1 Scope
This US Consumer Health Data Privacy Notice supplements the Everbite Privacy Policy. It applies to consumer health data covered by the Washington My Health My Data Act, Nevada's consumer health data law, and similar applicable US state laws.
Everwake Interactive Pty Ltd (ABN 66 688 718 881) ("we", "us", or "our") provides Everbite. In this Notice, "consumer health data" means Personal Data that identifies or is reasonably capable of being linked to a consumer and identifies or reveals information about that consumer's past, present or future physical or mental health, as defined by applicable law.
2 Consumer Health Data We Collect
Depending on how you use Everbite, we may collect:
- Body and profile information used for health or nutrition features, including age, gender, height, weight and progress measurements.
- Food, meal and nutrition information, including food logs, meal descriptions, notes, recipes, dietary preferences and nutrition goals.
- Photos and associated metadata that you upload, including food and progress photos.
- Calories, nutrients, ingredients, quantities, eating patterns, progress trends and other health or nutrition information generated or inferred from your inputs.
- App usage, device or account information where it is linked to your health or nutrition activity or used to provide, secure or improve health-related features.
We do not currently collect consumer health data from Apple HealthKit or Google Health Connect.
3 Sources of Consumer Health Data
We collect consumer health data:
- Directly from information and content you enter or upload.
- From your interactions with Everbite and the device you use to access it.
- By analysing or deriving information from your inputs, including through Everbite's algorithms, artificial intelligence and nutritional databases.
- From a third-party service or integration only where you direct or authorise that service to provide information to Everbite. No health-data integration is included in the current release.
4 Why and How We Process Consumer Health Data
We may process consumer health data to:
- Provide meal analysis, food identification, optical character recognition, nutrition estimates, progress tracking and other requested features.
- Personalise your experience and generate health or nutrition insights.
- Maintain accounts, provide support, secure the Service and prevent fraud or misuse.
- Test, troubleshoot and maintain requested features, monitor their reliability, and evaluate the accuracy of meal analysis and nutrition estimates.
- Develop new features, conduct broader research, use identifiable health data for marketing, train AI models, or carry out another non-core activity using identifiable or pseudonymised consumer health data only where the required separate optional consent has been obtained.
- Comply with law, protect legal rights, complete a business transaction, or, where permitted by applicable law, create information that meets applicable legal de-identification requirements.
Processing may include storing and organising data, analysing photos or text, extracting text, identifying or categorising foods and ingredients, estimating quantities and nutrients, matching results against nutritional databases, generating insights, allowing corrections, and irreversibly anonymising or aggregating information.
Once information meets applicable legal de-identification requirements, we may retain, use and disclose it indefinitely for any lawful business purpose, including research, statistics, marketing, developing products and services, and training, testing and improving AI models. We take reasonable measures to prevent identification, use this information only in de-identified form, do not attempt to re-identify it, and impose equivalent contractual requirements on recipients. Aggregation alone does not remove consumer health data protections.
5 Disclosures of Consumer Health Data
We disclose consumer health data only as described in this Notice and the Privacy Policy. Depending on the feature used:
- DigitalOcean processes and stores consumer health data as our cloud-hosting provider.
- OpenAI may process food photos, text, food information, relevant technical metadata and resulting analysis to provide AI meal-analysis functions. We do not currently opt in to provider model training using identifiable or pseudonymised Personal Data. Use and disclosure of de-identified information for training is described in section 4.
- Other contracted service providers may process limited consumer health data where necessary for customer support, security, auditing or professional advice.
- Authorities may receive consumer health data where disclosure is permitted or required by applicable law.
- A purchaser or successor may receive consumer health data as part of a merger, acquisition, restructuring or sale of assets, subject to applicable law and the commitments described in our Privacy Policy.
- Another party may receive consumer health data where you specifically direct or authorise the disclosure.
The categories disclosed may include the categories in section 2, limited to what the recipient needs for the relevant purpose. We have no affiliates with which we currently share consumer health data.
We do not sell consumer health data. We do not use or disclose consumer health data for targeted third-party advertising. We do not permit third parties to collect consumer health data through Everbite over time and across unrelated websites or online services for targeted advertising.
Some applicable laws exclude disclosures to processors acting on our instructions from the legal definition of a "share." We describe those processors above for transparency regardless of that classification.
6 Consent and Your Choices
Where consent is required, we request it before collecting or sharing consumer health data. The request identifies the relevant data, purposes, recipient categories and method of withdrawal. Additional categories or additional purposes not disclosed in this Notice require further notice and consent where required by applicable law.
Processing that is necessary to provide a feature you request may involve service providers acting only on our instructions. We request separate consent for other sharing where applicable law requires it. Broader research, identifiable health-data marketing, AI training and other non-core uses are subject to separate optional controls where required.
You may withdraw consent through the controls provided in Everbite or by emailing [email protected]. If you withdraw the consent required for Everbite's core functions, we will stop the affected processing, erase the affected Personal Data or use anonymisation only where applicable law permits it as described in section 8, and suspend access until you provide consent again. Withdrawing optional consent does not block core functions.
7 Your Consumer Health Data Rights
Depending on applicable law, you may have the right to:
- Confirm whether we collect, share or sell your consumer health data and access that data.
- Obtain information about the sources, purposes and recipients of your consumer health data, including a list of relevant third parties and affiliates and their contact details where required by applicable law.
- Review and request correction of inaccurate consumer health data.
- Withdraw consent from future collection or sharing.
- Request deletion of consumer health data held by us and relevant processors or other recipients.
- Appeal our refusal to act on a request.
Submit a request through the privacy controls made available in Everbite or by emailing [email protected]. We may take reasonable steps to verify your identity. You do not need to create a new account to make a request, although we may ask you to use an existing account where permitted.
We will respond without undue delay and within 45 days where that period applies. Where permitted and reasonably necessary, we may extend the response period once by up to 45 additional days after notifying you within the initial period and explaining the reason.
To appeal a decision, reply to the decision or email [email protected] and identify the decision being appealed. We will respond within the period required by applicable law. If we deny an appeal, we will provide any regulator complaint route required by applicable law.
We will not unlawfully discriminate against you for exercising a consumer health data right. Some features or the Service may be unavailable where they require data that you ask us not to process.
8 Deletion and Retention
When deletion is required, we will erase affected consumer health data in active systems within 30 days and notify relevant processors and other recipients as required. We may use anonymisation instead of deletion only where applicable law permits it. Protected backup copies are placed beyond ordinary use and erased or overwritten within three months. We may retain only specific information, and only for as long as applicable law permits or requires its retention despite the request or withdrawal. Information already lawfully de-identified before the request or withdrawal, or anonymised under that permitted alternative, may be retained and used indefinitely for the purposes described in section 4, provided it meets applicable legal de-identification requirements and the safeguards in that section apply.
Information retained solely to meet a legal retention requirement will not be used for ordinary product operations, research or marketing and will be deleted when that requirement ends.
9 Security
We restrict access to consumer health data to personnel and service providers that need it for authorised purposes. We use reasonable administrative, technical and physical safeguards appropriate to the volume and sensitivity of the data, including encryption at rest and in transit.
10 Changes to This Notice
We may update this Notice as our practices or applicable laws change. We will post the revised Notice with an updated effective date. Before collecting, using or sharing additional categories of consumer health data, or using existing data for an additional purpose not disclosed in this Notice, we will provide further notice and obtain consent where required by applicable law.
11 Contact
For questions, complaints, consumer health data requests or appeals, contact:
Everwake Interactive Pty Ltd (ABN 66 688 718 881) Email: [email protected]