1. Introduction

Bewell, a limited liability company incorporated and existing under the provisions of Investment Law No. 72 of 2017, Cairo, Arab Republic of Egypt, under Commercial Registration No. 303311, having its registered office at Administrative Unit No. 1, Second Floor, Building No. 85, Street 9, Maadi, Cairo, Egypt, hereinafter referred to as “Bewell”, “we” or the “Company”.

Bewell operates a digital health and wellness platform consisting of its website, mobile application, restaurant and administration portals, connected services, and related communications (collectively, the “Platform”).

This Privacy Policy explains how Bewell collects, uses, stores, shares, protects, and deletes personal data relating to people who use the Platform. Bewell is the controller of the personal data described in this Privacy Policy.

Reading this Privacy Policy is not the same as giving consent. Where processing requires your consent, we ask for it separately in the app, explain what it covers, and record your choice. Your continued use of the Platform is not treated as consent.

2. Scope of This Privacy Policy

This Privacy Policy applies to personal data processed through:

1. the Bewell website;
2. the Bewell mobile application;
3. the Bewell restaurant and administration portals, for restaurant partners, staff and drivers;
4. health and fitness services you choose to connect to Bewell;
5. communications between Bewell and users, restaurants or other contacts; and
6. any other digital service operated by Bewell that refers to this Privacy Policy.

Bewell currently offers its services in the Arab Republic of Egypt. Some of our service providers process personal data outside Egypt, as explained in Section 12.

The Bewell app is intended only for adults aged 18 or over (see Section 15).

3. Personal Data We Collect

Depending on the features you use, Bewell processes the following categories of personal data.

3.1. Account and Contact Information

• Name, username, email address and mobile number, and their verification status;
• Identifiers from Apple or Google sign-in, where you use them;
• A securely hashed password, where you sign in with a password, and temporary verification and account-recovery records; and
• Account settings, language preference and records of your privacy choices.

3.2. Profile and Health Information

Much of this information is health data, which is sensitive personal data (see Section 7). It includes:

• Date of birth and age, and gender;
• Height, weight, weight history, body fat percentage and other body measurements;
• Allergies, medical conditions and injuries you choose to tell us about;
• Goals, lifestyle, activity level, training experience, available equipment and food preferences;
• Targets we calculate from this information, such as basal metabolic rate (BMR), total daily energy expenditure (TDEE), and calorie and macronutrient targets; and
• Unfinished onboarding answers, saved so that you can resume setup.

3.3. Wellness and Activity Records

Meals and nutrients you log, water intake, workouts and exercise sets, progress entries, meal and workout plans, achievements, and recommendations generated from these records.

3.4. Coach Conversations, Photos and Voice

• Messages you send to the AI coach, the coach’s replies, and coach memory (preferences and facts the coach remembers to keep conversations consistent);
• Meal photos you take or select for scanning, the food items and portions estimated from them, and any corrections you make;
• Voice recordings you submit and the resulting transcripts; and
• Your profile photo, if you add one.

3.5. Connected Health Data

If you connect Apple Health, Android Health Connect or WHOOP, we process the health readings described in Section 7.2, according to the permissions you grant.

3.6. Location and Order Information

• Device location, when you allow it, and saved or selected delivery addresses, delivery coordinates, apartment, floor and landmark details, and delivery notes;
• Restaurant orders, ordered items and options, favourites, reviews and order issues; and
• Payment status and transaction amounts for orders.

Delivery notes may contain personal or health information if you include it, so please include only what the restaurant or driver needs.

3.7. Subscription and Payment Information

• For subscriptions: your Bewell account identifier, subscription service identifiers, products purchased, entitlement status, and purchase and renewal history received from RevenueCat and the Apple App Store or Google Play; and
• For card payments for restaurant orders: payment status and transaction references received from our payment provider. Bewell does not store full card numbers.

