Washington Consumer Health Data Privacy Policy

This supplemental notice applies to consumer health data processed in connection with Whisk where the Washington My Health My Data Act applies. It supplements the general Privacy Policy and controls in the event of a conflict concerning covered consumer health data. Not every recipe selection constitutes consumer health data; classification depends on the information and the inferences drawn from it.

Covered information may include dietary patterns, allergies, ingredient-avoidance selections, health-related goals, and health information submitted in preferences, customization prompts, or support messages. Saved customizations and cooking activity, meal-plan, or grocery records may also contain or reveal such information when associated with an identifiable individual.

Information originates from your submissions, onboarding answers, use of the Services, and outputs derived from customization instructions. It is processed for requested dietary personalization, recipe modification, saved and planning functions, support, and analytics concerning preferences and feature usage. Analytics is a distinct purpose from executing a particular recipe request.

Supabase stores account-associated preferences, prompts, recipe content, and planning information. OpenAI receives the prompts, recipes, and relevant preferences used for customization, moderation, validation, and repair. PostHog receives diet, goal, cooking-time, and individual allergy or ingredient-avoidance selections when analytics is configured; events are associated with a user identifier when identified. Disclosure to PostHog is not limited to technical metadata.

Development analytics logging prints event payloads, and retained generation code records dietary or allergy counts and can record model output on failure. Covered information may therefore appear in diagnostic records. Support and infrastructure providers may also process information included in correspondence or service records. Contact support@trywhisk.app to request recipient information applicable to your data.

The current App does not provide a dedicated sensitive-preference consent or analytics withdrawal mechanism. General Terms acceptance and notification permission do not substitute for any separate consent required for collecting or sharing covered information. This notice is not authorization to sell consumer health data. The application’s absence of an advertising feature does not, by itself, determine the legal classification of a provider disclosure.

Where the Act applies, you may confirm processing, access covered data and a list of recipients with contact details, withdraw consent, and request deletion. Email support@trywhisk.app with the subject "Washington health data request." Reasonable identity verification may be required; you need not create a new account.

Applicable law requires a response within 45 days, with a further 45 days where a permitted extension is explained within the initial period. Covered deletion obligations extend to relevant recipients; the permitted backup delay may not exceed six months after authentication. The current in-app account-deletion function does not itself propagate requests to all providers or backups. Additional operational handling is necessary to fulfill these obligations.

If a request is refused, reply requesting an appeal. Where the Act applies, a reasoned appeal decision is due within 45 days. You may submit a complaint to the Washington Attorney General. The request and appeal procedure requires operational handling and is not an automated feature of the App.

The general Privacy Policy describes other information practices, retention criteria, safeguards, and contact procedures. Material changes to covered processing remain subject to applicable notice and consent requirements.