Consumer Health Data Privacy Policy

1. Scope

This Consumer Health Data Privacy Policy applies to consumers in the United States, in particular under the Washington My Health My Data Act and comparable laws of other states. It supplements our Privacy Policy. Responsible for Rootinez is: Crytech Berlin UG (haftungsbeschränkt) c/o TUECHTIG, Haus 06, Aufgang D, Etage 1 Oudenarder Str. 16 13347 Berlin Germany Email: support@rootinez.com

2. Our approach

Rootinez stores everything you enter on your device or in your browser. If you use Rootinez without an account, we do not collect any consumer health data. We only collect consumer health data if you voluntarily create an account and expressly consent, or if you use an AI feature after giving separate consent.

3. Consumer health data we collect and why

With an account and your consent, we store a copy of the data on your device: your profile (date of birth, biological sex, pregnancy or breastfeeding, diet, activity level, health goals, answers from the initial survey), logged foods and meals, active nutrients, intake times and intakes, dietary supplements, blood values, and your own foods and recipes. We use this copy only to make your data available on your devices and in the web version.

When you use an AI feature, we process the photo of a meal or the text of an ingredient list to analyse it, and we record the time, the feature and your account for each call to limit usage. We do not use consumer health data for advertising, profiling or any other purpose.

4. Sources

We collect consumer health data only directly from you, when you enter it in the app or use an AI feature. Reference values and evaluations are calculated on your device; we do not derive or infer health data on our servers and do not obtain it from third parties.

5. Sharing

We do not sell consumer health data and do not share it for advertising. We only disclose it to processors that act on our behalf and under contract: Supabase Inc. (hosting of the account and the copy of your data) and, only when you use an AI feature, OpenAI (analysis of photos and ingredient lists). We have no affiliates that receive consumer health data. We do not use geofencing around health care facilities.

6. Your rights

You have the right to confirm whether we collect, share or sell your consumer health data, to access it — including a list of all third parties and affiliates with whom we have shared it —, to have it deleted, and to withdraw your consent at any time.

You can export the data in your account, delete the copy in your account (this withdraws your consent) or delete your account in the app under Profile → Settings. You can also send a request by email to the address in section 1. We respond within 45 days; where reasonably necessary, we may extend this period once by 45 days and will inform you. When you delete your data, we also delete it at our processors; backups of our database are overwritten within 30 days.

If we decline your request, you can appeal by replying to our decision or by writing to the address in section 1 with the subject "Appeal". We will respond to your appeal within 45 days and explain our decision. If the appeal is denied, you can contact the Attorney General of your state, in Washington via the Attorney General's online complaint form.

7. No discrimination

We will not deny you our services, charge you different prices or provide a different quality of service because you exercise your rights. Rootinez remains fully usable without an account and without consent.

8. Changes

We adapt this policy when the app or the legal situation changes. The version published in the app and on our website applies.