Yes — Dietozaur is built by a Polish (EU) company with GDPR-first architecture, and we have a signed Data Processing Agreement with OpenAI Ireland Ltd.
Our legal entity is Om Fund Operations sp. z o.o., registered in Poland — making UODO (the Polish data protection authority) our lead supervisory authority under GDPR. We signed a formal DPA with OpenAI Ireland Ltd. in May 2026, establishing them as a GDPR sub-processor with contractual obligations toward your data.
Architecturally, your profiles and medical data are stored on your device only — not on our servers. This means we do not hold your health data at rest, which eliminates an entire category of breach risk.
Your consent to health data processing is obtained separately from our Terms of Service, with a clear withdrawal path (Settings → Privacy).