Coming soon on the App Store

Rootwell App Privacy Policy

Effective date: October 14, 2026

1. Introduction

Rootwell is operated by Biokainos Corp. ("Rootwell," "we," "our," or "us"). This Privacy Policy explains how we use, disclose, and protect your personal information when you use the Rootwell App mobile application (“App”). By using the App, you agree to the practices described in this policy.

2. Information We Collect

  • Full name and email address when creating an account

  • Password (stored encrypted, never in plain text)

  • Profile data: age, sex, weight, height, activity level, dietary goals, and biometrics provided during onboarding

  • Food photos you take or upload for nutritional analysis

  • Meal logs and food diary entries

    2.2 Information collected automatically

    • App usage data and feature interactions (to improve the service)

    • Device type and operating system version (for debugging and compatibility)

    • Crash reports and error logs

    2.3 Information from third-party sign-in

    If you use Sign in with Apple or Sign in with Google, we receive your name and email address from those providers, subject to their privacy policies.



2 Information used by Rootwell

Food and scan information. This includes meal photos, food descriptions, barcode information, product labels, restaurant menus, and other text or images you submit through the supported features. Images may contain additional information visible in the photo. Please avoid including faces, documents, or unrelated sensitive information.

Nutrition information and preferences. Rootwell processes the nutrition estimates, food scores, plant variety records, goals, and dietary preferences associated with the features you use. Information about eating habits or restrictions may reveal health information when associated with you.

Support information. If you contact us, we receive the contact details and information you choose to include in your message. Please do not send your complete food history or other sensitive information unless needed for your request.

3 Where information comes from

Information comes from what you enter or select in the app, your device when you use scanning features, the results returned by our AI analysis provider, and your communications with us. Camera or photo access is controlled through your device permissions.

4 How scanning and AI processing work

Rootwell uses OpenAI API services to help interpret submitted images or text and produce food and nutrition insights. These services are separate from using the ChatGPT consumer app. For an AI request, Rootwell sends the selected scan content and the accompanying information required for that analysis to the API. The result is returned to the app.

[CONFIRM API DATA FLOW: Identify the exact images, text, dietary preferences, identifiers, and previous meal context transmitted; whether requests pass through a Rootwell server or intermediary; and any separate scanner, barcode, food database, hosting, or logging provider. Identify whether each provider receives scan content or only product lookup information.]

OpenAI states that API inputs and outputs are not used to train its models by default unless the API customer opts in. Retention depends on the API endpoint, settings, and applicable exceptions. OpenAI may retain abuse monitoring logs, generally for up to 30 days, and some features store application data for longer. This is not a promise of immediate deletion or zero retention. Provider documentation: https://developers.openai.com/api/docs/guides/your-data

[CONFIRM OPENAI SETTINGS: Record the endpoint and model used, storage settings, any uploaded files or persistent conversations, retention controls, and whether data sharing for training is disabled. Replace this note with the verified Rootwell-specific retention description.]

5 Why we use information

We use submitted information to identify foods, retrieve or estimate nutrition information, assess food choices, and provide the tracking and personalized insights you request. We also use necessary information to answer support requests, troubleshoot failures, protect the service against misuse, and fulfill applicable legal obligations.

Where consent is legally required, we obtain it before the relevant processing. This policy is a disclosure of our practices and is not, by itself, a request for consent to unrelated uses of health information.

6 Disclosures to others

AI processing providers receive the content needed to perform the analysis you request. Other technical providers receive information only as described in the completed provider disclosures above. Where providers act on our behalf, their processing must be governed by appropriate contractual restrictions.

We may disclose information in response to a binding legal obligation, or in a lawful business transfer, subject to applicable restrictions on consumer health data. These provisions do not authorize unrestricted disclosure of health information.

[CONFIRM COMMERCIAL PRACTICES: State whether Rootwell sells personal or health information, shares it for targeted advertising, or uses it for research or model training. If none occur, use: "We do not sell your personal information or use or disclose your consumer health data for targeted advertising or model training." Verify SDKs and provider settings before adopting this statement.]

7 Storage retention and deletion

Locally stored records remain on your device until removed through the available app or device controls. Device backups may retain copies according to your backup settings. Removing local records does not automatically remove information previously transmitted to an API or retained in provider logs.

We retain information under our control only for as long as needed for the disclosed purpose or a specific legal obligation. You can contact us to request deletion of information we or our processors hold about you. We will handle the request under applicable law, including notifying relevant recipients where required.

[COMPLETE RETENTION DETAILS: Specify the working method for deleting local records, whether iCloud or other backups include app data, and the retention and deletion periods for API content, intermediary logs, support messages, and any purchase or account records. Do not state that uninstalling deletes every copy unless verified.]

8 Your choices and privacy rights

You can choose what to submit for analysis and change camera and photo permissions in your device settings. Not submitting content for external analysis may prevent the corresponding scanning feature from working. Contact us for help with access, correction, deletion, consent withdrawal, or other privacy requests.

