Meridian Care Privacy Policy

Last Updated: September 23, 2026

Introduction

This Privacy Policy explains how Sprout Technologies INC (“Sprout Technologies,” “we,” “us,” or “our”) collects, uses, shares, and protects information in connection with the Meridian Care iOS application and related website services (collectively, the “Services”).

Meridian Care provides wellness and self-care features. It is not a medical service and is not intended to diagnose, treat, cure, or prevent any disease or medical condition.

Information We Collect

Account and identity information

We may collect:

An account identifier provided through Sign in with Apple.
Your name and email address, including an Apple private relay email address, when you authorize Apple to provide them.
The display name, language preference, or region setting you choose for your Meridian Care account or experience.

Wellness and app content

We collect and store information you actively provide or create when using Meridian Care, which may include:

Your selected wellness goal.
Your selected current feeling or status.
Your selected practice duration, focus area, and other setup answers.
Your generated wellness plan and plan details.
Daily check-in dates, status, completed steps, practice duration, and check-in history.
Tongue-scan results, reports, scan history, and small saved thumbnails associated with your account.

We use this information to provide the wellness features you request. As noted above, Meridian Care is not a medical service, and this information is not used by Meridian Care to diagnose or treat medical conditions.

Onboarding profile and food journal

The app asks for your age, sex or preference not to say, height, weight, units, goal, and eating preference during onboarding. The current onboarding profile is saved on your device, including edits made in Settings. It is not uploaded to your Meridian Care account as part of this onboarding flow.

Meal photos you take or select, meal names, dates, and nutrition values you enter or save in the food journal are currently stored on your device in an account-specific local journal. Food photo analysis is not connected; displayed food nutrition may be an illustrative example or a value you enter. Deleting your account in the app also clears this device's food journal. A copy on another device is not removed by clearing this device alone.

Tongue photos and AI processing

When you choose to scan your tongue, the app briefly processes the full camera image on your device to orient and crop it. The cropped area within the on-screen guide, an account-related identifier, and necessary request information are sent through our Vercel-hosted API to OpenAI to generate the requested wellness result. Depending on how you align the camera, the crop may include more than your tongue. Temporary images used for the request are removed from the app after processing.

We store the structured scan result and limited service records in Supabase, as well as a small thumbnail of a successful scan in private storage for your scan history. We do not store the full camera image or the analysis crop in our database or storage. OpenAI may retain API input and output for abuse monitoring according to its data controls; asking the API not to store a response does not by itself eliminate that processing.

Subscription information

Apple App Store and RevenueCat may provide us with information about products, subscriptions, entitlement status, purchases, and purchase restorations. Meridian Care does not directly collect or store your full payment-card details.

Usage and technical information

We may collect usage and technical information such as:

App opens, page or screen views, button interactions, login results, plan creation, check-ins, and subscription-flow events.
App version, operating system, device category, and other technical information processed by our software development kits and service providers.
Where you have granted the required permission, an advertising identifier and advertising-attribution information.
A device push token and notification preferences if you enable app notifications.

Website product interest and launch notifications

When you record interest in a proposed Meridian Care plan or product on our website, we collect the selected plan or product, displayed price variant, call-to-action location, page and language, anonymous browser and session identifiers, campaign parameters, full landing and referring URLs, browser User-Agent, originating hostname, and whether the submission came from production or a test or preview deployment.

You may optionally provide an email address. Submitting that email means you agree that we may use it only to notify you when the specific plan or product becomes available. We do not store a raw IP address in the product-interest record; our hosting provider may process network information transiently to operate its firewall and prevent abuse.

How We Use Information

We use information to:

Authenticate users and manage Meridian Care accounts.
Create, personalize, and save wellness plans.
Save daily check-in activity and progress.
Process tongue photos to provide scan reports and retain their history.
Save your onboarding profile and food journal on your device.
Send app notifications where you have enabled them.
Process subscriptions and restore purchases.
Improve the functionality, performance, and stability of the Services.
Measure interest in proposed plans and products and, when you provide an email address, send the related launch notification.
Protect the Services, prevent fraud, and troubleshoot problems.
Attribute advertising, measure advertising performance, and optimize campaigns.
Comply with legal obligations and enforce our terms.

Analytics and Advertising Technologies

We use, or may use, the following providers to operate the Services, understand product usage, manage subscriptions, and measure advertising:

On the Meridian Care website, Google Analytics loads when an analytics-enabled page opens. We do not show a separate analytics consent prompt before this collection. Google Analytics receives allowlisted interaction, session, campaign, device-category, and deployment-environment fields; it does not receive an email address from the website interest form.

