Oregano Prime

Privacy notice

Effective: 29 October 2026 · Version: 2026-10-29-1 · Optional push: meal-reminders-v1
The Hungarian version prevails; this translation is for information. Magyar · Hrvatski
In short: Oregano Prime is an AI-first service. It processes nutrition, activity and body weight data to give AI-based estimates, a diary, reports and review by an assigned expert. There are no advertisements, no profiling for tracking and no sale of data. The AI makes an estimate, not a medical diagnosis.

1. Controller and contact

The controller and the operator of Oregano Prime is Y Innovation Lab Kft. Registered office: 1103 Budapest, Gergely utca 112/C S2/1. EU VAT number: HU32543003. Contact person: Szabó András. Phone: +36 30 251 6551. Privacy, support and deletion requests: szundi@gmail.com.

2. Who can use the service?

The service is for adults. It is not for children. Registration is by invitation only. You can ask for an invitation at hello@oreganoprime.com. The administrator approves the exact email address in advance and gives the name of the participant and the speech recognition setting. This is not yet a user account. The approval can be used once, with a Google or Apple login that verifies the same address. For an Apple hidden address, the exact relay address is necessary. Only the login provider that is available at the time can be used; the native Android app supports Google login.

3. What data do we process?

The optional evening feedback is a versioned user text of no more than 160 characters per day. The advice function keeps the advice and the time when it was first closed. Each press of the thumb button that closes the advice is recorded separately, with a timestamp, for later analysis. Together with no more than four earlier pieces of advice, we give the advice AI the latest signal for each piece: the user liked or did not like the advice. We do not give the time of the rating or the list of button presses; the signal does not prove that the user followed the advice or that the advice had an effect. We do not ask for a commitment or a clarifying answer. These are self-reports of the participant; they are not measured nutrition data. The participant, the assigned expert and the administrator see them under the existing access rules. They are kept as participant data that is not meal data until the permanent deletion of the account. The raw evening feedback and the button presses do not go into the PDF; the text of the selected AI advice can be in the export.

The sex, body height, target body weight and text goal that you can give in onboarding are kept as versioned profile data. The current body weight that you give goes into the diary as a weight measurement for that day. We also keep the onboarding progress and the fact that a weight measurement was recorded earlier, so that we do not ask again for data that you already gave. This profile data is kept until the permanent deletion of the account. The advice AI uses the profile data at the next advice that is due.

4. Why do we process the data?

The legal basis for the account and the basic functions is the performance of the service. With one data processing checkbox, empty by default, the participant gives explicit consent to the processing of nutrition, activity, body weight, photo and voice data that this notice describes, including the external AI and speech recognition processing that the service needs. Together with the separate acceptance checkbox of the Terms of use, there are two checkboxes in total on the start screen. The legal basis for security logging is the legitimate interest of the operator. When the law makes retention mandatory, the law can also be the legal basis of the processing.

5. Who has access?

The participant sees their own data. The currently assigned expert sees the participant data that is necessary for their task. The administrator has the access that is necessary for operation and moderation; sensitive reads by the administrator are logged.

For the operation, the following categories of providers can receive data:

The native logging reminders that you can turn on separately are delivered by Google Firebase Cloud Messaging on Android and by the Apple Push Notification service on iOS. The provider receives the notification identifier of the device and the general reminder text. We do not send a meal description, a diary entry or fasting data. Our own server checks the diary and the fast. We record the opt-in with a separate version and time; the permission of the operating system is also necessary. You can turn the reminders off on the Account page. Logout and session revocation stop the delivery for that connection.

The measurement of input work is on by default, and you can turn it off on the Account page. We measure active input, correction, acceptance and day closing, and the waiting time, separately. The daily total and the fixed-text log contain only the operation type and the duration. They do not keep meal data or keystrokes. The device keeps them for 30 days. At a successful day closing, we upload them once to our own server; when you close the day again, the new data replaces the old data. The server keeps them for 25 months; the permanent deletion of the account deletes them earlier.

We do not sell personal data. We do not use nutrition data or data related to health for advertisements or to make a marketing profile.

If the advice fails repeatedly, the operator receives a summary system email through Resend. It can contain an account identifier, a run identifier, a time and an error category, but no meal text and no evening feedback. The notification and its delivery status are kept for 14 months.

