Consumer Health Data Privacy Notice

This Notice describes how Cholestie handles consumer health data. It is separate from the general Cholestie Privacy Policy. Cholestie is operated by ECBC Technologies LLC.

1. Consumer Health Data We Collect

Depending on the features you choose to use, Cholestie may collect or derive the following categories of consumer health data:

• Cholesterol and lab information. LDL, HDL, triglycerides, total cholesterol, test dates, and changes between saved lab results.
• Meal and nutrition information. Meal descriptions, saved meal photos, meal names, cooking or ingredient clarification answers, and estimated saturated fat and fiber.
• AI-inferred health-related information. Nutrient estimates, identified foods, confidence information, and educational meal insights produced from meal descriptions or meal photos.
• Health-management preferences and context. Information you provide about why you are using Cholestie, such as having recent cholesterol results, wanting to eat better for heart health, or already working on cholesterol management.
• Derived progress information. Daily saturated-fat and fiber totals and comparisons or trends generated from the information you save in Cholestie.

2. Why We Collect and Use Consumer Health Data

• to provide the Cholestie features you request, including meal analysis, meal logging, daily nutrient totals, cholesterol tracking, and progress views;
• to generate AI-based meal estimates, clarification questions, and educational insights;
• to save your meals, meal photos, and lab results so they remain available to you across sessions;
• to calculate and display changes over time using the information you choose to save;
• to operate security, abuse-prevention, and service-limit controls necessary to provide Cholestie; and
• to maintain, troubleshoot, and improve the operation and reliability of Cholestie without using consumer health data for targeted advertising.

Where applicable law requires affirmative consent for a particular collection, use, or sharing of consumer health data, Cholestie will request that consent before the activity occurs.

3. Sources of Consumer Health Data

• Directly from you, when you enter cholesterol results, type meal descriptions, answer clarification questions, or otherwise provide information in Cholestie.
• From your device at your direction, when you take a meal photo or choose a meal photo from your photo library.
• Derived or inferred by Cholestie and its service providers, when meal descriptions or photos are analyzed to estimate foods, saturated fat, fiber, or related meal information, or when Cholestie calculates daily totals and lab-result changes.

4. Consumer Health Data We Share

Cholestie does not sell consumer health data. We share consumer health data only as necessary to provide the Cholestie service you request or where you separately authorize the sharing.

• Meal descriptions and meal photos used for AI analysis. These may be shared with our AI processing provider so that Cholestie can identify foods, estimate saturated fat and fiber, decide whether a clarification question is useful, and generate an educational meal insight.
• Saved cholesterol, meal, nutrition, and progress information. These are processed and stored by our cloud infrastructure provider so Cholestie can authenticate your account, save your information, display your history, and operate the service.

We do not intentionally send your email address, Cholestie user ID, or saved cholesterol lab results to the AI provider as part of meal-analysis requests.

5. Third Parties and Affiliates

The categories of third parties with whom Cholestie currently shares consumer health data, as described above, are:

• Supabase - cloud database, authentication, private meal-photo storage, and server-side infrastructure used to provide Cholestie.
• OpenAI - artificial-intelligence processing used for meal analysis and related estimates.

Cholestie does not currently share consumer health data with affiliated companies for their own independent purposes.

6. Your Consumer Health Data Rights

Where the Washington My Health My Data Act applies, you may have the right to:

• confirm whether Cholestie is collecting, sharing, or selling consumer health data about you;
• access consumer health data about you, including information about third parties or affiliates with whom that data has been shared or sold;
• withdraw consent from future collection or sharing of consumer health data where consent is the legal basis for that activity;
• request deletion of consumer health data about you; and
• appeal a refusal to act on an eligible consumer-health-data request.

Cholestie does not sell consumer health data.

7. How to Exercise Your Rights

You may submit a consumer health data request by emailing [email protected]. If you have a Cholestie account, you may also delete your account in the app through Settings → Delete Account.

We may take reasonable steps to verify your identity before acting on a request. You do not need to create a new Cholestie account solely to exercise privacy rights, although we may ask you to use an existing account where appropriate to authenticate your request.

Eligible requests will be handled without undue delay and, where the Washington law applies, generally within 45 days. When reasonably necessary, that period may be extended once by up to an additional 45 days, with notice. Requests are generally provided free of charge up to twice per year, subject to applicable law.

8. Deletion Requests

When an eligible deletion request is verified, Cholestie will delete applicable consumer health data from active systems and will take steps required by applicable law with respect to processors or other parties with whom the data was shared.

If consumer health data is stored in archived or backup systems, deletion from those systems may be delayed as permitted by applicable law. Under the Washington My Health My Data Act, that delay may be up to six months from authentication of the deletion request.

9. Withdrawing Consent

Where Cholestie relies on your consent to collect or share consumer health data, you may withdraw that consent for future activity by contacting [email protected]. You may also stop providing optional health information or delete your account. Withdrawal does not require Cholestie to undo processing that was lawful before the withdrawal, and some features may no longer function if the data is necessary to provide the service you request.

10. Appeals

If Cholestie refuses to act on an eligible consumer health data request, you may appeal by replying to the decision or emailing [email protected] with the subject line Consumer Health Data Appeal. Where applicable law requires it, we will respond to the appeal within the required period and provide information about how to contact the Washington State Attorney General if the appeal is denied.

11. Changes to This Notice

If Cholestie plans to collect, use, or share additional categories of consumer health data, or use consumer health data for materially different purposes that require additional disclosure or consent under applicable law, we will update this Notice and obtain any required consent before the new activity occurs.

12. Contact