Firebase Analytics / Google for product analytics. Firebase may receive product analytics events and limited identifiers associated with feature selections.
Google Analytics for website page, interaction, conversion, campaign, and deployment-environment measurement.
TikTok App Events SDK for approved advertising attribution and conversion measurement.
Meta App Events SDK for approved advertising attribution and conversion measurement.
RevenueCat for subscription and entitlement management. RevenueCat also sends subscription purchase events to Google/Firebase and Meta for revenue analytics and advertising attribution, using available matching signals. This can occur without ATT authorization, but does not permit IDFA collection without that authorization.
Supabase for account, database, and backend services.
Vercel to host the app API, including the tongue-scan request pathway.
OpenAI to process the cropped tongue image for the requested wellness report.
Apple for Sign in with Apple, App Store purchases, subscription management, and Apple-provided attribution services.

Advertising event limits

Our app event adapters send TikTok and Meta only specifically allowlisted, high-level events, such as app activation, login success, first registration, and first tutorial completion. Separately, the subscription integrations described above may send purchase, trial, and subscription events for advertising measurement. The TikTok SDK may also observe App Store purchase and subscription events.

Our advertising event adapters do not send:

A wellness goal or current feeling or status.
Plan content, focus area, setup answers, or generated plan details.
Check-in content, completed steps, or practice records.
Routine or acupoint content.
An Apple user identifier, email address, or name.
Other health, medical, wellness-sensitive, or sensitive information.

Meta's terms prohibit health and other sensitive information from being sent to Meta as Business Tool Data. We apply the same data-minimization principle to advertising event integrations.

App Tracking Transparency

Before engaging in tracking across other companies' apps or websites, or accessing Apple's Identifier for Advertisers (“IDFA”), we will request your permission through Apple's App Tracking Transparency (“ATT”) framework.

If you deny permission, Meridian Care will not access IDFA and will not engage in cross-app tracking that requires ATT authorization. You can review or change your choice in iOS Settings > Privacy & Security > Tracking.

Even if you deny ATT permission, privacy-preserving and aggregated advertising attribution provided by Apple may still be available to us and our advertising partners.

Data Retention

We generally retain account information, wellness plans, plan details, tongue-scan results, scan attempts and thumbnails, and check-in records until you delete your Meridian Care account or request deletion, unless a longer retention period is required for legal, security, or fraud-prevention purposes. Retaking a scan or replacing a wellness plan does not automatically remove prior scan history.

Onboarding answers remain on the device until app or device data is removed. The food journal on this device is cleared through the app's account-deletion flow or app-data removal. A tongue-scan image sent to OpenAI may remain in its abuse-monitoring systems for up to 30 days by default, or longer where legally required, under its API data controls.

Analytics, security, and transaction records may be retained or de-identified according to provider retention policies and legal requirements. Apple purchase records and information independently retained by a service provider for legal or operational reasons may not be deleted at the same time as your Meridian Care account.

Website product-interest records and any associated launch-notification email are not assigned an automatic expiration date. We retain them until deletion is requested or they are no longer needed for the stated business purpose, subject to legal, security, and fraud-prevention requirements.

Account Deletion

To permanently delete your account in the Meridian Care app:

Open Meridian Care.
Open the Settings tab.
Tap Delete account.
Confirm by tapping Delete account in the confirmation sheet.

Account deletion is permanent and cannot be reversed. It deletes your Meridian Care account and the user profile, wellness plans, plan details, tongue-scan results and saved thumbnails, daily check-ins, and check-in history that we control. The app also clears this device's food journal as part of the flow.

Deleting your Meridian Care account does not delete your Apple ID and does not automatically cancel an App Store subscription. You must separately cancel any active subscription in your Apple subscription settings.

Records retained by Apple, RevenueCat, Firebase, Meta, or TikTok as required by law or under their applicable retention policies may not be deleted immediately or at the same time as your Meridian Care account.

If you cannot access the app, email us at team@sprout.place for assistance. We will not ask for your Apple password. We will request only the information reasonably necessary to verify that you own the relevant Meridian Care account.

User Choices and Rights

Subject to applicable law, you may have the right to access, correct, or delete your account information and to make other privacy or data requests. You can also:

Review or update available account profile information.
Manage ATT permission in iOS settings.
Manage or cancel an App Store subscription through Apple.
Contact us to submit a privacy or data request.
Ask us to access or delete a website product-interest record or associated launch-notification email.

Children's Privacy

The Services are not directed to children under 13. We do not knowingly collect personal information from children under 13 or knowingly send their data to advertising platforms. If we learn that we have collected such information, we will take reasonable steps to delete it.

Security and International Transfers

We use reasonable administrative, technical, and organizational safeguards designed to protect information against unauthorized access, loss, misuse, alteration, or disclosure. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

We and our service providers may process information in countries other than the country where you live. Where required, we use appropriate safeguards for international transfers and handle information in accordance with applicable law.

Changes to This Policy

We may update this Privacy Policy as our Services or privacy practices change. If we make a material change, we will update this page, revise the Last Updated date, and provide any additional notice required by applicable law.

Contact Us

Sprout Technologies INC
Email: team@sprout.place