Consumer Health Data Privacy Policy

This Consumer Health Data Privacy Policy applies to consumer health data that Bazu Technologies, LLC (“Bazu,” “we,” “us”) collects about residents of Washington under the My Health My Data Act (RCW 19.373) (“MHMDA”) and residents of Nevada under Senate Bill 370 (NRS Chapter 603A). It is published as a separate, distinctly linked document as required by Washington law.

This policy applies only to consumer health data. For all other personal information we collect, see our Privacy Policy and our Terms of Service.

“Consumer health data” is personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status, as defined by MHMDA and similar Nevada law.

The categories of consumer health data we collect from or about you include:

• Self-reported diabetic status (none, pre-diabetes, Type 2 diabetes, Type 1 diabetes, other, or not sure)
• Height and weight
• Weight goals and general wellness goals
• Nutrition goals (e.g., cut added sugar, more protein, more fiber)
• Meals you log, including descriptions, photos, ratings, and how you felt after the meal
• Estimated nutrition values for those meals (macros, calories, glycemic index/load)
• Algorithmic outputs we generate from your meals: Bazu Scores, per-meal predicted glucose curves, and the 24-hour Estimated Glucose Curve
• Optional blood glucose readings you manually enter
• Optional continuous glucose monitor (CGM) readings you sync from Apple HealthKit
• Optional insulin doses you manually enter
• Activity log timestamps associated with the above (when you logged what)

We collect consumer health data from the following sources:

• Directly from you — when you complete onboarding, log a meal, take a meal photo, enter a value, or use any feature of the Service.
• Apple HealthKit, with your permission — if you choose to enable CGM integration, we read blood glucose samples from Apple HealthKit. You can revoke this permission at any time in iOS Settings → Health → Data Access & Devices → Bazu.
• Generated by Bazu about you — algorithmic outputs (Bazu Scores, predicted curves, the Estimated Glucose Curve) are derived from the data you provide and stored alongside your account.

We collect, use, and share consumer health data only for the following purposes:

• To provide and operate the Service you requested — including displaying your meals, generating your Bazu Scores and Estimated Glucose Curve, and personalizing your in-app experience based on your goals and self-reported diabetic status
• To process meal descriptions and meal photos through our AI providers (OpenAI and Anthropic) for the limited purpose of identifying foods and estimating nutrition
• To gate features that are not appropriate for users who self-report Type 1 diabetes
• To respond to your support requests and to communicate with you about your account
• To diagnose technical issues and to keep the Service secure
• To comply with applicable law and respond to lawful legal requests

We do not collect, use, or share consumer health data for any purpose not listed above. We do not engage in geofencing within or around any healthcare facility.

We share consumer health data only with a limited set of service providers who help us operate the Service. Each provider is bound by contract to use the data only as we instruct and to protect it.

• Supabase (cloud database, storage, and authentication, U.S.-based) — receives all of the categories listed in Section 2 in order to store them on your behalf.
• Railway (backend application hosting, U.S.-based) — runs the Bazu API; processes your requests but does not retain consumer health data beyond the request.
• OpenAI and Anthropic (AI providers) — receive only meal descriptions (text) and meal photos (images) needed to identify foods and estimate nutrition. They do not receive your diabetic status, glucose readings, insulin doses, weight, or any other identifying information about you. Data sent to OpenAI and Anthropic via API is not used to train their models, per their API terms.
• Edamam and Open Food Facts (food databases) — receive food names and barcode scans from your meal searches. They do not receive any other consumer health data.
• Sentry (crash and error monitoring) — may receive minimal identifiers and technical context when the app crashes or hits an error. We configure Sentry to exclude the contents of meals, glucose readings, insulin doses, diabetic status, and other consumer health data.
• Apple HealthKit — the source of CGM glucose readings if you enable that integration. Apple does not receive any data from Bazu through this integration.

We do not share consumer health data with any advertising network, data broker, analytics partner, marketing partner, insurer, employer, or any other third party not listed above.

We do not sell consumer health data. We have not sold consumer health data in the preceding twelve (12) months and have no plans to do so.

We also do not share consumer health data for cross-context behavioral advertising or for any advertising purpose. The limited advertising-identifier sharing with Meta described in our Privacy Policy involves no consumer health data.

If you are a Washington or Nevada resident, you have the following rights regarding your consumer health data:

• Right to confirm whether we are collecting, sharing, or selling your consumer health data, and to access the data we have collected.
• Right to a list of all third parties with whom we have shared or to whom we have sold your consumer health data, along with active contact information for each.
• Right to delete your consumer health data. We will delete the data from our active records and notify all of the service providers listed in Section 5 to do the same.
• Right to withdraw consent for our collection or sharing of your consumer health data, where we rely on your consent as the legal basis.
• Right to appeal any denial of a request under this section (see Section 9).
• Right to non-discrimination for exercising any of the rights above.

To exercise any of the rights in Section 7:

• Email us at hello@withbazu.com with the subject line “Consumer Health Data Request”
• Include your full name, the email address on your Bazu account, and a description of the request
• If you are submitting on behalf of another person, include evidence of your authorization to act

We will respond to your request within forty-five (45) days. We may extend this period once by another forty-five (45) days when reasonably necessary, and will notify you of the extension and the reason within the initial 45 days.

You may also delete your account — and the consumer health data associated with it — directly inside the Bazu app under Settings → Delete Account.

If we deny your request, you may appeal that denial by replying to our denial email or by emailing hello@withbazu.com with the subject line “Consumer Health Data Appeal.” Within forty-five (45) days of receiving your appeal, we will inform you in writing of the action we have taken or have decided not to take, along with our reasons.

If we deny your appeal, you may contact the Washington State Attorney General to submit a complaint at https://www.atg.wa.gov/file-complaint, or the Nevada Attorney General as applicable.

We may update this Consumer Health Data Privacy Policy from time to time. When we do, we will update the “Last Updated” date at the top. Material changes will be communicated through the app or by email to the address on your account.

For any question about this Consumer Health Data Privacy Policy: