NEMEO Privacy Policy

On this website, we use Google Analytics 4 only after you accept analytics. Google processes page visits, referral and campaign information, app-store clicks, cookie identifiers, and browser and device information to help us understand where visitors come from and which pages lead to app-store visits. Google receives network information, including your IP address, when your browser connects to its service. Analytics cookies are configured to expire after six months; your choice is also saved for six months. Advertising storage, advertising personalization and Google signals are disabled. Our custom events exclude contact form contents, exercise search text and URL fragments. Campaign links must not contain personal information. You can reject analytics or withdraw consent using Analytics preferences on any page; withdrawing stops collection and removes this site's Google Analytics cookies. Google may process information outside your country. See Google's privacy policy for its data handling.

Google — Privacy policy

This Privacy Policy explains how Nemeo, located at Chemin de pierrefleur 88, 1004 Lausanne, Switzerland ("NEMEO," "we," "us," or "our"), handles personal information when you use the NEMEO mobile application and its related server services.

NEMEO provides fitness planning, guided workouts, progress analytics, body tracking, optional body scans, and an AI-assisted coaching conversation. It is a fitness product, not a medical service. Body analyses and recommendations are estimates and are not medical diagnoses or medical advice.

We collect information you provide, information created through your use of the app, and limited technical information needed to operate and secure the service.

Information collected automatically

Our servers and network proxy receive technical request information such as your IP address and request metadata when the app connects to the service. We use this information for delivery, abuse prevention, rate limiting, diagnostics, and security. The app does not currently include a third-party mobile analytics or crash-reporting SDK.

Information we do not intentionally collect

NEMEO does not request precise or approximate device location, contacts, Bluetooth data, advertising identifiers, or data from Apple HealthKit or Google Health Connect. The app does not provide an advertising network with your information and does not use your information to track you across other companies’ apps or websites.

You can manage permissions through your device settings. Declining an optional permission limits only the related feature.

• Camera: to capture optional progress photos and body-scan photos, scan a QR code, or take a photo for a workout story.
• Photos and file access: to select progress or body-scan photos, choose workout-story media, and import a training-program image or PDF. Older Android versions may describe this as storage access.
• Notifications: to show local workout and rest-timer alerts. Android may also allow exact alarms and rescheduling after device restart so a requested timer can function reliably.
• Biometric capability: the operating system may use biometric or device authentication to protect credentials stored in its secure storage. NEMEO does not receive or store your fingerprint or face template.

NEMEO does not intentionally use the microphone or record audio. Camera capture for body scans is configured without audio.

We use personal information to:

• create, authenticate, maintain, and support your account;
• build and manage personalized training programs;
• guide live workouts, preserve unfinished workout progress, and record completed sessions;
• provide progress analytics, goals, body measurements, progress photos, and optional body-scan results;
• provide coach conversations, exercise search, program import and generation, goal-date estimates, and other AI-assisted features;
• send one-time sign-in codes and user-requested local notifications;
• respond to feedback and support requests;
• protect the service, prevent abuse, enforce rate limits, investigate errors, and maintain reliability; and
• comply with applicable law and establish, exercise, or defend legal claims.

We do not use your body photos, health-related information, or workout history for advertising.

If the GDPR, UK GDPR, Swiss data-protection law, or a similar law applies, our legal basis depends on the context:

• Contract: processing needed to create your account and provide the features you request.
• Consent: optional device permissions and optional features involving photos or AI processing, where consent is required. You may withdraw consent through device settings or by no longer using the optional feature, without affecting earlier lawful processing.
• Legitimate interests: securing, troubleshooting, improving, and operating the service, provided those interests are not overridden by your rights.
• Legal obligation: processing needed to comply with applicable law or valid legal process.

Where law requires explicit consent to process sensitive or health-related information, we will request it before that processing. If the required consent is not requested in your version of the app, do not submit that information and contact us.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We disclose information only as described below, as directed by you, or when legally required.

Service providers are expected to process information on our instructions and for the services they provide, subject to their contracts and applicable law. Their exact contractual roles and processing locations should be confirmed in our vendor agreements.

NEMEO uses our AI service provider for optional AI-assisted features. Depending on the feature you choose, the information sent can include:

• coach messages and recent conversation history, first name, age, sex or gender, height, recent body measurements, goals, training program, workout history, and active-workout context;
• front, side, and back body photos, height, weight, waist, lean mass, and body-fat information for body-scan processing;
• training preferences, schedule, equipment, experience, injuries, body-part priorities, free-text instructions, and imported images or PDFs for program generation;
• body records and workout frequency for goal-date estimates; and
• exercise search prompts and catalog information.

AI output can be inaccurate or incomplete. Do not rely on it as medical advice, and do not include information about another person or information that is unnecessary for your request.

For certain AI requests—including body scans, coach interactions, and exercise search—the server asks our AI service provider not to store the response for later retrieval. This setting does not by itself describe every form of provider-side logging or retention, and older or other AI workflows may be handled differently. The provider’s handling is also governed by our applicable service terms and data-processing arrangements with it.

The current NEMEO mobile app does not integrate a third-party analytics SDK, advertising SDK, attribution SDK, or mobile crash-reporting service. We do not use advertising identifiers and do not track users across apps or websites owned by other companies for advertising.

We do use server and network logs for security, diagnostics, and service operation. These logs can contain IP addresses, timestamps, requested endpoints, status codes, errors, and internal identifiers. This operational logging is different from behavioral advertising analytics.

NEMEO currently schedules workout and rest-timer notifications locally on your device. The reviewed implementation does not register the app with a remote marketing push-notification provider. You can disable notifications in device settings.

The app stores authentication tokens and cached account/settings information using operating-system secure storage. It also stores an unfinished workout draft in the app’s local support storage so your workout can be resumed, and can create temporary workout-story images before you share them. Local notification schedules and tutorial or preference flags may also be stored on your device.

The mobile app does not use browser cookies. Authentication tokens, local preferences, and similar device storage perform functions comparable to cookies within the app. Deleting the app normally removes app-local data, subject to device backup and operating-system behavior, but does not delete information held on our servers.

NEMEO offers auto-renewable monthly and annual subscriptions, which may include a free trial for eligible accounts. Purchases are processed by Apple (App Store) or Google (Google Play) under their own terms and privacy policies. NEMEO does not receive or store your payment-card information.

We use RevenueCat to validate purchases and manage subscription status. For this purpose, Apple or Google, RevenueCat and NEMEO process your internal NEMEO account identifier (used as the RevenueCat app user ID; we do not use your email address for this purpose), product, offer, store and transaction identifiers, purchase, trial, renewal, cancellation, grace-period, refund and expiration status and dates, the store country, currency and price, and subscription-management links. We use this information to unlock paid features, restore purchases, prevent fraud and abuse, provide support and comply with our legal obligations. This processing is necessary to perform our contract with you.

Subscription records are kept while your account is active and afterwards only as long as necessary for accounting, tax, fraud-prevention, dispute-resolution or other legal purposes. Deleting your NEMEO account does not cancel a store subscription; manage it in your App Store or Google Play account. Subscription conditions are set out in the Terms of Use and Subscription Terms.

We retain your account, profile, training programs, workout history, body measurements, progress photos, coach conversations, and derived body-scan results for as long as your account remains active. These records support the longitudinal training, personalization, analytics, and progress features you request. We periodically review retained information and may delete or de-identify records that are no longer necessary for those purposes.

When your account is deleted, we delete or de-identify the personal information associated with it from active systems, except where limited retention is required or permitted for security, fraud prevention, legal compliance, dispute resolution, or the establishment, exercise, or defense of legal claims. Information retained for one of these exceptions is restricted to that purpose and kept only for as long as the exception requires.

Raw body-scan photos are held in temporary server storage during processing and are deleted after the job completes or reaches a final failure state. Derived scan results remain associated with your account. Temporary program-generation job records are configured to be removed shortly after reaching a terminal state—currently after approximately ten minutes—although the resulting training program remains in your account. Imported content is also sent to the AI provider for processing.

Network and application logs and protected backup copies are retained for up to 90 days, unless a longer period is required for an active security investigation, legal obligation, or legal claim. Access is restricted, and records are deleted or overwritten when the retention period expires. Information remaining in backups after an account-deletion request is not restored to active use and is deleted as the backups expire.

We use reasonable technical and organizational measures intended to protect personal information. The reviewed implementation uses encrypted network connections for the production API, authenticated access controls, short-lived access tokens with refresh tokens, operating-system secure storage for credentials, production signing and encryption certificates, request rate limiting, and restricted administrative access. One-time codes are stored by the server in hashed form.

No security method is perfect, and we cannot guarantee absolute security. Protect access to your device and email account, and contact us if you believe your NEMEO account has been compromised.

NEMEO and its service providers may process information in countries other than the country where you live. Those countries may have different data-protection laws. Our primary application servers and databases are located in Switzerland. Some service providers may process personal information in the European Economic Area, the United States, or other countries where they operate. Where information is transferred to a country that is not recognized as providing adequate protection, we rely on recognized contractual safeguards, such as the European Commission’s Standard Contractual Clauses with the adaptations required under Swiss law, together with appropriate technical and organizational measures.

Depending on where you live, you may have rights to access, receive a copy of, correct, delete, restrict, or object to processing of your personal information; withdraw consent; or request portability. You may also have the right to appeal a decision and to complain to your local data-protection authority.

Residents of certain U.S. states may have rights to know, correct, delete, and obtain a portable copy of personal information, and to opt out of sale, sharing for cross-context behavioral advertising, or certain uses of sensitive information. NEMEO does not sell personal information or share it for cross-context behavioral advertising. We will not discriminate against you for exercising an applicable privacy right.

You can edit certain profile and goal information in the app, control device permissions in system settings, delete individual coach conversations, delete your account through the profile screen, and choose whether to send feedback or share media. To exercise another right, contact info@nemeo.ai. We may need to verify your identity and may deny or limit a request where permitted by law.

You can delete your account from the profile screen by selecting Delete my account and confirming the request. You may also request deletion by emailing info@nemeo.ai or visiting https://nemeo.ai/contact. For an external request, include the email address associated with your account. Do not send authentication codes, passwords, body photos, or identity documents unless we specifically request information through an appropriate verification process.

Account deletion removes the account and associated personal information from active systems, including stored progress photos and pending body-scan files, unless retention is required or permitted for legal obligations, fraud prevention, security, dispute resolution, or the establishment or defense of legal claims. Service-provider copies and backups may take additional time to expire. Deleting a coach conversation removes that conversation but does not delete the whole account. Deleting the mobile app from your device also does not delete your server account.

NEMEO is intended for adults aged 18 and older, and registration in the reviewed app requires a birth date indicating that the user is over 18. We do not knowingly collect personal information from children. If you believe a child has provided information to us, contact info@nemeo.ai so we can investigate and take appropriate action.

The app may open services controlled by others, such as Google or Apple sign-in, your email application, a system share sheet, an app store, or an external link. Their privacy practices are governed by their own notices. Review them before providing information.

We may update this policy as the product, providers, or legal requirements change. We will post the revised policy with a new “Last updated” date and provide additional notice where required. Material changes apply prospectively unless law permits otherwise.

For privacy questions, requests, or complaints, contact: