Effective Date: August 28, 2026

This Privacy Notice explains how MicAI Software Limited ("MicAI," "we," "our," or "us") collects, uses, discloses, retains, and protects personal information when you use the NEXFIT mobile application, website, and related services (collectively, the "Services"). It also explains the privacy choices and rights available to you.

By using the Services, you acknowledge the practices described in this Privacy Notice. Where consent is required, including before personal information is shared with a third-party artificial intelligence provider, we will request that consent separately and before the relevant processing begins.

1. Scope and Eligibility

This Privacy Notice applies to personal information processed through the Services. It does not apply to third-party products or services that you access independently, even if they are linked from the Services.

The Services are intended for adults age 18 or older. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected personal information from a person under 18, we will take reasonable steps to delete the information and associated account. A parent or guardian who believes that a minor has provided us with personal information may contact us at support@mic-ai.com.

2. Personal Information We Collect

We collect personal information directly from you, automatically when you use the Services, and from platforms or services that you choose to connect.

A. Account and Profile Information

Depending on the features you use, we may collect:

• Name;

• Email address;

• Account identifier;

• Profile photograph, if you choose to provide one;

• Date of birth, age, and gender;

• Login and authentication information received from Sign in with Apple, Google Sign-In, or another login provider you select; and

• Subscription status, purchase history, and entitlement information. We do not receive or store your full payment-card number when a purchase is processed by the Apple App Store or Google Play.

B. Health, Fitness, Nutrition, and Activity Information

You may choose to enter, upload, generate, or synchronize information such as:

• Height, weight, body mass index, body measurements, and fitness goals;

• Dietary preferences, restrictions, allergies, food and drink consumption, calorie and macronutrient targets, and nutrition history;

• Food names, food photographs, serving information, recipes, recipe names, ingredients, and cooking instructions;

• Exercise and equipment names, fitness-equipment photographs, workout plans, training recommendations, sets, repetitions, resistance or weight, exercise volume, rest periods, session duration, and workout history;

• Heart rate, active energy, calorie-expenditure estimates, and related activity information;

• Progress photographs and other photographs you choose to upload; and

• Information derived from the foregoing, including nutrition estimates, training metrics, trends, and AI-generated analyses.

C. Connected Health Data

With your separate permission, NEXFIT may read specific information from Apple HealthKit or Google Health Connect, such as workout, heart-rate, active-energy, and related fitness data. The permission screen presented by your device identifies the specific data types requested. You may change those permissions at any time in your device settings.

We do not use data obtained from Apple HealthKit or Google Health Connect for advertising, marketing, data-broker activities, or cross-app tracking. We do not store personal HealthKit information in iCloud.

D. AI Inputs, Outputs, and Feedback

When you use an AI-powered feature, we may process:

• The text, photographs, records, and other content you choose to submit;

• Relevant health, fitness, nutrition, or workout context needed to respond to your request;

• The instructions sent to the AI service;

• The AI-generated response; and

• Feedback you provide about the response.

We do not send your name or email address to the Gemini API as part of an AI prompt unless a particular feature clearly requires it and we disclose that fact before transmission. We seek to remove unnecessary identifiers and image metadata before transmitting AI requests.

E. Communications and Support

We collect the information you provide when you contact support, submit feedback, report a problem, or otherwise communicate with us. This may include your contact details, message content, attachments, and information reasonably necessary to resolve your request.

F. Device, Usage, and Diagnostic Information

We and our service providers may automatically collect:

• Device type, operating-system version, app version, language, time zone, and device or installation identifiers;

• Internet Protocol address and information derived from it for security, fraud prevention, diagnostics, or approximate regional settings;

• App launches, screens or features used, taps, searches, session duration, and other product-interaction information;

• Crash logs, performance information, error reports, and technical diagnostics;

• Push-notification token, if notifications are enabled; and

• Website browser, cookie, and page-interaction information.

We do not use this information to track you across apps or websites owned by other companies for targeted advertising.

3. How We Use Personal Information

We use personal information to:

• Create, authenticate, secure, and administer your account;

• Provide food logging, recipe, nutrition, workout, and fitness-tracking features;

• Synchronize information across your authorized devices;

• Calculate metrics and display trends, histories, and progress;

• Personalize nutrition and fitness recommendations;

• Process photographs and other content when you request an AI-powered analysis;

• Generate AI-assisted food, recipe, equipment, workout, and fitness insights;

• Maintain subscription status and provide paid features;

• Send service, security, support, and administrative communications;

• Provide notifications that you have enabled;

• Diagnose crashes, prevent fraud or misuse, maintain security, and improve reliability;

• Analyze how features perform and improve the design and usability of the Services;

• Enforce our Terms of Service and protect the rights, safety, and integrity of MicAI, our users, and others; and

• Comply with applicable law and respond to valid legal requests.