Android login after a device change

The supported Android app can make a separate recovery key, so that you can log in to your Oregano Prime account automatically after a device change. The key is made only after you accept the current Terms and data processing in the app. Participants who registered earlier must also accept version 2026-10-29-1 once, with the two existing checkboxes that are empty by default. We do not extend an earlier acceptance retroactively. There is no separate key backup switch in the app.

The Google system manages the separate key, the internal Oregano Prime account identifier and the technical data that is necessary to bind the key to the app. The internal identifier is not an email address or a name. If the conditions of Google backup and end-to-end encryption, for example a screen lock, are available on the device, the key can go into an end-to-end encrypted Google cloud backup. The Google account and the backup settings of the device control the cloud backup. If the encrypted cloud backup is not available, the key is made only for direct device transfer.

We do not send diary data, meal photos, voice, pending submissions or existing session tokens into this key backup. The server keeps only the public key and the account and original session that it belongs to. The recovery makes a new session. It does not give a new data processing consent, and it does not automatically restore the health data or notification permissions. If the recovery fails, you can use the usual login method.

The revocation or expiry of the original session, and the suspension, access block or permanent deletion of the account, prevent a new login with the key. If the account is later approved again, the deleted key does not become active again. At logout and when the app detects a session revocation, the app asks Google to delete the key that Google manages. A connection error can delay this. After a server-side database restore, the key cannot be used; the usual login method is necessary again.

6. What does the AI provider receive?

The advice is made in advance, in the background, from the accepted diary data, the goal, the current expert guidance, the evening feedback, no more than four earlier pieces of advice and their latest optional like signal. A new piece of advice uses the data of the previous 14 completed Budapest calendar days; the last three days can also be identified separately. A new piece of advice can be made no earlier than 72 hours after the first successful closing of the previous advice. A closing without a rating is not a like signal or a follow-up signal. No new advice is made in place of a ready advice that is not read. After an error, we try again on the next Budapest day. The text advice task does not receive raw photos or voice. The advice model uses a separate administrator setting from the provider scope listed below.

An AI or speech recognition task that Oregano Prime starts does not give the email address of the Oregano Prime account, the Google or Apple identifier, the display name or the internal user identifier. These tasks use the server-side connection of the app. The connection that you make with your own assistant, as described below, is connected to your provider account.

This is separated processing without an account identifier, but it is not guaranteed anonymisation. Text, photos or voice that the user gives can contain a name, a face, a voice or other identifying data. Give such content only when the task needs it. The system sends only the record and the context that the task needs; it does not send the full account profile or unnecessary history.

The specific provider depends on the administrator model setting assigned to the user. Some providers can also process data outside the European Economic Area. The provider route does not give a status of medical confidentiality or of a healthcare provider.

The data processing consent also covers the external AI and speech recognition processing described here. The AI receives the data that is necessary for meal recognition, nutrient and activity estimates, reports and advice. Speech recognition makes a text transcript from a temporary microphone recording. Voice input is optional; you can also type.

The acceptance is for the following provider scope and for the purposes above:

The service can do the processing directly or through OpenRouter. OpenRouter forwards the task to the selected processor. More than one provider can take part in a task, one after another. For example, Google can process the meal photo, and then OpenAI can process the text description made from the image and the meal data. In this mode OpenAI does not receive the photo; a photo with a recognised barcode is left out of the image processing.

By default, we prohibit the use of the given data for training. An exception can be a route of any AI provider in the list above that the administrator explicitly selects with the use of data for training. Then the selected provider can also use the content given for the task and the answers to train and improve its own models. This can include meal descriptions, meal photos, activity data and report data, and also the goal and history given for the advice. Such a route has no zero data retention commitment. The system does not select such a route without an administrator setting. On the Phala route, we currently prohibit use for training, and we permit only an endpoint marked as zero data retention, without automatic redirection to another provider.

The choice between the listed providers, and the name, version and technical setting of the model, can change. This includes the administrator enabling or disabling the use of data for training. If the processing stays within the provider scope, purposes, data categories and data use conditions described here, the change does not need a new contract, a change to the Terms or to this notice, or a new acceptance. When we introduce a new provider that is not listed here, a new processing purpose or data category, or a materially different use of data, we update the notice and ask for acceptance on the shared policy screen before the processing concerned.

