Consumer Health Data Privacy Policy

This policy covers consumer health data that MedMenu collects, as that term is used in Washington's My Health My Data Act and similar state laws. It applies to everyone who uses MedMenu, wherever they live.

1. What we collect and why

• Conditions you pick (for example, diabetes or chronic kidney disease). We use them to choose recipes for you and to check recipes, meal plans and scanned foods against published dietary guidelines for those conditions.
• Food exclusions and allergies you pick. We use them to leave those foods out of the recipes we show you.
• Recipes, ingredient lists, ingredient photos and barcodes you submit to Check Recipe, Scan-and-Cook or Scan. We use them to analyze that food against the conditions you picked.
• Your activity in MedMenu (recipes you view, save or add to a plan), where it could reveal health information. We use it to run your meal plans, favorites and grocery list, and to measure how MedMenu's features are used so we can improve them.

We use this data only to provide and improve MedMenu. We do not use it for advertising, and we do not use it to choose who receives marketing emails or what they say.

2. Where it comes from

Directly from you, when you pick options or submit food in MedMenu.

3. What we share

We share the categories listed in section 1 only with the service providers below, each receiving only what it needs, who process it on our behalf to run MedMenu. We do not sell consumer health data.

4. Who we share it with

• Hosting provider (Replit), which runs the MedMenu application.
• Database provider (Neon), which stores your account data.
• Product analytics provider (PostHog), which receives your activity in MedMenu under a random account number. It does not receive your email address or the conditions you pick.
• AI processing provider (Google, Gemini API), which analyzes the recipes, ingredients and photos you submit, together with the conditions you picked, so we can return an analysis.

MedMenu has no affiliates that receive this data.

5. Your rights and how to use them

• Know and access. Ask us to confirm whether we hold your consumer health data, send you a copy, and give you the list of third parties we have shared it with.
• Delete. Delete your account and its data any time from your Account page, or ask us by email.
• Withdraw consent. Email us to withdraw your consent. MedMenu needs your condition picks to work, so withdrawing consent means we delete them and your account.

To make a request, email medmenu.app@gmail.com from the address on your MedMenu account. We respond within 45 days. If we need more time, we will tell you why, and the extension will be no longer than 45 more days.

Appeals. If we decline your request, reply to our decision with the word "Appeal". We will respond in writing within 45 days and explain our reasoning. If your appeal is denied, you can contact the Washington State Attorney General at atg.wa.gov/file-complaint.