have this

Washington and Nevada health data notice

Last updated 2 November 2026.

This is our consumer health data privacy policy under Washington’s My Health My Data Act and Nevada’s consumer health data law. Consumer health data is personal data that identifies your past, present or future physical or mental health.

The health data we collect

• Your answers: age, sex, height, weight, goal weight and pace, activity, goals, diets and diet days, allergies and foods you don’t eat.
• What you log: food and drink with its calories and nutrients, water and weigh-ins.
• What we work out from them: your calorie and nutrient targets, and the ideas and recipes we show you, with your yes and no swipes.
• Photos (of menus, fridges, cupboards, receipts, recipes, products, plates and labels) and what you type or say, when they tell us what you eat. Each photo is deleted as soon as it’s been read.
• Whether what you type sounds worrying, for example about not eating: worked out at that moment, to show a calm note instead of ideas, and never kept.

Why we collect it and how we use it

Only to give you meal ideas and recipes that fit your targets, diets and allergies, to keep your food log and show your progress, and to keep you safe (allergy, diet, alcohol and food-safety checks). Never for ads.

Where it comes from

From you: your answers, what you log, your photos and what you type or say. We work out your targets and ideas from these. We don’t get health data from anyone else.

Who we share it with

We don’t share or sell your consumer health data, and we have no affiliates. Companies that process it for us under contract, only to provide have this to you: Supabase (stores it), OpenAI and Google (AI that reads your photos and words and writes ideas and recipes), and RevenueCat (subscriptions: it gets only your account’s random ID and your purchases, never health data).

Your rights

You can confirm whether we have your consumer health data, see it, get a copy, delete it and withdraw your consent. In the app: Settings > Your data > Export my data or Delete my health data, and Settings > Delete account. Or email havethisprivacy@nerdyslothstudios.com.

We answer within one month, and always within 45 days of confirming it’s you. If we need longer, we’ll tell you why within that time (up to 45 more days).

When you delete it, we delete it from our systems straight away, tell the companies that process it for us within 30 days, and remove it from our backups within 90 days.

To withdraw your consent, delete your health data or your account, as above: we then stop collecting it.

If we say no to a request, you can appeal: reply to our answer, or email havethisprivacy@nerdyslothstudios.com with "Appeal" in the subject. We answer appeals within 45 days, and if we still say no, we’ll tell you how to contact your state’s attorney general.