Consumer Health Data Privacy Policy

What we collect, and why

• Your body and activity: date of birth, sex used in the calorie estimate, height, weight readings and usual activity, to work out your energy estimate, targets, weight changes and BMI.
• Your goals: your weight goal, goal weight and date, and your calorie and macro targets, to set your daily budget and show your progress.
• Your food diary: what you log, its nutrition, and the photos, descriptions and corrections you add, to log what you eat and estimate its nutrition. We count it as consumer health data because it’s kept with your body details and goals.
• What we work out from these: your energy estimate, budget, totals, weight trend, BMI and logging streak, to show them to you.

Copies of the photos, descriptions and correction text you send for an AI estimate are also used to check and improve Caloit’s estimates. Those copies aren’t consumer health data: they’re kept apart from your body details, goals and targets, and never used to learn anything about you or your health. The Privacy Policy covers them.

Where it comes from

From you, through the app, and from what Caloit works out from what you enter. Caloit doesn’t read Apple Health or buy data about you.

What we share, and with whom

• An AI service provider (OpenAI) receives the photos, descriptions and correction text you send for an AI estimate. It never receives your body details, goals or targets.
• A cloud infrastructure provider (Cloudflare) carries the app’s connections to us, which can include any of the data above, and stores your photos and our encrypted backups.
• An analytics provider (PostHog) receives app events, such as that an entry was logged, without what you ate, your body details or your targets.

We have no affiliates that receive it, and we don’t sell consumer health data.

Your rights

• To know whether we collect or share your consumer health data, to get a copy of it, and to get the list of the companies we’ve shared it with. Profile › Export data gives you a copy at any time.
• To have it deleted: Profile › Delete account deletes it, including the photos Cloudflare stores for us and what PostHog holds. It leaves our encrypted backups within about 30 days, and OpenAI keeps what it receives for at most 30 days, unless the law requires longer.
• To withdraw any consent you’ve given.

Write to support@caloit.com to use any of these. We answer within 45 days. If we turn your request down, reply with “Appeal” in the subject and we’ll look at it again and answer within 45 days; if you’re still not satisfied, you can contact your state’s attorney general.