Privacy policy

1. Introduction

This policy clearly explains, with no fine print, what data Semly collects, where it is stored, who it is shared with (the short answer: no one), and what control you have over it. By using Semly, you accept this policy. If you disagree with any part of it, you should not use the app.

2. Data controller

The controller responsible for your data is Mariano Hidalgo, Semly's independent developer. For any question related to your data or this policy, you can write to support@semly.es or visit semly.es. Since there are no servers or user accounts of any kind, in practice you hold direct, exclusive control over your data: you don't need to go through the developer to access, correct, or delete it.

3. What data Semly collects

Only the data you voluntarily enter while using the app is stored:

• Profile: name, date of birth, height, starting weight, preferred units.
• Weight and body composition: daily weight, measurements, body fat, muscle mass, water percentage.
• Treatment: type of GLP-1 medication, dose, injection schedule, injection site, pen inventory.
• Side effects: type, intensity, and notes tied to a day or a specific injection.
• Daily wellbeing: mood, hunger and energy level, free-text notes, day tags (vacation, illness, travel, special meal).
• Progress photos you choose to attach to an entry.
• Optional vital signs: blood pressure, glucose, heart rate.
• Goals and achievements derived from the data above.
• A technical error log for the app itself (date, failure type, message), meant only to help you diagnose a problem if you choose to share it with support.

Semly does not ask you to create an account, does not collect your location, does not access your contacts or advertising identifier, and does not include any third-party analytics or advertising SDK.

4. Special category of data: health information

Much of this data (weight, body composition, medication, side effects, vital signs) qualifies as health data, a category specially protected by regulations such as the General Data Protection Regulation (GDPR). We treat it with that level of sensitivity: it's stored only on your device, never sent to any server of ours (none exists), and never shared with third parties, advertisers, or insurers. The legal basis for this processing is your explicit consent, given when you enter this data, under Articles 6.1.a) and 9.2.a) of the GDPR; its sole purpose is to provide the personal tracking this app describes.

The predictions and projections Semly calculates (for example, the estimated date to reach your goal) are a simple statistical calculation based on the data you enter yourself. They do not constitute an automated decision with legal or similarly significant effects on you (Article 22 GDPR), nor medical advice.

5. Where your data is stored

All your data is stored locally on your iPhone or iPad, in the app's private container (SwiftData), protected by the operating system itself and accessible only to Semly. Progress photos are stored as separate files in the app's private storage, never inside exported backups. The technical error log is stored as a local text file, also within the app's private container.

Semly does not operate any server of its own. There is no "Semly cloud": if your data ever leaves your device, it is always because you explicitly chose to (for example, by exporting a file or enabling iCloud, see below).

6. iCloud sync

Semly syncs your data across your own devices via iCloud (CloudKit), using your private Apple account and Apple-managed encryption. This sync turns on automatically if you have iCloud Drive enabled for Semly in your device's Settings (system Settings → your name → iCloud); Semly has no separate switch of its own for this, so control is exercised from system Settings, just like with any other iCloud-compatible app.

Your synced data never passes through any Semly server: it travels directly between your devices and Apple's servers. If you turn off iCloud Drive for Semly, or sign out of iCloud, your data stops syncing but remains intact on each device separately.

The Apple servers that support this sync may be located outside your country or the European Economic Area. Apple safeguards these international transfers through the guarantees required by the GDPR, such as the European Commission's standard contractual clauses or other recognized mechanisms. You can check Apple's privacy policy for more information on how it handles your data in iCloud.

7. Health integration (HealthKit)

If you explicitly authorize it through the operating system's permission, Semly can read your weight and body fat percentage from Apple's Health app, and can write to Health the weights you log manually. This sync happens only on your device, through HealthKit; no Health data ever passes through any Semly infrastructure. You can grant, restrict, or revoke this access at any time from system Settings → Privacy & Security → Health → Semly, or from Settings → Health within the app itself.

