Washington Consumer Health Data Privacy Policy

1Consumer health data we may collect

Depending on how you use Coach Anaya, consumer health data may include:

• health conditions or health-related information you choose to provide;
• dietary requirements, allergies and intolerances;
• food, meal and nutrition information;
• fasting information;
• medication and supplement information;
• wellness goals and preferences;
• mood or behavioural information;
• symptoms or other health-related information you choose to enter;
• information contained in health-related voice, text or AI interactions;
• health-related photographs or meal information;
• information used in Knock Knock or Care Circle where enabled; and
• information derived or inferred from information you provide where that information relates to your physical or mental health status.

Washington law defines consumer health data broadly and can include information reasonably linkable to an individual that identifies or relates to their past, present or future physical or mental health status.

2Why we collect and use consumer health data

We may collect and use consumer health data to:

• provide food, nutrition and wellness coaching requested by you;
• personalise Coach Anaya based on information you choose to provide;
• analyse meals, foods, ingredients and nutritional information;
• support food and wellness logging;
• provide medication and supplement logging and reminders;
• provide fasting-related functionality;
• provide user-enabled reminders and nudges;
• operate Knock Knock and Care Circle where you choose to enable them;
• respond to your questions and AI interactions;
• maintain account security and service reliability;
• provide customer support; and
• comply with applicable law.

We do not use Coach Anaya consumer health data to determine eligibility for employment, insurance, credit or similar high-impact decisions.

3Sources of consumer health data

We may receive consumer health data from:

• you directly, including information you type, speak, upload, photograph, scan or log;
• information generated through your interactions with Coach Anaya;
• accepted Care Circle interactions where applicable;
• technical systems required to provide a feature you have requested; and
• service providers processing information on our behalf to deliver Coach Anaya.

At launch, Coach Anaya does not obtain health data from Apple HealthKit or Android Health Connect.

4Consumer health data we may share

We may share consumer health data only as reasonably necessary to provide services you request or where you provide any consent required by applicable law.

Categories of information shared may include:

• health and wellness information relevant to an AI request;
• food, meal, nutrition and photograph information;
• voice transcripts or text supplied for processing;
• medication, supplement or reminder information;
• Care Circle or Knock Knock information where enabled;
• account or technical information needed to provide or secure the service.

Washington law generally requires consent for collection or sharing unless the processing is necessary to provide a product or service requested by the consumer. Separate consent may be required for sharing in other circumstances.

5Categories of recipients

Consumer health data may be processed or shared with categories of providers including:

• cloud hosting and database providers;
• artificial intelligence and transcription providers;
• communications and notification providers;
• authentication and security providers;
• customer-support providers;
• an accepted Care Circle contact where you have enabled the relevant sharing; and
• other processors necessary to provide a feature you specifically request.

Material providers currently include, where applicable:

• Supabase
• OpenAI
• Twilio
• 360dialog / WhatsApp / Meta, where WhatsApp functionality is enabled

More information is available on our Service Providers & International Processing page.

6We do not sell consumer health data

Coach Anaya does not sell consumer health data.

If that practice were ever to change, we would first comply with Washington’s specific authorization requirements. Washington requires a separate valid authorization before consumer health data may be sold.

7Your Washington rights

Where the Washington My Health My Data Act applies, you may have the right to:

• confirm whether we collect, share or sell consumer health data about you;
• access that consumer health data;
• obtain information about third parties and affiliates with whom it has been shared or sold;
• withdraw consent to future collection or sharing where processing relies on consent; and
• request deletion of your consumer health data.

Washington law also requires deletion requests to be communicated to relevant processors and other recipients, subject to applicable legal provisions.

8How to exercise your rights

You may submit a request by emailing privacy@foodrx.com.au.

You may also use our account-deletion process where relevant.

You do not need to create a new account solely to make a privacy request.

We may take reasonable steps to verify your identity before fulfilling a request.

9Response timing

Where Washington law applies, we will respond to eligible requests without undue delay and generally within 45 days.

Where reasonably necessary because of the complexity or number of requests, that period may be extended once by an additional 45 days, with notice to you within the initial response period.

10Deletion and backups

Where Washington law requires deletion of consumer health data, we will take the steps required by law, including notifying relevant processors and other recipients where applicable.

Deletion from archived or backup systems may be delayed where permitted by Washington law, for up to six months after authentication of the deletion request where necessary to restore and delete data from those systems.

11Appeals

If we decline to take action on a Washington consumer-health-data request, you may appeal that decision by emailing privacy@foodrx.com.au.

Please write “Washington Privacy Appeal” in the subject line.

We will respond to an eligible appeal within the period required by Washington law and explain the outcome.

If an appeal is denied, we will provide information about how you may contact the Washington State Attorney General.

12Consent and future uses

We will not collect, use or share additional categories of Washington consumer health data, or use existing consumer health data for materially new purposes, where Washington law requires prior disclosure and affirmative consent, without first providing the required disclosure and obtaining that consent.

13Contact

See also the Coach Anaya Privacy Policy and Privacy Rights.