This Consumer Health Data Privacy Policy explains how Ingrevo, a product of Nexora Labs Limited ("Ingrevo," "we," "us," or "our"), handles the narrow category of information that certain laws treat as "consumer health data." It is designed to meet the requirements of the Washington My Health My Data Act (MHMDA) and comparable U.S. state consumer-health-data laws, including the Nevada Consumer Health Data Privacy Law (SB 370) and the Connecticut Data Privacy Act.
This is a separate, supplemental policy. It focuses only on consumer health data and adds to, and does not replace, our general Privacy Policy. Where a term is defined in the general Privacy Policy, that meaning applies here unless we say otherwise. This policy also does not replace the other U.S. state disclosures in our Privacy Policy (for example, CCPA/CPRA notices for California residents).
Scope. This policy is written primarily for residents of Washington, Nevada, and Connecticut whose consumer health data we process. As a matter of practice, however, we apply the protections described here to all Ingrevo users, wherever they live. Ingrevo is a pantry-first AI kitchen and meal-planning assistant. It is not a fitness, weight-loss, calorie-coaching, medical, or diagnostic service, it does not provide medical advice, and it does not deliver any health outcome. The features described here exist to help you plan meals within your own nutrition needs.
Ingrevo is for people aged 16 and older. Where local law sets a higher age, that higher requirement applies. We do not knowingly collect consumer health data from anyone under 16.
1. What is "consumer health data"?
Under laws like the MHMDA, "consumer health data" means personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status. Depending on the law, this can include information about health conditions, diagnoses, treatments, medications, bodily functions, and data used to infer any of these.
Ingrevo's footprint of consumer health data is deliberately small and food-focused. The only information we handle that could be treated as consumer health data is:
- your dietary preferences (for example, a diet you follow);
- your allergies and intolerances (for example, a nut or shellfish allergy);
- your meal and calorie logs (meals you record, and the calorie and protein/carbohydrate/fat totals associated with them); and
- the body metrics we use to personalise meal suggestions — your height, weight, sex, date of birth or age, and activity level.
Note: We do not collect wearable-device data, lab or diagnostic results, biometric identifiers, reproductive or sexual-health data, mental-health records, or precise geolocation that could reveal your access to health services. We do not use Apple HealthKit in the current version of the app.
2. Categories of consumer health data we collect
We use the body metrics and calorie information below only to personalise meal suggestions and to suggest your next meal within your nutrition and calorie needs. This is meal planning, not weight-loss or medical guidance.
| Category | What it includes | Why we hold it |
|---|---|---|
| Dietary preferences | The diet(s) you choose to follow in the app | To suggest and generate recipes that respect your preferences |
| Allergies and intolerances | Allergens you tell us to avoid | To suggest allergen-free foods and recipes (see Section 4) |
| Meal and calorie logs | Meal name/type and time; calorie and protein/carbohydrate/fat totals; per-item nutrition | To record your meals and show your nutrition totals |
| Body metrics | Height, weight, sex, date of birth/age, activity level | To personalise meal suggestions within your nutrition/calorie needs |
We treat all of the above as special-category / sensitive data throughout our systems.
3. Sources of consumer health data
We collect this data only from you, through your use of the app:
- Directly from you — when you set your dietary preferences, allergies, and body metrics, or record a meal.
- From your use of app features — for example, when you photograph a meal for recognition, the resulting nutrition estimate is saved to your meal log after you keep it. We do not store your photos on our servers (see our Privacy Policy).
We do not buy consumer health data, and we do not obtain it from data brokers or other third-party sources.
4. How we use consumer health data
We use this data only to provide and operate the meal features you asked for, including to:
- filter and generate recipe suggestions so they respect your dietary preferences and avoid your allergens;
- record and display your meals and their calorie and macronutrient totals; and
- personalise meal suggestions and suggest your next meal within your nutrition and calorie needs, using your body metrics.
Never used for advertising. We do not use consumer health data — your dietary preferences, allergies, meal or calorie logs, or body metrics — for advertising, ad targeting, cross-context behavioural advertising, or profiling for marketing. We do not sell it, and we never share it with advertising partners. Any advertising shown in the app (to free users only) relies solely on advertising identifiers under your App Tracking Transparency choice and never on your health, diet, allergy, meal, calorie, or body-metric data.
Allergens and our AI providers. To suggest allergen-free foods and recipes, we send your allergen information to our AI providers (Microsoft Azure AI and Google AI) so the AI can avoid those allergens in what it suggests. Those providers receive your allergen information, food text, and EXIF/GPS-stripped photos for recognition. They do not receive advertising data, and we contractually require them to process this information only to return your result and, where the provider offers it, not to train their models on your data.
