Consumer Health Data Privacy Policy

Effective October 1, 2026

This policy explains what consumer health data Me & Milo collects, why, where it comes from, who it goes to, and how you can access, delete or withdraw consent. We never sell your health data and never use geofencing.

About this policy

This Consumer Health Data Privacy Policy describes how [COMPANY LEGAL NAME] (“we,” “us” or “our”) collects, uses, shares and protects “consumer health data” through the Me & Milo app and related services (the “Service”). It is written to meet the requirements of Washington’s My Health My Data Act (RCW 19.373), Nevada’s consumer health data law (Senate Bill 370, NRS Chapter 603A), and the consumer health data provisions of the Connecticut Data Privacy Act, and we apply it to all our US users.

“Consumer health data” means personal information that is linked or reasonably linkable to you and that identifies your past, present or future physical or mental health status. For Me & Milo, that includes most of what you log.

This policy supplements our Privacy Policy, which covers all personal information and is available in the app under Settings and at https://meandmilo.app/privacy. If there is a conflict between the two for consumer health data, this policy controls.

Our commitments

Categories of consumer health data we collect

Depending on the features you use, we collect these categories of consumer health data:

We do not collect precise location, biometric data used to identify you, genetic data, or reproductive or sexual health data (unless you choose to write about it in a free-text note or chat).

Why we collect and use it

We collect and use consumer health data only as reasonably necessary for these purposes:

We don’t use consumer health data for advertising, marketing, research or to make decisions about your eligibility for anything.

Where we get it

Consent

Collecting consumer health data is necessary for Me & Milo to work. When you set up Me & Milo, before we ask any health questions, we ask for your separate consent to collect and use your consumer health data for the purposes in this policy. We ask for separate consent, in the app, before any consumer health data is shared with our AI service provider, and your device asks for your permission before Me & Milo can access Apple Health, Health Connect, Fitbit, your camera or your photos.

We will ask for your separate consent before we collect or use your consumer health data for any purpose not described in this policy, or share it with anyone not described below.

Who we share it with

We do not sell consumer health data. We share it only with the following categories of recipients, and only for the purposes described:

Our processors may use consumer health data only to provide services to us under a written contract, and are not allowed to use it for their own purposes.

Barcode lookups send only the barcode number to Open Food Facts, a public food database. No consumer health data or personal information is sent.

Affiliates. We do not currently have any affiliates with whom we share consumer health data. If that changes, we will update this policy and list them here.

Your rights

You have the following rights regarding your consumer health data:

How to exercise your rights

In the app (fastest):

By email or mail: send your request to [privacy@yourdomain.com] with the subject line “Health data request,” or write to [COMPANY LEGAL NAME], [COMPANY MAILING ADDRESS]. Tell us which right you want to exercise. You can also ask for the list of third parties we have shared your data with.

Verification. To protect your data, we will verify your identity, usually by asking you to send the request from the email address on your account or to confirm a code sent to it. We won’t ask you to create an account just to make a request.

Authorized agents. You may use an authorized agent where the law allows. We may ask for proof that the agent is authorized and ask you to verify your identity directly.

Timing and cost. We will respond within 45 days of receiving your request. If we need more time, we may extend this once by up to 45 more days when reasonably necessary, and we will tell you why within the first 45 days. Requests are free, up to twice a year; we may charge a reasonable fee or decline requests that are clearly unfounded, excessive or repetitive, as the law allows.

How to appeal

If we deny your request in whole or in part, we will explain why. You can appeal by replying to our decision or emailing [privacy@yourdomain.com] with the subject line “Health data appeal” within a reasonable time after our decision.

We will respond to your appeal in writing within 45 days, explaining any action we took or did not take and why. Where the law allows, we may extend this by up to 60 more days and will tell you if we do.

If we deny your appeal, you can contact your state Attorney General:

No sale and no geofencing

We do not sell consumer health data, and we will not sell it in the future without first getting a valid, signed authorization from you as required by law.

We do not collect location data, and we do not implement a geofence around any facility that provides in-person healthcare services (or anywhere else) to identify, track, collect data from, or send notifications or messages to anyone.

How we protect and keep it

The consumer health data you log is stored on our servers in the United States, hosted by Amazon Web Services, and a copy is kept on each device you sign in on (on the web, in your browser’s storage for this site). Signing out removes that device’s copy. Progress photos and meal photos stay on the device where you took them.

We limit access to consumer health data to employees, contractors and processors who need it to provide the Service, and we use reasonable administrative, technical and physical safeguards to protect it, including encryption in transit and at rest on our servers and hashed passwords.

We keep consumer health data for as long as your account is active. When you delete your account, we delete your consumer health data from our servers immediately, and backup copies are overwritten within 30 days, unless the law requires us to keep it longer.

Who this policy is for

Me & Milo is for adults 18 and older in the United States. We don’t knowingly collect consumer health data from anyone under 18, and we will delete it if we learn that we have.

Changes to this policy

We may update this policy from time to time, and we will change the effective date above when we do. If we make a material change, such as collecting a new category of consumer health data, using it for a new purpose, or sharing it with a new category of recipients, we will notify you in the app or by email and ask for your consent before the change applies to you.

Contact us