8. Who we share your data with

With no one, unless you actively choose to share it. Semly does not sell, rent, assign, or transfer your data to third parties, does not show ads, and does not include third-party trackers.

The only way your data leaves the app is when you explicitly decide to: when exporting a file (CSV, Excel, JSON, or PDF) or sharing the diagnostics log, the app uses the standard iOS share sheet so you choose the destination yourself (for example, Mail, Messages, Files, or AirDrop). At that point, the destination and subsequent use of that file are outside Semly's control and become subject to the privacy policy of whichever service you choose.

9. Security of your data

You can protect access to Semly with Face ID, Touch ID, or your own app passcode of 4 or more digits. That passcode is never stored as text: only its cryptographic fingerprint (SHA-256 hash) is stored in the system Keychain, the same secure mechanism iOS uses for passwords and credentials. The app can automatically lock again when it goes to the background, and privacy mode lets you blur your weight on the home screen until you decide to reveal it.

No security measure is foolproof. The ultimate protection of your data also depends on keeping your device up to date and protected with its own passcode.

10. Data retention

Your data is kept on the device for as long as you keep the app installed and do not delete it yourself. You can delete individual entries at any time from within the app. Restoring a backup completely and irreversibly replaces existing data. Uninstalling the app permanently removes all data stored in its private container, including progress photos and the diagnostics log.

11. Your rights

Since the data lives only on your device and there is no account or central server, you exercise your rights of access, rectification, portability, and erasure directly, with no intermediaries:

• Access and rectification: view and edit any entry from within the app.
• Portability: export your data at any time to CSV, Excel, JSON, or PDF from Settings → Data.
• Erasure: delete specific entries, restore a backup to replace your entire history, or uninstall the app to permanently remove everything stored.
• Objection and restriction: since processing is based on your explicit consent, you exercise these rights by no longer entering new data or by deleting data you no longer want processed.

If you have any questions about how to exercise these rights, write to us at support@semly.es. In addition, if you believe the processing of your data does not comply with the regulations, you have the right to lodge a complaint with the Spanish Data Protection Agency (aepd.es) or with the data protection authority of your country of residence in the European Union.

12. Minors

Semly is not directed at children and does not knowingly collect data from minors without the supervision of a responsible adult. Tracking treatment with GLP-1 medication must always be supervised by a healthcare professional, regardless of the user's age.

13. Regulatory framework

This policy has been drafted taking into account the principles of the European Union's General Data Protection Regulation (GDPR) and Spanish data protection law (LOPDGDD), given the especially sensitive nature of the health data processed. Given the volume and nature of this processing — limited to your own device, with no centralized processing by the developer — appointing a Data Protection Officer is not required under Article 37 GDPR.

Semly is not a medical device or a healthcare service under Regulation (EU) 2017/745 on medical devices: it's limited to recording and displaying information you enter yourself, without performing any calculation for the purpose of diagnosis, prevention, monitoring, prediction, prognosis, treatment, or alleviation of a disease. The developer also doesn't act as a healthcare provider, insurer, or healthcare clearinghouse; for that reason, frameworks such as U.S. HIPAA, designed for that type of entity, don't apply to this app. If you live outside the European Union, additional or different rights recognized by your country's or state's legislation may apply (for example, the CCPA in California); since Semly doesn't sell or share data with third parties, the practical impact of those rules is limited, but you can contact us with any specific questions about your jurisdiction.

14. Changes to this policy

If this policy changes significantly, we will indicate this within the app itself before the change takes effect, and we will update the "last updated" date shown at the top of this document. We recommend reviewing it from time to time.

15. Governing Law and Jurisdiction

This policy and your use of Semly are governed by Spanish law. If you live in another European Union country, this clause doesn't deprive you of the protection granted by the mandatory consumer-protection provisions of your country of habitual residence, under Article 6 of Regulation (EC) No 593/2008 (Rome I). For any dispute that can't be resolved amicably, and to the extent you have the legal status of a consumer, the courts of your domicile will have jurisdiction, without prejudice to any other venue the law grants you.