Consumer Health Data Privacy Policy

This Consumer Health Data Privacy Policy explains how Melomeal, MB, trading under the NutriDetector brand (“NutriDetector”, “we”, “us” or “our”), collects, uses and discloses Consumer Health Data through nutridetector.com and app.nutridetector.com (together, the “Service”).

This policy applies only to the extent that U.S. state consumer-health-data laws apply to NutriDetector and to the information concerned, including the Washington My Health My Data Act, Nevada consumer-health-data law and other applicable state laws (collectively, “Consumer Health Data Laws”). It supplements our Privacy Policy. If this policy and the Privacy Policy conflict, this policy controls only with respect to Consumer Health Data protected by an applicable Consumer Health Data Law.

1. What We Mean by Consumer Health Data

In this policy, “Consumer Health Data” means personal information that is linked or reasonably capable of being linked to you and that identifies or may be used to infer your past, present or future physical or mental health status, as defined by applicable Consumer Health Data Laws. Depending on the applicable law, this may include information identifying your use of a service intended to help you assess, measure, improve or learn about health.

Not every account detail, supplement label, product choice or technical event is Consumer Health Data in every context. We apply this policy when such information is protected under an applicable Consumer Health Data Law, including where it is linked to you or used to identify or infer a health status, health interest, supplement-use pattern or request for a health-related service.

NutriDetector is not designed to collect medical records, diagnoses, prescriptions, genetic data, biometric data or precise geolocation. Please do not submit medical records or other health information that is not needed to use the requested feature.

2. Categories of Consumer Health Data We Collect and Why

2.1 Personalized Cautions profile

If you voluntarily use Personalized Cautions, we may collect the selections you save for:

• pregnancy or breastfeeding;
• specified food allergies: milk, egg, fish, shellfish, tree nut, peanut, wheat, soy or sesame;
• vegan or vegetarian dietary preferences.

Pregnancy, breastfeeding and allergy selections may identify health or reproductive status. A dietary preference is not necessarily Consumer Health Data under every law, but we protect it under this policy when it is stored with your Cautions profile.

We use saved selections to maintain your optional profile and, where the relevant feature is supported, to apply server-controlled deterministic matching rules that surface label-based cautions. Profile values are not sent to the supplement-analysis engine or to our AI provider, and they are not logged by value.

Personalized Cautions are provided for informational purposes only. They do not diagnose a condition, constitute medical advice, recommend the use of a product, or establish that a product is safe or suitable for you.

2.2 Supplement-label submissions and analysis data

When you request an analysis, we may collect or generate:

• supplement-label images, pasted or typed label text and OCR-extracted text;
• product, ingredient, dose, serving, form, standardisation and other label-derived details;
• structured analysis inputs and results, scores, explanatory output and caution information;
• request identifiers, timestamps, processing status and limited diagnostic metadata.

We use these data to perform the analysis you request, show and maintain eligible analysis history, support My Stack, explain results, troubleshoot failures, protect the Service and maintain usage or billing integrity. These data may be Consumer Health Data when they are linked to you or used to identify or infer your supplement use, health interests or use of a health-related service. NutriDetector analysis is educational supplement-label analysis and is not a medical diagnosis.

2.3 My Stack data

If you use My Stack, we may collect product names, brands, product or label image links, ingredients, serving information, dose, frequency, timing, notes, active or removed status, related scan references and a structured snapshot of a saved supplement. We use these data to maintain the stack you request, synchronise it across signed-in devices, show daily totals, identify ingredient overlap and provide related Service functions.

My Stack information may be Consumer Health Data where it identifies or permits an inference about your supplement use, health status, health interests or efforts to learn about or improve health.

2.4 Service-use, device and security data

We may process account or session identifiers, IP address and approximate location derived from it, browser and device information, sanitised page or feature-event categories, timestamps, request status, performance information, and security or rate-limit data. We treat these data as Consumer Health Data to the extent that applicable law does so because they are linked with the categories above or identify your use of a health-related Service.

We use these data to authenticate users, deliver requested features, secure the Service, prevent abuse, diagnose failures and, after the applicable Analytics consent, understand general Service use.

2.5 Support communications

If you contact us about a label, analysis, My Stack or Personalized Cautions, your message may contain Consumer Health Data. We use it to respond to your request, investigate a reported issue and maintain appropriate support or legal records. Please include only the information needed for us to assist you.

2.6 Subscription and transaction data

If you purchase a paid plan, we may process your account or email identifier, payment-provider customer and subscription identifiers, selected plan, subscription status, billing-period dates, checkout verification, payment status and limited transaction metadata. Our payment provider, rather than NutriDetector, collects and processes the full payment-card details.

