Consumer Health Data Privacy Policy
Last updated:
ZomaLog is a nutrition tracker, so much of what you enter is health information. This policy explains what consumer health data we collect, where it comes from, why we use it, who handles it and how you can use your rights. We never sell it, never use it for ads, and disclose it only to companies that process it for us or that you choose to use.
Before launch: ZomaLog is preparing for its public launch. This policy describes how ZomaLog works from launch. If anything changes before then, we'll update this page and its date.
Who this policy covers
This policy is written for Washington's My Health My Data Act and Nevada's consumer health data law (SB 370). It applies to consumer health data about people in those states, and we follow it for everyone who uses ZomaLog. It adds to our Privacy Policy.
ZomaLog ("we" or "us") can be reached at [email protected].
Consumer health data we collect
- What you eat and drink: foods, amounts, meals, recipes, Quick add entries, water, and the calories and nutrients we calculate from them.
- Body weight: weights you enter or import from Apple Health, and your weight trend.
- Your plan: calorie and macro targets and their history.
- Setup answers: birth date, height, sex for the calorie equation, activity level, workouts per week, goals, goal weight and pace, eating style (such as vegetarian) and allergies.
- Health context you choose to share: for example pregnancy, breastfeeding, diabetes or insulin use, prediabetes, PCOS, GLP-1 medication, kidney disease, or a past or current eating disorder. Each of these questions is optional.
- What you send to AI features: Describe text and meal photos, only after you allow AI.
- What we calculate: your targets, weight trend, weekly check-in summaries and the days you mark as complete.
- Account details: using a nutrition tracker can itself count as health data under these laws, so we also treat your email address, sign-in details and purchases as consumer health data.
We don't collect your exact location or buy data about you.
Where it comes from
- From you, when you use ZomaLog.
- From Apple Health on your iPhone, only if you connect it (body weight).
- From Apple or Google when you sign in with them (your sign-in ID and email address).
- From our calculations, based on what you enter.
Why we collect and use it
- To keep your diary and show your totals, progress and weekly check-ins.
- To calculate your targets, explain them in "Why this number?", and apply safety rules, such as no calorie deficit during pregnancy.
- To sync your data across your devices and keep backups.
- To turn Describe text and Snap photos into editable estimates, only when you ask and after you allow AI.
- To give you Plus, restore purchases and handle refunds (account and purchase details only).
- To answer your requests and keep your account secure.
We never use consumer health data for advertising, never sell it, and never use it to choose the cards shown on the free plan. If we ever want to use it for a new purpose, we'll ask for your consent first.
Your consent
We collect consumer health data only with your consent, and use it only to provide the service you ask for. When you create an account, a separate checkbox, unticked by default, asks: "I agree that ZomaLog processes the health information I enter (like food, weight and goals) to run my diary and plan." You can't create an account without it. AI features need a second, separate permission, which you can refuse and still log manually.
Who we disclose it to
We never sell consumer health data, and we don't share it with third parties or affiliates. If we ever wanted to, we would ask for your separate consent first. We disclose it only to companies that process it for us under contract, or that you choose to use:
- Hosting and infrastructure: Netcup (our server), Hetzner (short-lived recovery servers in the US) and Cloudflare (secure connections and R2 storage) handle all the categories above.
- AI provider: only the text and photos you send to AI features, without anything that identifies you, and only after you allow AI.
- Email: Resend sends our emails to your address. Our emails never contain your health information.
- Sign-in and purchases: Apple, Google, RevenueCat and Paddle receive account and purchase details only, never your diary.
If you connect Apple Health, we write your entries to it on your iPhone, at your direction. The full list, with what each company does and where, is in our Privacy Policy. No third party collects consumer health data about your activity over time and across websites or apps through ZomaLog.
Your rights
You have the right to:
- Confirm and access: find out whether we collect or share your consumer health data, get a copy of it, and get a list of every company we've disclosed it to, with how to contact them.
- Delete: have it deleted from our systems. We also pass your request on to the companies that process it for us.
- Withdraw consent at any time.
- Correct: review your data and ask us to change it.
- Equal treatment: we won't treat you differently for using these rights.
How to use your rights
- In the app: Me → Export data gives you a copy of everything. Me → Account → Delete account deletes everything within 24 hours, and it rolls off our encrypted backups within 35 days. You can edit any entry, target or setting, and withdraw permissions in Me → Privacy & consents.
- By email: write to [email protected] from the email address on your account and tell us what you'd like: access, a list of recipients, correction, deletion or withdrawing consent. We verify every request against your account, for example by replying to that address or asking you to sign in. If you can't send from that address, for example because you use Apple's Hide My Email, tell us and we'll confirm through a message to your account's address.
- Timing: we respond within 45 days of receiving your request. If a request needs more time, we may extend this once by up to 45 more days, and we'll tell you why within the first 45 days.
- Cost: requests are free.
Appeals
If we decline your request, in whole or in part, we'll tell you why. You can appeal by replying to our decision or by emailing [email protected] with "Appeal" in the subject line. We'll answer in writing within 45 days of receiving your appeal and explain our reasons. If we deny your appeal, you can contact your state attorney general: the Washington State Office of the Attorney General or the Nevada Attorney General.
How we protect it
Only people who need access to run ZomaLog can reach consumer health data, and staff access to admin tools requires two-step verification. Health data stays out of our logs, analytics and crash reports, and backups are encrypted.
Changes to this policy
This policy takes effect on the date shown at the top of this page. If we make a significant change, we'll tell you by email or in the app before it takes effect, and ask for your consent again where the law requires.
Contact
Email [email protected].