Consumer Health Data Privacy Policy

Last updated: July 31, 2026

This Consumer Health Data Privacy Policy supplements our Privacy Policy and applies to "consumer health data" of residents of Washington and Nevada (and residents of any other state with a similar consumer-health-data law), as those laws define that term — generally, personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status. It describes how Novelty Technologies, LLC, doing business as The Recipe Society ("we," "us," or "our"), collects, uses, and shares consumer health data in connection with The Recipe Society mobile applications and websites (the "Services"), and the rights available to you.

If anything in this policy conflicts with our Privacy Policy with respect to consumer health data of Washington or Nevada residents, this policy controls.

CONSUMER HEALTH DATA WE COLLECT

We collect the following categories of consumer health data, in each case when you choose to provide it, enable the feature that uses it, or — for inferences — generate activity data through features you use:

• Health-related characteristics you provide — age, gender, height, weight, target weight, activity level, fitness goals, dietary preferences, and food allergies.
• Nutrition and diet information you log — meals, foods and drinks, calorie and nutrient information, recipes you save, fasting periods, and weight entries (including optional progress photos you choose to add).
• Fitness information you authorize — workout, activity, and related measurements (such as heart rate recorded with workouts) read on your device from Apple Health (iOS) or Health Connect (Android), if you connect them. Raw fitness data is processed on your device and is not uploaded to our servers; a connection/disconnection audit record (including technical details such as the IP address captured at the time) is kept on our servers.
• AI interaction content — messages you send to the AI nutrition assistant and photos you submit to AI food-analysis features, which may reveal health information. Your stored AI chat history is encrypted with keys held on your devices, as described in our Privacy Policy.
• Safety signals — limited operational signals derived from AI interactions by our automated safety systems (for crisis-resource routing and community-guidelines enforcement), retained for a limited time as described in our Privacy Policy.
• Inferences — dietary patterns and food preferences inferred from your activity, used to personalize the Services.
• Launch-notification request data — your email address, your self-attestations that you currently reside in the United States and are at least 18 years old, and the record that you asked for one email when our nutrition and health-assessment mobile app becomes available in U.S. app-store storefronts. The U.S. launch-market code is not treated as residence evidence, and we do not use precise-location tracking or a government identifier to verify the attestations. In Washington, this request may identify you as seeking a service that helps assess, measure, improve, or learn about health. We do not use the request to infer a diagnosis, condition, or other health status.

We do not collect precise geolocation or genetic data, do not use facial-recognition technology, and do not collect biometric identifiers as defined by applicable biometric-privacy laws. No feature is designed to request or use reproductive or sexual health information or gender-affirming-care information; free-text content you choose to submit (such as AI chat messages) may nonetheless contain health information you include, and it is handled as described in this policy.

SOURCES OF CONSUMER HEALTH DATA

• You, when you enter information in the Services;
• You, when you submit the public website form requesting the one-time U.S. mobile-launch notification;
• Your device's health platform (Apple Health or Health Connect), if you connect it, including any weight entries you direct the app to write back to it;
• Your use of the Services (for the derived signals and inferences described above).

WHY WE COLLECT AND USE IT

We collect and use consumer health data to provide the Services you request: calculating personalized nutrition targets, tracking your meals, weight, and fasting, providing optional AI-assisted features you enable, enabling sharing you direct (such as with a connected nutrition professional), providing safety features (crisis resources), delivering the single U.S. mobile-launch email you specifically request, securing the Services and its public forms, and complying with legal obligations. We do not use consumer health data for advertising, and we do not sell it.

HOW WE SHARE IT — AND WITH WHOM

We do not sell consumer health data, and we do not share it with advertising networks or data brokers. We share it only:

