ELEMENTSPrivacy Policy

ELEMENTS Privacy Policy

Effective date: 1 June 2026

This Privacy Policy explains how Element Nutrition Catering ("ELEMENTS," "we," "us," or "our") collects, uses, shares, and protects your personal information when you use the ELEMENTS mobile app and related services (the "Service"). ELEMENTS is a premium daily meal-prep, nutrition, and fitness service based in Doha, Qatar.

Please read this policy carefully. By creating an account and using ELEMENTS, you agree to the practices described here.

1. Who We Are

ELEMENTS is operated by Element Nutrition Catering (Commercial Registration No. 157822), located at Alsadd Street, Doha, Qatar. We are the party responsible for your personal information (the "data controller").

If you have any questions about this policy or your data, contact us at mk@elementsqa.com. You can also visit us at https://www.elementsqa.com.

2. What Data We Collect

We only collect what we need to run the Service — deliver your meals, personalize your nutrition and fitness experience, process your payments, and keep your account secure. Here is exactly what we collect, grouped by type.

a. Account & Contact Information

Full name
Email address
Phone number
Date of birth
Gender
Delivery address

b. Health & Fitness Information — This is sensitive personal data

Because ELEMENTS is a nutrition and fitness service, we collect health-related information. We treat this as sensitive data and handle it with extra care:

Body weight and weight history
Height and body metrics
Activity level
Fitness and nutrition goals
Food allergies and dislikes
Daily nutrition and food logs
Water intake
Meal plans and portion preferences
WHOOP metrics (recovery, strain, sleep) — only if you choose to connect your WHOOP account (see Section 8)
Workout logs and streaks

c. Payment Information

Subscription and payment transaction records (what you subscribed to, when, and the amount)
Subscription status

We do not store your card or payment-instrument details. Your card number and payment details are entered on and handled directly by our payment gateway, SkipCash (see Section 5).

d. Photos

Your profile picture, if you choose to add one from your camera or photo library.

e. Device & Technical Identifiers

Your Firebase Authentication user ID (the internal ID for your account)
Your Firebase Cloud Messaging (FCM) push notification token (so we can send you notifications)

f. User Content

Product reviews and feedback you submit
Messages you send to our AI nutrition coach ("Xero")
Consultation bookings with dietitians

g. App Activity

In-app activity we use to power your streaks, badges, and notifications, and to keep the Service working properly (basic diagnostics).

What we do not collect

To be clear about what we don't do:

We do not collect your precise or approximate location. ELEMENTS has no location feature.
We do not use advertising identifiers (such as IDFA or GAID).
We do not track you across other apps or websites.
We do not use third-party analytics or advertising SDKs.

3. How We Use Your Data

We use your data only for the following purposes:

What we use	Why we use it
Account & contact info	Create and manage your account, deliver your meals, contact you about your orders and bookings, verify your identity by email/phone.
Health & fitness info	Build and personalize your meal plans and portions, respect your allergies and dislikes, track your progress (weight, water, nutrition, workouts), power streaks and badges, and personalize AI coaching.
Payment info	Process your subscription, confirm payments, manage your subscription status, and keep required financial records.
Photos	Show your profile picture in the app.
Device identifiers	Keep you signed in securely and send you push notifications.
User content	Show and manage your reviews and feedback, run your dietitian bookings, and generate personalized AI-coach responses.
App activity	Power streaks, badges, and notifications, and keep the app running reliably.

We never sell your data. We never use your data for third-party advertising. We never track you across other apps.

4. Legal Bases for Using Your Data (and GDPR)

Where data-protection law such as the EU General Data Protection Regulation (GDPR) or UK GDPR applies to you, we rely on the following legal bases:

Performance of a contract — to provide the Service you signed up for (managing your account, delivering meals, processing subscriptions, running bookings).
Consent — for sensitive health & fitness data, for connecting your WHOOP account, and for push notifications. You can withdraw your consent at any time (see Section 10).
Legitimate interests — to keep the Service secure, prevent fraud and abuse, and improve and maintain the app — balanced against your rights.
Legal obligation — to keep certain financial and transaction records where the law requires it.

If you are in the EU/UK, additional rights may apply; see Section 10.

5. Who We Share Your Data With

We share data only with the trusted providers we rely on to run the Service. These are processors acting on our behalf — they are not permitted to use your data for their own advertising, and we do not sell your data.

