Privacy policy

Last updated: 26 October 2026

In short

Varalion helps you keep track of your own GLP-1 treatment and health. To do that it stores health information about you, which is sensitive information under Australian law. This page explains what we hold, who else sees it, and how you remove it.

No advertising, analytics or tracking. We do not sell your information or share it for advertising.
Your progress photos and profile photo stay with us. They are never sent to an artificial intelligence (AI) provider.
Meal photos and nutrition label photos are sent to Google to recognise the food. Photograph the food, not the people around it.
Vara, our in-app coach, uses AI. To do that, your first name and health records are sent to Anthropic or Google in the United States.
Your prescriber summary is made on your phone. You send it from your own email or share sheet. It does not pass through our servers.
You can delete your account inside the app. Deleting it deletes your data; it does not just hide it.

This summary is not the whole policy. The sections below are.

1. Who we are

The Varalion app is operated by Varalion Pty Ltd (ABN 83 701 644 813), a South Australian company (“Varalion”, “we”, “us”). Vara is the name of the coach inside the app, not a separate company.

We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles. The app is available outside Australia, so other laws also apply to some users. Section 14 covers those.

2. What we collect

2.1 Your account and profile

Email address (to sign in)
Your name and, if you choose, a preferred name
Date of birth, sex at birth and height, used to calculate your nutrition targets and BMI
Unit preference (metric or imperial) and time zone
Your goal, where you are in your treatment, and the month you started
Your activity level
A profile photo, if you add one
Notification and reminder preferences
Your prescriber’s name and email, and an alternative email for yourself, if you add them (section 5)
Your subscription status

2.2 Health information

All of the following is health information. We collect it only with your consent, and only because the app cannot work without it.

Your medication, dose, schedule, and any pauses or changes
Doses you log, including doses you skip, edit or delete, and a history of those edits
Weight, starting weight and body measurements
Your daily targets for calories, protein, fibre, water and steps
Meals and nutrition, including foods you create and any notes you write
Water and step counts
Mood entries and any notes you write
Side effects, their severity and duration, and any notes you write
Progress photos, meal photos and nutrition label photos (section 3)
Your conversations with Vara (section 4)

2.3 Apple Health and Android Health Connect

If you allow it, we read your daily step count from Apple Health or Health Connect. We ask separately before doing this, and you can turn it off at any time in your phone’s settings. We only read step counts. We do not use this data for advertising and do not sell it.

2.4 Your device

To send reminders, we store a push notification token for your phone, its platform (iOS or Android) and the app version.

2.5 Payments

Subscriptions are bought through the Apple App Store or Google Play. We never see your card details. We receive your subscription status through RevenueCat.

2.6 What we do not collect

The app contains no analytics, advertising, crash reporting or tracking tools. We do not collect your location or contacts. Our hosting provider keeps ordinary server logs, including IP addresses, for a limited period.

3. Photographs and scanning

3.1 Progress photos and your profile photo

These are stored in a private area of our storage that cannot be accessed publicly. Only you can view them, through a temporary link sent to your phone. They are never sent to Google, Anthropic or any other AI provider, and never analysed by any automated system. They are deleted when you delete the photo or your account.

3.2 Meal photos and nutrition label photos

When you photograph a meal or a nutrition label, the image is sent to Google’s Gemini service to recognise the food or read the label. Only the image is sent, without your name or account details. Google processes it to return a result.

If you save the photo with your meal, we store it privately, on the same terms as progress photos. A saved photo is never sent to an AI provider again.

Please photograph the food, not the people around it. Everything in the frame is sent to Google, including faces and surroundings, and including people who have not agreed to it.

3.3 Barcode scanning

When you scan a barcode, the barcode number is looked up in a food database to find the product. Your name and account details are not sent with it.

4. Vara, the in-app coach

Vara writes your daily outlook on the Today screen and answers you in chat. Vara is powered by AI services from Anthropic and Google, and is part of the app you agree to when you create an account.

4.1 What is sent

To prepare a reply or your daily outlook, the following is sent to an AI provider:

Your first or preferred name, so Vara can address you
Your age group (not your date of birth), time zone and goal
Your medication, dose, schedule, and whether you are paused
Your recent doses
Your weight trend, nutrition, water and steps
Side effects, their severity, and notes you have written
Mood entries and notes you have written
Your recent conversation with Vara

We never send your email address, your account ID, your date of birth, or any photo of you.

4.2 Who receives it

Anthropic (United States) prepares your daily outlook and some chat replies. Anthropic does not use information sent through its commercial service to train its AI models.
Google (United States) prepares other chat replies.

Each provider keeps what we send for a limited period under its own terms.

4.3 How long we keep your chats

Vara remembers recent conversations so it can follow up with you. Conversations are deleted automatically after 30 days.

4.4 What Vara is not

Vara makes observations about what you have recorded. Vara does not diagnose, does not give medical advice, and is not a substitute for your prescriber. Vara can be wrong. Do not change your treatment because of anything Vara says without speaking to your prescriber first.