3.8. Technical and Communication Information

• Session and device identifiers, push-notification tokens, notification preferences and notification history;
• Request, error and security logs needed to operate and protect the Platform; and
• Messages you send to us, and, for restaurant partners, staff and drivers, account, role, application, sales and payout records and administrative audit records.

4. How We Collect Your Personal Data

We collect personal data:

1. directly from you, when you create an account, complete onboarding, log meals or workouts, chat with the coach, scan meals, record voice messages, place orders or contact us;
2. from your use of the Platform, such as the records and targets generated by the app;
3. from services you choose to connect, such as Apple Health, Android Health Connect, WHOOP, and Apple or Google sign-in;
4. from restaurants, drivers, app stores, RevenueCat and payment providers involved in the features you use; and
5. from your device, such as location (when you allow it) and push-notification tokens.

The Bewell website can be used without an account. An account is required to use the Bewell app. The app also keeps some information on your device, such as your sign-in state, settings, drafts, cart and delivery choices.

5. Purposes of Processing Personal Data

Bewell processes personal data for the following purposes:

5.1. Providing the Services

To create and manage your account and provide the features you request, including nutrition and workout tracking, plans and progress.

5.2. Personalization and AI Features

To calculate your targets, personalize recommendations, and provide the AI coach, meal scanning, voice transcription and AI-generated plans described in Section 8.

5.3. Food Ordering and Delivery

To process and fulfil restaurant orders, share the necessary order details with the restaurant and driver, and handle order support.

5.4. Payments and Subscriptions

To process order payments and refunds, verify transactions, and manage subscription access.

5.5. Platform Operation and Security

To maintain, troubleshoot, secure and improve the Platform, and to detect and prevent fraud, abuse and unauthorized access.

5.6. Communications

To send you service messages by push notification, email or in the app, such as order updates, account and security messages, coach reminders and account-inactivity warnings. Notifications may appear on your lock screen depending on your device settings. You can manage notification preferences in the app and in your device settings.

5.7. Optional Food-Recognition Training

Only if you opt in, to improve our food-recognition model using your meal photos and corrections, as described in Section 8.3.

5.8. Legal and Regulatory Compliance

To keep accounting and tax records, comply with legal obligations, and respond to lawful requests from competent authorities.

6. Legal Basis and Consent

Bewell processes personal data in accordance with the Egyptian Personal Data Protection Law No. 151 of 2020 and its Executive Regulations.

We process account, order and payment information where it is necessary to provide the services you request, security information where it is necessary to protect the Platform and its users, and accounting records where the law requires us to keep them.

6.1. Separate Consents

We ask for your explicit electronic consent separately for each of the following purposes, and we do not bundle them together or with acceptance of our terms:

• Health data processing (required): processing your health information to provide Bewell’s personalized wellness features. Bewell cannot be used without this consent.
• External AI processing (required for AI features): sending relevant information to the external AI providers described in Section 8 to provide the AI coach, meal scanning, voice transcription and AI-generated plans. This consent is optional for the rest of the app; without it, these features are unavailable or work without AI.
• Food-recognition training (optional): allowing your meal photos and corrections to be used to improve our food-recognition model, as described in Section 8.3. Not giving this consent does not affect any feature.

For each consent we record the version of the consent text you accepted, the date and time, and the language in which it was shown to you. Your continued use of the Platform is not treated as consent to any of these purposes.

You can review and withdraw each consent at any time in the app under Settings › Privacy & Security. See Section 14 for what happens when you withdraw.

7. Health and Sensitive Personal Data

7.1. How We Handle Health Data

Information about your body, diet, allergies, medical conditions, injuries and activity, and readings from connected health services, is health data and is treated as sensitive personal data. We process it only with your health data processing consent and only to provide and personalize Bewell’s wellness features. We do not use health data for advertising and we do not sell it.

7.2. Connected Health Services

Connecting a health service is optional. You choose which permissions to grant.

