Privacy Policy

Effective date: 20 September 2026

Last updated: 20 September 2026

1. Who we are

Prano (the "App") is operated by Sandhu Technologies LLC ("Prano," "we," "us," "our"), a limited liability company registered in the United States.

Registered address: 15305 Dallas Parkway, Suite 1200, Addison, TX 75001‑6423, United States

Privacy contact: contact@anantex.com

Person responsible for the protection of personal information, and Grievance Contact: J Sandhu, Founder — contact@anantex.com

We are the data controller (in India, the Data Fiduciary) for the personal information described in this policy.

2. Where Prano is offered

Prano is offered in the United States, Canada, Australia and India. It is not offered in the European Economic Area, the United Kingdom, or Switzerland, and this policy is written for the four markets above. If we add markets, we will update this policy before doing so.

3. What this policy covers

This policy explains what personal information Prano collects, why, who it is shared with, how long it is kept, and what rights apply to it. It covers the Prano mobile application, the website at https://pranoapp.com, and our support channels.

Read it alongside our Terms of Service, which is incorporated into this policy by reference for defined terms.

Washington, Nevada and Connecticut residents: consumer health data is also covered by our separate Consumer Health Data Privacy Policy.

4. Plain‑language summary

• Prano works by looking at photos of barcodes, labels, meals and menus. Those photos, and what we work out from them, are the core of what we hold about you.
• What we work out — a personalised health score, your dietary patterns, and the goals, allergies and self‑reported conditions you tell us about — is health‑related information. We treat it as sensitive because in several jurisdictions the law requires that, and because it is the honest description of what it is.
• To analyse a scan and to answer a question in Ask Prano, we send the relevant image and/or text to Anthropic, our AI processor, from our own server — never directly from your device. Anthropic does not train its models on your content under our agreement with them.
• We do not sell your personal information, and we do not share it for cross‑context behavioural advertising. We do not use an advertising identifier and do not run an ad SDK.
• You can delete any individual scan, and you can delete your entire account and all associated data, from inside the App — or from a web page even if you no longer have the App installed.
• Prano is not a HIPAA‑covered service, and we do not claim to be. See §13.

5. Information we collect

5.1 Information you give us

5.2 Information we generate about you

• Personalised health scores (0–100) and the reasoning behind them, derived from a scan plus your profile
• Ingredient and nutrient breakdowns, additive explanations, and suggested swaps for a given scan
• Aggregated patterns in your intake and scores across days, weeks and months
• Scan and meal history metadata — timestamps and, only if you separately enable it, a location tag

5.3 Information collected automatically

• Device and technical information — device model, OS version, App version, language, time zone
• Usage information — which features are used, session length, screens viewed
• Diagnostic information — crash reports, error logs and performance metrics, collected via Sentry
• Purchase information — subscription status and transaction identifiers, processed via RevenueCat and Apple/Google as the payment processors. We never receive your full card number.

5.4 Information we do not collect

• No precise location unless you explicitly enable location tagging for a scan
• No access to contacts, calendar, SMS, call logs, or your wider photo library — the App requests camera access and access only to images you deliberately select
• No advertising identifier (IDFA/AAID), no ad SDK, and no cross‑app tracking
• No information knowingly collected from children (§17)

5.5 Apple Health and Health Connect

Prano v1.0 does not integrate Apple Health (HealthKit) or Android Health Connect. No data is read from or written to either platform's health store in this version. If a future version adds that integration, this policy will be updated first, and the update will describe exactly what is read, what is written, and that it is never used for advertising or shared with third parties for their own purposes.

6. Why we use your information

We do not use your personal information for automated decision‑making that produces legal or similarly significant effects about you. A health score is informational output about food, not an automated decision about you as a person.

7. Consent — what we ask for, and how to take it back

Prano's core function requires processing health‑related information about you. We ask for your express, opt‑in consent to that processing before any scan is analysed, separately from your acceptance of the Terms of Service, and we tell you at that point what we will collect and why.

