
• Chat content: everything you send the coach — text, photos (e.g. food photos), and documents — plus the coach's replies, stored as your conversation history.
• Technical & log data: server logs (timestamps, IP address, user agent), usage/activity records, and error diagnostics.

4. Why we process it (purposes)

• Providing the coaching service: personalized training, nutrition and recovery guidance, reminders, and reports.
• Keeping your history and profile so the coach "knows you" across conversations.
• Account management, approval, and support.
• Security, abuse prevention, and debugging.

5. Legal bases (GDPR)

• Contract (Art. 6(1)(b)) — creating and running your account and delivering the service.
• Explicit consent (Art. 9(2)(a)) — for your health and fitness data, which is "special category" data. You give this consent at signup and may withdraw it at any time (see section 10). Withdrawing it means we must stop the coaching service, since it cannot work without this data.
• Legitimate interests (Art. 6(1)(f)) — security logs and abuse prevention.

6. AI processing

Coaching replies and analyses are generated by an artificial-intelligence language model (Anthropic's Claude). AI output can be imperfect and is not medical advice — consult a physician for medical decisions. We do not make solely-automated decisions about you that produce legal or similarly significant effects.

7. Who receives your data (recipients / sub-processors)

We never sell your data, and we do not share it for cross-context behavioral advertising (in California CCPA/CPRA terms: no "sale" or "sharing"). Data goes only to the service providers needed to run nssistant:

Legal authorities may receive data if the law requires it.

8. International transfers

Some of our providers process data outside Israel and the EU/EEA. Specifically, Anthropic and Meta process data in the United States, and our database at Supabase is currently hosted in Singapore; a migration of the database to an EU region is planned. Israel benefits from a European Commission adequacy decision; for transfers to countries without one, we rely on each provider's data-processing agreement and, where applicable, the EU Standard Contractual Clauses.

Agreements in place per sub-processor: [ TO FILL: confirmed DPA / SCC status for each sub-processor listed in section 7 ]

9. Retention

We keep your data for as long as your account exists, so the coach can use your history. If your account is archived by the operator, the data is retained but access is paused. When you ask us to delete your account, we hard-delete your database records and your per-user files, including photos and uploaded documents; deleted records then disappear from backups as those backups age out.

Server logs and database backups expire on a rolling basis: [ TO FILL: exact log retention period and backup retention period ]

10. Your rights

• Access your data and get a copy (much of it is visible in the dashboard; you can also request an export).
• Rectify inaccurate data — in chat, in the dashboard, or by asking us.
• Erase your data ("right to be forgotten") — ask us and we will hard-delete your account and data.
• Withdraw consent to health-data processing at any time — this stops the coaching service but does not affect the lawfulness of processing before withdrawal.
• Restrict or object to processing, and data portability where applicable.
• Complain to a supervisory authority: in Israel, the Privacy Protection Authority (רשות הגנת הפרטיות); in the EU/EEA, your local data-protection authority.

To exercise any right, contact us (section 1). We may need to verify you control the WhatsApp number of the account.

11. Cookies & local storage

We use exactly one strictly-necessary login cookie and a few local preference keys — and no analytics or advertising trackers, which is why there is no cookie pop-up. Full details: Cookie Policy.

12. Security

Traffic is encrypted in transit (HTTPS), the login cookie is HttpOnly/Secure, dashboard access uses one-time login links sent to your own WhatsApp, secrets are masked in logs, and database access is restricted to the operator.

13. Children

nssistant is not directed at children and is not intended for anyone under 18. We do not knowingly process children's data; if you believe a minor has signed up, contact us and we will delete the account.

14. Changes to this policy

We update this policy as the service evolves, and review it periodically to keep it accurate. The version and date at the top change with every update, and for material changes affecting your consent we will ask for your consent again.

This is version 1.0, last updated 5 August 2026.