Consumer Health Data Privacy Policy

This policy is for people in the United States, and is written for the consumer health data laws of Washington (the My Health My Data Act), Nevada and other states with similar laws. It sits alongside our Privacy Policy, which covers everything else Frittu does with your information.

Frittu is operated by StreetsideWeb, based in Melbourne, Australia ("we", "our" or "us").

"Consumer health data" here means information that is linked to you and identifies your past, present or future physical health. For Frittu, that includes your food allergies, your diet and goals, and any activity, sleep or body data you choose to bring in from a health app.

We collect only what the features you use need:

• Food allergies and intolerances, and dietary preferences (for example coeliac disease, vegetarian, lactose intolerance): to check recipes against them and say what a recipe was generated without.
• Goals and preferences: fitness goals (such as calorie awareness or building muscle), health goals (such as gut friendly or diabetic friendly) and daily calorie, protein, carbohydrate and fat targets: to shape recipes, meal plans and the Fuel tab.
• About you, if you give it (sex, birth year, height and activity level) to estimate energy needs and resting energy.
• Meals you log: what you ate, its calories and macros, and photos of cooked dishes you scan: to show your day, your week and your trends.
• Health app data, if you connect Apple Health or Health Connect: steps, energy burned, workouts, sleep, water, weight and resting heart rate. By default this stays on your phone. It is stored on our servers only if you turn on "Use my activity in my meal plans", as daily totals and one row per workout, kept for 90 days (weight as a monthly average after that).
• What Frittu works out from it: for example your weekly read, a training rhythm you accepted, or whether a dish looked like a restaurant portion: to suggest your next meal and next week's plan.

We use this data only to provide Frittu's features to you. We do not use it for advertising.

• From you: what you enter in the app (the setup questions, your profile, meals you log, photos you scan).
• From your phone's health app: Apple Health or Health Connect, only after you give Frittu permission there. You can change or withdraw that permission at any time in the health app's settings.
• From Frittu itself: figures and facts worked out from the above (for example averages, trends and estimates).

We do not sell consumer health data. We share it only with service providers that process it for us, under contract, to provide the features you use:

• Supabase: stores your account data, including the consumer health data above, on our servers.
• Anthropic (AI recipes and meal plans): when you ask for a recipe, a meal or a plan, that request carries what it needs: your allergens, dietary preferences and goals, and (if you turned on "Use my activity in my meal plans") the health figures the request uses (such as a recent workout, energy burned or last night's sleep). When you ask for a dish's calorie estimate, your goals go with it, so the estimate can say how the dish fits them. Your name, email and account id are never sent.
• OpenAI (photo analysis): photos you scan, to identify ingredients or estimate a dish. For an ingredient-label scan, your allergens go with the photo, so the label can be checked against them. Your name, email and account id are never sent.
• Resend (email): the weekly summary email can include your eating, activity and weight figures for the week (calorie figures are left out when "Hide calories" is on in Fuel settings).
• PostHog (product analytics): which features are used, including which goal-based layout of Home you see, whether a health app is connected, the kind of Fuel moment (for example "after a workout") and whether a product you looked at lists one of your allergens. Never your health figures, which allergens you have, or what you ate.
• Sentry (crash reports): technical details of errors, which are not meant to contain health data.

Our AI providers do not use your requests to train their models, and keep request data only for a limited time (up to 30 days) for abuse and safety monitoring before deleting it.

We may also disclose information where the law requires it, for example in response to a valid legal order.

We collect consumer health data when you choose to give it: by answering the setup questions, adding allergens or goals, logging meals, or connecting a health app. Uploading health app data to our servers is a separate choice ("Use my activity in my meal plans" in Fuel settings), which explains what is stored before you turn it on.

You can withdraw consent at any time:

• Turn off "Use my activity in my meal plans": everything we hold from your health app is deleted straight away.
• Switch off individual kinds of health data in Fuel settings: what we hold for that kind is deleted.
• Remove Frittu's access in Apple Health or Health Connect settings.
• Edit or remove allergens, goals and details in your profile.
• Delete your account (Profile → Delete account): all of it is deleted.

You have the right to:

• Confirm and access: ask whether we hold your consumer health data and get a copy of it, together with a list of the third parties we have shared it with and how to contact them.
• Withdraw consent: as described above.
• Delete: ask us to delete your consumer health data. We delete it from our systems; copies our service providers hold are deleted under their own retention periods (for example, our AI providers within 30 days).
• Not be treated differently for using these rights.

How to make a request: email privacy@frittu.app with the subject "Consumer health data request", from the email address on your Frittu account (that is how we confirm it is you). You can also delete everything yourself in the app (Profile → Delete account). We reply within 45 days. If we need more time, we will tell you why within those 45 days, and we can take up to 45 days more.

Appeals: if we decline your request, you can appeal by replying to our answer with the subject "Appeal". We answer an appeal within 45 days and explain our decision. If we deny your appeal, you can contact your state's Attorney General: in Washington at atg.wa.gov/file-complaint.

• Health app data uploaded to our servers: 90 days (weight as a monthly average after that), or until you turn the upload off.
• Allergens, goals, details and logged meals: until you change or remove them, or delete your account.
• Everything: deleted when you delete your account, as described in our Privacy Policy.

We will update this policy when what we collect or share changes, and change the date at the top of this page.

Operator: StreetsideWeb, Melbourne, Australia Email: privacy@frittu.app Website: frittu.app