Consumer Health Data Privacy Policy

Washington’s My Health My Data Act (RCW 19.373), Nevada SB 370, and similar state laws regulate "consumer health data" — information that identifies a consumer’s past, present, or future physical or mental health status, collected by businesses that aren’t otherwise regulated as HIPAA "covered entities." BiteWise, a product operated by OmniWise LLC, is one of those businesses: it’s a nutrition and food-safety app, not a healthcare provider, health plan, or insurer, so HIPAA generally doesn’t apply — but these state laws still do, and they require this specific, standalone disclosure.

BiteWise is one of several products OmniWise operates, on its own separate infrastructure. Consumer health data collected through BiteWise is used only within BiteWise and is not shared with, or accessible to, any other OmniWise product or service.

Everything in this document is consistent with, and cross-references, our main Privacy Policy. Where the two overlap, the main Privacy Policy remains the fuller reference — this page exists to satisfy the specific disclosures these laws require in their own dedicated document.

We collect the following categories of consumer health data, each for a specific, stated purpose — never for advertising or unrelated use:

• Health conditions (e.g. diabetes, hypertension) you choose to add to your profile — used to personalize nutrition analysis and flag condition-specific dietary concerns.
• Medications you enter — used to generate medication & food interaction insights. This is our most sensitive data category; see our Privacy Policy’s "Medications (Sensitive Data)" section for how it’s encrypted at the field level.
• Food allergies you select — used to flag allergen risk in meal analysis.
• Meal photos and their AI-generated analysis, when that analysis is tied to a health condition or medication (e.g. a medication & food interaction insight, a condition-specific caution) — used to generate and, on paid plans, retain that personalized guidance.
• Dietary goals and meal history — where, taken together with your profile, they reveal or point to a health condition — used to personalize your guidance and weekly reports.

We do not collect consumer health data for any purpose beyond providing the personalized nutrition and drug-interaction features you sign up for. Account identifiers (email address) and ordinary technical data (IP address, browser type) are covered by our main Privacy Policy but are not "consumer health data" under this law.

Every category above comes directly from you — entered into your BiteWise profile, or captured from a meal photo/description you submit for analysis. We do not purchase consumer health data, infer it from data brokers, or obtain it from any source other than your own direct use of the Service.

Before we save any health condition, medication, or allergy, profile setup asks for your consent in its own required checkbox, separate from accepting our Terms. We use this data only to provide the personalized features you signed up for. We do not share it for any other purpose and do not sell it. You can withdraw consent at any time (see Section 6).

We do not sell consumer health data. This law requires a specific, signed authorization before any sale of consumer health data could occur — we don’t sell it, so that authorization requirement doesn’t come up. We also don’t share it with advertisers or data brokers.

The following categories of processors receive consumer health data as part of providing the Service — see our Privacy Policy’s Third-Party Services section for the complete, currently accurate processor list (kept as the single source of truth so this page doesn’t drift out of sync with it):

• AI providers (Google Gemini, Anthropic Claude) — process health conditions and medications to generate personalized nutrition and drug-interaction guidance.
• RxNorm (U.S. National Library of Medicine) — receives medication text only, to resolve spelling or naming issues.
• Supabase — our database provider, stores your health profile and medications (field-level encrypted) to operate the Service.
• Google Cloud Run — hosts our backend, so requests carrying your health profile pass through it.
• Resend — sends our emails, which can include a summary of your nutrition report.

You can ask us for the full list of third parties and affiliates that receive your consumer health data, with their contact details, by emailing us (see Contact below).

You have the right to:

• Confirm whether we’re collecting, sharing, or selling your consumer health data, and access it — via Settings or by emailing us (see Contact below).
• Withdraw consent for consumer health data processing at any time — remove your health conditions and medications from your profile, or delete your account entirely.
• Delete your consumer health data — available from Settings → Privacy, which deletes your account and associated data as described in our Privacy Policy’s Data Retention section.

We will not discriminate against you for exercising any of these rights. To exercise a right that isn’t self-serve through Settings, email us. We will respond within 45 days, and may extend that once by 45 more days when reasonably necessary, telling you why. If we decline a request, you may appeal by emailing us with “Appeal” in the subject line. We will answer the appeal within 45 days and, if we still decline, explain how to contact your state attorney general.

For questions about this policy or to exercise your rights, contact us: Send us a note