Privacy Policy

At a Glance

• We collect identifiers (email, device ID), subscription details, and health/nutrition logs you provide, including body weight, glucose and A1C entries.
• We use this data to run the app (tracking, insights, reminders), manage subscriptions, and improve our services.
• We do not sell personal data. Some analytics/ads may count as “sharing” under California law. You can opt out anytime.
• You can access, delete, or export your data by contacting contact@gococo.app.

1. Information We Collect

We collect the following categories of data when you use the GoCoCo app or website:

• Identification data: name, email, phone, address.
• Browsing data: IP address, device, operating system, browser, cookies.
• Interaction data: forms, support requests, feedback.
• Subscription and billing data: payment info for subscriptions or refunds.
• Nutrition and health-related data (sensitive data): meal photos, logs, scans, goals, streaks, body weight, glucose readings, A1C values, and other wellness insights voluntarily provided by the user.
• Device permissions: camera access, used only to capture meal photos and scan barcodes.
• Data from Apple Health and Health Connect (optional): see Section 1.3.

1.2 Research Program

GoCoCo operates an optional research program, carried out with our academic research partner, to generate scientific evidence on how people use the app. The study is observational: it analyzes data that participants have already logged in the app (A1C, weight and app-usage data). It involves no medical intervention, test or visit.

Participation is entirely voluntary. If you choose to join, we will use, in pseudonymized form, the A1C and weight values you have already logged, together with data from your app usage (scan frequency, food log frequency, average nutrition scores). You may also choose to log a new A1C reading, obtained by your own means.

How your data is used: Research data is pseudonymized: you are identified by a technical code, never by your name or email. The table linking that code to your identity is kept separately by GoCoCo, with access restricted to authorized GoCoCo personnel. Our academic research partner (Instituto de la Grasa, Consejo Superior de Investigaciones Científicas (CSIC), Spain) receives only the technical code and the study variables, and cannot re-identify you. Research data is analyzed in aggregate and never sold. Most participants live in the United States. Their pseudonymized data is analyzed by our research partner in Spain, within the European Economic Area. This program is not a medical service and does not constitute healthcare treatment.

FTC compliance: GoCoCo complies with the FTC Act and the FTC Health Breach Notification Rule. In the event of a data breach involving research health data, affected users will be notified promptly in accordance with applicable law.

California residents (CCPA/CPRA): Your A1C, weight, glucose and health-related data constitutes sensitive personal information under the California Consumer Privacy Act. You have the right to access, correct, delete, or limit the use of this data at any time. To exercise your rights, contact us at contact@gococo.app. We do not sell or share your sensitive personal information with third parties for advertising purposes.

Retention: Research data is retained for 3 years from the date of collection, after which it is deleted or irreversibly anonymized.

Withdrawal: You may withdraw from the research program at any time by contacting contact@gococo.app. Withdrawal has no consequence on your access to the app.

1.3 Data from Apple Health and Health Connect (optional)

If you choose to connect GoCoCo to Apple Health (iOS) or Health Connect (Android), we read your blood glucose readings. We do not read any other data type. Access is read-only and starts only after you grant permission on your device. You can turn it off at any time in the app or in your device settings.

On iOS, GoCoCo also reads new glucose readings in the background. On Android, if you allow it, GoCoCo also reads new glucose readings in the background, while the app is closed, so your tracker is up to date when you open it. You can refuse or withdraw background access on Android and keep using the rest of the feature.

How we use this data:

• We store your glucose readings, including the last 14 days when you connect and the name of the app and device that recorded them, on our servers (DigitalOcean, United States) so they appear in your tracker, next to your meals, on any device where you sign in.
• We show them only to you. We do not use them to analyze your meals or products, for advertising, or for the research program described in Section 1.2.
• We do not sell them, and we do not share them with advertising, attribution or analytics providers. Our analytics tools may record that a sync took place, but never any data from your readings or the apps and devices they came from.

GoCoCo's use of information received from Health Connect adheres to the Health Connect Permissions policy, including the Limited Use requirements.

Disconnecting stops new readings but keeps those already imported. You can delete your glucose readings by deleting your account, as described in Section 6.

2. Legal Basis for Processing

We process your data under:

• Consent: when you agree to tracking, notifications, or newsletters.
• Contract: to provide paid subscriptions and premium services.
• Legal obligations: tax, accounting, fraud prevention.
• Legitimate interests: app analytics, security, fraud prevention, and service improvement.

For sensitive health data (nutrition and wellness information such as food photos, logs, body weight, glucose and A1C entries, data from Apple Health or Health Connect, or health insights), we only process this information based on your explicit consent, which you may withdraw at any time.

3. Purposes of Processing

We use your data to:

• Provide food scanner and meal tracker functions.
• Let you log your glucose readings in your tracker, next to your meals, and your body weight and A1C values in the Progress section, so you can see how they change over time. We only show these entries back to you: we do not use them to analyze your meals or products.
• Generate nutrition and wellness insights (including daily analyses).
• Manage subscriptions, payments, and billing.
• Send notifications, reminders, and streak updates.
• Provide customer support.
• Comply with applicable laws.

4. Data Accuracy

Users must provide accurate, up-to-date information and notify GoCoCo of any changes to their personal data.

5. Data Retention

Data is retained while your account is active. After closure, retention periods vary by category:

• Billing and payment data: up to 5 years, as required by tax and accounting laws.
• Nutrition and health-related data: deleted within 45 days of account closure or of a deletion request, in line with Section 6.
• Security and technical logs: up to 12 months.

After these periods, data is securely deleted or anonymized unless longer retention is required by law.

