Your weight, your meals, your meds — yours.

Who we are

Tonic is made by Prisma Labs, a sole proprietorship (eenmanszaak) registered in the Netherlands.

• Chamber of Commerce (KVK): 99547368
• VAT: NL005393832B11
• Address: Maerten van Heemskerckstraat 65, 2021ZH Haarlem, Netherlands
• Contact: [email protected]

Prisma Labs is the data controller for information you provide through the Tonic app and this website.

What we collect

From you, directly

• Account. When you Sign in with Apple on iOS or Google on Android, we receive a stable user identifier and the account details the provider returns, such as email, display name, or profile photo. We never see your Apple ID or Google password.
• Health and lifestyle data you log. Weight, body measurements, meals, GLP-1 medication and doses, injection sites, side effects, mood, water intake, notes, and any other data you choose to enter.
• Apple Health and Health Connect (opt-in, per data type). On iOS, if you allow it, Tonic reads metrics such as weight, activity, nutrition, and workouts from Apple Health, and can write weight and water back. On Android, if you allow it, Tonic reads Health Connect steps and exercise sessions to show activity summaries. You choose the data types you grant, and you can revoke them in iOS Settings or in Android's Health Connect settings at any time.
• Photos. Meal-scan photos, progress photos, and any other images you capture or pick. Meal photos are sent to our backend for AI analysis (see below); the recognized food details are stored in your account. The original images are retained only as long as needed to analyze them and to let you re-open the meal entry, and are not used to train any AI model.
• Problem reports. When you report a problem in the app, we receive your note and, as the form shows before you send: a screenshot of the screen you were on (you can remove it), your app version, device model, iOS version, language and region, time zone, and the names of the last few screens and actions you used. Those step names never include values you logged. The report is linked to your account (user identifier, name, email and subscription status) so we can reply in the app, where you can answer us. A report about a meal scan also includes the scanned photo, what Tonic recognized, and any changes you made. If you allow notifications, we keep your device's push token to tell you when we reply. We use reports only to answer you and fix the problem, and delete them, the replies and the push token with your account. The full list is on What's in a problem report.

Automatically

• Diagnostics. Pseudonymous crash reports and performance traces via Sentry. Pseudonymous product-event analytics and masked session replay via PostHog (e.g., "opened logging sheet"). We minimize these events and do not intentionally include health logs, photos, meal details, or free-text notes.
• Device info. iOS or Android version, device model, app version, and locale, used to debug issues.
• Ad attribution. We share available app-install identifiers, Apple's advertising identifier when authorized, and basic app events such as first open, app launches, trial starts and subscription purchases with AppsFlyer and Google Analytics for Firebase to measure our own campaigns. Details in Who we share data with.

You can turn off Apple's app analytics in iOS Settings → Privacy & Security → Analytics & Improvements. On Android, you can reset or limit the Android advertising ID in system privacy settings. You can also revoke Apple Health or Health Connect access from the platform's health data settings.

Why we collect it (legal basis)

Under the EU General Data Protection Regulation:

• Account, logging, subscription, and platform health data are processed to perform our contract with you — i.e., provide the Tonic service (Art. 6(1)(b)).
• Health-related data is processed on the basis of your explicit consent (Art. 9(2)(a)), given when you create an account and accept this policy, and renewed for each Apple Health or Health Connect type you grant.
• Diagnostics and analytics rely on our legitimate interest in improving the app (Art. 6(1)(f)) — minimized, pseudonymous, and disabled when you opt out as described above.
• Limited ad-attribution processing of available app-install identifiers and basic app events relies on our legitimate interest in measuring our own campaigns (Art. 6(1)(f)). Access to Apple's advertising identifier relies on your consent (Art. 6(1)(a)) through App Tracking Transparency. Denying or withdrawing that permission keeps the advertising identifier unavailable; the remaining attribution processing continues. You can object to or ask us to restrict that processing by contacting us.

Who we share data with

We never sell or rent your data, and we never share it with data brokers. Your health data — weight, meals, doses, side effects, photos, notes, anything you log — is never shared with advertisers, full stop. And the app shows no ads.

Measuring our own ads

We run ads so people who could use Tonic can find it. To measure those campaigns, AppsFlyer receives available device and app-install identifiers and basic app events, including first open, app launches, retention, trial starts and subscription purchases. AppsFlyer may forward campaign measurement to configured ad partners such as TikTok or Google. We do not send health logs, photos, meals, medication, weight, chat content or free-text notes to these measurement services.

On iOS, Google Analytics for Firebase also receives an app-instance identifier, basic app activity, and device and app information. We pass that app-instance identifier to RevenueCat so it can send subscription lifecycle events, including trial starts, purchases, renewals and cancellations, to the same Google Analytics property. Purchase events can include the subscription product, amount and currency. This lets us measure whether our Google ads lead to trials and paid subscriptions. Automatic screen reporting and advertising personalization are disabled for this integration. We do not send your name or email address to it.

The iOS app also includes Google’s on-device conversion measurement library. It helps measure whether an install came from a Google ad without Apple’s advertising identifier. The match happens on your device and produces a de-identified token that AppsFlyer passes to Google. Google may also use de-identified, temporary signals derived from your IP address. See how Google uses information from apps that use its services.

Apple’s App Tracking Transparency prompt controls whether Apple’s advertising identifier is available. Google advertising storage and ad-user-data consent follow that choice; advertising personalization remains disabled. App-instance identifiers, basic app activity, Apple AdServices attribution and privacy-preserving measurement can continue without that identifier. You can change your ATT choice in iOS Settings → Privacy & Security → Tracking → Tonic. On Android, you can reset or limit the advertising ID in system privacy settings. AppsFlyer describes its processing in its privacy policy.

We use the following sub-processors to run the service. They are bound by data-processing agreements:

When data is transferred to the United States it is covered by Standard Contractual Clauses, or the EU–US Data Privacy Framework where the recipient is certified. We instruct AI sub-processors not to train their models on your data, via API settings and contract terms where available (e.g., zero-retention modes).

Your rights

Under the GDPR, you can:

• Access the data we hold about you.
• Correct anything inaccurate.
• Delete your account and all associated data. In the app: Settings → Account → Delete account. Or email us.
• Export a portable copy of your data.
• Withdraw consent at any time (e.g., revoke Apple Health or Health Connect access, disable analytics where offered, or make Apple's advertising identifier unavailable in iOS privacy settings).
• Object to processing, or restrict it.
• Lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or the supervisory authority in your country of residence.

To exercise any of these rights, email [email protected]. We respond within 30 days.

How long we keep your data

We keep your account data for as long as your Tonic account exists. If you delete your account, we delete the underlying data from our systems within 30 days, except where law requires us to retain something longer (e.g., financial records for Dutch tax purposes). Anonymous diagnostic data is retained for up to 90 days.

Children

Tonic is not directed to anyone under 16, and we do not knowingly collect personal data from children. If you believe a child has provided us data, email [email protected] and we will delete it.

Security

Data is encrypted in transit (TLS 1.2+) and at rest. Backend access is limited to people who need it to operate the service. We log administrative access and review it periodically.

Changes to this policy

If we change this policy, we post the new version here with a new effective date, and notify you inside the app for any material change. The current version always lives at https://asktonic.com/privacy.

Contact

Privacy questions, data requests, or anything you want us to know — email [email protected]. Or write to Prisma Labs, Maerten van Heemskerckstraat 65, 2021ZH Haarlem, Netherlands.