Consumer Health Data Privacy Notice

This notice is the consumer health data privacy policy for the Moraea iOS app, its home-screen widgets, and moraea.app (the “Services”), operated by Shivendra Ananthan Chelliah (“Moraea,” “we,” “us”). It is written for the Washington My Health My Data Act, Nevada’s consumer health data law (SB 370), Connecticut’s consumer health data provisions, and similar laws, and applies to anyone those laws protect.

“Consumer health data” means personal information that is linked or reasonably linkable to you and identifies your past, present, or future physical or mental health status. Moraea is a calorie and nutrition tracker with an optional medication-tracking add-on. It is not a medical device and does not provide medical advice.

Our Privacy Policy covers all personal information we handle. This notice covers consumer health data only.

Most of this information stays on your device and never reaches our servers. We list it all so you know what the Services handle. The categories are:

• Body and plan details: sex, birth date, height, current and goal weight, activity level, weight goal and pace, dietary preference, and the calorie, nutrient, and water targets calculated from them.
• Food and drink: meals and their estimated calories and nutrients, meal photos, favorite meals, meal ratings, and water intake.
• Weight and body measurements: weight entries and, if you record them, waist, fasting glucose, and blood pressure.
• Medication records, only if you turn on medication tracking: the medication, the dose and schedule you enter from your existing prescription, administration route, injection site, skipped doses, notes, side effects, and their severity.
• Apple Health data, only if you allow it: weight, steps, and active energy read from Apple Health.
• AI requests and results: what you send to Moraea AI (messages, dictated text, meal photos, and the nutrition context described in Section 4.5 of our Privacy Policy), the aggregate snapshots sent for Progress and Daily AI, and the estimates, ratings, scores, recipes, and summaries returned.
• Analytics categories, only while usage analytics is on: your goal direction and a broad treatment-stage category (for example, “no medication” or “maintenance”), never a medication name, dose, or logged value.
• Account and subscription records: under some of these laws, information that shows you use a nutrition app can itself be consumer health data, so we treat your account identifier, sign-in email, and Moraea Pro status the same way.
• Legacy Circle signals, only if you used Circle in an older app version: weekly counts of the days you met your protein and hydration goals.

We collect and use consumer health data only to:

• provide the features you use: logging, nutrition targets, progress views, reminders, home-screen widgets, and the Dose log summary PDF;
• back up your nutrition plan to your account and restore it when you sign in again (body and plan details only);
• produce the AI estimates, recipes, insights, and scores you ask for;
• understand broad patterns in how the App is used, while usage analytics is on;
• keep Circle working for people still using an older app version;
• verify your subscription, keep the Services secure, prevent abuse, and meet our legal obligations.

We do not use consumer health data for advertising or to make decisions about you, and we do not use it to train our own AI models.

We get consumer health data from:

• you, when you enter it or send it to an AI feature;
• your device, which calculates targets, totals, and ratings from what you enter;
• Apple Health, only with your permission;
• the AI providers that return estimates and summaries for your requests; and
• for Circle in older app versions, the members of a circle you joined.

We share consumer health data only as needed for the feature you request, and mostly with service providers (processors) that handle it for us under contract:

• Database and server host (Supabase): your nutrition-plan backup and account records, and AI requests passing through our relay.
• AI gateway (Vercel AI Gateway): AI requests on their way to the model and search providers.
• AI model providers (OpenAI; Google as a fallback; Anthropic only for some older app versions): Moraea AI requests and Progress and Daily AI snapshots.
• Search providers (Perplexity and Exa): short search queries written by the AI model from your request, such as a food or dish name.
• Product analytics provider (PostHog): goal direction and treatment-stage category, while usage analytics is on.
• Subscription provider (RevenueCat): your Moraea Pro status, linked to a random account identifier.
• Email delivery provider (Resend): your email address, when we send you an email you asked for or a sign-in code for an older app version.
• At your direction: Apple Health on your device, when you let the App write food, water, and weight entries; and Open Food Facts, which receives the barcode number of a product you scan.
• Other users, in older app versions only: the weekly protein- and hydration-goal counts shared with members of a circle you joined.
• Authorities, when the law requires it.

We have no affiliates, so no affiliate receives consumer health data. Section 9 of our Privacy Policy names every recipient. On request, we will send you the list of the third parties that received your consumer health data, with a way to contact each one.

• We do not sell consumer health data.
• We do not use it, or share it, for targeted or cross-context behavioral advertising.
• We do not let third parties collect consumer health data about your activity over time and across other websites or online services through the Services.
• We do not collect precise location and do not set up geofences around places where health care is provided.
• Only people and providers who need consumer health data to run the Services can access it.

Where these laws require consent, we ask before we collect or share consumer health data, and you can change your mind at any time:

• Moraea AI shows a notice and waits for your acknowledgment before your first message or photo is sent.
• Progress and Daily AI start only after you accept the current Terms and Privacy Policy in the App. Switch them off with “Moraea insights” under Profile → Moraea AI, or stop all future AI processing with “AI processing” under Profile → Moraea AI → Privacy choices.
• Usage analytics is shown during onboarding and starts on. Switch it off before continuing or later under Profile → Data & account → Device & privacy.
• Apple Health access is off until you allow it, and you control it in the iOS Settings app.
• Medication tracking is off unless you turn it on.

Withdrawing consent stops future collection and sharing. It does not undo processing that has already happened, but you can ask us to delete that data (Section 8).

You have the right to:

• confirm whether we collect, share, or sell your consumer health data, and access it, including the list of third parties and affiliates that received it, with a way to contact them;
• review your consumer health data and ask us to correct it;
• have it deleted, including copies held by our service providers, which we will tell to delete it;
• withdraw your consent; and
• appeal if we decline your request.

Most of this data is on your device, where you can view, edit, and delete it yourself. Deleting your account in the App, under Profile → Data & account, deletes your on-device data and the records on our servers. For any other request, email developer@rainfroglabs.com. We may ask you to confirm your identity, for example by writing from your account email. You may use an authorized agent where the law allows.

We will respond within 45 days. If we need more time, we will tell you why within those 45 days and may take up to 45 more. Requests are free, up to twice a year. We will not treat you differently for using your rights.

To appeal, reply to our decision and tell us why you disagree. We will answer within the time the law requires and explain our reasons. If we deny your appeal, you can contact your state Attorney General, such as the Washington, Nevada, or Connecticut Attorney General.

When this notice changes, we update the date at the top. Before a material change takes effect, we will tell you in the App or on the Site, and we will ask for your consent where the law requires it before using consumer health data in a materially different way. The English, Malay, Spanish, and German versions are updated together.

Shivendra Ananthan Chelliah
Moraea
Email: developer@rainfroglabs.com