How Lomba handles your data

Freiberger IT Consulting Pty Ltd (ABN 34 642 130 658, Australia) operates Lomba and decides how your data is used. For any question or request about your data, contact privacygetlomba.com.

• Your health log: meals and meal photos, glucose and ketone readings, weight, fasting, habits, notes, and any lab or care records you add.
• Data from services you connect: recovery, sleep, strain and workouts from WHOOP; weight and body composition from Withings.
• What you write to Ask: your questions and Lomba’s answers.
• Your account: email address, time zone, passkeys (a public key, never your fingerprint or face), and sign-in records.
• Technical records: server logs with your IP address and the pages requested, used to keep Lomba secure.

Health data is sensitive, so Lomba processes it only with your explicit consent: the box you tick when you create your account. You can withdraw that consent at any time by contacting privacygetlomba.com; that does not affect what was done with your data before. A health log cannot work without that consent, so withdrawing it means your account is disabled: you can no longer sign in, and your connected services stop syncing. Asking for a copy of your data, or for it to be deleted, is a separate request you can make at the same time.

Your account details are needed to provide the account you asked for. Technical records are kept because Lomba has a legitimate interest in keeping the service secure and preventing abuse. You don’t have to give Lomba any of this, but it cannot create an account without an email address, or keep your log without your consent.

Lomba does not sell your data or show you ads, and it makes no decisions about you with legal or similarly significant effects.

These kinds of service handle your data for Lomba. The list follows how Lomba is set up, so it changes when that does.

• HostingThe Netherlands, in the EU
  Runs the server and database that hold your records and photos.Everything you log, your account and your photos.
• Network and securityA global network, usually the location nearest you
  Delivers the site and protects it from attacks.Every request on its way to the server, including what you log.
• Backup storageWestern Europe, preferred but not guaranteed
  Keeps a nightly copy, so your records survive a server failure.A copy of the database and photos, encrypted before it leaves the server. The storage provider cannot read it.
• AI servicesThe United States and other countries the model provider uses
  Read meal photos, voice notes and typed meals, and write Ask answers.What you submit for AI-assisted logging, and your Ask questions with the records needed to answer them.
• Email deliveryA global network
  Sends sign-in codes and account email.Your email address and the message.
• Bot checkA global network, usually the location nearest you
  Checks that a person, not a script, is joining the waiting list.Your IP address and what your browser sends when the check loads, once you start typing an address on the home page.Only if you join the waiting list.
• Services you connectEach service's own systems
  WHOOP and Withings send your own data to Lomba.Lomba reads what you allow. It sends nothing back except the access you granted.Only if you connect them in Settings.

Ask us and we will tell you which company provides each service.

Your records and photos are stored on a server in the Netherlands, in the EU. Backups are encrypted on that server first, then kept in storage set to Western Europe, a preference the storage provider applies rather than a guarantee. The company that operates Lomba is Australian, so from Australia’s point of view your data is held overseas.

Some of the services above also process data outside the EU, in particular the AI services in the United States. When one of these services handles your data outside the EU, the transfer relies on the European Commission’s standard contractual clauses or an adequacy decision, as that provider’s published terms set out. The exception is an optional AI service that only the administrator can switch on: its provider has published no transfer terms of its own. Ask us and we will point you to those terms.

If you join the waiting list on the home page, we keep your email address and when you joined, to confirm it is yours and to invite you. Nothing else: no name, no health data. The legal basis is your request to be invited, a step you ask us to take before you sign up. You can leave at any time with the link in our email, which deletes your address from the list.

• An address that is never confirmed with the emailed code: deleted after 24 hours.
• A confirmed address: kept for up to 12 months, and deleted sooner when you leave the list or we invite you (the invitation then holds the address, as for anyone invited).
• To keep automated sign-ups out, the form runs the bot check listed above once you start typing.

• Your health log and account: until you ask for them to be deleted.
• Sign-in records: 180 days.
• Server access logs: 14 days. Application logs: 30 days.
• Encrypted backups: copies are replaced nightly, and a deleted record can remain in a backup for up to 14 days before that backup expires.
• Generated daily summaries: those more than 30 days old are deleted whenever a new one is made, and the rest with your account.

AI reads meal photos, voice notes and typed entries and turns them into a draft that you check before anything is saved. Ask uses AI to write answers from your records, and each answer is marked as written by an AI.

Only what a request needs is sent. Lomba does not train an AI model of its own on your records. The AI providers handle requests, and decide how long they keep them, under their own terms.

AI output can be wrong. Nothing Lomba writes is medical advice.

Lomba uses no advertising or analytics cookies and loads nothing from other websites, except the waiting list’s bot check, which loads once you start typing an address.

• A sign-in cookie that keeps you signed in.
• A short-lived cookie while you add a passkey.
• A cookie that remembers your text size on this device.
• Browser storage for your theme and where you placed the Ask button.

You can ask to:

• see the data Lomba holds about you, and get a copy in a format other software can read;
• correct anything that is wrong;
• delete your account and your data;
• restrict or object to how your data is used;
• withdraw your consent.

For now these requests are handled by hand: contact privacygetlomba.com. You will get an answer within one month.

If you are unhappy with how your data is handled, you can complain to us by contacting privacygetlomba.com: we will look into it and reply within 30 days. You can also complain to the Office of the Australian Information Commissioner, OAIC, and in the EU to the data protection authority of the country where you live or work, or where you think the problem happened.

You sign in with a passkey, not a password. Each account’s records are kept apart from every other account’s. Connections to Lomba are encrypted, and backups are encrypted before they leave the server.

If a breach puts your data at risk, it is reported to the regulators that must be told: the Australian Information Commissioner and, for people in the EU, the data protection authority within 72 hours. You are told directly if the breach is likely to cause you serious harm.

When this notice changes, the date at the top changes too. If a change affects how your data is used, you will be told by email before it applies.