Privacy policy

In short

IBS AI is a diary and a guide for people managing digestive symptoms. To work, it stores what you choose to write in it: what you ate, how you felt, which program phase you are in and, if you log it, which medication you take and when. That is information about your health, so we treat it with extra care and ask for your explicit consent before anything is stored.

We do not sell your data, we do not show ads, we do not profile you, and nobody at Mudacorp reads your diary unless you ask us for help with it. If you turn on the AI meal analysis, the text of a meal — and only that — is sent to an AI provider for that one task. You can download everything, or delete everything, from Settings at any time.

1. Who is responsible

The data controller is Mudacorp ("Mudacorp", "we"). For anything about your data, write to hello@mudacorp.com.

2. What IBS AI is — and is not

IBS AI is a self-tracking tool. It is not a medical device, it does not diagnose or treat anything, and nothing in it is medical or dietetic advice. We do not review, interpret or act on what you log. See the Terms of service for the full disclaimer.

3. What we collect

Account data: your email address, your language, and the date you joined.

What you log — health data: meals and drinks you write down and the foods the analysis found in them; your symptom scores, stool type, context tags and notes; red-flag symptoms you tick; your answers to the starting questions, including any about diagnosis or medication; the program phase you are in and the dates; reintroduction tests and their results; the medication, doses and injections you record; your protein and fluid targets. You decide what to enter.

AI analysis: when you ask IBS AI to analyse a meal, the text you wrote for that meal is sent to our AI provider, which returns the foods it recognised and, depending on the product, their FODMAP groups or an estimate of protein. The provider receives the meal text only — no name, no email, no other entries — and under our agreement does not keep it or use it to train models. The analysis is off until you turn it on, and you can turn it off in Settings. We record that a call happened (when, how long, how many tokens, whether it succeeded), never its content.

Billing data: if you buy a plan on the web, payments are handled by Stripe and we receive your subscription status, the plan, the dates and a customer reference; we never see or store your full card number. In a phone app, the app store handles payment and we receive only a confirmation of the purchase.

Technical data: like every online service, the servers that deliver IBS AI record your IP address, device or browser type and the time of each request, for security and to fix faults. The app keeps you signed in and remembers your language on your device.

Usage data on this website: to understand how the landing pages are used we use PostHog (hosted in the European Union), which records page views, clicks and session replays without setting a cookie. The app itself sends no usage analytics today; if that changes, this policy will say so first.

4. What we do not do

No advertising and no advertising trackers on IBS AI. No sale or rental of personal data. No sharing of your entries with insurers, employers, pharmaceutical companies or data brokers — a report you choose to share with your doctor is shared by you, from your device. No automated decisions about you, and no use of your entries to train artificial-intelligence models, ours or anyone else's.

5. Why we use it, and on what legal basis

To give you the service you signed up for — your account, your diary, your program, your insights (performance of our contract with you, GDPR Art. 6(1)(b)).

For your health data specifically: your explicit consent (GDPR Art. 9(2)(a)), which IBS AI asks for before you log anything, and a separate consent for sending meal text to the AI provider. You can withdraw either at any time — the AI consent in Settings, the storage consent by deleting your entries in Settings or by writing to us; withdrawing does not affect what was done before.

To bill you and keep the invoices the law requires (contract, and legal obligation, Art. 6(1)(c)).

To keep the service secure and working — preventing abuse, diagnosing errors (our legitimate interest, Art. 6(1)(f)). We do not use your entries for this.

6. Who processes it for us

We use a small number of providers, each bound by a data processing agreement and allowed to use your data only to provide their service to us: Supabase (database and sign-in; your entries are stored in the European Union, in Ireland), Cloudflare (delivers the website and the web app), OpenAI (the AI meal analysis; receives meal text only, in the United States, with no retention for training), Stripe (payments and invoices on the web), Resend (sends sign-in and service emails), PostHog (usage statistics on this website, stored in the European Union), and, for the phone apps, Apple and Google (distribution and in-app purchases).

Some of these companies are based in the United States or may process data there. Where personal data leaves the European Economic Area, it is protected by the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework.

We may disclose data if a law or a court order requires it. If IBS AI is ever transferred to another company, your data would move with it under this policy and we would tell you first.

7. How long we keep it

Your entries stay until you delete them. You can erase everything you logged from Settings, immediately; the consent record goes with it.

If you stop using IBS AI, your account and entries are kept so you can come back to them. To delete your account entirely, write to hello@mudacorp.com; we do it within 30 days. Backup copies are overwritten on a rolling basis within a further 30 days.

Invoices and payment records are kept for as long as tax and accounting law requires (ten years in Portugal). Server logs and the records of AI calls (without content) are kept for a limited period and then deleted.

8. Your rights

You can see your data (it is all in the app), correct it, download it in a standard format (Settings → Share my data), delete it, ask us to restrict or stop a use of it, and withdraw your consent. Write to hello@mudacorp.com for anything the app does not let you do yourself; we answer within one month and it costs nothing.

If you think we have handled your data wrongly, you can complain to your data protection authority. In Portugal that is the Comissão Nacional de Proteção de Dados (cnpd.pt). We would rather hear from you first and put it right.

9. Security

Connections to IBS AI are encrypted. Each entry is stored against your account, and the database itself enforces that only your account can read or change it. Access by our own staff is limited to what is needed to run the service and to help you when you ask.

No online service can promise perfect security. If a breach affecting your data ever occurs, we will tell you and the authorities as the law requires.

10. Age

IBS AI is for adults. It is not intended for anyone under 18, and a restrictive diet or a medication plan for a child or teenager should only be followed with a health professional. If you believe a minor has created an account, write to us and we will remove it.

11. Changes to this policy

If we change this policy we will update the date at the top. If a change affects how we use your health data — a new provider, analytics in the app, a new use of the AI — we will tell you in the app and ask for your consent again where the law requires it.