• With service providers processing it on our behalf under contract: our cloud infrastructure provider (hosting and storage); our third-party AI provider (the content needed to perform an AI feature associated with your request or app action, as described in our Privacy Policy, under a data processing agreement that prohibits using it to train the provider's models); our third-party content-moderation service (content you submit to community features); our bot-detection and email-delivery providers (limited to securing the public launch form and delivering the one notification you request); and our other service providers described in our Privacy Policy (such as analytics, error-monitoring, and subscription-management providers), in each case limited to what the provider needs to perform its services for us.
• At your direction: with a nutrition professional you connect with (limited to the goal-record fields described in our Privacy Policy), with other users when you choose to share content, under the household-profile feature described in our Privacy Policy, and — to the extent a shopping list you choose to send reflects your dietary preferences — with the grocery or delivery service you send it to, under that service's own policy, as described in our Privacy Policy and our Disclaimer. We may receive a commission on qualifying purchases you make through such retailer links; this does not change that the items are disclosed only at your direction and does not constitute a sale of consumer health data.
• For legal reasons: where required by law, legal process, or to protect the rights, property, or safety of you, us, or others, as described in our Privacy Policy.
• In a business transfer: if we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, consumer health data may be transferred to the party that assumes the relevant business or assets, which must continue to protect it under this policy and comply with the obligations of applicable consumer-health-data law. Consistent with that law, a transfer of this kind is not a sale or a share of consumer health data.

Affiliates: we do not share consumer health data with any affiliated companies.

Collection across services: Two bot-detection providers may collect limited network, device, browser, and interaction signals over time and across different websites or online services where their protection services operate. Google Cloud Fraud Defense protects the public launch-notification form; its script is requested only after a person follows a valid submission path, so merely visiting that page does not load it. Cloudflare Turnstile is conditionally presented in the app's sign-up or sign-in flow when a security challenge is required; it is not shown on every authentication attempt. We use both providers only for security, fraud prevention, and abuse prevention, and do not authorize either provider to use information we identify as consumer health data for advertising, health profiling, or another unrelated purpose. We do not permit our other service providers to collect consumer health data across unrelated websites or online services for their own purposes.

CONSENT

Consumer health data is collected only when you provide it, request the one-time launch notification, or enable the feature that uses it, and health-platform data is read only after you grant permission in your device's health settings, which you can revoke at any time. App and account-feature consent changes are recorded in the profile consent history described in our Privacy Policy, and withdrawing those consents is as easy as giving them. The unauthenticated launch request is recorded separately with its disclosure version, status, and request timestamps; it is not represented as an account consent-history entry. For the launch notification, we use the record only to provide and secure the requested notification. You may withdraw the launch request through the verification or unsubscribe mechanism supplied for that request, or through our privacy-request channel.

YOUR RIGHTS

If you are a Washington or Nevada resident (or a resident of another state with a similar law, to the extent that law applies to you), you have the right to:

• Confirm whether we are collecting, sharing, or selling consumer health data about you and to access that data, including, where required by applicable law, a list of the third parties with whom we have shared it and the categories described in this policy;
• Withdraw consent to our collection and sharing of your consumer health data (by disabling the relevant features, disconnecting your health platform, or contacting us);
• Correct inaccurate consumer health data or ask us to review its accuracy. Use the in-app editing controls where available, or submit a correction request through the channels below. If a record must remain immutable as legal or consent evidence, we will preserve the original record and append a linked correction or explanatory notation rather than silently rewriting history;
• Delete your consumer health data. You can delete individual entries in the app, delete your account in Settings (your account is deactivated when you request deletion and permanently deleted after an approximately 30-day reactivation window, during which signing back in cancels the deletion), or submit a deletion request through our privacy-request channel, which is not subject to the reactivation window. When deletion is carried out, your consumer health data is removed from our active systems without undue delay, subject to the narrow legal-retention exceptions described in our Privacy Policy; deleted files remain in a backup/soft-delete tier for a limited period before permanent purge;
• Not be discriminated against for exercising these rights.

How to exercise your rights. Use the in-app controls in Settings, visit therecipesociety.com/privacy-request, or email support@therecipesociety.com. We will verify your request using information associated with your account and respond within the time required by applicable law.

Appeals. If we decline to act on your request, you may appeal by replying to our response or emailing support@therecipesociety.com with the subject "Health Data Appeal." We will respond to your appeal within the time required by applicable law, with a written explanation. If your appeal is denied, Washington residents may contact the Washington State Attorney General at atg.wa.gov, and Nevada residents may contact the Nevada Attorney General at ag.nv.gov.

CHANGES TO THIS POLICY

We will update this policy as our practices or applicable law change, will update the "Last updated" date, and will notify you of material changes as described in our Privacy Policy.

CONTACT US

Email: support@therecipesociety.com

Novelty Technologies, LLC 11720 Amber Park Dr Ste 160 PMB 1056 Alpharetta, GA 30009 United States