Precision Compass
Privacy Policy

This Privacy Policy sets out how users’ information is handled in Precision Compass (hereinafter, “the App”).

Article 1 (Storage on the Device and Backups)

Information recorded in the App is, in principle, stored only on the user’s device. Except as expressly stated in this Policy, this information is never sent externally. The App does not sync records, the profile, or test data to any cloud, such as iCloud. However, the number that identifies the user may be shared with the user’s other devices through the sync function of the device’s Keychain (the system that stores passwords and the like).

If the device’s backup function is turned on, information on the device is included in that backup. Of the imported original files, those kept as organic acids test, genetic test, or other documents are excluded from backups. In contrast, original blood test files, imported sensor glucose files, and meal photos are included in backups. This is so that they can be restored when the user changes devices.

Article 2 (Information Collected)

The App collects the following information and stores it on the device.

(1) Basic information entered by the user (name, email address, date of birth, sex, height, and weight). Registering a name and email address is optional. If they are registered, they are used for registration in the client list under Article 5, item (4), and for matching against counseling records.

(2) Health-related information entered by the user (allergies, conditions under treatment, medications, medical history, supplements taken regularly, bowel habits, exercise habits, main concerns, goals, and dietary approach). This information includes special care-required personal information as defined in the Act on the Protection of Personal Information.

(3) Day-to-day information recorded by the user (how the user feels, meals, water, caffeine, alcohol, smoking, bowel movements, menstruation, exercise, supplements, events, the schedules and results of 14-day tries, etc.)

(4) Test data and photos imported by the user (including the results of blood tests, sensor glucose, organic acids tests, genetic tests, and other tests). This information includes special care-required personal information as defined in the Act on the Protection of Personal Information.

(5) Purchase information for checking subscription status (App Store transaction identifiers and expiration dates)

The App collects the information in items (2) and (4) of the preceding paragraph only through the user’s own entry or import. By entering or importing this information, the user is treated as having consented to the collection of special care-required personal information. Users who do not consent are asked to leave the relevant fields blank or not to import the data. Content already entered can be deleted at any time.

Article 3 (Integration with the Health App)

The items for which the App asks the Health app for read permission are as follows. Data is read only if the user grants permission on the device’s permission screen, and the information read is used for display and analysis on the device.

(1) Sleep

(2) Heart Rate, Resting Heart Rate, Heart Rate Variability, and Cardio Recovery

(3) Respiratory Rate and Blood Oxygen

(4) Body Temperature and Wrist Temperature during sleep

(5) Blood Pressure (systolic and diastolic) and Blood Glucose

(6) Steps, Walking Speed, Exercise Minutes, Active Energy, Cardio Fitness (VO2 max), Time in Daylight, and workout type, duration, and average heart rate

(7) Weight, Body Fat Percentage, and Lean Body Mass (Weight is also used to update the weight in the profile to the newer value)

(8) Water, Caffeine, and Number of Alcoholic Beverages

(9) Records of Constipation and Diarrhea

(10) Menstruation (only if the App is set to use the items for women)

(11) Date of Birth (used to fill in the profile automatically)

The information in items (5) and (10) of the preceding paragraph includes special care-required personal information as defined in the Act on the Protection of Personal Information. When the AI analysis under Article 5, item (1), is run, and when the user has consented to the sharing under item (5) of that Article, values summarizing the information in the preceding paragraph are included in what is sent.

What the App writes to the Health app is limited to the items, among the information the user has recorded in the App, that the user has given permission to write. This may include values calculated by converting what was recorded, but the results of AI analysis are never written. The items to be written are shown on the device’s screen when write permission is requested. Apple Health data is never used for advertising purposes and, except as provided in this Policy, is never provided to third parties. Read permission can be changed at any time in the device’s settings.

Article 4 (Purposes of Use)

The operator uses the information collected within the scope of the following purposes.

