Consumer Health Data Privacy Policy

1. Consumer health data we collect

Depending on what you choose to provide and use, Nurieat may collect or derive:

• age and sex at birth;
• height, weight, activity level, calorie goals, and macro targets;
• food allergies, restrictions, excluded foods, and dietary preferences;
• nutrition goals and meal-planning goals;
• meal plans, foods, recipes, portions, swaps, nutrient totals, and grocery lists; and
• calorie estimates, nutrient requirements, and other values derived from information you submit.

Nurieat is a general-wellness meal-planning service. We do not ask for diagnoses, medical records, insurance information, prescriptions, or genetic data, and you should not submit them in free-text fields.

2. Sources of consumer health data

We receive consumer health data directly from you during onboarding and when you update preferences, request a plan, swap a meal or ingredient, or send feedback. We also derive nutrition targets, estimates, and plans from the information you provide and from reviewed food and nutrition datasets.

3. Why we collect and use it

We collect and use consumer health data only to provide and maintain the meal-planning service you request, including to:

• calculate calorie, macro, and micronutrient targets;
• filter meals based on allergies, exclusions, and preferences;
• generate, validate, save, display, and update meal plans and grocery lists;
• support meal and ingredient swaps;
• troubleshoot the service, respond to requests, and protect account security; and
• comply with law and establish, exercise, or defend legal claims.

We do not use consumer health data for advertising or to build advertising profiles.

4. Consumer health data we disclose and who receives it

We disclose the categories listed above only as needed to provide the service you request, to processors working under our instructions, or as legally required.

• Cloudflare: hosting, database, request delivery, and security services.
• Nutrition-solver infrastructure providers: computing and hosting used to calculate and validate your plan.
• Legal and safety recipients: courts, regulators, law enforcement, advisers, or other parties when disclosure is required or reasonably necessary to protect rights and safety.

Google receives information when you choose Google sign-in, and Stripe receives account and billing information when you subscribe, but we do not send your body measurements, allergies, food restrictions, nutrition targets, or meal plans to either service. Nurieat has no affiliates with which it shares consumer health data.

5. Sale of consumer health data

We do not sell consumer health data. If that practice ever changes, we will update this policy and obtain the authorization required by applicable law before any sale.

6. Your consumer health data rights

Where applicable, you may ask us to:

• confirm whether we collect, share, or sell your consumer health data;
• provide access to that data and a list of third parties or affiliates that received it;
• delete consumer health data from our systems and direct relevant processors to do the same; or
• withdraw consent from future collection or sharing that relies on consent.

Email support@nurieat.com from the address associated with your account and describe your request. You do not need to create an account to submit a request, though we may need information to authenticate you. We will respond without undue delay and within 45 days where Washington law applies, subject to one permitted 45-day extension.

If we deny your request, reply to our decision with “Appeal” in the subject line and explain why you believe it should be reconsidered. We will decide the appeal within 45 days where Washington law applies and explain how to contact the appropriate regulator if we deny it.

7. Changes and contact

We will update the effective date when this policy changes and provide additional notice where required. Questions and rights requests may be sent to support@nurieat.com.