• Apple Health and Android Health Connect: with your permission, the app reads steps, sleep, active energy, resting heart rate and heart-rate variability (HRV) from your device. Your daily steps and sleep totals are uploaded to Bewell’s servers so that they can be shown across your devices and used in your plans. The other readings are used on your device.
• WHOOP: if you connect WHOOP, Bewell stores your WHOOP user identifier, the authorization (OAuth) tokens needed to keep the connection working, and your latest recovery information, which can include recovery score, resting heart rate, heart-rate variability, blood oxygen saturation (SpO2), skin temperature, and related timestamps.

You can change Apple Health or Health Connect permissions in your device settings at any time. You can disconnect WHOOP in the app; when you do, we ask WHOOP to revoke Bewell’s access and delete the stored WHOOP connection. Stopping access does not by itself erase readings already copied to Bewell; you can ask us to delete them, and they are deleted when you delete your account. Deleting your Bewell account does not delete the records held by Apple Health, Health Connect or WHOOP.

8. AI and Automated Processing

Bewell uses automated calculations and artificial intelligence (AI) to estimate nutrition, calculate targets, generate meal and workout plans, rank meal suggestions, and provide personalized wellness guidance. These outputs can be inaccurate. They are for general wellness and information only and are not medical advice, diagnosis or treatment, or an emergency service. You can correct your information and logged results at any time.

8.1. External AI Providers

With your external AI consent, Bewell uses Google Gemini and Groq to provide AI features. These providers process data outside Egypt. Depending on the request, we send:

• AI coach and AI plans: your message and the context needed to answer it, such as relevant profile and health information, goals, plans, progress, recent conversation history and coach memory;
• Meal scanning: the meal photo you submit, to Google Gemini or Groq; and
• Voice: the recording you submit and its language, to Groq for transcription with the Whisper speech-recognition model. The transcript may then be used as a coach message.

Some meal analysis may be performed by a model operated within Bewell’s own infrastructure. Please avoid including information about other people, or sensitive information unrelated to your request, in messages, recordings and photos.

8.2. Without External AI Consent

If you do not give, or later withdraw, your external AI consent, we do not send your information to external AI providers. The AI coach, AI meal scanning, voice transcription and AI-generated plans are then unavailable or work without AI, and the rest of the app continues to work.

8.3. Optional Food-Recognition Training

Saving or correcting a meal scan does not by itself allow us to use it for training. Only if you give your separate, optional food-recognition training consent may your meal photos and corrections be included in datasets used to train Bewell’s food-recognition model.

• Training datasets identify contributions by a pseudonymous contributor ID, not by your name or account ID. Pseudonymous data is not anonymous: Bewell can still link it back to your account, so it remains personal data.
• If you withdraw this consent, your photos and corrections are excluded from all future training datasets.
• Models that have already been trained are not automatically changed to remove what they learned from earlier contributions.

9. Sharing of Personal Data

We share personal data only with the parties involved in the features you use, our service providers, and where the law requires it. The full list of recipients and where they process data is in Section 12.

9.1. Restaurants and Drivers

Restaurants, their staff and drivers receive only the order details needed to accept, prepare, deliver and support your order, such as the items ordered, your name and contact number, delivery address and instructions, and order and payment status. They do not receive your health profile.

9.2. Payments and Subscriptions

Subscriptions are purchased through the Apple App Store or Google Play and managed by RevenueCat, which receives your Bewell account identifier and your purchase and entitlement information. Card payments for restaurant orders may be processed by Kashier, which receives the information needed to process the payment. Bewell does not store full card numbers.

9.3. Service Providers

Our service providers for AI, hosting, maps, email, push notifications and connected services process personal data on our behalf to provide their services, as listed in Section 12.

9.4. Authorized Bewell Staff

Authorized Bewell personnel access personal data only where needed for their support, administrative and operational responsibilities.

9.5. Competent Authorities

We may disclose personal data where required by law, court order or a lawful request from a competent authority.

Bewell does not sell your personal data.

10. Data Retention and Deletion

We keep personal data only for as long as needed for the purposes described in this Privacy Policy, then delete it, subject to the specific periods and legal obligations below.

