Consumer Health Data Privacy Policy

This Consumer Health Data Privacy Policy is required under the Washington My Health My Data Act (MHMDA), Nevada SB 370, the Connecticut Data Privacy Act (CTDPA), and similar state consumer health data laws. It applies to residents of Washington, Nevada, Connecticut, and any other state with applicable consumer health data privacy requirements. It also appears as Section 12 of our general Privacy Policy.

What Is Consumer Health Data

For purposes of this policy, “consumer health data” means personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status. Medifoodz currently collects the following consumer health data in connection with the Glyvance program:

• Continuous glucose readings received through user-authorized CGM device connections
• Body composition metrics including weight received through user-authorized body composition scale connections
• Program participation data that identifies your dietary health goals or health-related behaviors
• Communications with the Vance AI coach that relate to your physical health status

Consumer health data does not include data that has been de-identified such that it cannot reasonably be used to identify you. This policy will be updated as additional data streams are added to the platform.

How We Collect Consumer Health Data

We collect consumer health data only in the following circumstances:

• With your affirmative consent for a specified purpose, obtained prior to collection; or
• To the extent necessary to provide a product or service that you have requested from us.

Consent to collect and consent to share are obtained separately. We do not collect consumer health data through geofencing, location tracking near healthcare facilities, or any passive surveillance mechanism.

How We Use Consumer Health Data

We use consumer health data to deliver the Glyvance program, operate the Vance AI coaching platform, share with healthcare providers you have authorized, fulfill orders, maintain platform security, comply with legal obligations, and in de-identified form, for product improvement and regulatory submissions. We do not use consumer health data for targeted advertising. We do not sell consumer health data.

How We Share Consumer Health Data

We share consumer health data only with: healthcare providers you have authorized through the provider portal; service providers bound by written contracts limiting their use to performing services on our behalf; third-party device manufacturers whose devices you connect to the platform through Apple Health, Android Health Connect, or direct API integrations, through your user-authorized connections; and as required by law. You may contact the manufacturer of any connected device directly using the contact information in that device's product documentation.

Your Rights

You have the following rights with respect to your consumer health data:

• Right to confirm whether we collect, share, or sell your consumer health data and to access that data, including a list of all third parties with whom it has been shared
• Right to withdraw consent to collection and sharing at any time through your account settings
• Right to request deletion of your consumer health data
• Right to non-discrimination for exercising these rights

To exercise any of these rights, contact us at privacy@medifoodz.com. We will respond to verified requests within 45 days.

Security

We maintain administrative, technical, and physical data security practices appropriate to the volume and nature of the consumer health data we process, consistent with our HIPAA compliance program and applicable industry standards.

Data Retention

We retain consumer health data for as long as your account is active and for a period following account closure as required by applicable law. Upon a verified deletion request, we will delete your consumer health data subject to any conflicting legal retention obligations. De-identified data derived from consumer health data is not subject to deletion requests and may be retained indefinitely for product development and regulatory purposes.

Consent

Where required by applicable law, we obtain your affirmative consent before collecting or sharing consumer health data. Consent to collect and consent to share are obtained separately at enrollment. You may withdraw consent at any time through your account settings. Withdrawal of consent may affect our ability to deliver the Glyvance program to you.

Connected Device Third Parties

Medifoodz currently receives continuous glucose readings and body composition metrics including weight through user-authorized device connections via Apple Health, Android Health Connect, or direct device API integrations. When you connect any device through these mechanisms, data flows between that device manufacturer's platform and Medifoodz through your authorization. You may contact the manufacturer of any device you connect directly using the contact information in that device's product documentation. This policy will be updated as additional device integrations are added to the platform.

Contact Us

To exercise your consumer health data rights or for questions about this policy, contact:

Medifoodz, Inc.
Privacy inquiries: privacy@medifoodz.com
General support: support@medifoodz.com
Website: https://www.medifoodz.com
Tampa, Florida

Glyvance provides a structured nutrition plan. If you have a medical condition or take any medication, use with guidance from a licensed healthcare professional.