We use these data to provide paid features, verify checkout, administer subscriptions, prevent fraud, reconcile payments and meet accounting, tax and legal obligations. Subscription or transaction data may be Consumer Health Data where applicable law treats the purchase or use of a health-related service as identifying health status or an effort to assess, improve or learn about health.

3. Sources of Consumer Health Data

We collect the categories described above from:

• you directly, when you submit a label, save a supplement, select an optional Cautions profile value, use a Service feature or contact us;
• your use of the Service, through account, session, device, request, security and consent technologies;
• data generated by NutriDetector, including label-derived structured data, deterministic analysis results and deterministic matches between supported profile selections and ingredient caution rules;
• service providers acting for us, such as OCR output returned from an image you submit, account and session information returned by an authentication provider, or subscription status returned by our payment provider.

We do not obtain Consumer Health Data about you from data brokers, advertising networks, public records, social-media profiles or marketing partners.

4. How We Process Consumer Health Data

Depending on the feature you request, we may:

• receive, validate, structure, store, retrieve, display, update or delete the data;
• parse a supplement label and apply deterministic rules to dose, form, standardisation, transparency, evidence alignment and caution data;
• compare supported Cautions profile selections with curated ingredient caution tags on our server;
• use an AI API for label-image OCR and limited explanatory narrative generation, but not to determine scores, safety decisions or factual conclusions;
• maintain analysis history and My Stack when you ask us to save those features;
• respond to support, rights, security, fraud, abuse or legal matters;
• create aggregate or de-identified statistics that are not reasonably linkable to an individual and that we do not use to re-identify anyone.

We do not use identified Consumer Health Data for personalised advertising, advertising profiles, data-broker products, employment or insurance decisions, or training an AI model.

5. Consent and Your Choices

When you intentionally submit a supplement label, request an analysis or save an item to My Stack, you ask NutriDetector to process the information necessary to provide that feature. Where applicable law requires consent rather than allowing processing necessary to provide a requested product or service, we request the required affirmative consent before collection.

Personalized Cautions are optional. Before collecting health-related profile selections, we request affirmative consent where required and explain the categories collected, the purpose, the relevant recipient categories and how to withdraw. Refusing or withdrawing this consent may prevent Personalized Cautions from operating, but does not prevent you from using the core supplement-label analysis without a Cautions profile.

You can stop future use of the Cautions profile by removing all selections and saving the empty profile in your account, deleting your account, or emailing hello@nutridetector.com. Withdrawal does not affect processing completed before the withdrawal. Where separate consent is legally required for a disclosure, we will request it separately unless the disclosure is necessary to provide the product or service you requested or is otherwise permitted by law.

6. Categories of Consumer Health Data We Disclose and Recipients

We disclose only the Consumer Health Data reasonably necessary for the purposes described in this policy. The meaning of “share” varies by state. Some laws do not treat a disclosure to a contractually restricted processor as “sharing” when it is made to provide the service requested by the consumer. For transparency, the disclosures below include service-provider processing whether or not a particular law defines it as sharing.

6.1 Service-provider categories

• Application hosting, runtime, managed database, storage and backup providers may process account-linked profile selections, label and analysis records, My Stack data, service-use data and related identifiers as necessary to operate and secure the PWA.
• OCR and explanatory-processing providers may process a submitted label image, label text and limited structured analysis context to return OCR text or an explanation. Personalized Cautions profile selections are not sent to this provider.
• Authentication and security providers may process account identifiers, session and authentication information, IP address, request information and security events. They are not provided with Cautions profile values as content.
• Payment and subscription providers may process account or email identifiers, checkout and payment details, plan and subscription information, fraud-prevention data and transaction records. They are not provided with label content, My Stack contents or Cautions profile values.
• Support and communication providers may process your contact details, message content, attachments and related technical metadata when you ask us for support.
• Optional analytics providers may process limited technical data, sanitised page templates, general feature-event categories and limited subscription checkout or purchase-event metadata after Analytics consent. Our analytics event boundary excludes label text, supplement product and ingredient names, free-text notes, My Stack contents, Cautions profile values and matched-caution details.

These providers may use the data only for the contracted services and legal obligations applicable to them. The names and general roles of our current providers are listed in our Privacy Policy.

6.2 Other recipient categories

We may disclose only the relevant Consumer Health Data to professional advisers bound by appropriate duties of confidentiality, or to courts, regulators, law-enforcement bodies and other public authorities where the disclosure is required or permitted by applicable law and the legal conditions are met.

We do not currently share Consumer Health Data with any affiliate. We do not disclose Consumer Health Data to data brokers, advertising networks, employers or insurers, or to third parties for their own personalised-advertising purposes.