10.1. Deleting Your Account

You can delete your account in the app under Settings › Privacy & Security, or by contacting us at privacy@bewellhealthapp.com. When your account is deleted:

• we delete your profile, health information, plans, logs, coach conversations and coach memory, profile photo, meal-scan photos, consent records and connected-health data;
• we revoke Bewell’s access to WHOOP;
• we remove the delivery address, delivery coordinates and delivery notes from your past orders; and
• we keep order receipts (items, amounts and dates) for 5 years to meet tax and accounting obligations, without your name or precise delivery address.

If a file cannot be deleted immediately, deletion is retried automatically. An account cannot be deleted while an order is in progress; you can delete it once the order is completed or cancelled. Restaurant partner accounts cannot be deleted in the app; they are closed through our support team (privacy@bewellhealthapp.com). Deleting your account does not cancel an App Store or Google Play subscription; please cancel it separately in your App Store or Google Play account settings.

10.2. Inactive Accounts

Accounts with no activity for 60 days are deleted in the same way as described above. We warn you 7 days before deletion by push notification and/or email, and in the app. Returning to the app before the deletion date cancels it. If we cannot reach you by push notification or email, we do not delete your account automatically. Accounts with an active paid subscription are not deleted for inactivity. This also does not apply to restaurant partner and staff accounts or to accounts that must be kept because of a legal obligation.

10.3. Retention Periods

• Account, profile, health and activity records: while your account is active, until you delete it or until it is deleted after 60 days of inactivity;
• Order receipts (items, amounts and dates): 5 years, without your name or precise delivery address once your account is deleted;
• Payment and subscription webhook logs: 90 days;
• AI coach processing traces: 30 days;
• Raw AI responses for meal scans: 30 days, after which they are cleared (the meal log you saved remains until you delete it or your account);
• Notifications: 30 days;
• Server logs: up to 30 days;
• Database backups: up to 14 days; and
• Previous versions of stored files: up to 90 days.

Data deleted from our live systems may remain in backups until those backups expire. You can also ask us to delete specific information at any time (see Section 13).

11. Data Security

Bewell uses technical and organizational measures designed to protect personal data against unauthorized access, disclosure, alteration, loss or destruction. These include:

• encrypted connections (HTTPS) between the app and our servers;
• authentication and access controls;
• restricting access to personal data to authorized personnel who need it;
• monitoring and logging of our systems; and
• sharing only the data each service provider needs for its service, and requiring providers to protect it.

No electronic system, transmission method or storage environment can be guaranteed to be completely secure.

12. Service Providers and International Transfers

Bewell uses the following recipients to provide the Platform. Several of them process personal data outside Egypt.

• Amazon Web Services: hosting, databases, file storage and, where used, SMS delivery, in the European Union (Frankfurt, Germany).
• Google: Gemini AI (coach, plans and meal scanning), Google Maps geocoding (turning addresses and locations into map positions), Firebase Cloud Messaging (push notifications on Android), and Google sign-in where you use it.
• Groq: AI coach, plans and meal scanning, and Whisper voice transcription.
• Apple: Apple Push Notification service (push notifications on iPhone), Apple sign-in where you use it, the App Store for subscriptions, and Apple Health on your device.
• Resend: delivery of transactional emails, such as verification, account and account-inactivity warning emails.
• RevenueCat: management of subscriptions purchased through the Apple App Store or Google Play.
• Kashier: may process card payments for restaurant orders.
• WHOOP: if you connect your WHOOP account.
• Restaurants and drivers: order details only, as described in Section 9.1, in Egypt.

Personal data is therefore processed outside Egypt, including in the European Union, the United States and other countries where our providers operate. Such transfers are made in accordance with the requirements of the Egyptian Personal Data Protection Law No. 151 of 2020. We share only the data each provider needs for its service and require providers to protect it and use it only to provide their services. You can contact us at privacy@bewellhealthapp.com for more information about these transfers.