Google Firebase — provides our core app infrastructure: Authentication, the Firestore database, Cloud Storage, Cloud Functions, Cloud Messaging (push notifications), and App Check security. This is where your account and app data are stored and processed.

SkipCash — our Qatar payment gateway. When you pay, your card and payment details are entered on and handled by SkipCash to process the transaction.

WHOOP — only if you connect your WHOOP account. When you connect WHOOP (via secure OAuth login), ELEMENTS receives your WHOOP health metrics (recovery, strain, sleep) so we can personalize your experience. If you don't connect WHOOP, we receive nothing from them. See Section 8.

Anthropic (Claude API) — powers our AI nutrition coach, "Xero." When you chat with the coach, we send your relevant nutrition and profile context to Anthropic so it can generate a personalized response. Anthropic does not use this data to train its models. See Section 8.

Twilio SendGrid — sends you transactional emails such as order and booking confirmations.

We may also disclose data if required by law, to comply with a legal request, or to protect the rights, safety, and security of our users and the Service.

6. International Data Transfers

ELEMENTS is operated from Qatar, and the providers listed above may store and process data in other countries. This means your personal information may be transferred to, and processed in, locations outside your home country, including outside Qatar and the EU/UK.

Wherever data is transferred, we take steps intended to keep it protected to the standard described in this policy. Where required by law (for example, for EU/UK users under GDPR), we rely on appropriate safeguards for such transfers.

7. How Long We Keep Your Data

We keep your personal data for as long as your account is active and as long as we need it to provide the Service.

When you delete your account (see Section 10), we delete your account and personal data. However, certain financial and transaction records may be retained in archived and/or de-identified form where we are required to keep them by law or for accounting purposes.

8. WHOOP & AI Coach — Specific Disclosures

Because these two features involve sensitive data and a third party, we want to be especially clear:

WHOOP connection. Connecting your WHOOP account is entirely optional. If you choose to connect it, you authorize ELEMENTS (through WHOOP's secure OAuth process) to receive your WHOOP health metrics — including recovery, strain, and sleep data. We use this only to personalize your ELEMENTS experience. You can disconnect WHOOP at any time; after that, we stop receiving new WHOOP data.

AI nutrition coach ("Xero"). When you send a message to the AI coach, your message and relevant nutrition/profile context are processed by Anthropic (the Claude API) to generate a personalized response. Anthropic acts as our processor and does not train its models on this data. Please avoid entering information in the coach chat that you don't want processed for this purpose.

9. How We Protect Your Data (Security)

We take security seriously and use measures including:

Encryption in transit — all data travels over secure TLS/HTTPS connections.
Access controls — Firebase Security Rules restrict each user to their own data.
Secure token storage — authentication and push tokens are stored in your device's secure storage.
Server-side safeguards — privileged operations run on our secure backend (Cloud Functions).
App Check — Firebase App Check is enabled to help ensure requests come from the genuine ELEMENTS app.

No system can be guaranteed 100% secure, but we work to protect your information using industry-standard practices.

10. Your Rights

You have control over your personal data. Depending on your location, your rights include:

Access and correction — you can view and update most of your profile information directly in the app (Profile).
Deletion — you can delete your account and personal data yourself, in-app, via Profile → Delete Account. As noted in Section 7, certain financial records may be retained in archived/de-identified form where the law requires.
Withdraw consent — where we rely on your consent (for example, sensitive health data, WHOOP connection, or push notifications), you can withdraw it at any time — for example by disconnecting WHOOP, turning off notifications, or deleting your account. Withdrawing consent does not affect processing that already took place.

If GDPR/UK-GDPR applies to you, you may also have the right to object to or restrict certain processing, to request a portable copy of your data, and to lodge a complaint with your local data-protection authority.

To exercise any right or ask a question, contact us at mk@elementsqa.com.

11. Children

ELEMENTS is intended for adults and is not directed to children. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at mk@elementsqa.com and we will take appropriate steps.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Effective date" above and, where appropriate, notify you in the app or by email. Please review this policy periodically.

13. Contact Us

If you have any questions, requests, or concerns about this policy or your personal data, contact us at:

Email: mk@elementsqa.com
Company: Element Nutrition Catering (Commercial Registration No. 157822)
Address: Alsadd Street, Doha, Qatar
Website: https://www.elementsqa.com

This policy is governed by the laws of the State of Qatar.