(1) Providing recording, display, aggregation, and analysis in the App

(2) Providing the AI analysis set out in Article 5, items (1) and (2)

(3) Checking subscription status and the number of free uses available

(4) Registration in the client list, conducting precision nutrition counseling, and matching against counseling records. This use includes the provision to third parties set out in Article 5.

(5) Sending the newsletter

(6) Responding to inquiries, responding to data deletion requests, and investigating bugs

(7) Identifying bugs in the App and improving its quality

Except where the individual’s prior consent has been obtained or as otherwise provided by laws and regulations, the operator does not handle users’ information beyond the scope necessary to achieve the purposes in the preceding paragraph.

Article 5 (Information Sent Externally and Its Recipients)

Users’ information is sent externally only in the following cases. “Analysis service” means a generative AI service that analyzes text and images; currently, this is Claude, provided by Anthropic, PBC (USA).

(1) Creating day-to-day insights (only if the user has consented): The profile (including the health-related information in Article 2, item (2)), the day-to-day log, values summarizing Apple Health data, trends calculated from records, the text of the insight created the previous morning, meal photos, and values summarizing test data are sent, via the operator’s server, to an analysis service provided by a US company. “Trends calculated from records” means what the App calculates from records on the device, namely the usual range derived from the last 30 days of records; summaries by period (the usual spread over 3 months, changes over the last 7 days, milestones in the records, how consistent bedtimes, wake times, and dinner times are, bowel movements over the past 4 weeks, and comparisons with last week, the past 4 weeks, last month, and the same month last year); averages before and after things started in the last 90 days (supplements, this month’s focus, and Today’s one step that the user keeps up); and summaries of connections found by the App’s Observations feature (the connected pair, the direction, the size of the difference, the certainty, the period of records, whether it was checked in a 14-day try, and which side of usual the value for the previous day or that day falls on). The text of the insight created the previous morning is sent so that the same explanation is not repeated, and it excludes the user’s name and any text added by the App. Values summarizing test data include the item names, measured values, units, and their assessments from the latest blood test; per-day summaries of imported sensor glucose and the rise after each meal and sweet drink (the time of the meal or sweet drink, the value before it and the peak value, the time of the peak, and the time taken to come back down); organic acids test items; and items from genetic tests and other documents that the user has chosen to use for insights through the App’s settings or a choice made for each document.

(2) Reading test results and documents (only if the user has consented): The test data and photos the user imports, in their original form, and text extracted from PDFs are sent, via the operator’s server, to the same analysis service as in item (1).

(3) Checking subscription status and the number of free uses available: The number that identifies the user and purchase information are sent to Apple and the operator’s server. They are sent when the App is launched and at other times, regardless of whether AI analysis is used. These transmissions do not include health-related information and are not passed on to analysis services.

(4) Registration in the client list: If the user registers an email address in the App’s basic information, the email address and the name (only if registered) are sent, via the operator’s server, to a cloud service provided by a US company and registered in the operator’s client list. This is done to send information about counseling and to match against records, and it is done for everyone who has registered an email address, regardless of whether they have consented to AI analysis and whether they have applied for counseling.

(5) Sharing for counseling (only if the user has consented on the App’s screen): Monthly compilations of the information recorded in the App (the day-to-day log, values summarizing Apple Health data, meal records, meal photos, supplement records (including label photos), and imported sensor glucose records), the full history of test results, and the profile (the date of birth, sex, height, and weight under Article 2, item (1), and the health-related information under item (2) of that Article; supplements taken regularly are covered by the supplement records mentioned above) are sent, together with the email address, via the operator’s server, to a cloud service provided by the same US company as in item (4), and shared with the counselor. Sending takes place when the user chooses to send, and, if automatic monthly sending is turned on, the first time the user opens the App after the month changes. When sharing is started, after it is checked that the email address entered belongs to a counseling client in the operator’s client list, a confirmation code is sent to that email address. The confirmation code email is sent through the same company in France as in item (7). The operator’s server stores an identification number created for each device used for sharing, the email address, and records of consent and transmission. Shared information is used only for precision nutrition counseling and is never used for promotion, solicitation, advertising, or sales. To prepare counseling reports, the counselor may load the shared information into a generative AI service provided by a US company. In that case, the service is used with settings under which the loaded information is not used for AI training. “Counselor” means a person who conducts precision nutrition counseling. If a person other than the operator conducts it, this will be communicated in advance, and consent will be confirmed again.

