Privacy Policy

Who we are

m80 Limited (“m80”, “we”, “us”) is a Hong Kong-registered company building an AI healthspan companion. We are responsible for the personal information you give us, both through this website and through our apps. You can reach us any time at hello@m80.fit.

The short version

• We do not track you, advertise to you, or sell or share your data for anyone else’s purposes.
• The website collects an email address. That is all it collects.
• The Supplem8 app stores the health information you choose to give it, so an AI agent can build a supplement plan that is safe for you.
• Raw Apple Health data never leaves your device, and sending anything to the AI model is opt-in and revocable.
• You can delete your account, and everything in it, from inside the app.

What we collect

Only what you type into our waitlist form: your email address, an optional first name, and a note of which form you used (so we can improve the site). We do not collect health data through this website, and the waitlist is not the m80 product.

Why we collect it, and our legal basis

We use your email to confirm your signup and to send you m80 launch updates and longevity insights. We rely on your consent, given when you submit the waitlist form. You can withdraw it at any time, and every email we send includes a one-click unsubscribe.

Who processes it

We keep the list small and the vendors few. Your signup is stored in a database hosted by Cloudflare, and confirmation and update emails are sent through Resend. These providers act on our instructions as processors. Some processing happens outside Hong Kong (for example, Resend sends email from the United States). When your data is handled overseas, we take reasonable steps to keep it protected to the standard set out in this policy. We do not sell or rent your information to anyone, ever.

How long we keep it

We keep your email for as long as you want to hear from us. If you unsubscribe or ask us to delete your data, we remove you from the list promptly. If you go quiet for an extended period (around 24 months with no engagement), we remove you automatically.

Cookies and analytics

This site does not set advertising or cross-site tracking cookies. If we add privacy-respecting analytics later, we will update this policy first.

What the app collects

Your account details: an email address and an account identifier. Signing in with Apple is the only sign-in method, so if you use Hide My Email we only ever see Apple’s relay address.

The health record you type in: allergies, medications, health conditions, dietary restrictions and intolerances, notes you write to your agent, and reports of side effects. This is the most important data in the app. The agent checks every suggestion against it, because a supplement recommender that cannot see “warfarin” or a shellfish allergy is a dangerous one. We store it so that check can run.

Documents you upload, such as a lab panel or a prescription, and the information read out of them.

Your plan and how you use it: the plan the agent builds, the doses you mark as taken, and the outcome measures you record.

Apple Health data stays on your device

If you grant access, Supplem8 reads four signals: sleep, heart rate variability, resting heart rate and step count. It never writes anything back to Apple Health.

Your raw Apple Health data never leaves your device. It is read on the device and reduced to a short summary, for example that your sleep trended down over a two week window. Only that summary can be sent anywhere, and only if you have consented to AI processing. Apple Health data is never used for advertising or marketing, never sold, and never disclosed to a third party other than the AI processing described below, which you control.

The AI model, and what is sent

To build or adapt your plan, Supplem8 sends your supplement related question or note, and the health context you have shared (your goals, your constraints, information from documents you uploaded, and where relevant the derived Apple Health summary) to Google Gemini, through Google Cloud Vertex AI.

This is opt-in. We ask before the first transmission, and you can revoke consent at any time in the app settings, which stops further transmission.

Google processes this data as our service provider. Under the Google Cloud terms, customer data is not used to train or fine-tune Google’s models without our instruction, and Gemini does not use prompts or responses as training data. One detail a blanket claim would get wrong: Google caches inputs and outputs in memory for up to 24 hours to keep responses fast. That cache is held in memory rather than stored, is isolated to our project, and can be turned off.

Some things are deliberately never sent to the model. In particular, a report of a suspected adverse reaction is recorded for you and kept out of the AI planning loop entirely.

Who processes it

Google (Firebase and Google Cloud) provides our authentication, database, file storage and the AI model. Apple provides Sign in with Apple, and TestFlight while the app is in beta. That is the complete list: no advertising networks, no data brokers, no analytics vendors. As with the website, some of this processing happens outside Hong Kong, and when your data is handled overseas we take reasonable steps to keep it protected to the standard set out in this policy.

What the app does not collect

No advertising identifiers, no location, no contacts, and no photos beyond a document you deliberately upload. There is no analytics, crash reporting or usage telemetry in the app at all, so we cannot see how you use it. We do not track you across other apps or websites.

Supplem8 is not medical advice

Supplem8 is not a medical device, and it does not provide medical advice, diagnosis or treatment. Statements about supplements have not been evaluated by the Food and Drug Administration. It is a tool for organising information you already have, and for holding a plan to the constraints you set. Talk to a qualified professional about your health. If you think you may be having a medical emergency, contact your local emergency services.

Deleting your account

You can delete your account from inside the app, in Settings. That removes your records from our database and deletes your sign-in account, and if you signed in with Apple we also revoke the Apple token. We keep a minimal record that a deletion happened, which does not identify you. Residual copies age out of our providers’ infrastructure afterwards on their own schedules.

Security

Your data is encrypted in transit and at rest by our infrastructure providers. Access to your records is limited to your account and enforced on the server, not just in the app, and every request to our backend is attested using Apple’s App Attest, so requests from anything other than a genuine copy of the app are rejected.

Children

Supplem8 is not intended for anyone under 18, and we do not knowingly collect information from children.

Changes to this policy

As m80 grows we will expand this policy and update the effective date above. Material changes that affect how we use your data will be communicated by email, and where a change affects health data, in the app as well.