Privacy Policy

LEAN LINE

Effective date: __ __, 2026

Version: v1.0 (English edition)

H Solution Factory Co., Ltd. ("we", "us", "our") provides the LEAN LINE mobile application and website (the "Service"). This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and what rights you have.

The Service is available only to individuals aged 18 or over.

The Service is a record-keeping and reminder tool. It is not a medical device and does not provide medical advice, diagnosis, or treatment.

1. Who We Are

Data Protection Officer

We are established in the Republic of Korea. We do not offer the Service to residents of the European Economic Area.

2. Information We Collect

2.1 Account information

Your email address is stored only in Firebase Authentication. It is not written to our application database.

2.2 Health data (special category data)

The following is health data. Under UK GDPR Article 9 this is special category data, and under Korean law it is sensitive information. We collect it only with your explicit consent.

2.3 Service usage information

2.4 Optional information

Declining does not limit your use of the Service.

2.5 Information we do not collect

• Your name, national identification number, date of birth, phone number, or postal address
• Payment card details or other payment instrument data
• Your IP address or access logs
• Device identifiers assigned by the manufacturer or operating system (IDFV, Android ID, advertising identifiers)
• Location data

We do not use behavioural analytics tools such as Firebase Analytics.

The device restore key is a random string the app generates on first launch. It is different from an operating system device identifier. It is held in your device's secure storage, and our servers hold only that key and the identifier of the account last used. It is normally deleted when you uninstall the app, though it may persist depending on your device settings.

2.6 Apple Health integration (iOS only)

If you grant permission and start a sync, we read the following from the Apple Health app:

• Body fat percentage
• Lean body mass
• Basal metabolic rate
• The identifier of the app that recorded the data

We never write anything to Apple Health, and we do not access any other health data. You may revoke this permission at any time in your device settings.

2.7 Crash reports

If the app terminates unexpectedly, Firebase Crashlytics sends us the point of failure, device model, operating system version, and your user identifier (UID). Your email address, nickname, and health records are not included.

3. How We Use Your Information and Our Legal Basis

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing carried out before you withdrew.

Where we rely on legitimate interests, we have assessed that our interest in operating a secure and reliable service does not override your rights.

We do not use your data for automated decision-making that produces legal or similarly significant effects.

4. Sharing Your Information

We do not sell your personal information. We do not share it for cross-context behavioural advertising.

We share information only in these circumstances.

4.1 Service providers

Each provider acts as our processor under a written agreement and may use the data only to provide the service to us.

4.2 Clinic Bridge

You may generate a single-use access code so that a healthcare provider can view your records.

• You create the code yourself and choose how long it lasts (15 minutes by default).
• Once it expires, the code cannot be used again.
• Viewable data: injection records, weight records, body composition, side effect summary, four-week statistics.
• You can see who accessed your records and when, inside the app.
• We never let any third party view your records without your explicit request.

This is a viewing facility you control. Any diagnosis or prescription based on what a provider sees is that provider's responsibility.

4.3 Legal requirements

We may disclose information where required by law, or where necessary to protect the life or safety of you or another person.

5. International Transfers

Our database is located in the Republic of Korea (Seoul). Some processing takes place in the United States.

We use the paid Gemini API. Google does not use content sent through it to train its models.

If you would like a copy of the safeguards we rely on, contact support@leanline.app.

6. How Long We Keep Your Information

Consent records are kept so that we can demonstrate we obtained valid consent. They contain the consent type, timestamp, and policy version. They do not contain your email address, nickname, or health data.

7. Your Rights

You have the following rights. To exercise them, use the app where indicated or contact support@leanline.app.

We respond within one month. If your request is complex we may extend this by two further months, and we will tell you why within the first month.

We do not charge a fee unless a request is manifestly unfounded or excessive.

We will verify that you are the account holder before we act. For sensitive requests such as a full data export, we ask you to sign in again.

Complaints. If you are unhappy with how we have handled your information, please contact us first. You also have the right to complain to a supervisory authority — see Section 11 for the authority in your country.

8. Security

We protect your information with the following measures.

Organisational

• Access to personal data is limited to staff who need it
• A Data Protection Officer is appointed

Technical

• Database access rules restrict each user to their own records
• Data is encrypted in transit (TLS)
• Secrets such as API keys are held in a dedicated secret manager
• App integrity verification (App Check)
• Clinic Bridge access is logged; IP addresses are hashed rather than stored in the clear

Physical

• Data is held in data centres operated by our cloud provider under their physical security controls

No system is completely secure. If a breach occurs that is likely to result in a risk to your rights, we will notify the relevant supervisory authority and, where required, you.

