Consumer Health Data Privacy Policy

1. Scope

This Washington Consumer Health Data Privacy Policy applies to “consumer health data” as defined by the Washington My Health My Data Act and to consumers covered by that law. It supplements our Privacy Policy. If there is a conflict regarding covered consumer health data, this notice controls.

2. Consumer health data we collect

Depending on how you use EveryCal, we may collect or derive:

• Food, meal, calorie, nutrient, hydration, dietary-habit, allergy, and dietary-preference information.
• Height, weight, target weight, body measurements, progress photos, and related trends.
• Exercise, steps, activity level, active energy, workouts, fitness goals, and fitness progress.
• Age or birth date, formula parameter, and pregnancy or breastfeeding status if you choose to provide it.
• Meal photos, nutrition-label photos, audio descriptions, and inferences produced from them.
• Health and activity data from Apple Health, Health Connect, or another device or service that you expressly connect.
• Identifiers and technical information that can be associated with the health information above.

3. Sources of consumer health data

• Directly from you, including information, photos, audio, goals, and logs you submit.
• From your device and your interactions with the Services.
• From Apple Health, Health Connect, or another health service you authorize.
• From service providers processing information on our behalf.
• From calculations or AI-assisted inferences based on information you provide.

4. Why we collect and use it

• Analyze meal photos, food descriptions, and nutrition labels at your request.
• Track meals, nutrients, hydration, exercise, steps, weight, and progress.
• Create personalized calorie and macro targets, trends, reports, reminders, and insights.
• Synchronize information across your devices and connected health services.
• Maintain, secure, troubleshoot, and improve the health-related features you choose to use.
• Comply with legal obligations and protect users, EveryCal, and others.

Where the law requires consent to collect or share consumer health data for a purpose, we will request it separately. You may withdraw consent as described below.

5. Consumer health data we share

We may share the categories of consumer health data listed above only as reasonably necessary to provide features you request, with your consent, or as permitted by law. Recipients may include:

• OpenAI, with your explicit permission, for meal, label, or voice analysis you request.
• Apple and Google, for platform services, authentication, subscriptions, and health integrations you choose.
• RevenueCat, for subscription entitlement management.
• Hosting, storage, security, and support providers operating under contracts that limit their use of the information.
• Authorities or transaction counterparties when disclosure is required or permitted by law, including in a corporate transaction subject to applicable protections.

A current description of our providers and the information involved is available in the subprocessor section of our Privacy Policy.

6. Sale of consumer health data

We do not sell consumer health data. We do not exchange consumer health data for money or other valuable consideration, and we do not permit service providers to use it for their own advertising. We do not use geofences around healthcare facilities to identify or collect health data.

7. Your Washington rights

Subject to applicable exceptions, you may have the right to:

• Confirm whether we are collecting, sharing, or selling your consumer health data.
• Access your consumer health data, including a list of third parties and affiliates with whom it has been shared or sold and contact information for those recipients where required.
• Withdraw consent for our collection or sharing of your consumer health data.
• Delete consumer health data held by us and request deletion by processors as required by law.
• Appeal our refusal to act on a request.

You can exercise certain rights in EveryCal’s Privacy settings, including exporting data, deleting analysis images, disconnecting health integrations, changing consent choices, and requesting account deletion.

8. Submit a request or appeal

Email contact@everycal.ai with the subject “Washington Health Data Request.” Describe the right you wish to exercise. We may ask for information reasonably necessary to authenticate your request. Authorized agents may submit requests where permitted by law, subject to verification of their authority.

To appeal a decision, reply to our decision or email us with the subject “Washington Health Data Appeal” and identify the decision you are appealing. We will respond within the time required by applicable law and explain how you may contact the Washington Attorney General if your appeal is denied.

9. Changes to this notice

We may update this notice to reflect changes in the Services or law. We will post the updated notice with a new effective date and provide additional notice or obtain consent where required.