Consumer Health Data Privacy Notice
Last updated: 20 October 2026
This notice is for people in US states with a specific consumer health data law — Washington (My Health My Data Act), Nevada (SB 370) and Connecticut. It adds to our Privacy Policy and does not replace it. Everything below is already true of everyone who uses Mealione; this page states it in the form those laws ask for.
What consumer health data we collect
The answers you give in our quiz, and what you do with the plan built from them:
- your sex, age, height, current weight and goal weight;
- how active you are and how fast you want to move toward your goal;
- your diet, your allergies and the foods you have excluded;
- the calorie range and the weekly plan we calculate from all of the above, the meals you mark as eaten and the shopping items you tick off.
If you choose the optional AI coach, this also includes the food and health information you write in messages, replies and prepared action cards, plus relevant saved habits, quiz goals, favorites and plan or shopping-list context used to answer you.
Where it comes from
From you, directly. We do not buy consumer health data, we do not receive it from data brokers, and we do not infer it from your device, your location or your browsing. Mealione does not connect to Apple Health, Health Connect or any other health tracker.
What we use it for
To build and personalise your meal plan, run the account that holds it, and personalise Mealione quiz follow-up emails. These emails may include your sample meal day, selected body illustrations, starting and goal weight, and an illustrative progress chart alongside an offer for Mealione. You can unsubscribe from these offers in any message. We do not use consumer health data to target advertising on other services or to profile you for anyone else. We use free-text you write only to answer you.
Who we share it with
We do not sell consumer health data. We have never sold it and we do not offer it for sale. No advertising network and no data broker receives it.
The service providers who process it on our instructions in order to run the service are listed in section 4 of our Privacy Policy. Railway hosts our own quiz and plan records. Web2Wave hosts the answers entered in the website quiz. When we email your sample meal day, Resend processes the resulting meal, recipe, nutrition and shopping-list information in the message and PDF for delivery. An offer email may also contain your selected body illustrations, starting and goal weight, and an illustrative progress chart. Resend processes these embedded images and message contents for delivery; we do not put your health answers in its marketing contact properties or publish personalised image files. The temporary preview and provider retention periods are described in section 6 of our Privacy Policy.
OpenAI processes the optional AI coach's messages and relevant saved context to generate a personal reply. This includes quiz answers, current dietary preferences and restrictions, calorie range, available plan and confirmed meal marks, favorites and shopping-list checkmarks. We do not automatically include your name, email, account ID, payment details or advertising identifiers. You may include identifying information in a message yourself, so avoid doing so. We use response storage disabled; OpenAI may still retain API content for abuse monitoring under its API data controls.
Our analytics provider receives no consumer health data at all. What it does receive is a short, fixed list of events about the account itself, each tied to an internal user ID: that an account was created, that you signed in, that you connected an email address to an account that started on your device, that a plan was built for a given week, that our server prepared a response to your request for the current plan (with the week start date, without confirming delivery or display), that a payment happened, and that a cancellation was started or finished. It receives nothing about the contents of the plan or your meal and grocery actions — not one answer from the quiz, not your calorie target, not the dishes, not the items on your list, not what you marked as eaten or ticked off, and not any free text you write. We disclose data otherwise only when the law compels us.
Your consent
In the mobile app, before the first question of the quiz, we ask for your consent on a screen that does nothing else. You can decline; you will not get a plan, because the plan is calculated from those answers and cannot exist without them.
The optional AI coach has a separate versioned consent screen before any message is sent to OpenAI. Declining it does not remove other app features you can access. In Chat settings you can clear the conversation or withdraw AI consent; withdrawal also clears the conversation and blocks new AI messages until you consent again. A prescribed-diet answer from the native quiz is included only with recorded health consent; web health-condition answers are not imported for the coach.
We keep AI messages, replies and prepared cards for up to 30 days, or clear them sooner when you use these controls or delete the account. Cards expire after 15 minutes and never execute themselves. Pseudonymous paid usage counters remain for 30 days from the attempt, including after account deletion, so restoring a purchase does not reset its allowance. They contain no messages or health profile and do not restore erased data. OpenAI's applicable security retention can continue after local deletion; clearing a chat does not promise immediate deletion of all provider security records.
Your rights
You can, at any time:
- See what we hold — email support@mealione.com;
- Withdraw your consent and have your health data deleted — delete your account in the app (Profile → Delete account), or email support@mealione.com if you cannot open the app. We erase it on our side immediately and permanently, and we instruct our service providers to erase what they hold;
- Ask us to delete data collected before you had an account — email support@mealione.com and we will find and erase it, within one month;
- Complain — email support@mealione.com first if you can. You may also contact the Attorney General of your state.
If we turn a request down. Reply to the message in which we refused, and we will look at it again — the appeal reaches us the same way the request did, and it costs you nothing. We will write back within 45 days with what we decided and why. If we still say no, you do not have to stop there: we will give you, in that same message, the way to take your complaint to the Attorney General of your state.
We will not deny you the service, charge you differently or give you a worse experience for exercising any of these rights.
Contact
HG POINT LIMITED Spyrou Kyprianou 78, Limassol 3076, Cyprus
Optional unsafe-content reports stay with the AI answer in our own database for safety review. They are separate from helpfulness ratings and are not sent to OpenAI or analytics services. They are removed by chat clearing, AI-consent withdrawal, account deletion or the 30-day conversation retention.