Washington Consumer Health Data Privacy Policy

What this policy covers

This policy applies to residents of Washington State and to consumer health data collected in Washington, as those terms are used in the My Health My Data Act (RCW 19.373). Everything else about how Cal 3D handles data is in the privacy policy, and this page does not replace it.

Noah Sioly UG (haftungsbeschränkt) is based in Germany and operates under the GDPR. This policy exists because the My Health My Data Act applies to anyone offering a service to consumers in Washington, regardless of where the company sits and regardless of how small it is.

Categories of consumer health data we collect

Almost all of it is what you enter or capture yourself. There is no data broker and nothing is bought from anyone. There is one connection to a health platform, and it is listed below with exactly what it reads.

• Body measurements you enter: weight, height, date of birth and sex. They are used to calculate your energy needs and nothing else.
• Two values from Apple Health, if you allow it: your step count and the active energy you burned. They are shown next to what you logged and are not stored, not synced and never sent on.
• Your food diary: the meals you log, their nutritional values, and the time you logged them.
• Workouts you log, including the type and duration.
• Water you log.
• Goals and progress: a target weight, a rate of change, and the weight history that shows whether you are getting there.
• Progress photos, if you take them. They stay on your device and are never synced.
• A photo of a meal, at the moment you ask the app to recognise it. It passes through and is not stored on our side.

Without an account, your diary, your profile and your progress stay on the iPhone — with one exception that is not ours: if you use iCloud Backup, the app’s storage is part of that backup, between you and Apple.

Five things leave the phone, and only when you ask for them: a meal photo, a food name you type, a workout you describe in words, a barcode looked up at Open Food Facts, and the summary report you mail to yourself. A wrong estimate you choose to report reaches us as well. Each is set out in the privacy policy. An account is optional.

Categories of sources

The sources are you, and — if you switch it on — Apple Health.

• What you type into the app.
• What you photograph or scan with the app.
• Two values from Apple Health, and only if you allow it: your step count and the active energy you burned. Apple asks you, not us, and you can withdraw it at any time in the Health app. Cal 3D never writes anything back to Apple Health, and these two values stay on the device — they are shown, not stored, not synced to your account and never sent to the recognition model. The Apple Watch app reads the same two values on the watch and asks you separately for that.

We do not buy data, we do not receive it from data brokers, and we do not read anything from Google Health Connect or any other platform.

Why we collect it

• To show you what you logged and what it adds up to.
• To calculate a calorie and nutrient target from your body data.
• To recognise a meal from a photo, when you ask for that.
• To sync your diary between your own devices — only if you have an account.

Not for advertising, and not for profiling beyond the calculation you asked for.

Training is the one place where it is not a flat no, so here it is in full. What you log is never used to train anything. What you report as wrong is: when you tap to tell us an estimate was off, that report is kept and grouped so the recognition can be measured and improved. That is the whole purpose of the report, it only happens when you send one, and it is set out in the privacy policy under „Reporting a wrong estimate“.

Who we share it with

We do not sell consumer health data. The My Health My Data Act defines a sale as an exchange for monetary or other valuable consideration; nothing we do meets that definition, and we would need your signed authorisation to do it.

What follows is the complete list of processors that can see any part of it. It is the same list as in the privacy policy, and it is checked against our server code rather than maintained by hand:

• Supabase, Inc. — the photo or the text you typed while it passes through, the hash of your IP address, a mis-estimate you report to us including anything you type into it, and — only if you sign in — your account and the documents synced to it. Running our analysis endpoint, taking your reports about wrong estimates, and storing your synced data if you have an account. Processing location: EU (Frankfurt, eu-central-1).
• OpenRouter, Inc. — the photo or the typed text, together with the instruction that goes with it. Routing the request to the model. Processing location: United States.
• Google LLC (Sign in with Google) — your Google account identifier, your name and your email address — only if you choose this way of signing in. Signing you in. Processing location: United States.
• Google LLC (Gemini) — the photo or the typed text. Recognising the dish or the entry. Processing location: United States.
• Open Food Facts — the scanned barcode number and your IP address. Nutrition data for packaged products. Processing location: France.
• Resend, Inc. — your name and email address, and the summary you asked for: your goals, your daily totals and your weigh-ins. Mailing you the summary report you requested. Processing location: United States.
• Apple Distribution International Ltd. — purchase and billing data, and — if you use Sign in with Apple — that you signed in. Selling and billing the app, and verifying your Apple sign-in. Processing location: Cork, Ireland.
• Google Commerce Limited — purchase and billing data — your payment method never reaches us. Selling and billing the app on Android. Processing location: Dublin, Ireland.
• RevenueCat, Inc. — the purchase status, and an identifier: a random one while you are not signed in, and the identifier of your account once you are. Checking whether a subscription is active. Processing location: United States.
• 650 Industries, Inc. (Expo) — your device's push token, which it stores, and the text of the message itself — “You earned $5” — which it only holds for as long as passing it on to Apple takes. Delivering the notification that a referral reward was earned. Processing location: United States.
• Google LLC (Firebase Analytics and Crashlytics) — which screens you use, by which route you logged a meal and whether a scan succeeded — as event names without any values — and, when the app crashes, the technical crash report; never what you eat, your weight, your name or your email address. Anonymous usage statistics (only if you allow it) and crash reports. Processing location: United States.
• Vercel Inc. — the server logs of this website. Running the website. Processing location: Vercel's global edge network.
• IONOS SE — everything you send us by email. Running our mailbox. Processing location: Germany.

Each of them processes on our instructions only. The one exception is stated plainly in the privacy policy: what the model provider does with a transmitted photo is beyond our control, which is why the photo carries no name, no account and no diary with it.

Your rights in Washington

Under RCW 19.373.030 you may:

• ask what consumer health data we hold about you, including a list of everyone it was shared with;
• ask whether we have shared or sold it — the answer to sold is no, always;
• have it deleted, which we then pass on to every processor that holds a copy;
• withdraw your consent to its collection and sharing.

Two of these you can do yourself, immediately and without asking us: deleting your account in the app deletes everything synced to it, and deleting the app removes what is on the device. The steps are on the delete your data page, together with a table of what survives a deletion and why.

For anything else, write to support@cal3d.app. We answer within 45 days, and may extend that once by another 45 days where the request is complex — if we do, we will tell you why before the first period runs out.

We will not charge you, and we will not treat you differently for asking. Exercising any of these rights changes nothing about what the app does for you.

If we say no

If we decline a request, we will tell you why. You can then appeal by replying to that answer, or by writing to support@cal3d.app with the word appeal in the subject line. A different person reviews it, and you get a written decision within 45 days.

If the appeal is denied, you may complain to the Washington State Attorney General at atg.wa.gov/file-complaint. We will include that link in the denial itself, so you do not have to come back here to find it.

Who to contact

Email: support@cal3d.app

Data covered by this policy is processed in EU (Frankfurt, eu-central-1) and, for the steps listed above, by the processors named there.