This notice supplements our general Privacy Policy and applies only to the subset of information that qualifies as consumer health data under US state consumer health data laws, including Washington's My Health My Data Act (RCW 19.373) and Nevada's consumer health data law (SB 370 / NRS 603A). Our general Privacy Policy covers all other personal data and remains fully applicable alongside this notice.
1. What counts as consumer health data
Under these laws, consumer health data means personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status. For Ori, this includes:
- Body weight, height, biological sex, and date of birth
- Food and calorie log entries, including AI-estimated calorie values
- Weight trend data and calorie targets generated by our adaptive calorie-adjustment feature
- Look Away scale readings (derived weight values)
- Goal type and goal rate of change (e.g. weight loss, maintenance, gain)
- AI chat messages and voice-derived text where they describe food, weight, or related health information
2. Categories collected and why
We collect the categories listed above directly from you when you use Ori, for the sole purpose of providing the app's core functionality: calculating calorie targets, tracking weight trends, generating food and Weekly Tweaks guidance, and powering AI-assisted food logging. We do not collect consumer health data from any other source, and we do not use it for advertising.
3. Sources
The only source of your consumer health data is you: information you enter directly into the app (manual logs, onboarding answers), information derived from images or voice you submit (Look Away scale readings, food photo and label estimates, voice-log transcripts), and the outputs our adaptive calorie algorithm calculates from that information.
4. Categories shared, and with whom
We do not sell consumer health data. We do not share consumer health data for advertising. We share it only with the processors needed to run Ori:
| Third party | Categories shared | Purpose |
|---|---|---|
| Supabase | All categories in section 1 | Database, authentication, and backend processing (processor, under DPA) |
| Google (Google AI services / Gemini API) | Food, label, and scale photos; food-related prompts and voice-derived text; recent conversation context | AI food and scale recognition, chat, and Weekly Tweaks (processor, under DPA) |
We do not share consumer health data with RevenueCat, Apple, or Google Play beyond your account identifier and subscription status, neither of which reveals health information on its own.
5. Your rights
If you are a resident covered by these laws, you have the right to:
- Confirm whether we are collecting, sharing, or selling your consumer health data, and access that data.
- Withdraw consent for the collection and sharing of your consumer health data, at any time.
- Delete your consumer health data, including data held by us and, where applicable, by our processors.
- Appeal a denial of any of the above requests.
To exercise any of these rights, email hello@heyori.app. We will respond within the timeframe required by applicable law, and will not charge a fee for a reasonable number of requests. You can also delete your account and associated consumer health data directly within the app, or via our account-deletion page.
To appeal a denied request, reply to our response or email hello@heyori.app with "Appeal" in the subject line. If we cannot resolve your appeal, Washington residents may contact the Washington State Attorney General at atg.wa.gov, and Nevada residents may contact the Nevada Attorney General at ag.nv.gov.
6. No geofencing
We do not use geofencing technology around any healthcare facility, and we do not collect precise location data at all (see our Privacy Policy).
7. Retention
Consumer health data is retained for as long as your account is active, and deleted immediately on account deletion via database cascade, except where a narrower retention period is described in our Privacy Policy (for example, Look Away and food photos, which are never stored server-side).
8. Changes to this notice
If we change what consumer health data we collect, use, or share, we will update this notice and, where required, ask for your renewed consent before the new collection, use, or sharing begins. The date at the top of this page shows when it was last updated.
9. Contact
Questions about this notice: hello@heyori.app
Postal address: Double Quack LTD, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