(6) Sending the newsletter (only if the user has asked to receive it): The email address is sent, via the operator’s server, to a newsletter delivery service provided by a US company. The registration history is stored in the cloud service provided by the same US company as in item (4), and the email address is also registered in the client list under item (4). Users can unsubscribe at any time. However, this company does not merely accept the delivery entrusted to it; it uses the email address sent to it to register the person as one of its own users, and sends its own announcements and recommendations of other publications in its own name. The operator has no means of stopping this, and stopping them and deleting that registration are done by users themselves in that company’s settings.

(7) Inquiries and data deletion requests: The name, email address, and inquiry content entered, and device information for investigating bugs (app version, OS version, and device model name), are sent, via the operator’s server, to the cloud service provided by the same US company as in item (4), and stored in the operator’s inquiry records. For data deletion requests, the number that identifies the user is also sent in order to identify what is to be deleted. If sending notification emails to the operator is enabled, they are sent through an outside company that delivers email. This company is located in France, and the European Union is designated as a foreign country that the Personal Information Protection Commission recognizes as having standards equivalent to those of Japan. The transmission is an entrustment of delivery, and the information is not used to create contact lists. However, part of the company’s infrastructure is subcontracted to a US company, and it cannot be ruled out that the information is located in the United States.

For items (1) and (2), the name and email address registered in the App’s input fields are not sent to analysis services. However, because item (2) sends original files as they are, if a document shows a name, date of birth, or the like, the original including that information is sent.

Information sent to analysis services under items (1) and (2) is never used for AI training.

Article 6 (Provision to Third Parties in the United States)

The recipients under items (1), (2), and (4) through (7) of the preceding Article (including the generative AI service used by the counselor under item (5) of that Article) are all companies located in the United States, except for the company used for the confirmation code emails under that item and for the notifications under item (7) of that Article. Because this constitutes provision to third parties in the United States, the following information is provided.

(1) Name of the foreign country: United States of America

(2) System in that foreign country: The United States has no comprehensive federal law on the protection of personal information; it is governed by sector-specific federal laws and by state laws and regulations. Health-related information handled by the App is usually not protected by the federal law that covers healthcare providers and similar entities (HIPAA). There are also systems that allow the government to demand that companies disclose the data they hold (including the CLOUD Act, which may reach data outside the United States). The United States is not among the foreign countries that the Personal Information Protection Commission recognizes as having standards equivalent to those of Japan. The above is based on publicly available information as of September 2026 and is not exhaustive (the results of the Commission’s published survey of that country’s system reflect information as of October 2021).

(3) Measures taken by the recipients: For the recipients under items (1), (2), (4), (5), and (7) of the preceding Article (excluding the generative AI service used by the counselor under item (5) of that Article), the operator has confirmed, from each company’s published terms of use and security descriptions, that measures corresponding to the eight principles of the Privacy Guidelines established by the Organisation for Economic Co-operation and Development (OECD) are in place with respect to specifying the purpose of use and limiting use, security control measures, limiting retention periods and deletion, restricting onward provision to third parties, and publishing information about handling. However, there are exceptions to the restriction on onward provision, and each company provides that it will comply when compelled by a court or other government agency to disclose information under laws and regulations. In addition, each company has no point of contact that directly accepts requests from users for disclosure, correction, or suspension of use, and no method by which users can make such requests themselves can be confirmed. The operator accepts and responds to these requests at the contact point in Article 9, item (7). For the recipient under item (6) of the preceding Article, its purposes of use, the categories of parties it shares with, its criteria for retention periods, and its handling are published. However, its purposes of use are not limited to delivery for the App, and the specific retention periods, the names of onward recipients, and the details of its security control are not published. On the other hand, its point of contact for requests from users is published, and users can delete their own registration and information in that company’s settings. For the generative AI service used by the counselor under item (5) of the preceding Article, the company publishes its rules on purposes of use and retention periods. When the service is used with the settings described in that item, the loaded information is, under that company’s rules, deleted in principle within 30 days (if it is kept in the service as conversation history, it is deleted within 30 days after the counselor deletes that history). However, exchanges that the company’s safety assessments find may violate its usage policies may be kept longer and may be used, including for training for those assessments and countermeasures.