Where applicable law requires a legal basis, we process personal information as necessary to perform our contract with you, with your consent, to comply with legal obligations, and for legitimate interests such as security, fraud prevention, support, and product reliability, provided that those interests are not overridden by your rights. You may withdraw consent at any time as described below.

4. AI Processing and Google Gemini

Certain optional NEXFIT features use Google LLC's Gemini API to analyze information and generate a response. Before any personal information is sent to Gemini, NEXFIT presents an in-app notice describing the provider, the relevant categories of data, and the purpose of the transfer, and asks for your explicit permission.

Depending on the feature you choose, information sent to Gemini may include:

• Food names, food photographs, serving information, and nutrition context;

• Recipe names, ingredients, recipes, and cooking instructions;

• Fitness-equipment photographs and equipment names;

• Exercise names, sets, repetitions, resistance or weight, session duration, and workout records;

• Heart-rate and calorie-expenditure data;

• Fitness goals, body metrics, dietary preferences, and related context; and

• The portion of your workout or nutrition history reasonably necessary to provide the analysis you requested.

We do not send an entire workout or nutrition history unless the feature requested by you requires historical analysis and the in-app notice clearly identifies that use. We limit each transfer to the information reasonably necessary to perform the requested feature.

We access Gemini through a billing-enabled Google Cloud project and use the paid Gemini API. Under Google's terms for paid Gemini API services, Google does not use prompts, uploaded files, or generated responses to improve its products. Google may retain limited prompts, responses, and related technical information for a limited period for abuse prevention, safety, security, and required legal or regulatory disclosures. Information may be processed in countries where Google or its service providers maintain facilities.

Unless you separately opt in to a clearly described program, MicAI does not use your food photographs, equipment photographs, connected health data, or identifiable workout history to train a general-purpose artificial intelligence model.

You may decline AI processing or later withdraw permission in Settings > Privacy > AI Data Sharing. If you withdraw permission, we will stop sending new information to Gemini. AI features that require the transfer will no longer be available, but unrelated manual logging and non-AI features will remain available. Withdrawal does not affect processing that occurred before withdrawal or limited information retained by a provider for security or legal compliance.

Camera, photo-library, and HealthKit permissions are separate from permission to share information with Gemini. Granting an operating-system permission does not by itself authorize third-party AI processing.

5. How We Disclose Personal Information

We do not sell personal information. We do not share personal information for cross-context behavioral advertising, and we do not permit health or fitness data to be used for advertising or marketing.

We may disclose information as follows:

A. Google Cloud and Firebase

We use selected Google Firebase services, which may include:

• Firebase Authentication to register, authenticate, and secure accounts;

• Cloud Firestore and Firebase Storage to store and synchronize profile information, fitness and nutrition records, user-selected photographs, and saved results;

• Firebase Analytics to understand feature usage and product performance;

• Firebase Crashlytics and related performance tools to diagnose crashes, errors, and performance issues; and

• Firebase Cloud Messaging to deliver notifications that you enable.

The exact information processed depends on the Firebase services enabled in the version of NEXFIT you use.

B. Google Gemini API

We disclose the information described in Section 4 to Google LLC only after obtaining the explicit permission described there and only to provide the AI-powered feature requested by you.

C. Login, Health, and App-Store Platforms

We exchange limited information with Apple, Google, or another provider when you choose its authentication, health-data, payment, subscription, or app-distribution services. Those providers also process information under their own terms and privacy notices.

D. Website and Operational Service Providers

We may use service providers for website hosting, cloud infrastructure, security, email delivery, customer support, and other operational functions. Our website is hosted using Squarespace services. These providers may process information only as necessary to perform services for us or as otherwise permitted by law.

E. Legal, Safety, and Corporate Events

We may disclose information when reasonably necessary to comply with law, legal process, or a valid government request; enforce our agreements; investigate fraud or security incidents; or protect the rights, property, or safety of MicAI, our users, or others.

If MicAI is involved in a merger, financing, acquisition, reorganization, bankruptcy, or sale of assets, information may be disclosed as part of that transaction, subject to applicable law and continuing privacy protections.

We contractually require service providers that receive personal information on our behalf to maintain confidentiality, use appropriate safeguards, process information only for authorized purposes, and provide protection that is the same as or equivalent to the protection described in this Privacy Notice and required by applicable platform rules.