6. Users’ Rights

You may exercise the following rights at any time: access, rectification, erasure, restriction, objection, portability, withdraw consent, and not be subject to automated decisions. Requests can be sent to contact@gococo.app or by mail to our Barcelona office.

How to Request Data Deletion

To request the deletion of your personal data, you may:

• Email us at contact@gococo.app with the subject line "Data Deletion Request," including the email address associated with your account; or
• Within the GoCoCo app: tap the menu icon in the top left, tap My Profile, scroll to the bottom and tap Delete Account.

Upon receiving a valid request, we will confirm receipt within 5 business days. We will complete deletion within 45 days, except where retention is required by applicable law (see Section 5 for retention periods). If your request is complex or we receive a high volume of requests, we may extend this period by up to an additional 45 days and will notify you of the extension within the initial 45-day window.

Please note that deleting your account will permanently remove your personal data, including nutrition logs, food scans, meal history, body weight, glucose and A1C entries, and health insights. Certain data may be retained for the periods specified in Section 5 where required by tax, legal, or fraud prevention obligations. Any data retained beyond your deletion request will not be used for any other purpose. Anonymized or aggregated data that can no longer be linked to you may also be retained.

We respond to all valid requests within 45 days, or as otherwise required by applicable law. If you are unsatisfied with our response, you may lodge a complaint with your local data protection authority (e.g., the AEPD in Spain) or appeal under applicable US state laws.

GoCoCo does not make automated decisions with legal or similarly significant effects. Insights, scores, and streaks are provided solely for educational and motivational purposes.

7. Security

We implement appropriate technical and organizational measures to protect personal data. However, no system is 100% secure.

In the event of a personal data breach, we will notify affected users and regulators without undue delay, in accordance with applicable laws.

8. Sharing of Data

We do not sell personal data. Data is only shared with:

• Service providers (processors), acting under our instructions and subject to contractual safeguards, such as: hosting (Amazon Web Services, DigitalOcean); payments and subscriptions (Apple App Store, Google Play, Apple Pay, Google Pay, Stripe, RevenueCat); in-app paywalls and onboarding (Superwall); sign-in (Firebase Authentication, Google OAuth, Sign in with Apple); analytics and performance (Google Analytics for Firebase, Firebase Performance Monitoring, Mixpanel, Microsoft Clarity); crash reporting (Sentry); install attribution (Adjust); app testing and A/B tests (Firebase Remote Config, TestFlight, Google Play Beta Testing); messaging, notifications and surveys (Firebase Notifications, CleverTap, Mailchimp, Typeform); consent management (iubenda); and email marketing and sharing tools (Direct Email Marketing, ShareThis). Data read from Apple Health or Health Connect is stored only by DigitalOcean, our hosting provider for this data, and is never sent to the other providers listed here.
• Legal authorities: where required by law.
• Our academic research partner (CSIC), which receives only pseudonymized research data, for the optional research program described in Section 1.2.

9. International Transfers

Data may be transferred outside the EU (e.g., to the United States) when using third-party service providers. In such cases, safeguards such as Standard Contractual Clauses (SCCs) are applied.

10. Children’s Privacy

United States: The service is not directed to children under 13.

EU/Spain: The service is not directed to children under 14. We do not knowingly collect children’s data. Parents may contact us to request deletion.

11. Consumer Health Data (US States) — CHD

In certain US states (e.g., Washington, Oregon, Colorado), nutrition logs, scans, goals, streaks, body weight, glucose and A1C entries, and related wellness insights are classified as Consumer Health Data.

• We collect and use CHD solely to provide app functions (tracking, analysis, insights).
• We share CHD only with service providers (processors) necessary to operate the app and subject to contractual safeguards.
• We do not sell CHD.
• Users have the right to access, delete, or withdraw consent regarding this data.
• Geofencing: GoCoCo does not use geofencing near health facilities for targeted marketing or data collection.

12. US State Privacy (CPRA, CO, VA, CT, UT, TX)

Notice at Collection (California)

• Categories collected: identifiers (email, device ID), commercial data (subscriptions), internet/electronic activity (app usage, IP, device), and sensitive data (nutrition/health data).
• Purposes: provide app functions, manage subscriptions, customer support, analytics, compliance.
• Retention: while account is active; certain records up to 5 years for legal/tax obligations.
• Sensitive data limitation: used only to provide the service, not for advertising without your consent.
• Sale/Sharing: GoCoCo does not sell personal data. Advertising/analytics SDKs used in the mobile app may be considered “sharing” under CPRA. Users can opt out via a “Do Not Sell or Share My Personal Information” link (where available) or by contacting contact@gococo.app.
• Global Privacy Control (GPC): GoCoCo honors browser GPC signals.
• Exercising US privacy rights: To access, delete, correct, or opt out of sale/sharing (as applicable in your state), contact contact@gococo.app or write to our address above.

13. Marketing Compliance

Email marketing: complies with CAN-SPAM and always includes an unsubscribe link.

SMS/automated notifications: comply with TCPA, requiring prior consent.

14. HIPAA Disclaimer

GoCoCo is not a HIPAA-covered entity or business associate. The Application is intended for general wellness and educational purposes only.

15. Disclaimer: Educational and Wellness Purposes Only

GoCoCo is intended for lifestyle support and education. It is not a medical device and is not intended to diagnose, treat, cure, or prevent any disease. Information provided (food scores, insights, reminders) is for self-education only. GoCoCo does not provide medical advice. Always consult a qualified healthcare professional.

16. Links to Third-Party Sites

Our Service may include links to third-party websites. We are not responsible for the privacy practices of those sites. We encourage you to review their policies.

17. Updates

GoCoCo may update this Privacy Policy from time to time. Users will be notified of material changes.