The text, photo and dictated meal input of the app uses AI-based structuring and estimation. The external assistant connection gives ready structured data, and that recording does not start Oregano Prime AI processing. The automatic advice of Oregano Prime operates separately, and it can also use this data for the next advice that is due.

Before each external AI request and each OpenRouter speech recognition request, the server checks the permission under the accepted policy. The client also checks this before it starts platform speech recognition. This is a background check, not a new acceptance question. The consent log records the version, time, purpose and the model setting at the time of acceptance; the version refers to the full scope listed above. The log of each model call records separately the model and route that were actually used. We do not copy sensitive prompts or voice recordings into the consent log. We do not extend the acceptance of an earlier policy retroactively: this new version must be accepted once.

Connecting your own AI assistant

Before the optional connection, you can consent to the data transfer with a separate checkbox that is empty by default. The screen names the client, shows the redirect address and the read or read and write permission. This permission is separate from the acceptance of the basic operation of Oregano Prime.

The connected provider is OpenAI (ChatGPT, OpenAI Dot), Anthropic (Claude), xAI (Grok), Cursor/Anysphere (Grok Bot) or Meta (Meta Muse). The connection operates in your own provider account. The provider can connect the data it receives to the conversation, the history and your own account; retention, memory and use for model improvement depend on the terms of the provider and your account settings. The training prohibition and the zero data retention setting of the Oregano Prime server AI routes do not apply to this connection.

The assistant can get your own kept meals and drafts, their ingredients and nutrient values, your body weight, your activity, your daily reports, your goals, your profile settings and your current dietitian texts. We do not give raw photos, voice, the email address, the login identifier or the Oregano Prime session token. Free text can contain identifying or sensitive data.

With write permission, the assistant can record a ready meal draft, a weight measurement, an activity and a daily text for today and yesterday. The daily text can be saved also before 18:00. You must accept the meal in the Oregano Prime app. A ready draft for today or yesterday that is not accepted can be corrected and deleted; an activity and a weight measurement can be deleted. An accepted meal cannot be changed or deleted from the agent. We calculate the time limits in Europe/Budapest time.

You can end the connection separately on the Account page. This stops new access immediately; it does not delete conversations or data that the provider already keeps. You can manage them in your provider account. The usual Oregano Prime retention and deletion rules apply to the data recorded in the diary.

The access token is valid for no more than 30 days, and the connection and the refresh permission for no more than 365 days from the connection. You can revoke the connection at any time. We keep the tokens as hashes. We keep the version, time, client and operation permissions of the connection permission, and the audit data without content of reads and recordings; the data of a closed connection and the audit are kept for no more than 14 months. The origin identifier of a recording is kept together with the diary version. The operation replay protection store does not restore content from deleted data.

6/B. Apple Health and Health Connect

In the native app, you can choose separately to import weight measurements, workouts, daily activity and sleep. Daily activity means step count, distance and active energy. Sleep data contains the start and end time, the available sleep stages and their duration, and the title and note given in the source. Sleep is related to eating habits and to hunger; we use the data to interpret them together. The import choices that are not yet saved are selected in advance. To import data, you must save the choices and give the read permission on the phone. The first connection and turning on a new data type import the available data of the last 30 days. One importing phone at a time belongs to an account. The phone can also import the data of the watches, scales and other apps connected to it. The data kept on the Oregano Prime server appears on all logged-in devices.

The imported data, the source app, the source identifier, the time, the unit and the change history are part of the diary. The assigned expert can see them. Reports, PDFs and AI advice can use them for the purposes described above. The import operates during use and with the background refreshes that the system permits. On the phone, protected storage that is excluded from backup keeps the pending upload and the synchronisation status. The separate background key can be used only for upload; it cannot read other diary data.

You can correct an imported entry in the source. We follow an explicit deletion in the source. A local removal in Oregano Prime does not change the Health or Health Connect data. We keep only the source identifier that prevents a new import, until the permanent deletion of the account. For a daily total, this is the platform, the day and the data type. Disconnecting stops new imports, but keeps the data imported earlier. Logout, session revocation, suspension and the choice of another importing phone also stop the upload.