9. Journey Sharing

You may choose to share your weight progress with other users.

• A post shows your nickname, elapsed weeks, weight change, and a short message you write.
• Medication names, doses, and side effect information are never shown.
• Weight figures are calculated on our servers from your own records. You cannot alter them.
• You may delete your posts at any time. All posts are deleted when you close your account.
• We review reported posts and may hide or remove them.

Please do not include information that identifies you, or any contact details, in a post.

10. AI Guidance

The Service uses artificial intelligence to provide general information.

• Your question and a summary of your injection and weight records are sent to Google LLC's Gemini API.
• We use the paid API. Google does not use this content to train its models.
• AI guidance is general information only. It does not diagnose, prescribe, or decide a dose.
• AI consultation records are kept so that we can improve the Service and review its safety. They are deleted when you close your account.

11. Regional Provisions

11.1 For residents of the United Kingdom

We process your data as a controller under the UK GDPR and the Data Protection Act 2018. Our legal bases are set out in Section 3, and your rights in Section 7.

We rely on your explicit consent under Article 9(2)(a) to process health data. You may withdraw it at any time, though doing so means we can no longer provide the core features of the Service.

You may lodge a complaint with the Information Commissioner's Office.

Website: ico.org.uk · Helpline: 0303 123 1113

11.2 For residents of California

Under the California Consumer Privacy Act as amended (CCPA/CPRA), you have the right to:

• Know what personal information we collect, use, and disclose
• Delete the personal information we hold about you
• Correct inaccurate personal information
• Opt out of the sale or sharing of personal information
• Limit the use of sensitive personal information
• Non-discrimination for exercising these rights

We do not sell or share your personal information, and we have not done so in the preceding twelve months.

We collect sensitive personal information in the form of health data. We use it only to provide the Service you requested, and not for any purpose that would trigger the right to limit under §1798.121.

Categories collected in the preceding twelve months: identifiers, health information, commercial information (subscription status), and internet activity limited to crash diagnostics. Sources, purposes, and recipients are described in Sections 2 to 5.

To exercise these rights, use the app or contact support@leanline.app. You may use an authorised agent; we will ask for proof of authorisation.

11.3 For residents of Canada

We handle your information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA).

We obtain your express consent for health data, which is sensitive information under PIPEDA. You may withdraw consent subject to legal and contractual restrictions, with reasonable notice.

You may access and correct your personal information as described in Section 7. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).

11.4 For residents of Australia

We handle your information in accordance with the Privacy Act 1988 and the Australian Privacy Principles (APPs).

Health information is sensitive information under APP 3. We collect it only with your consent and only where it is reasonably necessary for the Service.

Under APP 8, we disclose your information to overseas recipients in the United States as set out in Section 5. By consenting, you acknowledge that APP 8.1 may not apply to those recipients and that we may not be accountable under the Privacy Act for their handling of your information.

You may access and correct your information under APPs 12 and 13 as described in Section 7. Complaints may be made to the Office of the Australian Information Commissioner (oaic.gov.au).

11.5 For residents of the Republic of Korea

A separate Korean-language privacy policy applies and prevails for Korean residents. It is available at leanline.app/privacy.

11.6 European Economic Area

We do not offer the Service to residents of the EEA and do not intend to monitor their behaviour. If you believe you have accessed the Service from the EEA, please contact support@leanline.app.

12. Children

The Service is for adults aged 18 or over. We do not knowingly collect information from anyone under 18.

If we learn that we hold information about someone under 18, we close the account and delete the information without delay.

If you believe a person under 18 has provided us with information, please contact support@leanline.app.

13. Changes to This Policy

We may update this policy to reflect changes in law or in the Service.

We will give at least 7 days' notice in the app and on our website before a change takes effect. Where a change materially affects your rights we will give at least 30 days' notice and, where required, seek your consent again.

14. Contact Us

For any question about this policy or about how we handle your information:

support@leanline.app

H Solution Factory Co., Ltd. 1802, 5 Hwamyeong-daero, Buk-gu, Busan, Republic of Korea

This policy takes effect on __ __, 2026.