13. Your Rights

Subject to the Egyptian Personal Data Protection Law, you have the right to:

1. know whether Bewell holds personal data about you and obtain information about how it is processed;
2. access your personal data and obtain a copy of it;
3. correct, update or complete inaccurate or incomplete data;
4. request deletion of your personal data;
5. withdraw any consent you have given;
6. request restriction of, or object to, certain processing; and
7. be notified of a personal data breach affecting you, where the law requires it.

Many of these rights can be exercised directly in the app: you can edit your profile, export a copy of your core account records, manage your consents and delete your account under Settings › Privacy & Security. You can also contact us at privacy@bewellhealthapp.com. We may ask for information needed to verify that the request comes from you. Please do not send passwords, verification codes, card details or unnecessary health information.

If you are not satisfied with our response, you can complain to the Personal Data Protection Center in Egypt.

14. Withdrawal of Consent

You can withdraw each of your consents at any time in the app under Settings › Privacy & Security. Withdrawal applies to future processing and does not affect the lawfulness of processing carried out before you withdrew.

• Health data processing: Bewell cannot provide its service without holding your health data. If you withdraw this consent, the app offers to delete your account.
• External AI processing: we stop sending your information to external AI providers. AI features become unavailable or work without AI; the rest of the app continues to work.
• Food-recognition training: your photos and corrections are excluded from all future training datasets. Models already trained are not automatically changed.

You can give a consent again later in the same settings.

15. Children’s Data

Bewell is intended only for adults aged 18 or over. Before using Bewell’s personalised health features you must provide a date of birth showing you are at least 18.

If we learn that an account belongs to a person under 18, we delete the account and its personal data. If you believe a person under 18 is using Bewell, please contact us at privacy@bewellhealthapp.com.

16. Cookies, Device Storage and Similar Technologies

The Bewell website does not use advertising or analytics cookies. The website’s contact and data-request forms open a message in your own email application; it reaches us only if you send it. The newsletter form does not currently save or send the email address you enter.

The restaurant and administration portals use cookies to keep you signed in and browser storage to remember settings such as language and theme. The mobile app stores your sign-in state, settings, drafts, cart and delivery choices on your device.

If we introduce cookies or similar technologies that require consent, we will ask for your consent before using them.

17. Third-Party Websites and Services

The service providers listed in Section 12 process personal data to provide their services to Bewell. Other services, such as Apple Health, Health Connect, WHOOP, the Apple App Store and Google Play, are operated independently under their own privacy policies, and the Platform may also link to third-party websites.

Bewell is not responsible for the privacy practices of independently operated services and websites. Please review their privacy policies before providing personal data to them.

18. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes to the Platform, our data practices, or applicable law. The effective date and last-updated date at the top of this page show when it last changed.

We will notify you of material changes through the app, by email or by other appropriate means. Where a change affects a purpose that requires your consent, we will ask for your consent again; continuing to use the Platform will not be treated as consent.

19. Data Breaches and Security Incidents

If a personal data breach occurs, Bewell will take prompt measures to investigate, contain and mitigate it.

We will notify the Personal Data Protection Center and affected users where and within the time required by the Egyptian Personal Data Protection Law.

20. Privacy Contact

For data protection questions, contact Bewell’s privacy team at privacy@bewellhealthapp.com.

21. Contact Us

If you have any questions, requests, complaints or concerns about this Privacy Policy or the processing of your personal data, you can contact Bewell at:

• Email: privacy@bewellhealthapp.com
• Registered office: Administrative Unit No. 1, Second Floor, Building No. 85, Street 9, Maadi, Cairo, Egypt
• Commercial Registration No.: 303311
• Website: https://bewellhealthapp.com/

22. Acknowledgement

This Privacy Policy explains how Bewell processes your personal data. Reading it, or continuing to use the Platform, is not consent. Where we rely on your consent, we ask for it separately in the app, as described in Section 6.