Last updated: 26.01.2026

This Privacy Policy explains how Nunanta Technologies S.r.l., with registered office at La Villa ( BZ), Via Boscdaplan 130, Italy (“Company”, “we”, “us”, or “our”), collects, uses, and protects personal data when you use the “BioSync” mobile application (the “App”).

We process personal data in accordance with Regulation (EU) 2016/679 (GDPR) and applicable Italian data protection laws.

1. Data Controller The data controller is: Nunanta Technologies S.r.l. Registered office: Via Boscdaplan 130, 39036 La Villa (BZ), Italy VAT / Company ID: 03142440217 Email: [email protected]

2. Categories of Personal Data We Process Depending on how you use the App, we may process the following categories of personal data: 2.1 Account and App Usage Data

   • App preferences and settings
   • Grocery lists and items you add
   • Technical data (app version, device type, operating system)

   2.2 Health and Fitness Data (Special Category Data) With your explicit consent, we process the following health-related data accessed via Google Health Connect:

   • Heart Rate Variability (HRV)
   • Steps / physical activity data These data qualify as special category personal data under Article 9 GDPR.

   2.3 Data Source

   Health and Fitness Data are obtained exclusively from Google Health Connect, based on the permissions you grant.

3. Purposes of Processing We process your personal data for the following purposes:

   • To provide and operate the App’s core functionality, which is to generate grocery and food-related suggestions based on lifestyle and activity patterns.

   The App does not provide medical advice, diagnosis, or treatment. Suggestions are lifestyle-oriented and informational only.

4. Legal Basis for Processing We process personal data on the following legal bases:

   • Article 6(1)(a) GDPR – Consent: for general personal data processed through the App
   • Article 9(2)(a) GDPR – Explicit consent: for the processing of health and fitness data (HRV and steps)

   You may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.

5. Profiling and Automated Processing We may use automated processing techniques to analyze health and activity data in order to personalize grocery suggestions. This processing: - Does not produce legal effects concerning you - Does not significantly affect you in a comparable way. You have the right to object to profiling and to withdraw consent at any time.

6. Data Retention We retain personal data only for as long as necessary to fulfill the purposes described in this Privacy Policy:

   • Health and fitness data: retained until you withdraw consent or disconnect Google Health Connect
   • App and usage data: retained for the duration of your use of the App and thereafter only as required by law

7. Data Sharing and Recipients We do not sell or rent your personal data. Your data may be shared only with: - Trusted service providers acting as data processors (e.g. cloud hosting providers) - Public authorities, where required by law. All processors are bound by GDPR-compliant data processing agreements. Health data obtained via Google Health Connect is never used for advertising purposes.

8. International Data Transfers Where personal data are transferred outside the European Economic Area (EEA), we ensure that appropriate safeguards are in place, such as: - Adequacy decisions by the European Commission, or - Standard Contractual Clauses (SCCs)

9. Data Security We implement appropriate technical and organisational measures to protect personal data, including: - Encryption in transit and at rest - Access controls and authentication mechanisms - Regular security assessments

10. Your Rights Under GDPR, you have the right to:

    • Access your personal data
    • Rectify inaccurate or incomplete data
    • Request erasure (“right to be forgotten”)
    • Restrict processing
    • Data portability
    • Object to processing, including profiling
    • Withdraw consent at any time
    • Lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali)

    Requests may be submitted to [email protected].

11. Children’s Data The App is not intended for children under the age of 16. We do not knowingly collect personal data from children.

12. Changes to This Privacy Policy We may update this Privacy Policy from time to time. Any changes will be communicated through the App or by other appropriate means.

13. Contact For any questions about this Privacy Policy or our data practices, please contact: Nunanta Technologies S.r.l. Email: [email protected]

This privacy policy relates solely to this App.