Consumer Health Data Privacy Notice

This notice supplements our Privacy Policy and describes how we handle consumer health data — information that identifies your past, present, or future physical or mental health. It exists to meet laws such as Washington's My Health My Data Act and Nevada SB370, which protect health data collected by apps that are not covered by HIPAA. MealCoach is a direct-to-consumer wellness app and is generally not a HIPAA covered entity.

Consumer health data we collect

• Meal & nutrition logs and derived Kibo scores (your diet and its analysis)
• Body metrics you enter (e.g., weight, body composition, goals)
• Apple Health data you choose to connect — read-only. We read the metrics you authorize; we do not write to Apple Health, and you control the connection in iOS Settings.
• Coach chat messages, to the extent you share health details with the AI coach

Sources: only you (what you enter) and Apple Health (only with your explicit permission).

How we use it

To provide the coaching service you asked for: scoring meals, generating insights and reports, and personalizing recommendations. Our AI features run on Amazon Bedrock inside our own AWS account — your data is processed to answer you and is not used to train third-party models.

What we do not do

• We do not sell your consumer health data. (MHMDA requires separate written authorization to "sell" health data; we do not seek it because we do not sell it.)
• We do not use health data for advertising, and we do not send it to advertising or cross-app tracking networks (we use none).
• Our product-analytics vendor (Amplitude) receives event names and your user ID only — not your meal, health, or chat content.

Who processes it for us

AWS — hosting, storage, and in-account AI (Amazon Bedrock). That is the only processor that handles the health-data content itself. All AWS processing is under contract and on our behalf.

Your rights

You may, at any time:

• Access the consumer health data we hold about you — Settings → Export My Data (within 3–5 business days).
• Delete your consumer health data — Settings → Delete Account permanently removes your account and associated data within our 30-day deletion window. To delete health data without closing your account, email us.
• Withdraw consent — disconnect Apple Health in iOS Settings, and turn off optional uses in Settings → Privacy & Data.
• Appeal — if we deny a request, reply to our response and we will re-review.

How to exercise your rights

Use the in-app controls above or email support@mealcoach.ai (subject: "Health Data Request"). We verify requests against your account and respond within the timeframe the law requires.

Retention

We keep your consumer health data for as long as your account is active. When you delete your account, associated data is removed within 30 days, except where we must retain limited records to meet legal obligations.

Questions

Contact us at support@mealcoach.ai with any questions about this notice. See also our full Privacy Policy and Your Privacy Choices page.

TODO — to confirm before this page is treated as final

• Registered business address for Morf Engineering Inc.
• Whether a homepage link labeled "Consumer Health Data Privacy Policy" is required by MHMDA in addition to the footer link already added
• Whether any sharing beyond AWS occurs now or is planned (today: none for health-data content)
• Consent and withdrawal mechanics wording, and whether separate consent is required at collection for any use
• Applicability of other state health-data laws as the user base grows