• United States. Health information, and the scores and inferences derived from it, are sensitive personal information under state privacy laws and consumer health data under Washington's My Health My Data Act, Nevada SB 370 and Connecticut law. We collect it only with your opt‑in consent, and we share it with a processor only with your separate consent. See §14.
• Canada. Health information is sensitive under PIPEDA, so we rely on your express consent rather than implied consent. Quebec residents: we obtain your consent separately for each purpose, and §10 tells you that your information is processed outside Quebec.
• Australia. Health information is sensitive information under the Privacy Act 1988 (Cth). Australian Privacy Principle 3.3 permits us to collect it only with your consent and where it is reasonably necessary for our functions, which is the basis we rely on.
• India. Under the Digital Personal Data Protection Act 2023, we give you a notice describing the personal data we process and the purpose, and we process it on the basis of your consent, which you give by an affirmative action before scanning begins.

Withdrawing consent. You can withdraw consent at any time in Settings, or by emailing contact@anantex.com. Withdrawal is as easy to do as giving consent was. Withdrawing consent to health‑data processing means Prano can no longer perform its core function for you, and we will offer you deletion or export of your data at that point. Withdrawal does not affect the lawfulness of processing carried out before you withdrew.

8. Artificial intelligence — what actually happens to a scan

What happens when you scan. The image is transmitted over TLS to our own backend — a Supabase Edge Function — which forwards it to Anthropic's Claude API for analysis. Your device never talks to Anthropic directly; the call is always server‑side, from our infrastructure, under our account. The response is stored in our Supabase Postgres database and Supabase Storage, both hosted in the United States. The original image is retained until you delete the scan or your account (§11).

What happens when you use Ask Prano. Your question, together with the context of the relevant scan, is sent the same way — client to our Supabase Edge Function, then to Anthropic — and the response is returned and stored as part of your conversation history.

Barcode lookups. When you scan a barcode, our backend queries OpenFoodFacts, a public, crowd‑sourced product database, using the barcode value. This lookup sends only the barcode — not your account identity or profile.

Our commitments: - Anthropic acts as our processor, processing your content only on our documented instructions under a data processing agreement. - Your content is not used to train Anthropic's models. This is a contractual term, not a setting you have to find and toggle. - We do not sell, licence, or otherwise make your images or conversations available to any third party for that party's own purposes. - Where we use data to improve Prano's own scoring accuracy, we use aggregated or de‑identified data, unless you have separately and explicitly opted in to contributing identifiable scans.

Limits you should understand. AI systems make mistakes. A health score and the reasoning behind it are estimates. Ask Prano can be confidently wrong. Prano's output is general information about food — it is not personalised medical, dietary or clinical advice, and it must never be relied on for allergen safety. Always confirm allergens on the physical packaging.

9. Sub‑processors — who receives what

Every processor below is engaged under a written contract containing data‑protection terms.

9.1 What we do not do

• We do not sell your personal information, as "sale" is defined under the CCPA/CPRA or any other US state privacy law.
• We do not share your personal information for cross‑context behavioural advertising.
• We do not disclose consumer health data to any third party for that third party's own purposes.
• We do not share data with data brokers.

10. Where your information is processed

We are based in the United States, and Supabase's infrastructure for Prano is hosted in the United States. If you are in Canada, Australia or India, your personal information is transferred to and processed in the United States, and in any other country where a sub‑processor listed in §9 operates.

• Canada. Under PIPEDA we remain accountable for your information when it is processed by a service provider outside Canada, and we use contractual means to give it a comparable level of protection. While it is in the United States it is subject to US law, including lawful access requests by US authorities. If you are in Quebec, this paragraph is also our notice under Law 25 that your information is communicated outside Quebec.
• Australia. Before disclosing personal information overseas we take reasonable steps under Australian Privacy Principle 8 to ensure the recipient does not breach the APPs, and we remain accountable for it.
• India. We process personal data outside India. Under the Digital Personal Data Protection Act 2023 the Central Government may restrict transfers to particular countries; we will comply with any such restriction and will update this policy if it changes where we process data.

A copy of the relevant transfer and processing terms is available on request to contact@anantex.com.

11. How long we keep your information

When you delete your account, we delete or irreversibly anonymise your personal information within 30 days, except where we are legally required to retain it (principally financial records) or need it to establish, exercise or defend legal claims.

