Consumer Health Data Privacy Policy

Effective date: July 10, 2026 · Last updated: July 10, 2026

1. Scope

This policy explains how Dumb Calories (operated by Alexander Burkhard, Münsterlandstraße 68, 10317 Berlin, Germany — [email protected]) collects, uses and shares consumer health data. It applies to users in the United States and is written to satisfy the Washington My Health My Data Act (chapter 19.373 RCW) and Nevada's consumer health data law (SB 370, 2023; NRS 603A.400–603A.550). It supplements our general Privacy Policy; where this policy is more specific about consumer health data, it prevails.

2. Consumer health data we collect, and why

Dumb Calories is a calorie-tracking app. The consumer health data we collect is the data you track:

• Nutrition and meal data: the foods you log and their nutritional values (calories, protein, carbohydrates, fat, sodium, saturated fat, quantity, unit, time and time zone).
• Body measurements: your body weight and its history; your date of birth, height and biological sex, used to calculate your calorie baseline and goals.
• Activity data: active (burned) calories and weight values synced from Apple Health, only if you enable that integration on your device.
• Personal goals: daily calorie, protein, sodium and saturated-fat targets.
• Chat content: messages, photos and voice recordings you send to the AI assistant, which may contain or reveal health information.

Purpose: we collect and use this data solely to provide the service you request — logging your meals, calculating and displaying your daily and weekly summaries, tracking your goals and weight, and generating the AI assistant's responses. We do not use it for advertising, and we do not use it to infer characteristics about you for any purpose other than providing the service.

3. Sources of consumer health data

• You: everything you type, speak or photograph in the app.
• Apple Health: burned calories and weight, only with the permission you grant on your device. You can revoke it at any time in iOS Settings.
• Derived data: calorie and macro estimates our AI generates from your inputs.

4. Consent, and collection necessary for the service

We collect and use consumer health data only to the extent necessary to provide the service you have requested — tracking the meals, weight and goals you ask the app to track. In addition, the app asks for your explicit consent to health-data processing when you create an account. We do not collect, use or share consumer health data for any category or purpose not disclosed in this policy without first disclosing it and obtaining your affirmative consent. You can withdraw your consent at any time (section 6).

5. No selling, no sharing

We do not sell consumer health data and never have. We do not share consumer health data with third parties or affiliates for their own purposes; we have no affiliates. Accordingly, the categories of consumer health data shared: none; the categories of third parties and specific affiliates with whom consumer health data is shared: none.

To operate the service, we disclose data to processors that act only on our documented instructions and are contractually bound to confidentiality and deletion duties: cloud hosting (Google Cloud Platform), database and file storage (Supabase), AI processing (Google Gemini API — paid tier; Google is contractually barred from training models on your content), subscription status (RevenueCat — pseudonymous ID only, no health data), transactional email (Resend — no health data), error monitoring (Sentry — token and PII fields filtered), and product analytics (PostHog — only if you opt in, in Settings). The full processor list is in section 4 of our general Privacy Policy.

No third party collects consumer health data about you over time and across different websites or apps through our service — there is no advertising and there are no advertising trackers.

6. Your rights

If you are a Washington or Nevada consumer (and, as a matter of policy, any US user), you have the right to:

• Confirm and access: confirm whether we collect, share or sell consumer health data about you, and access that data — including a list of all third parties and affiliates with whom we have shared or sold it (currently: none) and contact information for them.
• Withdraw consent: withdraw your consent to the collection and use of your consumer health data.
• Delete: have your consumer health data deleted. You can delete your account yourself at any time in the app (Settings → Account), which removes your data immediately and irrevocably; if you ask us by email instead, we complete deletion within 30 days of authenticating your request. We notify our processors, who must delete it as well. Copies on archived or backup systems are removed as those systems cycle, at the latest six months after your authenticated request (in practice much sooner — our backups are retained for days, not months).

You can also review and correct the data you have logged (meals, weight, goals) directly in the app at any time. We will not discriminate against you for exercising any of these rights.

7. How to exercise your rights, and appeals

Email [email protected] from the email address associated with your account (that is how we verify your identity), or use the in-app deletion described above. Requests are free of charge. We respond without undue delay, at the latest within 45 days of receiving your request; where reasonably necessary we may extend once by a further 45 days and will tell you within the first 45 days, with the reason.

If we refuse to act on a request, you may appeal by replying to our response with the word "appeal". We will review the appeal and respond in writing within 45 days, including the reasons for our decision. If your appeal is unsuccessful, you can contact your state attorney general: Washington (www.atg.wa.gov/file-complaint) or Nevada (ag.nv.gov).

8. Geofencing

We do not use geofencing of any kind — in particular, none around facilities that provide health care services.

9. Changes to this policy

We will post any changes to this policy here and update the date above, and we will announce material changes in the app or by email. Collecting, using or sharing new categories of consumer health data, or doing so for new purposes, will only apply to you after we have disclosed the change and obtained your affirmative consent.