Privacy Policy

Who we are

Healthyish ("we", "us") operates the Healthyish nutrition tracking app at healthyish.app. This policy explains what we collect, why, and the choices you have. Questions or requests: privacy@healthyish.app.

What we collect

• Account data — email address and an encrypted password hash, used to sign you in.
• Food and health information you enter — meal photos, meal titles and ingredients, calories and macros, water and mood logs, body weight, height, age, sex, activity level and goals from the onboarding questions.
• Derived nutrition figures — scores and pattern averages calculated from the entries above.
• Contact details you volunteer — name, email and phone if you RSVP to a group call.
• Basic technical data — device type, browser and error logs needed to keep the app running and secure.

We do not sell your personal information, and we do not share it with advertisers or data brokers.

Sensitive / consumer health data

Food logs, body weight and the goals you set are treated as consumer health data. We collect them only to provide the tracking and educational features you asked for, and only with your separate, explicit consent, which you give with a dedicated checkbox when you create your account (alongside confirming you are 18 or older). Healthyish is not a healthcare provider and this data is not medical records — HIPAA does not apply.

If you are in Washington, Nevada, Connecticut or another state with a consumer health data law, you may withdraw consent and request deletion at any time (see "Your choices"). We do not sell consumer health data under any definition of "sale".

How photos are processed

When you scan a meal, the photo is sent to our AI provider to estimate the foods and portions in it. The provider processes the image to return that estimate and does not use it to train models. Estimates are approximate and are not a measurement.

Who processes data for us

We use service providers strictly to run the app: cloud database and authentication hosting, application hosting, and an AI model provider for photo analysis. They act on our instructions under contract and may not use your data for their own purposes.

How long we keep it

Your logs stay in your account until you delete them or your account. Deleting your data from the profile screen removes your logs; deleted records are purged from backups within 30 days.

Your choices

• Export a copy of your data from the profile screen.
• Delete your logs, or your whole account, from the profile screen.
• Request access, correction, deletion, or an appeal of a decision by emailing privacy@healthyish.app. We respond within 45 days.
• California residents: you may exercise CCPA/CPRA rights above. We do not sell or share personal information for cross-context behavioural advertising.

Other US state privacy rights

Residents of states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon and Montana) have rights to access, correct, delete and obtain a portable copy of their personal data, and to appeal a refused request. Meal and nutrition data is treated as sensitive data and is processed only with your consent, which you can withdraw by deleting your data or your account. We do not sell personal data, do not use it for targeted advertising, and do not carry out profiling that produces legal or similarly significant effects. Email privacy@healthyish.app to exercise a right or appeal a decision.

Legal bases (EEA and UK)

• Contract — creating your account and delivering the features you ask for.
• Explicit consent — processing your meal photos and nutrition entries, which are health-related data. You may withdraw consent at any time by deleting the data or your account; this does not affect processing done before withdrawal.
• Legitimate interests — keeping the service secure, debugging, and preventing abuse.
• Legal obligation — keeping billing records where tax law requires it.

You may lodge a complaint with your local supervisory authority (in the UK, the Information Commissioner's Office).

International transfers

We and our providers process data in the United States and the European Union. Where data leaves the EEA or UK, transfers rely on the European Commission's Standard Contractual Clauses (with the UK Addendum where relevant) together with technical measures such as encryption in transit and at rest.

Cookies and local storage

We use only what the app needs to work: a session cookie or local-storage entry that keeps you signed in, plus local storage for preferences and offline caching of the installed app. We do not use advertising cookies, cross-site trackers or third-party analytics profiles. Clearing site data signs you out. We honour Global Privacy Control signals where applicable.

Automated processing

Meal photos are analysed by an AI model to estimate foods and nutrition, and scores are calculated by our own rules. This is not a decision with legal or similarly significant effects, it is not a medical assessment, and every figure can be edited or deleted by you.

Children

Healthyish is for adults. You must be 18 or older to create an account. We do not knowingly collect information from children under 13, and will delete it if we learn we have.

Security

Data is encrypted in transit and at rest, and each account can only read and write its own rows. No system is perfect; please use a strong, unique password. If a breach affects your data, we will notify you and any required regulator without undue delay.

Changes

If we make a material change we will update the date above and show a notice in the app before the change takes effect.