12. Your rights

12.1 Everyone

• Access — export your scan and account data from Settings → Data & Privacy → Export
• Delete — individual scans, individual conversations, or your entire account, from Settings → Data & Privacy → Delete Account
• Correct — edit your profile information at any time in Settings
• Withdraw consent — for health‑data processing, marketing, or optional features
• Contact us — contact@anantex.com for any request not covered by an in‑app control

A web‑based deletion page is available at https://pranoapp.com/delete-account for anyone who no longer has the App installed.

12.2 How to exercise a right

Email contact@anantex.com, or use the in‑App controls. We verify identity — normally by confirming control of the account email — and respond within 30 days, extendable where the law permits, with notice of why. No charge unless a request is manifestly unfounded or excessive.

12.3 California

Under the CCPA/CPRA: the rights to know, delete, correct, and to opt out of sale or sharing. We do not sell or share personal information, so there is nothing to opt out of, but the request mechanism exists regardless at contact@anantex.com.

Prano collects the following categories of sensitive personal information: health information (dietary style, goals, allergies, self‑reported conditions, and the scores/inferences derived from scans) and account credentials. We use sensitive personal information only to provide the service you requested and for the purposes permitted under Cal. Civ. Code §1798.121 and the CCPA regulations. We do not use or disclose sensitive personal information beyond those permitted purposes, so the "Limit the Use of My Sensitive Personal Information" right does not require a separate opt‑out link — you may still contact us to restrict processing.

We do not knowingly sell or share the personal information of consumers under 16. You may designate an authorised agent to make a request on your behalf; we will require reasonable proof of authorisation. We will not discriminate against you for exercising any privacy right.

12.4 Other US states

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and other states with comprehensive privacy laws have equivalent rights of access, correction, deletion, portability, and appeal of a refused request. To appeal, reply to our decision email with "Appeal"; we respond within 45 days. If the appeal is denied, you may contact your state Attorney General.

12.5 Canada

Under PIPEDA you may ask for access to the personal information we hold about you, ask us to correct it, and withdraw consent subject to legal or contractual restrictions, which we will explain if any apply. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).

If you are resident in Quebec, you also have the right to data portability in a structured, commonly used technological format, the right to be informed if a decision about you is based exclusively on automated processing (Prano makes no such decisions — see §6), and the right to complain to the Commission d'accès à l'information du Québec (cai.gouv.qc.ca). The person responsible for the protection of personal information is named in §1.

12.6 Australia

Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles you may request access to your personal information and ask us to correct it. If you believe we have breached the APPs, complain first to contact@anantex.com; we will respond within 30 days. If you are not satisfied, you may complain to the Office of the Australian Information Commissioner (oaic.gov.au).

We are covered by the Notifiable Data Breaches scheme: if a data breach is likely to result in serious harm to you, we will notify you and the OAIC as the scheme requires.

12.7 India

Under the Digital Personal Data Protection Act 2023 you have the right to:

• obtain a summary of the personal data we process about you and the processing activities we undertake;
• obtain the identities of other Data Fiduciaries and Data Processors with whom your personal data has been shared, and a description of what was shared;
• correction, completion, updating and erasure of your personal data;
• nominate another individual to exercise these rights on your behalf in the event of your death or incapacity; and
• grievance redressal.

Grievance redressal. Contact J Sandhu, Founder, at contact@anantex.com with "DPDP Grievance" in the subject. We will respond within the period prescribed under the Act and its rules. If your grievance is not resolved, you may approach the Data Protection Board of India.

You also have duties under the Act, including not impersonating another person when providing personal data and not filing a false or frivolous grievance.

13. HIPAA — why it does not apply, plainly

Prano is not a HIPAA‑covered entity, and it is not the business associate of one. The Health Insurance Portability and Accountability Act binds covered entities — healthcare providers who transmit health information electronically in connection with certain transactions, health plans, and healthcare clearinghouses — and their business associates, meaning organisations that create, receive, maintain or transmit protected health information on behalf of a covered entity. Prano is neither. It is a direct‑to‑consumer app: a person downloads it for themselves, outside any treatment relationship, and gives Prano information about themselves directly. That relationship sits outside HIPAA's scope entirely, no matter how health‑related the information is.