5. Prescriber summary

You can create a summary of your records to share with your prescriber or anyone else you choose.

It is made on your phone. The PDF is built on your device from your own records. It only includes the sections and dates you choose. It never includes photos, notes you have written, or anything written by Vara.
You send it yourself. It goes from your own email app or your phone’s share sheet. It does not pass through Varalion’s servers, and we do not keep a copy or see who you send it to.
Stored details are optional. If you save your prescriber’s name and email, or an alternative email for yourself, we keep them on your account so they are filled in for you. An address you type in once for someone else is never stored.
We record when you last made one. We keep the date you last created a summary, so the app can offer “since my last summary”.

Once you send a summary, the person who receives it handles it under their own obligations, for example your clinic’s privacy policy.

6. How we use your information

To run the app and show you your own records
To send the reminders and notifications you have turned on
To prepare Vara’s daily outlook and chat replies
To recognise food in meal photos, read nutrition labels and look up barcodes
To build your prescriber summary
To manage your subscription
To answer you when you contact us
To meet our legal obligations

We do not sell your information. We do not share it for advertising. We do not build profiles of you for anyone else. We do not send marketing emails to app users unless you have agreed to receive them, and you can unsubscribe from any email we send.

7. Who else receives your information

Who	What they receive	Where	Why
Supabase	All app data, including photos	United States	Hosting, database, storage and sign-in
Anthropic	The coach information in section 4	United States	Daily outlook and chat
Google (Gemini API)	The coach information in section 4, meal photos and nutrition label photos	United States	Chat, food recognition and label reading
RevenueCat	Subscription status and an app-specific ID	United States	Managing subscriptions
Apple and Google (app stores)	Purchase details and your push notification token	Varies	App distribution, payments, notifications
Kit	Your email address, if you joined the waitlist or signed up for updates	United States	Email
Sevalla and Cloudflare	Technical data from visits to varalion.com	Varies	Website hosting and security

We also disclose information where the law requires it, and to professional advisers who are bound by confidentiality.

8. Sending information overseas

Your information is stored and processed outside Australia, mainly in the United States, by the providers in section 7. We take reasonable steps to make sure they handle it appropriately, including through contracts. Overseas providers are not bound by the Australian Privacy Act, and you may not be able to seek a remedy under it against them.

9. How long we keep it, and deleting your account

While your account is open, we keep your records so you can see your history, except Vara conversations, which are deleted after 30 days.
When you delete your account (from the Profile screen), we delete your account, your health records, your conversations with Vara, your prescriber details, and all your photos: progress, meal and profile. Deletion starts immediately and cannot be undone.
Backups: deleted data may stay in encrypted backups for a limited period until those backups expire.
AI providers: what was sent to Anthropic or Google is kept by them for the period in section 4.2.
Payment records: Apple and Google keep their own purchase records.

10. Security

All data is encrypted in transit and at rest.
Database access rules mean your records can only be read by your own account.
Photos are kept in private storage and only shown through short-lived links sent to your phone.
Administrative access to user data is limited, and used only to fix a fault or answer a support request.

No system is completely secure. If a data breach is likely to cause you serious harm, we will tell you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires, and any other regulator whose laws require it.

11. Your consent

We collect health information only with your consent, which you give when you set up your account. You can withdraw it by deleting your account.

These features are optional. You can say no to any of them and keep using the rest of the app:

Reading step counts from Apple Health or Health Connect
Meal photo and nutrition label recognition
Progress photos and a profile photo
Saving your prescriber’s details

12. Your rights

You can, at any time:

See the information we hold about you. Most of it is shown in the app.
Correct anything that is wrong.
Ask for a copy of your data by emailing hello@varalion.com.
Delete your account and your data, from the Profile screen.
Complain to us at hello@varalion.com.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

13. Age

Varalion is for people aged 18 and over. We do not knowingly collect information from anyone under 18. If we learn that we have, we will delete it.

14. If you are outside Australia

14.1 Europe and the United Kingdom

We handle your health information on the basis of your explicit consent (Article 9(2)(a) GDPR, and the UK GDPR equivalent). We handle your account and subscription details to perform our contract with you (Article 6(1)(b)).

You have the right to access, correct, erase, restrict and object to the handling of your information, and to receive it in a portable format. You can withdraw consent at any time; this does not affect anything done before. You can complain to your local data protection authority.

14.2 United States

We do not sell your health information and do not share it for advertising.

15. Our website

varalion.com is hosted by Sevalla, with security from Cloudflare. The site uses no analytics or advertising cookies. Cloudflare may set a short-lived cookie to filter out automated bots.

If you join the waitlist, your email address is handled by Kit in the United States. You can unsubscribe from any email.

16. Changes to this policy

If we change this policy in a way that affects you, we will tell you in the app before the change takes effect.

Varalion Pty Ltd · hello@varalion.com · Home