Note that it is the operator that limits the scope of information sent to analysis services to the minimum necessary under items (1) and (2) of the preceding Article; this is not ensured by the terms of use published by each company.

For the transmissions under items (1) and (2) of the preceding Article, consent is confirmed in advance in the App by showing what will be sent and the matters in each item of this Article. If the user does not consent or withdraws consent, these transmissions do not take place. For genetic test data, explicit consent for each file is also confirmed when it is read under item (2) of the preceding Article. What is used for the insights under item (1) of the preceding Article is limited to the genetic test items on the device, in cases where the user has chosen in the App’s settings to use genetic traits.

Consent to the sharing under item (5) of the preceding Article is confirmed in the App before sharing begins, by showing the scope of information to be shared and the matters in each item of this Article, and the date and time of consent and the version of the content shown are recorded and stored on the operator’s server. Consent to the transmissions under items (4), (6), and (7) of the preceding Article is confirmed, after the matters in each item of this Article have been presented in this Policy, by the user registering an email address in the App’s basic information, registering for the newsletter, or sending an inquiry.

Article 7 (Retention Periods and Deletion)

(1) Information on the device is kept until the user deletes it or deletes the App. However, the number that identifies the user remains in the device’s Keychain even if the App is deleted, so if the App is reinstalled, the user is treated as the same user.

(2) The number that identifies the user, purchase information, and usage count records held on the operator’s server are used to check subscription status and usage counts, and no time limit is set for their retention. Deletion requests are made under Article 9, item (2). The device identification number, email address, and records of consent and transmission recorded on the operator’s server for the sharing under Article 5, item (5), are kept for 3 years from the date of the last transmission or the date sharing was stopped, whichever is later.

(3) The results of AI analysis are kept for up to 24 hours so that they can be retrieved again. Results past that limit can no longer be retrieved and are deleted by a scheduled process that runs every hour.

(4) The infrastructure of the operator’s server has a mechanism that keeps past states for recovery from failures, and even after the operator deletes a record, records for recovery remain for up to 7 days. After 7 days, recovery from these records is no longer possible, but when physical erasure from the storage devices is completed has not been confirmed from the materials published by the company concerned.

(5) Information sent to the analysis service is deleted, in principle, within 30 days under the rules of Anthropic, PBC. As that company has announced that it does not respond to individual deletion requests for information already sent, the information can only be deleted automatically when the retention period set by that company has passed, and the operator has no means of speeding this up.

(6) The client list, newsletter registration history, inquiry records, and materials shared under Article 5, item (5), are kept until the operator deletes them.

(7) When information is deleted under the preceding items, copies made by outside companies for security, backup, and business continuity may remain until the retention processing period set by that company has passed. Even in this case, the operator ensures that such copies are kept under the protection set out in the contract and are not handled except as permitted by law.