Your legal rights depend on your location and the laws that apply. We may request information reasonably needed to verify a request. We will not unlawfully discriminate against you for exercising your rights. Washington consumers should also read the separate Washington Consumer Health Data Privacy Policy at [INSERT SEPARATE POLICY URL].

9 Security and processing locations

We use safeguards appropriate to the personal information we handle. No storage or transmission method can guarantee absolute security. Protect your device and review your backup settings. External API processing may take place outside your state or country.

[CONFIRM: Describe verified transport security, access controls, processing locations, and any legally required international transfer safeguards. If offering Rootwell in the EEA, UK, or Switzerland, obtain review of lawful bases, sensitive-data consent, transfer arrangements, and any required representative before adding region-specific statements.]

10 Children

[SET AND VERIFY MINIMUM AGE: Insert the supported minimum age and any parental consent process. Ensure the policy matches onboarding, marketing, and the actual audience. Do not copy another app’s age limit without confirming Rootwell’s approach.]

11 Policy changes

We will update this policy when our practices change and revise the effective date. Where required, we will provide additional notice and obtain consent before introducing new processing. Continuing to use the app does not replace any consent required by law.

12 Contact us

Privacy contact: [INSERT MONITORED PRIVACY EMAIL]
Legal operator: [CONFIRM LEGAL ENTITY]
Mailing address: [INSERT BUSINESS MAILING ADDRESS]

Rootwell Washington Consumer Health Data Privacy Policy

Effective date: [INSERT PUBLICATION DATE]

This policy supplements the Rootwell Privacy Policy and describes how [CONFIRM LEGAL OPERATOR] handles consumer health data under the Washington My Health My Data Act. It applies to Washington residents and other individuals whose consumer health data is collected in Washington, acting in an individual or household capacity.

1 Categories of consumer health data and purposes

Depending on the features you use, we process the following information when it is linked or reasonably linkable to you and identifies your past, present, or future physical or mental health status:

Dietary information: meal photos and descriptions, food intake records, dietary restrictions and preferences, and submitted labels or menus where they reveal health-related choices. We use this information to perform the requested scan or nutrition analysis.

Nutrition and wellness records: nutrition estimates, food scores, goals, and food or plant variety tracking records. We use these to provide your requested tracking and personalized nutrition features.

Derived information: health-related inferences, if any, produced from submitted information or associated nutrition patterns. These are used to provide the insights you request; not every food score or generic product lookup is consumer health data.

Support information: health information you voluntarily include in a support message, used to answer your request or resolve the reported issue.

[CONFIRM CATEGORIES: Remove categories not actually processed and identify any additional health-related profile fields, identifiers linked to health data, wearable data, or inferred health attributes. Confirm which information stays local and which is transmitted.]

2 Sources of consumer health data

We obtain this information directly from you through entries, scans, and support messages; from your device when you submit selected images or other content; and from analysis results generated by the OpenAI API. [ADD OTHER ACTUAL SOURCES, OR CONFIRM THERE ARE NONE.]

3 Categories disclosed and recipients

Submitted scan images or text and any accompanying health-related context needed for analysis are disclosed to OpenAI as an AI processing provider. Health information included in support messages is handled by [IDENTIFY SUPPORT PROVIDER OR STATE DIRECT HANDLING]. [IDENTIFY HOSTING, API RELAY, LOGGING, AND OTHER PROCESSORS THAT RECEIVE HEALTH DATA, WITH THE CATEGORIES EACH RECEIVES.]

Categories of other third-party recipients: [STATE ACTUAL CATEGORIES, OR "NONE" IF VERIFIED]. Specific affiliates receiving health data: [LIST EACH AFFILIATE BY NAME, OR "NONE" IF VERIFIED].

[CONFIRM SALE STATUS: If accurate, state "We do not sell consumer health data." Do not infer this from local storage or lack of ownership. Describe any other actual sharing and its purpose before publication.]

4 Your Washington rights

You may confirm whether we collect, share, or sell your consumer health data and access it; obtain a list of third parties and affiliates that received it with a contact method; withdraw consent to collection and sharing; and request deletion.

5 Submitting a request

Email [INSERT MONITORED PRIVACY EMAIL] with your request. We may seek reasonable verification, but will not require a new account. We respond within 45 days of receipt, with one further 45-day extension when permitted and explained. Access responses are free up to twice annually, subject to statutory exceptions.

For deletion, we remove covered records and notify relevant recipients. Deletion from backups may take up to six months after authentication. For device-only records, we provide instructions for local removal; this does not replace our duties for transmitted data.

6 Appeals

Email the same address with "Washington privacy appeal" and identify the decision. We respond in writing within 45 days. If denied, we provide a complaint route to the Washington Attorney General: https://www.atg.wa.gov/file-complaint

7 Contact

Privacy contact: [INSERT MONITORED PRIVACY EMAIL]
Legal operator: [CONFIRM LEGAL ENTITY]
Mailing address: [INSERT BUSINESS MAILING ADDRESS]