The meal export can be chosen on the next, separate screen. After you explicitly turn it on, we write the name, time and known energy, protein, carbohydrate, fat, saturated fat, fibre, sugar and sodium values of the closed meals into the Apple Health or Health Connect store of the phone, with an Oregano Prime source label. The first time, we export the last 30 days; after that, we follow the new closed meals and also the correction, withdrawal and deletion of meals exported earlier. We do not export drafts, photos, body weight or activity. The accepted numerical values can also be estimates. We change only our own export records. We keep the export identifier and technical version, without meal content, until the permanent deletion of the account, for later correction and deletion.

If you refuse the export, the import still works. If the phone is offline, the app is removed or the write permission is missing, the correction and deletion of Health data are not immediate; they need the next permitted, successful synchronisation. The operating system controls the background refresh. After you turn off the export, disconnect, log out or revoke access, the earlier Health data stays, but it is not updated; you can manage it in the Health system. The current phone cannot change the data store of another platform. Apple does not tell whether an empty read result means that there is no data or that there is no permission.

We record the choice of the Health connection with a separate version and time, in addition to the basic policy acceptance. The permissions of the operating system can be changed separately. Giving the permission does not change the retention, access and AI data processing rules above.

7. Camera, photo library and microphone

The app asks for access only after a user action. The camera and the photo library are for choosing a meal photo. The microphone is for dictation. With the own speech recognition of the platform, the platform provider can process the voice under its own terms; Oregano Prime receives only the transcript.

The data processing acceptance for the basic operation is given on the shared policy screen. There is no separate acceptance window in the app before you take a photo, choose a photo or dictate. The connection permission of your own external assistant is separate. The camera, photo library, microphone and speech recognition permissions of the operating system or the browser are separate from this, and they still appear when necessary.

We upload the meal photo and the recognised barcode for the analysis; the assigned expert and the administrator can also see the photo. When a usable local barcode match is available, the catalogue data can go to the model instead of the photo; section 6 describes the image handling of processing with more than one provider. Server dictation sends the voice to the provider selected on OpenRouter. We do not keep the raw recording after a successful transcription, a cancellation, an error or a timeout. A successful server-side transcript is kept for the audit of the model run and its cost, also when the user does not send it. You can edit the transcript before you send it; only an explicit send changes the meal input.

7/A. Error diagnostics and performance measurement (Sentry)

We use Sentry to find JavaScript errors and slowdowns of the client. The system sends a technical error category, the line and column number in the source code, the time, the duration, a general screen or API route, the app version and the runtime environment. A random event and trace identifier connects one technical event or session; it is not the identifier of the Oregano Prime account.

The Sentry Session Replay function is off. The app does not make session replays, and it does not record the structure of the interface, input or click actions, scrolling or the screen size.

Sentry does not receive an email address, display name, Oregano Prime account or record identifier, meal description, photo, dictation, transcript, activity, body weight, goal, expert text, model input or model output. We also do not send the body, headers, authentication token or cookie of HTTP requests and responses. There is no automatic sending of logs or attachments. The network connection to the provider technically makes the IP address and the network data of the browser visible; this is not guaranteed anonymity. The app does not send a real user identifier or IP address in the events. It gives a fixed, not real client address, so that Sentry does not add a network IP address or location data derived from it to the event.

Data sending starts only after the current policy is accepted on the shared screen. There is no additional separate checkbox for this. The acceptance of an earlier version is not sufficient. Logout, a detected suspension, an account change or an invalid session stops new data sending. By default, we measure 100% of the technical transactions. The operator can reduce or turn off error sending and performance measurement for each environment.

The recipient is the United States region of Sentry and the processors of the provider. The operator uses the errors and performance measurements for troubleshooting; the assigned nutrition expert does not get Sentry access. The Sentry data processing terms and the international data transfer information describe the provider framework for international transfers and the available safeguards. They also cover the EU–US data privacy framework and the applicable standard contractual clauses. You can ask the controller for more information about the safeguards and the related documents.

