Consumer Health Data Privacy Policy

This policy describes how [LEGAL NAME] (“Trigger AI”) collects, uses, and shares consumer health data. It exists because Washington’s My Health My Data Act requires a distinctly linked consumer health data policy, and Nevada and Connecticut have parallel requirements. It applies alongside our Privacy Policy. Where the two differ as to consumer health data, this policy controls.

• Symptoms and bodily conditions you log, with severity and timing.
• Food and beverage consumption, including meal photographs and when you ate.
• Health goals and dietary status.
• Bodily measurements: height, weight, age, and sex.
• Self-reported allergies and intolerances.
• Inferences the app generates from your log, including suspected trigger foods and the confidence level attached to each.
• Precise location, only where you have enabled location for restaurant suggestions.

• Directly from you — what you log, answers you give during onboarding, and settings you choose.
• Derived by the app — ingredients identified from your photographs and the associations generated from your log.
• From your device, where enabled — location, only while suggesting restaurants.

Consumer health data is collected for one purpose: to run the features you use — your log, your history, and the associations the app surfaces between foods and symptoms. It is never used for advertising, marketing, or commercial profiling unrelated to the app’s function.

No other third party receives consumer health data.

We have never sold consumer health data, and we will not sell it without the separate, signed authorization Washington law requires.

We do not use geofencing, and no geofence is operated around any health care facility.

Collecting consumer health data and sharing it are consented to separately, and each consent can be withdrawn separately. You can withdraw either one in Settings in the app, or by email with the subject line “Withdraw Consent” — the address is on the Support page. Withdrawing a consent stops the activity it covers from then on.

• Know and access. Ask what consumer health data we hold about you and receive a copy, including a list of every third party with which it has been shared.
• Withdraw consent. Withdraw consent for collection and consent for sharing, separately, as described in section 8.
• Delete. Have your consumer health data deleted. We notify the processors listed in section 5 and confirm to you when deletion is complete.
• Appeal. If we decline a request, you may appeal, and we respond to appeals in writing within 45 days. If your appeal is denied and you live in Washington, you may file a complaint with the Washington State Attorney General.

Reach us at support@triggerai.app or through the Support page. Use the subject line “Health Data Request” for requests under this policy.

You may also raise concerns with the Washington State Office of the Attorney General or the Nevada Office of the Attorney General.