Article 8 (Restrictions on Provision to Third Parties)

Except as provided in this Policy, users’ information is never provided to third parties. In addition, users’ information is never used for advertising purposes or sold. For outside companies engaged to handle users’ information under this Policy, the operator ensures, through contracts or terms of use with each company, that users’ information is protected at a level equal to or higher than that of this Policy, and can request materials on the status of their security control. However, for the recipient under Article 5, item (6), what is ensured extends only to compliance with laws and regulations and following the operator’s instructions when it handles information on the operator’s behalf. The addendum setting out security control, subcontracting, and deletion upon termination applies only where European rules apply. The operator’s instructions do not extend to handling that the recipient under that item carries out for its own purposes. When a company’s handling changes, the operator reviews the details and reflects them in this Policy.

Article 9 (Users’ Rights and Contact Point)

(1) Export: Users can export recorded information from the App’s settings. The export includes the profile, the day-to-day log, Apple Health data, test data, insights created by AI, photos, and imported original files.

(2) Deletion of information held by the operator: Deletion of the number that identifies the user held by the operator, and of the data linked to that number, can be requested from “Request data deletion” in the App’s settings. Requests are also accepted by contacting the contact point in item (7). After confirming the requester’s identity, the operator will normally respond within 30 days and report the result to the email address provided in the request. Information that must be retained under laws and regulations and the copies under Article 7, item (7), are handled as provided in that Article.

(3) Records on the device and the number on the device: A request under the preceding item does not delete records on the device. To delete records on the device, please delete them from each screen or delete the App. In addition, the operator cannot erase the number that identifies the user stored in the device’s Keychain. If the user continues to use the App after the deletion under the preceding item, the same number will be sent to the operator’s server again, and the records deleted under the preceding item will be re-created.

(4) Requests for disclosure, etc.: Users may request, with respect to their personal data held by the operator, notification of the purpose of use, disclosure, correction, addition, or deletion of its content, suspension of use, erasure, or cessation of provision to third parties. Please make requests by email to the contact point in item (7). After confirming that the person making the request is the individual or their agent, by checking against the name and email address registered in the App or by other means, the operator will respond without delay by the method requested. If disclosure by that method is difficult, it will be made by delivering a written document. No fee is charged for responses by email or other electronic means. For disclosure, etc., by a method for which a fee may be charged under laws and regulations, if carrying it out incurs actual costs, the amount will be notified in advance.

(5) Personal data held by the operator: This consists of what is listed in Article 7, items (2), (3), and (6) (the number that identifies the user, purchase information, usage count records, the results of AI analysis, the client list, newsletter registration history, inquiry records, shared materials, and the device identification number and records of consent and transmission for sharing). Retention periods are as set out in that Article. Information stored only on the device can be retrieved by users themselves through the export in item (1).

(6) Changing consent and permissions: Consent to AI analysis (Article 5, items (1) and (2)) can be withdrawn at any time from the App’s settings. After withdrawal, these transmissions do not take place. Sharing for counseling (item (5) of that Article) can be stopped at any time from the App’s settings. After it is stopped, no new sharing takes place. Deletion of materials already shared can be requested under item (2). Users can unsubscribe from the newsletter at any time, and permissions for Apple Health and notifications can be changed at any time in the device’s settings.

(7) Contact point: Please direct inquiries about this Policy, complaints about the handling of users’ information, and requests under the preceding items to the contact point shown on this screen. The operator’s name is as shown at the end of this screen. The operator’s address will be provided without delay upon request.

Article 10 (Security Control Measures Taken and Response to Leakage, etc.)

The operator has taken the following measures for users’ information.

(1) Establishing a basic policy and rules: This Policy serves as the basic policy and sets out how information is handled at each stage of collection, use, storage, provision, and deletion.

(2) Organizational measures: The operator personally serves as the person responsible for handling information, and records of handling on the server are kept.

(3) Human measures: No one other than the operator is allowed to handle information. However, this excludes the counselor where the user has consented to the sharing under Article 5, item (5).

(4) Physical measures: For the devices the operator uses, screens are locked and storage is encrypted.

(5) Technical measures: Communications are encrypted, connections to the server are limited to the extent necessary, and authentication information is stored separately from the main content.

