Consumer Health Data Privacy Policy

• Dietary restrictions and allergies you declare (for example, a peanut allergy or a gluten-free diet), used to filter what we suggest you eat.
• Body and goal information you optionally provide: height, weight, weight-log entries, activity level, and calorie or nutrition goals.
• Meal nutrition analysis and hydration logs: the calorie and nutrition information we derive from meals or meal photos you submit for analysis, and the water intake you log.
• Wearable data, only if you connect a device (Strava, Fitbit, Whoop, Oura, Garmin, Withings, Polar, Suunto, Wahoo): activity, sleep, and energy-expenditure data.
• Wellness check-ins you optionally submit (for example a daily mood or context note).

Ordinary pantry management and cooking activity — what is in your kitchen, what you cook, what you add to a shopping list — is app-operational data, not consumer health data, and is covered by our general Privacy Policy rather than this one.

We collect this data only from you (what you type, photograph, or log) and from wearable providers you explicitly connect. We do not buy health data, do not collect it from data brokers, and do not infer health conditions from your browsing or from third-party sources.

• To filter recipes and suggestions so they respect your allergies and dietary restrictions — a safety function.
• To personalize meal recommendations, portioning, and nutrition information to your stated goals.
• To show you your own logs and progress.
• For no other purpose. We do not use health data for advertising, do not sell it, and do not share it except as listed in Section 3.

We share consumer health data only with the processors below, only to operate the features you use, and never for their own purposes:

• AI processing (OpenAI; Google) — when a feature you invoke needs cloud AI (for example, meal analysis or the Sous Chef), the content you provided may be processed by OpenAI or Google on paid API tiers that contractually do not train on your data. Your name, email, and account identifier are never included.
• Our hosting providers — the encrypted database and servers the app runs on, located in the United States.
• Wearable providers you connect — these are a source of your data under the permission you grant them; we do not send your Pantrove health profile back to them.

We have no affiliates. We do not sell consumer health data and have never sold it; because we do not sell it, no "authorization to sell" will ever be requested. We do not use it for targeted advertising. If a law-enforcement or legal demand for data ever compels disclosure, we will disclose the minimum required and, where lawful, notify you.

• Access — every health field we hold is included in your self-serve data export (Settings → Privacy & data → Download my data).
• Withdraw consent — remove any health field in Settings at any time (clear an allergy, disconnect a wearable, delete a weight log); collection of that field stops immediately.
• Delete — delete individual entries in the app, or delete your entire account (Settings → Privacy & data → Delete account, 30-day grace period, or email us). Health data is deleted with your account and is never retained in the shared food library.
• Appeal — if we decline a request, you may appeal by replying to our decision email; we will respond within the time your state's law requires. Washington residents may also contact the Washington Attorney General; residents of other states may contact their state Attorney General.

We honor these rights for everyone, not only residents of states that mandate them, and we do not discriminate against you for exercising them.

Health fields are stored in an encrypted database; the most sensitive of them (wearable tokens and payloads, check-in notes, weight-log notes) carry an additional layer of AES-256-GCM encryption at rest. Access within Pantrove is restricted to the systems that need each field to serve you; no employee browses user health data in the ordinary course of business.

Health data is retained while your account is active and deleted when your account is deleted, on the schedule described in the general policy's retention table.

Pantrove provides informational nutrition and food-management features only. It is not a medical device, does not diagnose or treat any condition, and is not a substitute for professional medical or dietary advice.

Material changes to this policy are announced to registered users by email at least 14 days before they take effect.

Questions or requests: privacy@pantrove.app