This policy is provided by JMB Assets LLC, doing business as StackForge Studios. It is separate from the general StackForge Studios Privacy Policy and applies to "consumer health data" processed through PlateStack or another StackForge feature that expressly links to this policy. It provides the disclosures required by consumer-health privacy laws, including Washington's My Health My Data Act.
PlateStack processes this data only for user-requested record, display, sync, storage, security, export, deletion, and limited automated-estimation functions. It does not use the data to provide health, wellness, nutrition, dietary, medical, fitness, recovery, readiness, or safety advice or to monitor health.
1. Consumer health data we collect and why
- Health-linked account and profile information: account identifier, age or age range, height, weight, activity level, dietary preferences, fitness preferences, goals, units, settings, and legal-consent records. We use this data to create and secure the account, apply the user's choices, and provide requested self-tracking features.
- Nutrition and routine information: foods, meals, recipes, calories, macros, micros, nutrients, water, fasting, habits, reminders, food images, labels, barcodes, voice transcripts, and corrections. We use it to create requested logs, estimates, summaries, trends, reminders, and user-requested AI results.
- Fitness and activity information: workouts, exercises, sets, repetitions, loads, cardio, steps, active energy, activity, user-created templates, personal records, and progress. We use it to create requested logs, history, neutral arithmetic displays, social features, and user-created templates. We do not send connected-health, body, workout, or activity records to an AI provider.
- Body and connected-record information: body weight, measurements, body-fat entries, progress photos, sleep, resting heart rate, HRV, blood oxygen / SpO2, respiratory rate, blood pressure, VO2 max, and mindful minutes. We use it to display user-requested history, neutral arithmetic, and connected features without health, recovery, readiness, fitness, or safety interpretation.
- Connected-health information: the data types the user authorizes PlateStack to read from or write to Apple Health / HealthKit or Android Health Connect. We use it to perform the sync and display functions the user requests.
- AI-assisted logging inputs, outputs, and inferences: selected food or label photos, voice or natural-language food entries, transcripts, and generated logging estimates. We use them only to provide, save, secure, or support the logging feature the user requests. Automated chat, health or fitness analysis, target generation, interpretation, coaching, and meal or workout plan generation are disabled.
- Health-feature usage and security records: timestamps, permission status, sync state, quota or entitlement records, and technical events associated with health features. We use them to deliver the feature, prevent abuse, diagnose failures, protect data, and comply with law.
2. Sources of consumer health data
- the consumer, through entries, uploads, prompts, photos, audio, settings, corrections, and permissions;
- the consumer's device and operating system;
- Apple Health / HealthKit and Android Health Connect, after platform permission;
- food, nutrient, barcode, and public-recipe sources used at the consumer's request;
- other users, when the consumer intentionally participates in a social or shared-workout feature; and
- processors that return a transcription, food result, AI output, delivery result, purchase entitlement, or security signal for a consumer-requested feature.
3. Consumer health data we share
We do not sell consumer health data. We do not share it for advertising, data brokerage, credit, insurance, employment, housing, lending, or eligibility decisions.
We disclose the following categories only as needed to provide a consumer-requested product or service, operate or secure that product, or comply with law:
- health-linked account, profile, nutrition, fitness, activity, body, recovery, photo, social, and feature records to hosting, database, storage, authentication, and security processors;
- selected food or label photos and voice or natural-language food entries to an AI processor when the consumer invokes the corresponding logging feature; automated chat and plan-generation modes are disabled;
- food search terms, barcodes, recipe URLs, and related request information to food, barcode, nutrition, and recipe sources used for the requested lookup;
- health-feature notification content and delivery identifiers to push or email providers when the consumer enables or requests the communication;
- purchase or entitlement information associated with a health feature to app-store and subscription processors; and
- user-selected profile, workout, activity, score, or message information to another user when the consumer intentionally uses a sharing or social feature.
4. Processors, third parties, and affiliates
Categories of processors or third parties that may receive the consumer health data described above are:
- Cloud, database, authentication, storage, and security: Supabase, Amazon Web Services, and Cloudflare.
- AI-assisted logging and transcription: OpenAI and Anthropic, limited to user-requested food, label, audio, and natural-language logging estimates. Automated chat, health or fitness analysis, coaching, targets, interpretations, and meal or workout plan generation are disabled.
- Food, barcode, nutrient, and recipe retrieval: FatSecret, USDA FoodData Central, Open Food Facts, the public recipe website selected by the consumer, and a functionally equivalent replacement disclosed before materially new processing.
- Subscriptions, purchases, and platform services: RevenueCat, Apple, Google, and Stripe.
- Notifications and email: Expo and Resend or a functionally equivalent delivery provider.
- Consumer-selected recipients: another StackForge user with whom the consumer intentionally shares data.
- Legal or transaction recipients: a government authority or other recipient when required by valid law, or a successor in a qualifying business transaction that assumes the obligations of this policy.
StackForge Studios currently has no affiliates with which it shares consumer health data.
5. Your consumer health data rights
Subject to applicable law, a consumer may:
- confirm whether we collect, share, or sell consumer health data;
- access that data and obtain a list of the third parties or affiliates with which it was shared;
- withdraw consent from future collection or sharing;
- request deletion from our network, including notice to processors and other recipients; and
- appeal a refusal to act on a request.
Submit a request at any time to [email protected] with the subject "Consumer Health Data Request." You may also use an existing in-app account-deletion control. We will use commercially reasonable methods to authenticate the request and may ask only for information reasonably needed to do so. You do not need to create a new account.
We respond without undue delay and, where Washington law applies, within 45 days. We may extend once by 45 days when reasonably necessary and will explain the extension. Qualifying requests are free up to twice each year. Health data in archived or backup systems will be deleted within the period required by law and, under Washington law, no later than six months after authentication.
If we refuse a request, reply with the subject "Consumer Health Data Appeal." We will respond to a qualifying appeal in writing within 45 days. If the appeal is denied, Washington consumers may submit a complaint to the Washington State Attorney General.