Consumer Health Data Privacy Policy

Last updated: July 18, 2026

This policy describes how Gutsy collects, uses, shares, and protects consumer health data, as required by the Washington My Health My Data Act and similar laws. It applies in addition to our general Privacy Policy.

Categories of consumer health data we collect

• The health condition you choose to tailor scores to (Crohn's disease, or type 2 diabetes / prediabetes).
• Crohn's disease severity and current disease phase (e.g., remission or flare) that you enter.
• The diabetes type you select (type 2, prediabetes, or not sure).
• Food allergies and food sensitivities you enter.
• Health-related answers from the onboarding questionnaire.
• Your food scan history, to the extent it reflects dietary management of your condition.
• Label photos you submit, which are used once for automated reading and then retained privately so we can verify the accuracy of the shared product catalog. They are stored under the product's barcode with no link to your account, are visible only to us — never to other users — and, because nothing ties them to you, they remain after account deletion. (A photo of the front of a package that you submit while adding a missing product is not treated as health data: it is stored as the product's catalog picture and is visible to other users.)
• The Monthly Report we generate when you open it, which summarizes that month's scan activity through the lens of your condition, and which we save so it does not have to be rewritten each time.

Why we collect it

We collect this data only to provide the app's core function you request: scoring packaged foods against the settings you enter, and saving your history and preferences. We do not use consumer health data for advertising, and we do not use it for any purpose unrelated to providing the app.

Sources of the data

Consumer health data comes directly from you — what you type into the app and the label photos you choose to submit. The one exception is the Monthly Report, which we generate for you from the scan history you created. We do not obtain consumer health data from any other source.

How and with whom we share it

We do not sell consumer health data, and we do not share it for advertising. We share it only with the service providers needed to operate the app:

• Supabase, Inc. — the database and authentication provider that securely stores your account and the health data you enter.
• OpenAI — receives three things, each only to produce a result you asked for. First, a label photo you submit, used once to read the product's text; OpenAI does not keep it (the private copy we retain for catalog verification is described above). Second, when you scan a product that is not yet in our catalog, that product's text details — its name, brand, ingredients, and nutrition numbers — used once to automatically check that the reading is plausible before we score it; this is product information, never tied to your identity, condition, severity, or allergies. Third, when you open your Monthly Report: the condition your scores are tailored to, together with that month's scan count, average score, and score breakdown. In none of these does OpenAI receive your name, email, account identifier, severity, or allergies.

Apple and Google process only sign-in data, not your health data.

Your rights

Under the Washington My Health My Data Act (and similar laws) you may:

• Confirm and access the consumer health data we hold about you.
• Withdraw consent to our collection and sharing.
• Delete your consumer health data.

To delete your data, use "Delete account" in the app, or email rdh2993@gmail.com. To withdraw the optional sharing consent, use Settings → Consent & data sharing. We will honor verified requests as required by law and will not discriminate against you for exercising these rights.

Data retention and security

We keep consumer health data only while your account is active; label photos you submit are retained privately for catalog verification, stored without any link to your account (and therefore not removed by account deletion). Data is encrypted in transit and at rest.

Contact

rdh2993@gmail.com — Gutsy.