(6) Understanding the external environment: The operator’s server runs on infrastructure provided by a US company, and its record storage region is set to the Asia-Pacific region. However, that company has stated that this setting does not guarantee processing in the preferred region, and it cannot be ruled out that records are located in other regions. The countries where the recipients under Article 5 are located, and their systems, are as set out in Article 6, and the operator has taken the measures in the preceding items with an understanding of this.

If the operator becomes aware that a leak, loss, or damage of users’ information or any other such incident has occurred, or that there is a risk of one, the operator will act to prevent further harm and investigate the cause, and will make the necessary reports and notify the individuals concerned in accordance with laws and regulations.

Article 11 (Use by Minors)

The App is intended for people aged 16 and over. Anyone under 16 is asked to use the App only after obtaining the consent of a person with parental authority or another legal representative. If the operator learns that the App is being used without the consent of a legal representative, the operator may delete the records relating to that user on the operator’s server.

Article 12 (For Users Outside Japan)

For users of the App outside Japan, the following applies in addition to the preceding Articles. Where the laws of the country or region in which a user lives provide greater protection than the preceding Articles, those laws apply.

(1) General: The operator is located in Japan and handles users’ information in accordance with Japanese law and this Policy. Requests under Article 9 (export, deletion, disclosure, correction, suspension of use, and withdrawal of consent) are accepted at the contact point in item (7) of that Article regardless of the country or region in which a user lives, and, after confirming the requester’s identity, the operator will normally respond within 30 days. Users who disagree with the response may ask the same contact point to reconsider it. The operator will report the result of the reconsideration within 45 days of the request. Regardless of the country or region in which a user lives, the provision to recipients in the United States under Article 6 takes place after the matters in that Article have been shown on the App’s screens and consent has been confirmed.

(2) Age: Notwithstanding Article 11, people under 13 who live outside Japan (under 16 for people living in the European Economic Area) may not use the App. If the operator learns that it has obtained information from such a person, the operator will delete that information on the operator’s server.

(3) Users in the United States: Health-related information handled in the App may be consumer health data under Washington’s My Health My Data Act and other state laws. The operator collects consumer health data only within the scope of the transmissions under Article 5 to which consent has been confirmed on the App’s screens, and uses it only for the purposes set out in that Article. The operator never sells consumer health data, and never shares it with third parties other than the recipients under that Article that process it on the operator’s behalf. Details of the handling, and how to request confirmation, a copy, deletion, or withdrawal of consent, are set out in the separate Consumer Health Data Privacy Policy.

(4) Users in Canada, Australia, and New Zealand: The provision to recipients in the United States under Article 6 takes place after the matters in that Article have been shown on the App’s screens and consent has been confirmed. For users in Australia, the operator does not ensure by contract that the recipients handle information in a manner equivalent to the Australian Privacy Principles (it is limited to the confirmation under item (3) of that Article). As a result, for information sent with consent, the operator may not be accountable under those Principles for how the recipients handle it. Users who are not satisfied with a response may complain to the Office of the Privacy Commissioner of Canada in Canada, the Office of the Australian Information Commissioner (OAIC) in Australia, or the Office of the Privacy Commissioner in New Zealand.

(5) Users in the European Economic Area and the United Kingdom: The operator is the controller under the EU General Data Protection Regulation (GDPR) and the UK General Data Protection Regulation (UK GDPR). Health-related information is handled on the basis of explicit consent confirmed on the App’s screens, and other information to the extent necessary to provide the App and respond to users’ requests. The provision to recipients in the United States under Article 6 takes place after the matters in that Article have been shown on the App’s screens and explicit consent has been confirmed. In addition to the requests under Article 9, users may object to processing, and these requests are accepted at the contact point in item (7) of that Article. Users who are not satisfied with a response may complain to the data protection supervisory authority in their country (in the United Kingdom, the Information Commissioner’s Office (ICO)).

Article 13 (Revisions)

When this Policy is revised, the revised content and the date of revision will be shown on this screen.

[email protected]