1. Information We Collect
Account Information
When you create an account, we collect your email address and password (stored in hashed form). You may also choose to provide your name, birthday, weight, height, and fitness goals.
Health & Nutrition Data
The App collects information you voluntarily enter, including dietary logs, nutritional intake, weight entries, calorie and macronutrient goals, and fitness-related preferences.
Usage Data
We automatically collect certain technical information such as device type, operating system version, app version, and general usage patterns to improve the App experience.
2. How We Use Your Information
We use the information we collect to:
- Provide, operate, and maintain the App's core functionality
- Personalize your nutrition and fitness recommendations
- Process your data through AI-powered features to deliver meal analysis, nutrition estimates, workout feedback, and other insights
- Improve, update, and expand the App
- Communicate with you regarding your account or updates to the App
- Detect and prevent fraud or technical issues
3. Third-Party Services
Mosaic uses the following third-party services that may receive your data:
AI Service Providers (OpenAI & Anthropic)
Certain features of the App use third-party AI providers — currently OpenAI and Anthropic — to generate AI-powered nutrition insights, meal analysis, workout feedback, recommendations, and chat responses. When you use these features, relevant data (such as your dietary entries, food photos, workout entries, journal notes, profile context, questions, or summarized wearable and Health Connect metrics requested by Coach) may be sent to these providers for processing. Their use of this data is governed by their respective privacy policies. We use API configurations that opt out of training on your data, and these providers do not use commercial API data to train their models. Some features (such as on-device semantic search of your notes) run locally and do not send your data to any third party. AI-generated outputs can be incorrect or incomplete, so review important information before relying on it.
Backend Server
Your account and app data are transmitted to and stored on our secure backend servers. We use industry-standard security measures, including encryption in transit (TLS) and at rest, to protect your information.
4. Wearable, Health Connect & Biometric Data
If you choose to connect WHOOP, Apple Health, or Health Connect, the App collects data from that source only after you explicitly opt in and complete the provider or system permission flow. You can deny individual Health Connect permissions and use the rest of the App, although features that need denied data will be unavailable.
Health Connect Data We Read and Why
On Android, Mosaic requests read-only access to the following Health Connect record types:
- Sleep Sessions (SleepSession): session start and end times and sleep-stage durations are used to show sleep duration, time in bed, light, deep, REM, and awake stages, sleep trends, and Mosaic sleep and recovery context.
- Heart Rate (HeartRate): heart-rate samples are reduced on the device to heart-rate-zone durations and exercise-session average and maximum heart rate. These derived values support visible workout details and the Mosaic Strain score; Mosaic does not upload the raw heart-rate sample stream.
- Heart Rate Variability (HeartRateVariabilityRmssd): daily average HRV is used in the Heart view, HRV trends, and the personalized Recovery score.
- Resting Heart Rate (RestingHeartRate): daily average resting heart rate is used in the Heart view, resting-heart-rate trends, and the personalized Recovery score.
- Steps (Steps): daily step totals are used for the Activity view, step trends, fitness progress, and activity context.
- Total Calories Burned (TotalCaloriesBurned): daily total energy burned is used for the visible calories-burned and activity views.
- Exercise Sessions (ExerciseSession): exercise type, start and end time, duration, and derived heart-rate details are used for visible activity counts, workout history, activity context, and strain.
- VO2 Max (Vo2Max): the available daily VO2 max value is shown in the Performance and oxygen view.
- Oxygen Saturation (OxygenSaturation): daily average SpO2 is shown in the Performance and oxygen view and, after a personal baseline is available, contributes to recovery context.
- Respiratory Rate (RespiratoryRate): daily average respiratory rate is shown in the Performance and oxygen view and, after a personal baseline is available, contributes to recovery context.
- Weight (Weight): the latest available weight measurement in the sync window is shown in the Body and metabolic view and in body-measurement details.
Health Connect Sync, Upload, and Storage
Health Connect records are read on your device when you connect Health Connect, request a manual sync, or return to and use the App. The first foreground sync reads a bounded window of up to the previous 30 days; later foreground syncs re-read a shorter recent window so corrections and new records can be reflected. Mosaic does not request Health Connect's background-reading or extended-history permissions.
On the device, Mosaic converts permitted records into daily summaries, sleep sessions, exercise sessions, derived heart-rate zones, and selected body measurements. These values are encrypted in transit and uploaded to Mosaic's backend. Mosaic stores the uploaded values, normalized wearable records, and derived daily scores with your Mosaic account so it can show synchronized history, dashboard metrics, trends, and personalized sleep, recovery, strain, and health scores across sessions. Mosaic never receives or stores your Health Connect account credentials.
Other Direct Device Connections
WHOOP connections use WHOOP OAuth, while Apple Health is read on your device after its native permission prompt. Mosaic never receives or stores your Apple Health credentials.
Purpose limitation and sharing. Wearable and biometric data is used to provide the user-facing features described above and to operate, secure, and improve those features. If you ask Coach a question that calls for wearable context, relevant summarized metrics may be processed by the AI service providers described in Section 3 to answer that request. We do not sell wearable or Health Connect data, provide it to data brokers, use it for advertising, or share it with third parties for their own independent purposes.
Retention & deletion. Disconnecting Health Connect or revoking its permissions stops future Health Connect collection, but it does not erase Health Connect data already uploaded to Mosaic because that history remains available in your account. Deleting your Mosaic account deletes the associated Health Connect connection record, uploaded payloads, normalized sleep, exercise, body, and daily records, and derived wearable summaries. The general retention terms in Section 6 apply.
5. Data Sharing & Disclosure
We do not sell, rent, or trade your personal information to third parties. We may share your information only in the following circumstances:
- With service providers who assist in operating the App (as described above), under contractual obligations to protect your data
- If required by law, regulation, or legal process
- To protect the rights, property, or safety of Mosaic, our users, or the public
- In connection with a merger, acquisition, or sale of assets (you will be notified of any such change)
6. Data Retention
We retain your personal information, including uploaded Health Connect data and derived wearable records, while your account is active or as needed to provide the App's services. Disconnecting a wearable preserves existing history but stops new collection from that source. If you delete your account, we will delete or anonymize personal data associated with the account within 30 days, except where retention is required by law.
7. Your Rights
Depending on your jurisdiction, you may have the right to:
- Access, correct, or delete your personal data
- Withdraw consent for data processing
- Request a portable copy of your data
- Opt out of certain data uses
To exercise any of these rights, contact us using the information below.
8. Children's Privacy
The App is not directed to individuals under the age of 13 (or the applicable age of consent in your jurisdiction). We do not knowingly collect personal information from children. If we become aware that we have collected data from a child without parental consent, we will take steps to delete that information promptly.
9. Security
We implement reasonable administrative, technical, and physical safeguards to protect your information. However, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.
10. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will revise the "Effective Date" at the top of this page and, where appropriate, notify you within the App. Your continued use of the App after changes are posted constitutes your acceptance of the updated policy.
11. Contact Us
If you have questions or concerns about this Privacy Policy or your data, please contact us at:
[email protected]