Privacy Policy
Last updated 14 October 2026. BioFilz is operated by Directory.com.au Pty Ltd (ABN 68 090 816 461), an Australian company.
This policy explains what we collect, why, where it lives and how to get rid of it. Health information is sensitive information under the Privacy Act 1988 (Cth) and we treat it that way.
What we collect
- Account details - your email address, a name if you give one, and a hashed password. We never store your password itself.
- Health information you enter - medications and supplements, doses you tick off, weigh-ins and body composition, meals and nutrition, exercise and steps, vitals, blood test results, notes, check-ins, tasks and reminders.
- Files you upload - photos of meals, medication labels and scale displays, and pathology reports as images or PDFs.
- Genetic markers - if you use the DNA feature, only the specific markers in our published panel. Your raw genotype file is read in your browser and is never uploaded to us.
- Technical data - the IP address a request came from (for rate limiting and abuse prevention), a session cookie, and a basic audit log of security-relevant actions such as sign-ins.
- Push subscriptions - if you turn on reminders, the endpoint your browser gives us so notifications can be delivered.
We do not use advertising trackers, analytics scripts or third-party cookies.
How we use it
To run the app for you: to show you your own records, work out your charts and statistics, send the reminders you asked for, and process your subscription. We also use it to keep the service secure and working.
Who we share it with
- Anthropic - when you use an AI feature, the relevant part of your data (for example, a meal photo, a report page, or a summary of what you have logged) is sent to Anthropic's API to produce that one answer. It is not used to train models. If you supply your own API key, the request goes to your own Anthropic account instead.
- Stripe - handles payments. Card details go directly to Stripe and never touch our servers. We store only a customer and subscription reference.
- Your browser's push service (Google, Apple, Mozilla or Microsoft, depending on your device) - delivers reminder notifications. Notification content is encrypted so only your device can read it.
- Nobody else. We do not sell, rent or trade your information, and we do not share it with insurers, employers, advertisers or data brokers.
We may disclose information if we are legally required to, or where it is necessary to protect someone's safety.
Where it is stored
On our own server in Sydney, Australia (AWS ap-southeast-2). The database is not public. Uploaded photos and documents are stored outside the web root and are streamed only after we check that the request comes from the account that owns them. API keys you supply are encrypted at rest with AES-256-GCM. All traffic is over HTTPS.
How long we keep it
Until you delete it. Records you delete inside the app are removed immediately, and deleting your account permanently removes everything associated with it - records, uploaded files and genetic markers - along with your push subscriptions. Backups roll over on a short cycle. We keep basic billing records for as long as Australian tax law requires.
Your rights
You can access and correct anything at any time inside the app, export the lot as a JSON file from Settings, or delete your account and all its data. You can withdraw consent for reminders by turning notifications off. If you would like a copy of your information in another form, or you think something is wrong, contact us.
Children
BioFilz is for adults. It is not designed for, or directed at, people under 16.
Security
We use hashed passwords, session cookies restricted to this app, CSRF protection on every write, rate limiting, encryption of secrets at rest, and permission checks on every file we serve. No system is perfectly secure. If we ever have a data breach likely to cause serious harm, we will notify you and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.
Complaints
Contact us first through the contact form and we will respond within a reasonable time. If you are not satisfied you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
Changes
If we change this policy we will update the date above. Significant changes will be flagged in the app.