Consumer Health Data Privacy Policy
Draft, under legal review. This page is a draft written for a lawyer to review. It is not legal advice, it has not been approved, and it may change before launch.
Text in [SQUARE BRACKETS] is a placeholder the owner has not filled in yet.
- Some of what you save here, such as your diet goals and plans, could say something about your health. The law calls that "consumer health data".
- We collect it only with your separate consent, given when you sign in, and only to run the features you use.
- We don't sell it, use it for ads, or share it with anyone except the service providers that run the site for us.
- You can see it, export it and delete it from your account page at any time.
Who this covers
This policy is for anyone who uses NutritionDictionary, run by [OWNER LEGAL NAME]. It's written to meet Washington's My Health My Data Act (RCW 19.373), Nevada's consumer health data law (Senate Bill 370, 2023) and Connecticut's rules on consumer health data (Connecticut Data Privacy Act, as amended in 2023). It adds to our Privacy Policy, which covers all the data we handle.
"Consumer health data" means personal information that is linked or reasonably linkable to you and identifies your past, present or future physical or mental health, including information inferred from other data.
Consumer health data we collect
We don't ask about medical conditions, medications, pregnancy, weight or body measurements. But these could still count as consumer health data:
- Diet and nutrition goals you set in the planner: calorie ranges, nutrient minimums and limits, portion sizes, and the goal preset you pick (Everyday essentials, Standard adult (FDA Daily Values), High protein, Lower carb, or your own). A goal such as a low carbohydrate limit could suggest something about your health.
- Plans you make: the foods, amounts, limits and goals in them.
- Food history: the foods you open, with their calories and key nutrients.
- Recipe history: recipes you analyze, with their ingredients and nutrition per serving.
- Recipe photos and text you send to be read. We process them to answer you and don't save the photo.
History is collected only while you're signed in, and only after you've given consent. Without an account, your goals and plans stay in your browser and we don't keep them, though our server processes them each time you make a plan.
Where it comes from
Only from you, through what you enter, choose and save on the site. We don't buy data or get health data from anyone else.
How we use it
- To make the plans and recipe reads you ask for.
- To keep your history so you can see and reopen foods, recipes and plans on any device.
- For Plus subscribers: the week planner, grocery list and whole-plan contaminant check, which work from the same data.
- To keep the service secure and fix problems.
We don't use it for advertising, to build profiles about you, to train AI models, or to make decisions about you.
Who we share it with
We don't share consumer health data with third parties or affiliates (we have no affiliates). These service providers ("processors") handle it only on our instructions and only to run the site:
- Amazon Web Services, which hosts the site and its database in the US.
- Amazon Bedrock (part of AWS), which reads recipe photos and some pasted recipes. It doesn't use them to train models or share them with the model makers.
Stripe and Google don't receive your consumer health data. We may disclose data if the law requires it, such as under a valid court order.
We don't sell it
We don't sell consumer health data, and we won't. We also don't use geofences around places where people get health care, or anywhere else.
Your consent
When you sign in, we ask for your consent to collect consumer health data in its own box, separate from agreeing to our Terms and Privacy Policy. You can't create an account without it, because saving your history is what an account is for. We record which version of this policy you agreed to and when. If we change this policy, we ask again the next time you sign in.
To withdraw consent, delete your account on your account page: that stops collection and deletes your data. You can also email privacy@nutritiondictionary.com. You can keep using the site without an account.
Your rights and how to use them
You have the right to:
- Confirm and access: find out whether we collect, share or sell your consumer health data, and get a copy. Export my data on your account page gives you everything at once.
- See who has it: the full list is in Who we share it with. You can ask us for it by email too.
- Delete it: single items on your history page, or everything with Delete my account. We delete it from our live database right away, and it leaves our backups within 35 days (how backups work). Our processors hold it only as part of our systems, so the same deletion covers them.
- Withdraw consent: as described above.
- Appeal: if we turn down a request, reply to our answer with "Appeal" and we'll respond in writing within 45 days. If you're still unhappy, you can complain to your state attorney general; in Washington, through the Attorney General's complaint form.
Use your account page, or email privacy@nutritiondictionary.com from the address on your account. We'll answer within 45 days, and if we need longer (up to another 45 days) we'll tell you why. It's free, and we won't treat you differently for asking.
Nevada and Connecticut
Nevada: you have the rights above, and we collect and share consumer health data only with your consent or as needed to provide the service you ask for. We don't sell it. Connecticut: we process consumer health data only with your consent, don't sell it, and limit who can access it to people bound by confidentiality.
Contact
Email privacy@nutritiondictionary.com. Effective date and version are at the top of this page.