6. Cookies and Similar Technologies

Our website and certain portions of the Services may use cookies, local storage, SDKs, and similar technologies to keep the Services functioning, remember preferences, prevent fraud, measure performance, and understand usage. Where required by law, we request consent before using non-essential analytics technologies. You may manage browser cookies through your browser settings, although blocking essential technologies may affect website functionality.

7. Data Retention

We retain personal information only for as long as reasonably necessary to provide the Services, maintain security, comply with legal obligations, resolve disputes, and enforce our agreements.

In general:

• Account and profile information is retained while your account is active;

• Saved nutrition, fitness, workout, recipe, photograph, and AI-result information is retained until you delete it or delete your account;

• Support records may be retained for up to three years after the matter is closed, unless a longer period is required by law;

• Consent and transaction records may be retained for the period necessary to demonstrate compliance and resolve disputes;

• Diagnostic and security logs are ordinarily retained for no longer than 12 months unless they are needed to investigate an incident; and

• Deidentified or aggregated information that can no longer reasonably identify you may be retained for analytics, security, and product planning.

After an account-deletion request, we delete or deidentify personal information from active systems within 30 days, except for information that we must retain for legal, security, fraud-prevention, transaction-record, or dispute-resolution purposes. Encrypted backup copies may persist until automatically overwritten, ordinarily within 90 days. Limited information retained independently by a service provider for abuse prevention, security, or legal compliance is subject to that provider's applicable retention obligations.

8. Your Choices and Privacy Rights

Depending on your location, you may have the right to access, correct, delete, or obtain a portable copy of personal information; restrict or object to certain processing; withdraw consent; and appeal a denied request. You may exercise many of these choices directly in NEXFIT.

A. Account and Record Controls

You may review or edit profile information and delete individual saved records through the app where those controls are available.

B. AI Data Sharing

You may enable or disable AI data sharing in Settings > Privacy > AI Data Sharing. Disabling it prevents future transmissions to Gemini but does not automatically delete information already saved to your NEXFIT account. You may delete saved records separately or delete your account.

C. Device and Health Permissions

You may revoke camera, photograph, notification, Apple HealthKit, or Google Health Connect permissions through your device settings. Revoking a permission prevents future access but does not automatically delete information previously imported or saved in NEXFIT.

D. Account Deletion

You may initiate account deletion in Settings > Account > Delete Account. Account deletion includes deletion or deidentification, as applicable, of the Firebase Authentication account, personal profile, Firestore records, stored user photographs, and saved AI inputs or outputs controlled by MicAI, subject to the limited retention described in Section 7. Where supported, we also initiate deletion requests with relevant processors.

Deleting your NEXFIT account or uninstalling the app does not automatically cancel an App Store or Google Play subscription. You must cancel the subscription through the storefront that manages it.

E. Contacting Us

You may submit a privacy request to support@mic-ai.com. We may need to verify your identity before completing a request. Authorized agents may submit requests where permitted by law, subject to appropriate verification.

We will not discriminate against you for exercising a privacy right. Some rights may be limited by law, and certain information may be exempt from deletion where retention is legally required.

9. Security

We use administrative, technical, and organizational safeguards designed to protect personal information. These safeguards include encrypted transmission, access controls, authentication controls, least-privilege practices, monitoring, and service-provider security requirements. Where supported by the applicable service, stored information is encrypted at rest.

No system can be guaranteed to be completely secure. You are responsible for protecting your device and account credentials and for notifying us promptly if you believe your account has been compromised.

10. International Data Transfers

MicAI and its service providers may process personal information in the United States and other countries where they operate. Those countries may have privacy laws different from the laws where you live. Where required, we use contractual protections or other approved transfer mechanisms intended to provide an appropriate level of protection.

11. Regional Disclosures

Residents of certain jurisdictions, including U.S. states, Canada, the European Economic Area, the United Kingdom, Switzerland, and Japan, may have additional rights under local law. These may include rights to know or access information, correct inaccurate information, request deletion, obtain portability, restrict or object to processing, withdraw consent, and complain to a privacy or data-protection authority.

MicAI does not sell personal information or share it for cross-context behavioral advertising. If our practices change, we will update this Privacy Notice and provide any choices required by law before the new practice begins.

12. Changes to This Privacy Notice

We may update this Privacy Notice to reflect changes to the Services, our practices, or legal requirements. We will update the Effective Date and, when a change materially affects your rights or expands how we use sensitive information, provide a prominent in-app notice and request new consent where required. We will not use information collected for a materially different purpose without additional notice and consent where required.

13. Contact Us

For privacy questions, requests, or complaints, contact:

MicAI Software Limited
Email: support@mic-ai.com
Website: https://www.mic-ai.com