Nevada Consumer Health Data Privacy Policy

1Consumer health data we may collect

Depending on how you use Coach Anaya, consumer health data may include:

• health conditions or health-related information you choose to provide;
• dietary requirements, allergies and intolerances;
• food, meal and nutrition information;
• fasting information;
• medication and supplement information;
• wellness goals and preferences;
• mood or behavioural information;
• symptoms or other health-related information you choose to enter;
• information contained in health-related voice, text or AI interactions;
• health-related photographs or meal information;
• information used in Knock Knock or Care Circle where enabled; and
• health-related information inferred or derived from information you provide.

Nevada defines consumer health data broadly to include identifiable information used to identify a person’s past, present or future health status, including health conditions, medication use, symptoms and certain inferred information.

2How we use consumer health data

We may use consumer health data to:

• provide food, nutrition and wellness coaching requested by you;
• personalise Coach Anaya;
• analyse meals, foods, ingredients and nutritional information;
• provide food and wellness logging;
• provide medication and supplement logging and reminders;
• provide fasting functionality;
• provide user-enabled reminders and nudges;
• operate Knock Knock and Care Circle where enabled;
• respond to your voice, text and AI requests;
• provide customer support;
• secure and maintain the service; and
• comply with applicable law.

3Sources of consumer health data

Consumer health data may come from:

• you directly;
• information you type, speak, photograph, scan, upload or log;
• information generated from your interactions with Coach Anaya;
• accepted Care Circle interactions where applicable; and
• service providers processing information on our behalf to provide functionality you request.

At launch, Coach Anaya does not obtain health information from Apple HealthKit or Android Health Connect.

4Consumer health data we may share

Depending on the functionality you use, categories of consumer health data that may be shared for service delivery include:

• health and wellness information relevant to an AI request;
• meal, food, nutrition and photograph information;
• voice transcripts or text;
• medication, supplement or reminder information;
• Care Circle or Knock Knock information where enabled; and
• account or technical information necessary to provide or secure the service.

Nevada generally requires affirmative, voluntary consent for collection or sharing unless the processing is necessary to provide a product or service that the consumer requested. Separate consent may be required for certain sharing.

5Categories of recipients

Consumer health data may be processed by categories of recipients including:

• cloud hosting and database providers;
• artificial intelligence and transcription providers;
• communications and notification providers;
• authentication and security providers;
• customer-support providers;
• accepted Care Circle contacts where you have enabled the relevant sharing; and
• other processors required to provide a feature you request.

Material providers may include:

• Supabase
• OpenAI
• Twilio
• 360dialog / WhatsApp / Meta, where enabled

More information is available on our Service Providers & International Processing page.

6How consumer health data is processed

Consumer health data may be:

• stored in secure cloud infrastructure;
• transmitted to authorised processors where needed to provide functionality;
• analysed by automated systems and AI where you request those features;
• associated with your account where needed to personalise or deliver the service; and
• deleted or de-identified in accordance with applicable law and our retention practices.

Access is restricted to personnel and processors who reasonably need it to provide the relevant service or perform authorised operational functions.

Nevada requires regulated entities to maintain reasonable administrative, technical and physical safeguards for consumer health data.

7Collection across websites or services

We do not permit third parties to collect Coach Anaya consumer health data over time and across unrelated websites or online services for advertising or cross-service tracking purposes.

Our processors may process information as necessary to provide Coach Anaya functionality, security and requested services.

8We do not sell consumer health data

Coach Anaya does not sell consumer health data.

If that practice ever changed, we would comply with Nevada’s separate written-authorisation requirements before any sale. Nevada prohibits sale without specific written authorisation.

9Your Nevada rights

Where Nevada consumer health data law applies, you may request that we:

• confirm whether we are collecting, sharing or selling consumer health data about you;
• provide a list of third parties with whom your consumer health data has been shared or sold;
• stop collecting, sharing or selling your consumer health data; and
• delete your consumer health data.

Nevada provides these rights under NRS 603A.505.

10Reviewing or correcting your information

Where Coach Anaya provides account or profile controls, you may review or update information directly within the service.

You may also request review or correction by contacting privacy@foodrx.com.au.

11How to submit a request

You may submit a Nevada consumer health data request by emailing privacy@foodrx.com.au.

You may also use our account-deletion page.

We may take reasonable steps to verify your identity before acting on a request.

12Response timing

We will respond to an authenticated Nevada request without undue delay and generally within 45 days.

Where reasonably necessary because of complexity or the number of requests, that period may be extended once by up to an additional 45 days, with notice to you.

13Deletion

For an authenticated Nevada consumer-health-data deletion request, applicable Nevada law generally requires deletion from our records and network within 30 days, along with notification to relevant affiliates, processors, contractors or other third parties with whom the information was shared.

Information stored on archived or backup systems may, where Nevada law permits, remain until restoration and deletion are practicable, for up to two years after authentication of the request.

14Appeals

If we refuse to act on a Nevada consumer-health-data request, you may appeal by emailing privacy@foodrx.com.au.

Please use the subject “Nevada Privacy Appeal”.

We will provide a written response to an eligible appeal within 45 days.

If an appeal is denied, we will provide contact information for the Nevada Office of the Attorney General.

15Material changes

If we make a material change to the categories of Nevada consumer health data we collect, the purposes for which we use it, or the categories of third parties with whom we share it, we will provide the disclosures and obtain any affirmative consent required by Nevada law before applying the new practice.

16Contact

See also the Coach Anaya Privacy Policy and Privacy Rights.