Prano is never described as "HIPAA compliant" in marketing, support responses, or the app itself, because it is not, and claiming it would itself be a deceptive‑practices risk.

What does bind Prano is listed in the sections around this one: the FTC Health Breach Notification Rule (§15), the FTC Act generally, Washington's My Health My Data Act and similar state laws (§14), CCPA/CPRA sensitive‑PI rules (§12.3), other state comprehensive privacy laws (§12.4), PIPEDA and Quebec Law 25, the Australian Privacy Act, and India's DPDP Act. Several of these are, in practical effect, more protective of a consumer's health data than HIPAA would be for this kind of app.

14. Consumer health data — Washington, Nevada and Connecticut

A separate Consumer Health Data Privacy Policy is published at its own URL, as Washington's My Health My Data Act requires. It describes the consumer health data Prano collects, why, who receives it, and your rights to withdraw consent to collection and, separately, to sharing.

In summary: the foods and products you scan, the nutritional composition and dietary patterns inferred from them, your dietary restrictions, allergies and intolerances, and self‑reported conditions are consumer health data. We collect it directly from you, use it solely to provide the features you asked for, share it only with the processors in §9, and never sell it or use it for advertising. We do not use geofencing around healthcare facilities and do not use location data to infer health status.

15. The FTC Health Breach Notification Rule

The FTC's Health Breach Notification Rule, as amended in 2024, applies to vendors of personal health records and related entities, and its updated scope reaches consumer health apps like Prano that are not covered by HIPAA. Two things about it matter:

• An unauthorised disclosure counts as a breach, not only unauthorised access — including through a vendor's security failure.
• Notification timelines are short. Notice to affected individuals, the FTC and, for larger breaches, media, is required within 60 days of discovery.

If a breach affecting your personal information occurs, we will notify you and the relevant regulators as required under this Rule, the Australian Notifiable Data Breaches scheme, PIPEDA's breach‑reporting obligations, the DPDP Act, and applicable state breach‑notification statutes.

16. Security

We maintain administrative, technical and physical safeguards appropriate to the sensitivity of the data, including:

• TLS encryption for all data in transit, including to Supabase and to Anthropic
• Encryption at rest, provided by Supabase's underlying Postgres/storage infrastructure
• Passwords stored only as salted, computationally expensive hashes — never in plain text (handled by Supabase Auth)
• Row‑level security in the database, so one account cannot read another's data
• Role‑based access control, with production data access limited to named personnel who require it
• Multi‑factor authentication on administrative and infrastructure accounts
• Audit logging of access to user data where the platform supports it
• Regular dependency scanning and patching

No system is perfectly secure. You are responsible for keeping your account credentials confidential. Tell us immediately at contact@anantex.com if you believe your account has been compromised.

17. Children

Prano is not intended for anyone under 13, and we do not knowingly collect personal information from children under 13. If we learn that we have, we will delete it promptly.

India. Because the Digital Personal Data Protection Act 2023 treats everyone under 18 as a child and requires verifiable parental consent before their personal data is processed, Prano is available in India only to users aged 18 and over. We do not knowingly collect personal data from anyone under 18 in India, and we do not undertake tracking or behavioural advertising directed at children anywhere.

If you believe a child has provided us with personal information, contact contact@anantex.com.

18. Third‑party links and services

The App may link to third‑party websites or services we do not control — for example, a manufacturer's product page reached via an OpenFoodFacts result. Their privacy practices are their own; we are not responsible for them.

19. Changes to this policy

We will update this policy when our practices change. For a material change — particularly one affecting how health‑related data is used — we will notify you in the App and by email before it takes effect, and where the law requires it, ask for renewed consent. The "Last updated" date at the top always reflects the current version. Previous versions are available on request.

20. Contact us

Privacy enquiries, rights requests and DPDP grievances: contact@anantex.com

General support: contact@anantex.com

Post: Sandhu Technologies LLC, Attn: J Sandhu, Founder — 15305 Dallas Parkway, Suite 1200, Addison, TX 75001‑6423, United States