7. Collection Over Time and Across Websites or Online Services

After you grant Analytics consent, a third-party analytics service may collect limited device, browser, traffic-source, approximate-location, sanitised page-template and general feature-event information over time while you use nutridetector.com and app.nutridetector.com. This analytics data is not used by NutriDetector to create health-status inferences or advertising profiles.

We do not permit analytics or advertising providers to receive Cautions profile values, label text, product or ingredient names, free-text notes, My Stack contents or matched-caution details for tracking across unrelated websites or services. We do not currently use advertising tags or personalised-advertising cookies. You can reject or withdraw Analytics consent at any time through Cookie Settings.

8. Sale of Consumer Health Data

NutriDetector does not sell Consumer Health Data and does not offer Consumer Health Data for sale. We do not require you to authorise a sale as a condition of receiving the Service. If this practice were ever to change, we would first update this policy and obtain the separate, legally valid authorisation required by applicable law before any sale.

9. Your Consumer Health Data Rights

Subject to your state of residence and applicable law, you may have the right to:

• confirm whether we collect, use, share or sell Consumer Health Data concerning you;
• access the Consumer Health Data we maintain about you and obtain a copy;
• obtain a list of third parties and affiliates with whom we shared or sold your Consumer Health Data and, where required, their active contact information;
• review and request correction of inaccurate Consumer Health Data;
• withdraw consent from future collection or sharing;
• request deletion of your Consumer Health Data;
• receive a portable copy where applicable law provides that right;
• appeal our refusal to act on a request.

We will not unlawfully discriminate against you for exercising a Consumer Health Data right. Rights and permitted exceptions vary by state. If an exception applies, we will limit any continued processing to what the law permits.

10. How to Exercise a Right or Appeal

Email hello@nutridetector.com with the subject Consumer Health Data Request. State the right you wish to exercise and provide the email address used for your NutriDetector account, if you have one, and your U.S. state of residence. Do not send medical records or identity documents unless we specifically request information reasonably necessary to verify your identity.

You do not need to create a new account to make a request, although we may ask you to use an existing account or complete a reasonable verification step. If we cannot authenticate a request using commercially reasonable efforts, we may ask for additional information or may be unable to act. We use verification information only for authentication, security, fraud prevention and request record-keeping.

We respond without undue delay and within the period required by applicable law. That period is generally no longer than 45 days, subject to a legally permitted extension and notice. Some state laws require a shorter period for an authenticated deletion request. Requests are free except where applicable law permits a reasonable fee for requests that are manifestly unfounded, excessive or repetitive.

If we refuse to act, you may appeal by emailing the same address with the subject Consumer Health Data Appeal and identifying the decision being appealed. We will respond to the appeal in writing within the period required by applicable law and explain our decision. If the appeal is denied, we will provide the method for contacting the relevant state attorney general where required.

11. Deletion and Retention

We retain Consumer Health Data only for the periods or purposes described in our Privacy Policy, subject to any shorter period required by an applicable Consumer Health Data Law. In particular, uploaded label images are processed in memory and are not intentionally stored in NutriDetector’s application database after the request completes. A copy sent to our OCR or explanatory-processing provider may be retained for up to 30 days for abuse monitoring under its standard API controls, unless different approved retention controls apply or a longer period is legally required. Raw label text is redacted no later than 60 days unless removed earlier, and saved Cautions profile values are retained until you clear the profile, withdraw consent, submit an applicable deletion request or delete your account.

When we grant a Consumer Health Data deletion request, we delete the covered data from our records and network and notify applicable processors, contractors and other recipients that must honour the request. Data in archived or backup systems is deleted or rendered unavailable within the period required by the applicable law. For a request protected by the Washington My Health My Data Act, a permitted backup delay will not exceed six months after authentication of the deletion request.

12. Security

We use technical and organisational measures designed to protect the confidentiality, integrity and availability of Consumer Health Data. These include encryption in transit, authentication and access controls, server-side validation, data minimisation, restricted logging, rate limiting, security monitoring and limiting access to personnel and providers that need it for the disclosed purpose. No internet service can guarantee absolute security.

13. Changes to This Policy

We may update this policy when the Service, our data practices or applicable law changes. We will post the revised policy with an updated effective date and provide any additional notice required by law. Before collecting, using or disclosing a new category of Consumer Health Data, using it for a materially new purpose, or disclosing it to a new recipient where consent is required, we will update the applicable disclosure and obtain affirmative consent before the new processing begins.

14. Contact Us

For questions, requests or complaints about Consumer Health Data, contact:

Email: hello@nutridetector.com