Consumer Health Data Privacy Policy

Effective August 5, 2026

This notice supplements the GlizzyScan Privacy Policy and applies to “consumer health data” covered by laws such as Washington’s My Health My Data Act and Nevada’s consumer health data law.

Consumer health data we collect

Depending on how you use GlizzyScan, consumer health data may include:

• meals, ingredients, serving sizes, calories, nutrients, food searches, saved foods, and eating patterns;
• weight entries and trends, age, biological sex, height, activity level, goals, calorie targets, and related inferences;
• meal photos and descriptions, corrections, AI estimates, and frequent meal names; and
• subscription or account activity that can be associated with use of a nutrition service.

Most of this data is stored only on your device. XYK collects it from the device only when you affirmatively request a feature that requires transfer, such as AI meal analysis or support, or when limited account and subscription data is necessary to provide the service.

Sources

We receive consumer health data directly from you and your use of GlizzyScan; from your device when you submit a photo or request; from automated nutrition inferences generated for you; and from Apple or RevenueCat regarding subscription access. We do not buy consumer health data from data brokers.

Why we collect and use it

We collect and use consumer health data only to:

• provide the feature you request, including generating and refining nutrition estimates, saving local entries, calculating goals, and validating Pro access;
• authenticate requests, enforce daily limits, prevent fraud or misuse, maintain security, and troubleshoot the service;
• respond to support and privacy requests; and
• comply with law and establish, exercise, or defend legal claims.

We will not collect additional categories or use consumer health data for materially different purposes without updating this notice and obtaining consent when required.

Consumer health data we share

“Share” can have a broad meaning under consumer health laws. We may share limited consumer health data with:

• OpenAI, which receives the meal text, optional image, meal context, locale, correction, and previous estimate needed to answer an AI request;
• Google/Firebase, which processes authentication identifiers, server requests, daily request counts, App Check information, and operational logs;
• RevenueCat, which receives account identifiers and App Store purchase or entitlement data to manage Pro access;
• Apple, which processes app distribution, purchases, subscriptions, and optional Apple sign-in;
• Google, only if you choose Google sign-in; and
• authorities, advisers, or transaction parties when legally required or reasonably necessary to protect rights and safety or complete a corporate transaction with appropriate safeguards.

Open Food Facts receives packaged-food search terms you choose to submit; those terms may themselves reveal dietary interests. We do not sell consumer health data, share it for targeted advertising, or use geofencing around healthcare facilities.

Consent

Before the first AI meal transfer, GlizzyScan presents a separate explanation and asks you to allow the transfer. AI analysis is optional; manual logging remains available. You may withdraw future consent from Settings at any time. Withdrawal does not affect processing already completed, and requesting AI analysis again will require a new affirmative choice.

Your health-data rights

Subject to applicable law and verification, you may request to:

• confirm whether we collect, share, or sell your consumer health data and access that data, including a list of specific third parties and affiliates with whom it was shared;
• withdraw consent to future collection or sharing;
• delete consumer health data held by us and, where required, direct relevant processors to delete it; and
• appeal our refusal to act on a request.

Use Settings → Privacy to erase on-device data or withdraw AI consent. Use Settings → Account & Subscription to delete the cloud account and associated GlizzyScan RevenueCat customer record. You may also email xyklabs@gmail.com with “Consumer Health Data Request” in the subject. To appeal, reply with “Appeal.”

We may ask for information reasonably necessary to verify and securely fulfill a request. Authorized agents may act where law permits, subject to proof of authorization. We will not discriminate against you for exercising a right.

Retention and security

On-device data remains until you erase it or remove the app. AI request content is not written to GlizzyScan’s cloud database; OpenAI may retain API abuse-monitoring logs for up to 30 days unless stricter controls apply. Daily AI count records are configured to expire after approximately 45 days. Account and subscription identifiers are retained as described in the Privacy Policy. We use safeguards including encryption in transit, authentication, App Check, access controls, and server-side secret storage.

Changes and contact

We will post changes here. If law requires consent for a new collection, use, or sharing practice, we will seek it before the new practice begins.

Questions or requests: xyklabs@gmail.com.

Privacy Policy · Terms · Support · Made by XYK Labs