5. How we share consumer health data
We share consumer health data only with a small set of service providers ("processors") that help us run the app, and only as needed to provide the service. Each is contractually bound to protect the data, to use it only on our instructions, and not to use it for its own purposes. We have no affiliates with whom we share this data.
| Recipient | Role | Consumer health data it receives | Region |
|---|---|---|---|
| DigitalOcean, LLC | Application server + database hosting | Dietary preferences, allergies, meal/calorie logs, and body metrics, at rest and in processing | European Union [TODO: confirm exact EU region] |
| Cloudflare, Inc. | Object storage (Cloudflare R2) | Your data-export archives, if you request one (not your photos) | European Union |
| Microsoft Azure AI | Food-photo recognition; nutrition, recipe, and assistant generation | Allergen information, food text and prompts, and EXIF-stripped photos for recognition. Does not receive advertising data. Contractually instructed to use the data only to return your result and, where offered, not to train on it | United States (transfers under Standard Contractual Clauses) |
| Google AI | Food-photo recognition; nutrition, recipe, and assistant generation | Allergen information, food text and prompts, and EXIF-stripped photos for recognition. Does not receive advertising data. Contractually instructed to use the data only to return your result and, where offered, not to train on it | United States (transfers under Standard Contractual Clauses) |
Our advertising partners never receive any consumer health data. We keep the current, complete list of our processors — with contact information — in the sub-processor list in our general Privacy Policy.
We do not "sell" consumer health data. Under the MHMDA, "sale" is defined broadly and includes most sharing of consumer health data for third-party targeted advertising. Ingrevo does not engage in targeted advertising with this data and does not share consumer health data for advertising of any kind, so no such sale occurs. We would never sell this data, and we do not offer or need any separate "authorization to sell" mechanism.
6. Your rights
Wherever you live, you can exercise the following rights with respect to your consumer health data:
- Right to know and access — to confirm whether we are collecting, sharing, or selling your consumer health data (we do not sell it), and to access that data.
- Right to a list of recipients — to obtain a list of all third parties and affiliates with whom we share your consumer health data, together with an active means of contacting each. Our current, complete recipient list is maintained in the sub-processor table of our general Privacy Policy; the principal recipients are summarised in Section 5 above. We have no affiliates.
- Right to withdraw consent — to withdraw your consent to our collection and sharing of your consumer health data at any time.
- Right to delete — to have your consumer health data deleted, including deletion from our backups and from our processors, subject to the limited legal-retention exceptions described below.
How to make a request. You can manage or delete your data in the app (Settings), or contact us at support@ingrevo.app. We will respond to a request within 45 days. If reasonably necessary, we may extend this period once by an additional 45 days and will tell you if we do.
Deletion mechanics and retention exceptions. When you delete your account, we immediately deactivate it, revoke all sessions and tokens (you are signed out within about one hour), and delete the linked sign-in record. We erase your personal data — including your consumer health data — across our systems, including backups, within 30 days. Where the law permits or requires retention, we may keep only limited information in anonymised form that is no longer linked to you (for example, anonymised subscription/financial records kept for tax compliance, anonymised proof-of-consent records, and anonymous account-deletion feedback). Your meal log may be retained for up to five years unless you ask us to delete it sooner. More information is at /delete-account.
Appeals. If we decline a request, we will explain why, and you may appeal by replying to our response or by emailing support@ingrevo.app with the word "Appeal." We will respond to your appeal within a reasonable time and explain the outcome. If we deny your appeal, you may contact the Washington State Attorney General (see Section 9).
7. Consent
We ask for your consent to collect and process your consumer health data separately and clearly, before we collect it, and only for the specific purposes described in this policy. This consent is opt-in. It is not bundled into your acceptance of our Terms of Use or into any other agreement, and it is not a condition of using unrelated parts of the app.
- We do not use deceptive or manipulative interface designs ("dark patterns") to obtain consent.
- Broad, blanket acceptance of our terms does not count as consent to process your consumer health data.
- You may withdraw your consent at any time, as described in Section 6, and withdrawal is as easy as giving consent.
- The separate "help improve recognition" consent, which controls whether AI food-correction audit records are kept, is likewise opt-in and off by default.
We do not use geofencing around any facility (such as a health-care location) to collect data or to send messages related to consumer health data.
8. Security and access controls
We protect consumer health data with administrative, technical, and physical safeguards appropriate to its sensitivity. In particular:
- Access is restricted to authorised personnel and processors on a need-to-know basis, using role-based access controls.
- Access to systems holding this data is logged and monitored.
- Data is encrypted in transit, and dietary preferences, allergies, and body metrics are treated as special-category data throughout our systems.
- Our processors are contractually required to maintain comparable safeguards.
No system can be guaranteed perfectly secure, but we work to protect this data and to limit who can reach it.
9. Contact and how to complain
For any question about this policy, or to exercise any right described here, contact us at support@ingrevo.app.
If you are a Washington resident and believe we have not resolved your concern, you may file a complaint with the Washington State Attorney General at https://www.atg.wa.gov/file-complaint. Residents of other states may also contact their state Attorney General or applicable regulator.
Contact
Ingrevo, a product of Nexora Labs Limited (a New Zealand company) is the controller responsible for your consumer health data.
Registered address: 52 Karepiro Drive, Stanmore Bay, Auckland 0932, New Zealand.
For all requests — including access, deletion, withdrawal of consent, and consumer-health-data questions — email support@ingrevo.app.