Privacy policy

Last updated: 28 September 2026

Moment is a service developed and provided by Lifesum AB, reg. no. 556729-2841, a company established in Sweden under Swedish law. In this privacy policy we describe how we collect, use, transfer, maintain and store (collectively, “process”) your personal data when you use the Moment mobile app, this website and related services, and what we do to respect your privacy. We process personal data in compliance with applicable data protection law, including the EU General Data Protection Regulation (GDPR).

Who is responsible for your data

Lifesum AB is the controller of the personal data processed through Moment.

Lifesum AB
Repslagargatan 17B, 118 46 Stockholm, Sweden
Email: privacy@smallmoments.app

You can reach our data protection officer at dpo@lifesum.com.

Personal data we process

Account data

Your name, email address and profile picture, which we receive when you create an account or sign in with Google or Apple, along with your account settings, preferences and consents.

Health and wellness data

Information you choose to enter into the app, such as your medication, doses and dose schedule, weight and other body measurements, symptoms and side effects, food and meals, habits, goals and notes. This is data concerning health, a special category of personal data under the GDPR, and we only process it with your explicit consent.

Device and usage data

Information about the device you use, such as device model, operating system, app version, language and identifiers, and information about how you use the app, such as the features you use, crash reports and diagnostic logs.

Correspondence

The content of messages you send us, for example when you contact support.

Subscription data

If you buy a subscription, we receive information about your purchase and subscription status from the app store you bought it through. We do not receive your full payment card details.

Where the data comes from

We obtain personal data directly from you when you install the app, create an account and use our services. Some data is generated by the app as you use it. If you sign in with Google or Apple, we receive account data from them, and if you subscribe we receive purchase information from the app store.

Why we process your data and our legal bases

• Creating and managing your account, including sign-in, account recovery and deleting your account. Legal basis: performance of our contract with you.
• Providing the app, including tracking your doses, symptoms, meals and progress, reminders, habit features and showing you your history. Legal basis: performance of our contract with you and, for health data, your explicit consent.
• Customer support and essential communications, such as answering your questions and telling you about important changes to the service. Legal basis: performance of our contract and our legitimate interest in supporting our users.
• Managing subscriptions. Legal basis: performance of our contract with you.
• Keeping the service secure, including detecting and preventing misuse, fraud and security incidents. Legal basis: our legitimate interest in protecting Moment and its users.
• Improving the service, including debugging, analytics on how the app is used and product development. Legal basis: our legitimate interest in improving our services, and your consent where required.
• Marketing communications, where you have agreed to receive them. Legal basis: your consent or our legitimate interest in direct marketing. You can opt out at any time in the app settings or by using the unsubscribe link in a message.
• Complying with the law, such as bookkeeping requirements. Legal basis: legal obligation.

Some personal data is necessary for us to provide the service. Without it, we generally cannot create your account or provide the app and its features.

Health data

To provide Moment's core features, we need to process the health information you enter, such as your medication and doses, weight, symptoms and food. We only process this data with your explicit consent, which we ask for in the app. You can withdraw your consent at any time from the account settings in the app. Withdrawing consent does not affect processing that took place before you withdrew it, but without it we will not be able to provide the tracking features that depend on that data.

Moment does not make automated decisions about you that produce legal or similarly significant effects within the meaning of Article 22 of the GDPR.

Google user data

If you choose to sign in with Google, Moment requests only the openid, email and profile scopes. Through these we access your basic Google profile information:

• your name,
• your email address, and
• your profile picture.

We use this information only to create your Moment account and to sign you in to it. We do not access any other data in your Google account, we do not use Google user data for advertising, we do not sell it, and we do not transfer it to third parties except as necessary to provide the service (for example, to our hosting provider), to comply with the law, or as part of a merger or acquisition with your notice. Humans do not read this data unless you ask us to for support, it is needed for security purposes, or the law requires it.

Moment's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can remove Moment's access to your Google account at any time from your Google account's security settings. Deleting your Moment account deletes the Google profile information we hold, as described below.

Sign in with Apple

If you sign in with Apple, we receive your name and email address, or a private relay email address if you choose to hide your email. We use this information only to create your account and sign you in.

Who we share data with

We do not sell your personal data.

Within Lifesum AB, access to your data is limited to the people who need it for the purposes described above. We use service providers (processors) who process personal data on our behalf, for example for cloud hosting and infrastructure, sign-in and authentication, subscription management, analytics and crash reporting, email delivery and customer support tools. They are bound by data processing agreements in accordance with Article 28 of the GDPR, may only process your data on our instructions, and must keep it secure and confidential.

We share data with other recipients only if the law requires it or you have given your prior consent.

International transfers

Some of our service providers may process personal data outside the European Economic Area (EEA). When that happens we make sure appropriate safeguards are in place, such as a European Commission adequacy decision (for example for the UK), the EU-U.S. Data Privacy Framework where applicable, or the European Commission's Standard Contractual Clauses.

How long we keep data

We keep personal data for as long as necessary for the purposes described in this policy, or for as long as the law requires us to. When we no longer need it, we delete or anonymise it. We periodically review whether we still need the data we hold, including for accounts that have been inactive for a long time.

If you delete your account, withdraw a consent or opt out of direct marketing, we stop processing the relevant data for those purposes. We may need to keep some data for longer where the law requires it, for example for bookkeeping.

Your rights

Under the GDPR you have the right to:

• be informed about how we process your data,
• access a copy of the personal data we hold about you,
• have inaccurate data corrected,
• withdraw your consent where processing is based on consent,
• have your personal data deleted,
• restrict processing of your data,
• object to certain processing,
• data portability, meaning you can receive your data and reuse it elsewhere, and
• lodge a complaint with a supervisory authority. In Sweden this is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), but you can also contact the authority where you live or work.

To exercise your rights, or if you have a complaint about how we process your personal data, contact us at privacy@smallmoments.app.

Deleting your account

You can delete your account at any time from the account settings in the app. You can also ask us to delete it by emailing privacy@smallmoments.app from the email address linked to your account. When you delete your account, we delete or anonymise your personal data, except for data we are required by law to keep. Deleting the app from your device does not delete your account, and it does not cancel a subscription bought through an app store.

Children

Moment is not intended for anyone under 18, and you must not create an account if you are under 18. If you believe a child has given us personal data, please contact us at privacy@smallmoments.app and we will delete it.

Security

We use appropriate technical and organisational measures to protect your personal data against loss, misuse and unauthorised access, including encryption in transit and access controls. No system is completely secure, but we work to protect your data and review our measures regularly.

Changes to this policy

We may update this policy from time to time. The current version will always be available on this page with its “last updated” date. If we make material changes, we will tell you in the app or by email before they take effect.

Contact

If you have questions about this policy or how we handle your data, contact us at privacy@smallmoments.app, or write to Lifesum AB, Repslagargatan 17B, 118 46 Stockholm, Sweden.