8. Retention periods

Account preparation
Before the claim, until the claim with Google or Apple login or until deletion by the administrator. After the claim, the claim record connected to the account is kept until the deletion of the account. The deleted bytes leave the rolling backups within no more than a further 35 days.
Pending submission on the device
No more than 30×24 hours from queuing. A successful send, a manual discard, logout, the revocation of all sessions or the activation of another account deletes it earlier.
Server-side meal draft that is not accepted
30×24 hours from the last change by the participant.
Closed meal and meal photo
25 calendar months from the first closing, or from the upload of the photo.
Report PDF and share link
The PDF is kept for 14 months; the bearer share link is valid for no more than 30 days.
Security and audit log, crash log, diagnostic and other app performance data, Apple server notification event, and content report
14 months.
Temporary IP log of the resource serving of the mobile app
We keep it for the geographical analysis, and we delete it on a separate deletion decision of the operator. There is no automatic deletion deadline. Stopping the collection does not delete the earlier data. Country-level or region-level totals that cannot be connected to a person can stay after the deletion of the raw log. Only the operator can access the file.
Sentry error diagnostics and performance measurement
In the current Sentry Developer plan, errors and the performance measurements sent are kept for 30 days. Replay recordings permitted earlier expire on the same deadline; no new Replay recording is made. This is different from the 14-month audit log of Oregano Prime. A separate expiry of no more than 90 days, depending on the data type, can apply to the backups of the provider. We do not keep a map of Sentry identifiers for the account; earlier technical events are not deleted automatically with the Oregano Prime account, but expire on the deadline of the provider. You can send a privacy deletion request to the controller.
App interaction and evaluation event without content
25 months.
Logging reminders
The device registration is bound to the valid session. After revocation or expiry, the daily deletion process removes it. The delivery status log is kept for no more than 30 days. We keep the reminder setting until the deletion of the account.
App session
No more than one year, or until logout, revocation or expiry.
Android recovery key
The public key kept on the server is bound to the validity of the original session, for no more than one year. Revocation, account suspension, access block or account deletion removes it; the daily deletion process cleans up an expired key. The audit without content of the registration and the login is kept for 14 months. The app actions described above and the Google backup process delete the key that Google manages; the server-side revocation does not prove the immediate physical deletion of the cloud copy.
Profile, expert history and related model record
Until the deletion of the account or the related source data, if no shorter separate deadline applies. The successful transcript of server-side speech recognition currently stays in the related model record until the deletion of the account.

9. Account deletion and withdrawal of consent

In the account, you can start the deletion of the full account through Account → Request account deletion. The account is suspended immediately. The user can restore it for 65 days. After the protection period ends, the system automatically revokes the kept Apple token within no more than 24 hours, and then deletes the account and its active content; after this, the account cannot be restored. The system sends one email about the completion, and then deletes the earlier email address from the notification queue. If the contact address is an Apple private relay address, the system does not try to send this message after the earlier revocation of the token, but the deletion is still completed. The deleted bytes leave the rolling backups within no more than a further 35 days, and the restore process cannot bring back a deleted account. Detailed guide: account deletion.

The withdrawal of the consent for Apple login, or a notification about the deletion of the Apple account, only disconnects the Apple identifier and the sessions that come from it. The Oregano Prime account and the diary stay under the usual lifecycle. A connected Google login stays usable. A later permission with the same Apple identifier connects the Apple login again.

Oregano Prime is an AI-first service; its basic functions do not work without the AI processing described above. If the user does not want to consent to the external AI or speech recognition data processing, or withdraws the consent, they can do this by deleting the account through Account → Request account deletion. After the deletion request, no new external transfer starts. The earlier consent and withdrawal events stay in the audit trail until the deletion of the account; the withdrawal does not affect the lawfulness of the earlier processing.

10. Rights

The user can ask for access, rectification, erasure, restriction, data portability and, under the applicable conditions, can object. You can send the request while logged in or from the contact address of the account. If the Apple relay is disabled, the operator checks the access to the account through the connected login method or other proportionate data.

You can make a complaint to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH). Address: 1055 Budapest, Falk Miksa utca 9-11. Postal address: 1363 Budapest, Pf. 9. Email: ugyfelszolgalat@naih.hu. Phone: +36 1 391 1400. Website: naih.hu.

11. Automated decision-making

The AI makes estimates and summaries. Oregano Prime does not make a decision about the user that is based only on automated processing and that has a legal effect or a similarly significant effect.

12. Security and changes

The app uses an encrypted network connection, role-based access, private object storage, revocable sessions, logging and a retention process. No system is completely free of risk. A model change within the scope listed in section 6 does not ask for a new acceptance. When the disclosed data processing scope is extended or changed materially, a new version appears, and the system blocks the external transfer concerned until the new version is accepted on the shared policy screen.